joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cd00
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x469a33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045d5d8
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00462c6d
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00464189
test eax, eax
je 0x43ce1c
mov ecx, dword [esp + 0x3c]
call fcn.00462c9a
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43cde0
push edi
mov ecx, esi
call fcn.00460302
mov ecx, esi
call fcn.0043cf80
cmp dword [esp + 0x38], 1
jne 0x43ce15
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046043d
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43f840
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f873
push esi
call fcn.00442930
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f86c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f8f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f8e2
mov eax, dword [esi + 8]
test eax, eax
je 0x43f897
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f8de
cmp eax, 2
je 0x43f8e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f88a
cmp eax, 3
je 0x43f8bd
cmp eax, 1
jne 0x43f88a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f88a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f88a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f920
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f908
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f920
add esp, 4
pop esi
ret

Function at 0x45e3cd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45e405
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045c481
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045c459
jmp 0x45e411
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45fabf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45fb01
call fcn.0046556f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45fb01
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45faf8
xor eax, eax
jmp 0x45fb09
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045fb0f
pop edi
pop esi
pop ebx
ret 4

Function at 0x465a9f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x465acd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x465aeb
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00465a05
jmp 0x465aeb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x465aeb
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00465a05
test edi, edi
mov eax, edi
jne 0x465ad5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x404d5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x416b58
cmp edx, dword [eax]
je 0x404d7f
add eax, 8
inc ecx
cmp eax, 0x416be8
jl 0x404d70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x416b58]
jne 0x404ead
mov eax, dword [0x4191e0]
cmp eax, 1
je 0x404e87
test eax, eax
jne 0x404db0
cmp dword [0x416754], 1
je 0x404e87
cmp edx, 0xfc
je 0x404ead
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404de7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404fe0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004050d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404e2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004050d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x412be4
push edi
call fcn.00406b00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404fe0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404ff0
lea eax, [ebp - 0xa0]
push 0x412bc4
push eax
call fcn.00404ff0
push dword [esi + 0x416b5c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404ff0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406a69
add esp, 0x2c
pop edi
jmp 0x404ead
lea eax, [ebp + 8]
lea esi, [esi + 0x416b5c]
push 0
push eax
push dword [esi]
call fcn.004050d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40b4c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x40b502
call fcn.0040ef61
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x40b502
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x40b4f9
xor eax, eax
jmp 0x40b50a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0040b510
pop edi
pop esi
pop ebx
ret 4

Function at 0x40f70e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40f73c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40f75a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040f674
jmp 0x40f75a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40f75a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040f674
test edi, edi
mov eax, edi
jne 0x40f744
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6f89f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub dword [ebx], eax
add byte [ebx + 0x1071e166], cl
jecxz 0x6f8a0c
mov al, byte [0xdd2e4be3]
push 0xffffffffffffffbc
cmp al, 0xd2
mov ch, 0x44
cli
mov esp, ecx
int3
lea esp, [esp + 4]
jmp 0x72b63f
shl dword [edi - 0x3a], cl
jmp 0x6f89d1
out dx, eax
sbb bl, ah
out 0x7f, eax
out dx, eax
mov bh, byte [ecx + 0x37]
ror byte [ebp + 0x5c], cl
xchg esp, eax
int3
call fcn.0072b7db
lea esp, [esp + 4]
jmp 0x6f8a20
call 0x72b847
loop 0x6f8a99
loopne 0x6f89b0
jb 0x6f89ee
loopne 0x6f8aa4
out 0x82, eax
jno 0x6f89fc
ljmp 0xcccc:0xcea7b405
mov dx, bp
push word [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0xa], ecx
call fcn.006f8aaa
sub eax, 0xb8d949c8
dec ebx
xchg dword [esp], edx
xchg dword [esp], edx
mov bl, 0x10
lea esp, [esp + 1]
and al, 1
bswap ebx
lea ebx, [esi*4]
jmp 0x6f8a74
pushal
lea esp, [esp + 0x20]
mov eax, dword [esp + 4]
sub esp, 0x14
jmp 0x72b693
lea edi, [ebp - 0xd7]
bt edi, edx
mov edi, ecx
sub esp, 4
sub esp, 0xc
jmp 0x72b790
mov word [esp + 0xc], bx
lea esp, [esp + 0x14]
push edi
lea edi, [esp + ebp]
bsf di, si
jmp 0x72b66b
pushal
mov dword [esp + 0x19], ebp
jmp 0x72b715
mov byte [ecx], al
not eax
mov al, ah
push esp
jmp 0x72b6fd
lea esp, [esp + 4]
mov eax, dword [esp + 8]
push edx
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x72b722
lea esp, [esp + 0x20]
dec dword [esp + 8]
call fcn.0072b6f8
inc ecx
pushal
pushal
push dword [esp + 0x26]
lea esp, [esp + 0x44]
jmp 0x72b779
lea esp, [esp + 0x20]
je 0x72b819
jmp 0x72b6b8
test eax, eax
call 0x72b7bf
mov ecx, dword [reloc.KERNEL32.dll_SetEndOfFile]
sbb ebx, dword [esi + 0x15a66b0c]
arpl word [0x32f5], ax
jbe 0x72b6e5
add esp, 1
les eax, [ecx]
lea esp, [esp + 1]
jmp 0x72b747
push edx
lea esp, [esp + 4]
inc edx
push esp
pop word [esp]
jmp 0x72b761
lea esp, [esp + 0x10]
test eax, eax
pushal
push word [esp + 0x17]
lea esp, [esp + 2]
jmp 0x72b738
call 0x72b7a2
push esp
jmp 0x72b825
lea esp, [esp + 3]
lea esp, [esp + 1]
push edi
mov edi, ecx
jmp 0x72bba5
mov ecx, dword [ecx + 0x7c]
add eax, ebp
pushal
push dword [esp + 4]
jmp 0x72bbc9
lea edi, [edi + 0x78]
mov eax, dword [edi]
pop edi
push edx
push dword [esp + 2]
jmp 0x72bb8a
lea esp, [esp + 0x2c]
mov dword [esp + 0x20], eax
call fcn.0072bbb2
mov dword [esp + 0x24], ecx
call fcn.0072bc3e
push 0xed1e7beb
push esp
sahf
or al, 0x82
in eax, 0x14
cmpsb byte [esi], byte es:[edi]
or byte [ecx + 0x5a9b6809], bl
js 0x72bc4e
mov dl, 0x83
les esp, [eax]
and byte [ebx + 0x104e90a], cl
add byte [eax], al
Function at 0x704307
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jge 0x7042ab
setg dh
bsr dx, bp
jmp 0x7042b2
pushal
mov edi, dword [esp + 0x50]
jmp 0x7042d4

Function at 0x7043c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
and eax, 0x9c2fdcb5
jecxz 0x7043dc
mov al, byte [0x910f1ae3]
invalid
pushal
call 0x7043ce
jne 0x7043b8
and eax, 0x76000004
out 0x74, al
adc ebp, esi
pop edi
test byte [ebx], bl
mov ebp, esi
out dx, al
sbb eax, 0x127ceaaf
jne 0x704368
inc edx
leave
push 0x6a71d9f6
mov edx, dword [esp]
lea ecx, [ebx + ebx]
xchg ah, ch
jmp fcn.00704419

Function at 0x7044fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dh
xchg word [esp], dx
jmp 0x70450a
lea edx, [ecx + ebx]
xchg dword [esp + 8], edi
rdtsc
adc edx, ecx
jmp 0x704553
lea edx, [ecx*4]
call fcn.00704531

Function at 0x72b7db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x24]
jmp 0x6f8a16

Function at 0x72bb22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], bx
pop word [esp]
lea esp, [esp + 2]
jmp 0x72bc0f
je 0x72b81e
jne 0x72b86a

Function at 0x74d3df
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call fcn.00705fbf
bt eax, edx
sub esp, 0xc
jmp 0x74d3df
push esi
mov esi, ecx
mov word [esi], dx
pop esi
jmp 0x74d464
lea eax, [esi - 0x7d]
mov ax, 0xd92f
push edx
xchg word [esp + 1], ax
jmp fcn.00704419

Function at 0x80ef43
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr ecx, edi
pushal
neg edx
xor dl, ch
xchg ah, ch
add esp, 0x1d
jmp 0x80ef68
pushal
lea esp, [esp + 0x41]
bsr cx, cx
lea edx, [ecx + edx]
bsr cx, bp
jmp 0x80ef28

Function at 0x80f6a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 5
xchg word [esp + 0x1e], dx
add esp, 0x20
mov dx, 0xbf4b
pop edx
jmp 0x80f6ca
lea edx, [ecx - 0xf3]
mov ecx, esi
xchg dx, cx
mov eax, 0xd61fc44
cld
mov ecx, dword [esp + 0xa]
jmp 0x80f713
xchg ch, dl
add esp, 0
xor dx, 0xc31c
dec ax
mov dl, dh
mov dx, word [esp + 1]
jmp 0x80f796

Function at 0x80f90e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 3]
push dword [esp + 8]
lea esp, [esp + 0xb]
neg ecx
mov dx, 0x12e3
lea edx, [ebp - 0xe7]
jmp 0x80f8ce
add esp, 0xb
cmc
xchg byte [esp], dl
rdtsc
pop word [esp + 1]
cld
jmp 0x80f897
lea ecx, [esi + 0x2d]
push word [esp + 2]
mov eax, ecx
push esp
not ah
mov cl, 0x4a
jmp 0x80f91a
mov edx, 0xac78474e
pop word [esp]
call fcn.0080f95c
push ebx
je 0x80f943
arpl word gs:[eax + eax - 0x76], si
dec esp
and al, 7
mov cl, byte [esp + 7]
pop dword [esp + 0xa]
lea esp, [esp + 1]
sub esp, 0xa
rdtsc
jmp 0x80f8bd
dec cx
add esp, 5
xchg byte [esp + 0xe], ch
dec edx
jmp 0x80f8f5
pop word [esp]
xchg ch, dl
setnp ch
xchg byte [esp], al
ror ch, 5
bt edx, edx
jmp 0x80f8df

Function at 0x80fc3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, ch
mov cx, 0xe947
rdtsc
xchg byte [esp], dl
mov eax, 0xd1a8d2a0
jmp 0x80fc61
add esp, 0x13
btc edx, edi
mov ax, 0x1e29
jmp 0x80fc22
Function at 0x810699
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
add esp, 2
lea edx, [ebx*4]
mov cx, 0xbb29
mov cl, byte [esp + 3]
pop dx
xchg cl, ch
lea ecx, reloc.KERNEL32.dll_SetEndOfFile
mov cx, 0xb175
jmp 0x80fe21
mov ecx, edx
lea eax, [ebp*4]
lea ecx, [esi - 0xd5]
jmp 0x810676

Function at 0x8140a6
Capabilities:
Parse pe header

Disassembly:
call fcn.00813009
mov byte [esp], ch
mov dword [esp], eax
mov word [esp], bx
push dword [esp + 2]
push word [esp + 7]
pop dword [esp]
jmp 0x8140b2
push word [esp + 3]
pop word [esp + 1]
jmp 0x814087
mov dword [esp], esi
lea esp, [esp + 2]
mov dword [esp + 0x4c], esi
call fcn.008144f3
mov byte [esp + 1], bh
mov word [esp], bx
mov byte [esp], bh
pop word [esp + 1]
jmp 0x8141b5
push eax
jmp 0x813004
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x81410c
lea esp, [esp + 0x50]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x81412d
push esp
push esp
pop dword [esp]
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x50], edi
jmp 0x814149

Function at 0x8144f3
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov byte [esp + 2], ah
push word [esp + 1]
mov word [esp + 2], sp
jmp 0x8140c2
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x407030]
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x4010b8
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x401076
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x401059
mov eax, 2
mov ecx, dword [esp + 0x94]
call fcn.00401134
add esp, 0x98
ret
cmp eax, 2
jne 0x4010b8
mov eax, 3
mov ecx, dword [esp + 0x94]
call fcn.00401134
add esp, 0x98
ret
cmp eax, 6
jne 0x4010b8
mov eax, dword [esp + 8]
test eax, eax
jne 0x40109b
mov eax, 4
mov ecx, dword [esp + 0x94]
call fcn.00401134
add esp, 0x98
ret
cmp eax, 1
jne 0x4010b8
mov eax, 5
mov ecx, dword [esp + 0x94]
call fcn.00401134
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor eax, eax
call fcn.00401134
add esp, 0x98
ret

