joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push esi
push edi
xor eax, eax
mov dword [ebp - 4], edx
mov dword [ebx + 0xc18], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov esi, 0x80000000
je 0x40c989
or esi, 0x40000000
mov dword [ebp - 8], 1
cmp byte [ebx + 0x12], 0
jne 0x40c99c
cmp byte [ebp + 0xc], 0
je 0x40c9a0
or dword [ebp - 8], 2
call fcn.0040505c
test eax, eax
je 0x40c9cc
test edi, edi
je 0x40c9cc
cmp word [edi], 0
je 0x40c9cc
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push edi
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x40c9e5
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c9fe
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40c9fe
mov dword [ebx + 0xc18], 1
xor eax, eax
cmp esi, 0xffffffff
mov byte [ebx + 0x13], 0
setne dl
mov dword [ebx + 0xc], eax
and edx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x40ca3c
mov dword [ebx + 4], esi
test edi, edi
je 0x40ca31
lea eax, [ebx + 0x416]
mov edx, edi
call fcn.0040e1a0
lea eax, [ebx + 0x15]
mov edx, dword [ebp - 4]
call fcn.0040daf8
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40cba8
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x40cbb7
cmp byte [ebx + 0x14], 0
jne 0x40cbbb
xor eax, eax
pop ebx
ret
cmp dword [ebx + 4], 0xffffffff
je 0x40cbc8
mov eax, ebx
call fcn.0040cb3c
call fcn.0040505c
test eax, eax
je 0x40cbf1
cmp word [ebx + 0x416], 0
je 0x40cbf1
add ebx, 0x416
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
jmp 0x40cc02
add ebx, 0x15
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
setne al
and eax, 1
pop ebx
ret
Function at 0x40cc04
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x40cce5
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40cc3f
dec eax
je 0x40cc29
dec eax
je 0x40cc35
jmp 0x40cc3f
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40cc3f
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40cc91
xor ebp, ebp
cmp esi, ebp
jle 0x40ccad
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40cc64
mov ecx, esi
sub ecx, ebp
jmp 0x40cc69
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40ccad
add ebp, 0x4000
cmp esi, ebp
jg 0x40cc4b
jmp 0x40ccad
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x40cce1
cmp dword [edi + 0xc], 0
jne 0x40cce1
lea ebp, [edi + 0x15]
mov eax, 0x418068
mov edx, ebp
call fcn.0040b4d0
test al, al
jne 0x40cc3f
mov edx, ebp
mov eax, 0x418068
call fcn.0040b49c
jmp 0x40cce1
mov byte [edi + 8], 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40cdbc
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40cde3
cmp esi, 0x4e20
jle 0x40cdd9
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40ce34
mov eax, ebx
call fcn.0040cfec
test al, al
je 0x40ce1b
cmp esi, 0x4e20
jle 0x40ce1b
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040cdbc
jmp 0x40ce37
cmp dword [ebx + 0xc], 1
jne 0x40ce2f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40ce2f
xor eax, eax
jmp 0x40ce37
or eax, 0xffffffff
jmp 0x40ce37
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x4126e4], 0
jne 0x40e0b9
call fcn.0040dc94
mov dword [0x4126e0], eax
inc byte [0x4126e4]
call fcn.0040dc94
sub eax, dword [0x4126e0]
cmp eax, 0x64
jle 0x40e0f5
cmp dword [0x412864], 0
je 0x40e0f0
mov eax, 0x418068
mov edx, 0xff
call fcn.0040b604
mov eax, 0x418068
mov edx, 0xff
call fcn.0040b5fc
call fcn.004027d8
ret
Function at 0x402050
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x154
push ebx
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, dword [str.CPLUtl64.exe__x]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x164]
mov dword [esp + 0x14], eax
mov dword [esp + 0x60], ecx
mov ecx, dword [0x40cc54]
mov dword [esp + 0x18], eax
mov eax, dword [0x40cc50]
mov edx, dword [0x40cc4c]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov dword [esp + 0x64], edx
mov dl, byte [0x40cc58]
not ecx
mov byte [esp + 0x70], dl
sub edi, ecx
lea edx, [esp + 0x60]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
lea edx, [esp + 0x60]
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x44
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40211a
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebx
add esp, 0x154
ret
Function at 0x402520
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cmp eax, 0x202
push esi
jne 0x402564
mov eax, dword [0x40cb84]
test eax, eax
je 0x4025e5
push 5
push str.RTLCPL.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x40d984]
test eax, eax
je 0x4025e5
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
pop esi
add esp, 8
ret
cmp eax, 0x205
jne 0x4025e5
call fcn.004025f0
mov esi, eax
test esi, esi