Function at 0x4010d0
Capabilities:
Create process on windows

Disassembly:
call fcn.00401000
cmp eax, 2
je 0x4010f1
cmp eax, 3
je 0x4010f1
push 1
push str.MHKX_Login.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
ret 0x10
push 1
push str.v2.0.50727FetionVM.exe_MHKX_Login.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
ret 0x10
Function at 0x401167
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x405138
call fcn.004014f4
mov edi, 0x94
mov eax, edi
call fcn.00402200
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4072bc], ecx
mov eax, dword [esi + 4]
mov dword [0x4072c8], eax
mov edx, dword [esi + 8]
mov dword [0x4072cc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4072c0], esi
cmp ecx, 2
je 0x4011c7
or esi, 0x8000
mov dword [0x4072c0], esi
shl eax, 8
add eax, edx
mov dword [0x4072c4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401202
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401202
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40121a
cmp eax, 0x20b
je 0x401207
mov dword [ebp - 0x1c], esi
jmp 0x40122e
cmp dword [ecx + 0x84], 0xe
jbe 0x401202
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401228
cmp dword [ecx + 0x74], 0xe
jbe 0x401202
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.004021a6
pop ecx
test eax, eax
jne 0x40125a
cmp dword [0x4072a8], 1
jne 0x401247
call fcn.0040195b
push 0x1c
call fcn.004017e4
push 0xff
call fcn.00401649
pop ecx
pop ecx
call fcn.00402104
mov dword [ebp - 4], esi
call fcn.00401f59
test eax, eax
jge 0x401273
push 0x1b
call fcn.00401142
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x407834], eax
call fcn.00401e37
mov dword [0x4072a0], eax
call fcn.00401d95
test eax, eax
jge 0x401299
push 8
call fcn.00401142
pop ecx
call fcn.00401b62
test eax, eax
jge 0x4012aa
push 9
call fcn.00401142
pop ecx
push 1
call fcn.00401679
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4012c0
push eax
call fcn.00401142
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401b05
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4012e1
movzx eax, word [ebp - 0x40]
jmp 0x4012e4
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004010d0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401302
push edi
call fcn.004017a4
call fcn.004017c6
jmp 0x401334
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040152f
ret
Function at 0x4016e3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x4072fc], esi
push edi
jne 0x401703
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x4072f8], esi
mov byte [0x4072f4], al
jne 0x401769
mov ecx, dword [0x407828]
test ecx, ecx
je 0x40174a
mov eax, dword [0x407824]
sub eax, 4
cmp eax, ecx
jmp 0x401743
mov eax, dword [eax]
test eax, eax
je 0x401735
call eax
mov eax, dword [0x407824]
sub eax, 4
cmp eax, dword [0x407828]
mov dword [0x407824], eax
jae 0x40172d
mov eax, 0x40701c
mov esi, 0x407020
cmp eax, esi
mov edi, eax
jae 0x401769
mov eax, dword [edi]
test eax, eax
je 0x401762
call eax
add edi, 4
cmp edi, esi
jb 0x40175a
mov eax, 0x407024
mov esi, 0x407028
cmp eax, esi
mov edi, eax
jae 0x401788
mov eax, dword [edi]
test eax, eax
je 0x401781
call eax
add edi, 4
cmp edi, esi
jb 0x401779
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4017a2
push dword [ebp + 8]
mov dword [0x4072fc], 1
call fcn.00401649
pop ebp
ret

Function at 0x4017e4
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x407030]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x407040]
je 0x401819
inc eax
cmp eax, 0x13
jb 0x40180a
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x407040]
jne 0x40193f
mov eax, dword [0x4072a8]
cmp eax, 1
je 0x401917
cmp eax, edx
jne 0x401849
cmp dword [0x407038], 1
je 0x401917
cmp ecx, 0xfc
je 0x40193f
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40187f
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00402340
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00402570
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4018b3
mov eax, edi
push eax
call fcn.00402570
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x40517c
push edi
call fcn.00402440
add esp, 0x10
push edi
call fcn.00402570
push dword [esi + 0x407044]
mov ebx, eax
call fcn.00402570
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402200
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00402340
push edi
push ebx
call fcn.00402350
push 0x405178
push ebx
call fcn.00402350
push dword [esi + 0x407044]
push ebx
call fcn.00402350
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040223d
add esp, 0x2c
jmp 0x40193f
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x407044]
push dword [esi]
call fcn.00402570
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00401134
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x40223d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x407414], ebx
push esi
push edi
jne 0x4022bd
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4022f8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x407414], eax
je 0x4022f8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x407418], eax
call esi
cmp dword [0x4072bc], 2
mov dword [0x40741c], eax
jne 0x4022bd
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x407424], eax
je 0x4022bd
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x407420], eax
mov eax, dword [0x407420]
test eax, eax
je 0x402302
call eax
test eax, eax
je 0x4022e9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x407424]
test eax, eax
je 0x4022e9
test byte [ebp - 8], 1
jne 0x402302
cmp dword [0x4072c8], 4
jb 0x4022fc
or byte [ebp + 0x12], 0x20
jmp 0x402321
xor eax, eax
jmp 0x402331
or byte [ebp + 0x12], 4
jmp 0x402321
mov eax, dword [0x407418]
test eax, eax
je 0x402321
call eax
mov ebx, eax
test ebx, ebx
je 0x402321
mov eax, dword [0x40741c]
test eax, eax
je 0x402321
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x407414]
pop edi
pop esi
pop ebx
leave
ret