je 0x4025e5
mov eax, dword [0x40d97c]
push 0
push 1
push 0x212
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x40d97c]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x40d97c]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push 0
push ecx
push edx
push 0x28
push esi
mov dword [0x40d988], 1
mov dword [0x40f360], 0
mov dword [0x40f368], 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x403090
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
mov byte [esp + 3], 1
cmp eax, 7
jne 0x40319e
mov eax, dword [0x40d99c]
test eax, eax
jne 0x4030b3
call fcn.00402f50
mov ax, word [0x40d98e]
mov ecx, dword [0x40d98c]
cmp ax, 0x104d
jne 0x4030e9
cmp cx, 0x8176
je 0x4030d3
cmp cx, 0x818b
jne 0x4030e9
cmp word [0x40d990], 0x8086
jne 0x4030e9
cmp word [0x40d992], 0x24c5
je 0x40310e
cmp word [0x40f55a], 0x10
jne 0x403113
cmp ax, 0x104d
jne 0x403113
cmp cx, 0x81a0
je 0x40310e
cmp cx, 0x81a9
je 0x40310e
cmp cx, 0x81df
jne 0x403113
mov byte [esp + 3], 0
lea eax, [esp + 0xc]
push eax
call fcn.004049b0
add esp, 4
test eax, eax
je 0x403194
lea ecx, [esp + 0x1c]
push ecx
push str.SoftwareAvanceAC97_AudioALSMTray
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403179
lea edx, [esp + 4]
lea eax, [esp + 3]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push str.ShowIcon
push edx
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 3]
test al, al
je 0x40319e
push 1
call fcn.00402500
add esp, 4
mov eax, 1
add esp, 0x14
ret
push 0
call fcn.00402500
add esp, 4
mov eax, 1
add esp, 0x14
ret
Function at 0x403510
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4035c0
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x2b
push str.Realtek_HD_Front_Pink_Jack
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 2
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x4035d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x403680
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x2b
push str.Back_Line_in_Mic
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 2
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret
Function at 0x403690
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x403740
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x2b
push str.Realtek_HD_Audio_Rear_Input
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 2
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x403750
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x88
push esi
push edi
mov ecx, 0x12
mov esi, str.SYSTEMCurrentControlSetControlMediaResourcesSetupPreferredAudioDevices
lea edi, [esp + 0x44]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x18]
push eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x48]
mov edi, 4
push ecx
push 0x80000002
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403821
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.SetupPreferredAudioDevicesCount
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x403821
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push edi
push eax
push edi
push 0
push str.SetupPreferredAudioDevicesCount
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x88
ret
pop edi
xor eax, eax
pop esi
add esp, 0x88
ret
Function at 0x403830
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4038e0
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x2b
push edx
push 1
push edi
push str.Record
push eax
call esi
mov ecx, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push edi
push str.PreferredOnly
push eax
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 0x100
call fcn.00403750
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x4038f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x34
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareMicrosoftMultimediaSound_Mapper
lea edi, [esp + 0x10]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push eax
xor edi, edi
push ecx
push 0x80000001
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4039a0
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x2b
push str.Realtek_HD_Front_Pink_Jack
push 1
push edi
push str.Record
push edx
call esi
mov eax, dword [esp + 8]
push 0x2b
push str.Realtek_HD_Audio_rear_output
push 1
push edi
push str.Playback
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push edi
push str.PreferredOnly
push edx
mov dword [esp + 0x24], edi
call esi
mov dword [esp + 0xc], 0x100
call fcn.00403750
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov dword [0x40d970], 1
mov eax, 1
pop esi
add esp, 0x34
ret
pop edi
xor eax, eax
pop esi
add esp, 0x34
ret

Function at 0x403c50
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403c7c
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.SoundMan
push ecx
call edi
test eax, eax
je 0x403c95
xor esi, esi
mov edx, dword [esp + 8]
push str.AlcWzrd
push edx
call edi
test eax, eax
pop edi
je 0x403ca8
xor esi, esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x405485
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x60
push 0x409330
call fcn.00406518
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 4], 0xffffffff
mov ebx, 0x94
push ebx
push 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405646
mov dword [esi], ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
test eax, eax
jne 0x4054e1
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x405646
mov eax, dword [esi + 0x10]
mov dword [0x40ee68], eax
mov eax, dword [esi + 4]
mov dword [0x40ee74], eax
mov eax, dword [esi + 8]
mov dword [0x40ee78], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x40ee6c], eax
xor ebx, ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x40ee68], 2
je 0x405522
or byte [0x40ee6d], 0x80
mov eax, dword [0x40ee74]
shl eax, 8
add eax, dword [0x40ee78]
mov dword [0x40ee70], eax
call fcn.00405429
mov dword [ebp - 0x1c], eax
push ebx
call fcn.00405748
pop ecx
test eax, eax
jne 0x405569
cmp dword [0x40ee2c], 1
jne 0x405556
call fcn.0040698c
push 0x1c
call fcn.0040682b
push 0xff
call fcn.004066ad
pop ecx
pop ecx
mov dword [ebp - 4], 1
call fcn.00406fb0
test eax, eax
jge 0x405581
push 0x1b
call fcn.00405404
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40f9f8], eax
call fcn.00406e8a
mov dword [0x40ee24], eax
call fcn.00406de9
test eax, eax
jge 0x4055a7
push 8
call fcn.00405404
pop ecx
call fcn.00406b9f
test eax, eax
jge 0x4055b8
push 9
call fcn.00405404
pop ecx
call fcn.004066dd
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x4055cb
push eax
call fcn.00405404
pop ecx
call fcn.00406b36
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4055df
movzx eax, word [ebp - 0x40]
jmp 0x4055e2
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push ebx
push 0x400000
call section..text
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x405601
push esi
call fcn.004067eb
call fcn.0040680d
jmp 0x405633
or dword [ebp - 4], 0xffffffff
mov eax, esi
jmp 0x40564b
mov eax, 0xff
call fcn.00406553
ret
Function at 0x40606e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00406670
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x406109
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40ee68]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x406109
cmp eax, 1
je 0x40612a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x406109
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4060d6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x406105
xor eax, eax
inc eax
jmp 0x406149
cmp edi, eax
jae 0x40610d
xor eax, eax
jmp 0x406149
cmp eax, esi
jae 0x406114
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40ee68]
jmp 0x40612d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40682b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [eax*8 + 0x40d730]
je 0x406843
inc eax
cmp eax, 0x12
jb 0x406834
push esi
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40d730]
mov dword [ebp + 8], esi
jne 0x406989
mov eax, dword [0x40ee2c]
cmp eax, 1
push ebx
je 0x406959
test eax, eax
jne 0x406878
cmp dword [0x40d714], 1
je 0x406959
cmp ecx, 0xfc
je 0x406988
push edi
push 6
pop ecx
mov esi, str.Runtime_Error__n_nProgram:
mov edi, 0x40eeb0
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x40eeca
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x40efce], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4068c6
push 5
pop ecx
mov esi, str._program_name_unknown_
mov edi, 0x40eeca
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4068cb
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x4068fe
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4068df
sub eax, edx
push 3
lea eax, [eax + 0x40ee8f]
push 0x4096bc
push eax
call fcn.004052e0
add esp, 0xc
mov edx, 0x40eeb0
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406906
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40d734]
mov esi, 0x4096b8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406921
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40692d
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00407a53
add esp, 0xc
pop edi
jmp 0x406988
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x406988
mov esi, dword [esi + 0x40d734]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x406970
push 0
sub ecx, edx
lea edx, [ebp - 4]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret