joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a0f
Capabilities:
Terminate process

Disassembly:
jmp 0x442470
mov eax, dword [esp + 4]
test eax, eax
je 0x4424a0
cmp eax, 1
je 0x4424a0
cmp eax, 2
jne 0x442494
mov eax, dword [0x4a83ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
ret
add eax, 1
mov dword [esp + 4], eax
jmp fcn.00401451
mov ecx, dword [0x4a83a8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
ret

Function at 0x401a19
Capabilities:
Get common file path

Disassembly:
jmp 0x4427c0
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
je 0x4427d2
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x4427dc
mov esi, 0x488e48
mov edi, 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, edi
jbe 0x4427f8
call fcn.0044ad41
pop edi
mov dword [eax], 0x22
xor eax, eax
pop esi
ret
push 0x4a50e0
push 0x4a8fa0
call fcn.00401325
add esp, 8
cmp eax, 0x4a7280
je 0x44281a
push esi
call fcn.004017e4
add esp, 4
push esi
call fcn.00401a78
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x401a82
Capabilities:
Terminate process

Disassembly:
jmp 0x4444c0
jmp 0x44a3f0
sub esp, 0x1c
push esi
mov esi, dword [0x489fac]
cmp esi, 0xffffffff
jne 0x4444da
push 0xffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x444521
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
push 0x800
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
je 0x444521
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push ecx
push 0x800
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
xor eax, eax
pop esi
add esp, 0x1c
ret
cmp dword [esp + 4], 0
jle 0x44a3fc
jmp 0x4012bc
ret
Function at 0x401a87
Capabilities:
Read file on windows

Disassembly:
jmp 0x43fe10
push ecx
mov eax, dword [esp + 8]
push edi
push eax
mov dword [esp + 8], 0
call fcn.00401a55
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
jne 0x43fe33
xor eax, eax
pop edi
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x43fe55
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
push edi
call fcn.00401dca
add esp, 0xc
pop edi
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x43fe88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jbe 0x43fea8
cmp eax, 0x3e5
jne 0x43feb9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43fec6
cmp byte [eax + esi - 1], 0xd
jne 0x43fe9e
sub eax, 1
mov dword [esp + 0x10], eax
test eax, eax
je 0x43fe66
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
je 0x43fee0
cmp eax, 5
jb 0x43feb9
cmp eax, 6
jbe 0x43fecc
cmp eax, 0x26
je 0x43fee0
call fcn.0044ad41
mov dword [eax], 9
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
call fcn.0044ad41
pop esi
pop ebp
pop ebx
mov dword [eax], 9
or eax, 0xffffffff
pop edi
pop ecx
ret
call fcn.0044ad41
pop esi
pop ebp
pop ebx
mov dword [eax], 0
xor eax, eax
pop edi
pop ecx
ret

Function at 0x401adc
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x444f60
sub esp, 0x18
push edi
mov edi, dword [0x489fac]
cmp edi, 0xffffffff
je 0x444ffa
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x444ffa
cmp dword [esp + 0x24], 0
push esi
mov esi, dword [esp + 0x24]
je 0x444fbc
movsx ecx, word [esp + 0xe]
movsx edx, word [esp + 0x18]
add ecx, esi
sub edx, 1
cmp ecx, edx
jle 0x444fb5
test esi, esi
jle 0x444fb5
push esi
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00401b36
add esp, 0xc
add word [esp + 0xe], si
jmp 0x444fdd
movsx ecx, word [esp + 0x16]
cmp esi, ecx
jle 0x444fd8
test esi, esi
jle 0x444fd8
push esi
lea edx, [esp + 0xc]
push edx
push edi
call fcn.00401b4f
add esp, 0xc
mov word [esp + 0xc], si
cmp word [esp + 0xc], 0
pop esi
jl 0x444ffa
cmp word [esp + 0xa], 0
jl 0x444ffa
mov eax, dword [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
pop edi
add esp, 0x18
ret

Function at 0x401afa
Capabilities:
Get common file path

Disassembly:
jmp 0x446870
sub esp, 0x108
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push esi
mov byte [esp + 0xe], 0x2f
call fcn.00450d80
mov ecx, dword [esp + 0x110]
add esp, 8
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0044b8bd
add esp, 0x108
ret
Function at 0x401bf9
Capabilities:
Create pipe
Create thread

Disassembly:
jmp 0x449900
sub esp, 0x18
cmp dword [0x4a8f04], 0
je 0x449913
or eax, 0xffffffff
add esp, 0x18
ret
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x44994b
call fcn.0044c3fb
mov ecx, dword [esp]
mov edx, dword [0x4a8994]
lea eax, [esp + 8]
push eax
push 0
push ecx
push 0x4013bb
push edx
push 0
mov dword [0x4a8f04], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x489f68], eax
mov eax, dword [esp + 4]
add esp, 0x18
ret

Function at 0x401c71
Capabilities:
Terminate process

Disassembly:
jmp 0x442070
push esi
xor esi, esi
call fcn.0044ad41
mov dword [eax], 1
cmp dword [0x489fd0], 1
mov eax, dword [esp + 8]
je 0x442094
test eax, eax
jge 0x4420a4
cmp eax, 0xffffffff
jmp 0x44209b
test eax, eax
jle 0x4420a4
cmp eax, 1
jne 0x4420a2
or eax, 0xffffffff
pop esi
ret
neg eax
push ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 7
ja case.0x4420b2.4
jmp dword [ebx*4 + 0x44214c]
push edi
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4420dc
call fcn.0044ad41
mov dword [eax], 3
or esi, 0xffffffff
cmp ebx, 7
jne 0x4420f4
push 0xc000013a
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4420f4
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
ret
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne case.0x4420b2.4
or esi, 0xffffffff
pop ebx
mov eax, esi
pop esi
ret
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne case.0x4420b2.4
or esi, 0xffffffff
pop ebx
mov eax, esi
pop esi
ret
push eax
call fcn.0040133e
add esp, 4
test eax, eax
jge case.0x4420b2.4
call fcn.0044ad41
mov dword [eax], 3
or esi, 0xffffffff
pop ebx
mov eax, esi
pop esi
ret
Function at 0x401d9d
Capabilities:
Terminate process

Disassembly:
jmp 0x403b60
push edi
mov edi, dword [0x4a500c]
test edi, edi
je 0x403bb3
push ebx
push esi
mov ebx, 0x20000
mov esi, edi
test dword [esi + 0xc], ebx
je 0x403b94
mov eax, dword [esi + 0x1c]
cmp eax, dword [0x488960]
je 0x403b94
push 3
push eax
call fcn.00401c71
add esp, 8
cmp eax, 0xffffffff
jne 0x403b9d
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x403b74
jmp 0x403bab
mov eax, dword [esi + 0x1c]
push 0x10
push eax
call fcn.00401c71
add esp, 8
mov edi, dword [edi]
test edi, edi
jne 0x403b72
pop esi
pop ebx
call fcn.004018d4
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401de8
Capabilities:
Create thread

Disassembly:
jmp 0x449d00
push ecx
mov ecx, dword [0x4a8994]
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x4014ec
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x449d2a
call fcn.0044c3fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x40d7a0
Capabilities:
Parse credit card information

Disassembly:
test edx, edx
jne 0x40d7ab
shr eax, 4
and eax, 1
ret
push esi
movzx esi, word [edx]
test si, si
je 0x40d8a1
movzx ecx, word [edx + 2]
test cx, cx
jne 0x40d81a
test al, 1
je 0x40d7d1
cmp si, 0x2b
je 0x40d813
cmp si, 0x2d
je 0x40d813
test al, 2
je 0x40d7e7
cmp si, 0x2a
je 0x40d813
cmp si, 0x2f
je 0x40d813
cmp si, 0x25
je 0x40d813
test al, 0x10
je 0x40d883
cmp si, 0x28
je 0x40d813
cmp si, 0x29
je 0x40d813
cmp si, 0x21
je 0x40d813
cmp si, 0x7e
je 0x40d813
cmp si, 0x5e
je 0x40d813
cmp si, 0x22
jne 0x40d883
mov eax, 1
pop esi
ret
cmp word [edx + 4], 0
jne 0x40d883
test al, 0x10
je 0x40d847
cmp si, 0x7c
jne 0x40d831
cmp cx, 0x26
je 0x40d813
cmp si, 0x3c
jne 0x40d83c
cmp cx, si
je 0x40d813
cmp si, 0x3e
jne 0x40d847
cmp cx, si
je 0x40d813
test al, 4
je 0x40d883
cmp si, 0x3d
jne 0x40d863
cmp cx, si
je 0x40d813
cmp cx, 0x7e
jne 0x40d883
mov eax, 7
pop esi
ret
cmp si, 0x21
jne 0x40d883
cmp cx, 0x3d
jne 0x40d876
mov eax, 6
pop esi
ret
cmp cx, 0x7e
jne 0x40d883
mov eax, 8
pop esi
ret
test al, 8
je 0x40d8a1
cmp si, 0x3c
jne 0x40d894
mov eax, 4
pop esi
ret
cmp si, 0x3e
jne 0x40d8a1
mov eax, 2
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4253b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esp + 0x18], 1
push esi
mov dword [esp + 8], ebx
jne 0x4253e1
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push eax
push esi
mov dword [esi + 4], ebx
call fcn.0040157d
push esi
call fcn.00401d89
add esp, 0xc
pop esi
xor eax, eax
pop ebx
pop ecx
ret
cmp dword [esp + 0x20], ebx
push edi
jne 0x42542c
cmp dword [esp + 0x28], ebx
jne 0x42542c
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx]
movzx eax, word [esi]
test ax, ax
mov edi, dword [esp + 0x18]
je 0x425575
mov dx, word [edi]
xor dx, ax
test dx, 0x77ff
jne 0x425575
movzx eax, word [esi + 2]
add esi, 2
add ebx, 1
add edi, 2
test ax, ax
jne 0x425404
jmp 0x425575
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
movzx eax, word [esi]
test ax, ax
mov edi, dword [esp + 0x18]
push ebp
je 0x42554c
mov cx, word [edi]
and cx, 0x77ff
and eax, 0x77ff
movzx ecx, cx
mov ebx, eax
test bx, bx
mov dword [esp + 0x24], ecx
jl 0x4254bd
mov edx, ebx
and edx, 0xffff8000
test dx, dx
jne 0x4254bd
mov ebp, ebx
and ebp, 0x80
je 0x42548f
push 0x4a50e0
push 0x4a74e0
call fcn.00401334
mov ecx, dword [esp + 0x2c]
add esp, 8
test eax, eax
jne 0x4254bd
movzx eax, bl
movzx eax, word [eax*2 + 0x4a55c0]
and eax, 0x400
je 0x4254bd
test bp, bp
je 0x4254af
cmp dword [0x488940], 0
jne 0x4254bd
movsx edx, bx
movzx ax, byte [edx + 0x4a63c0]
movzx ebx, ax
test cx, cx
jl 0x425527
mov edx, ecx
and edx, 0xffff8000
test dx, dx
jne 0x425527
mov ebp, ecx
and ebp, 0x80
je 0x4254f3
push 0x4a50e0
push 0x4a74e0
call fcn.00401334
mov ecx, dword [esp + 0x2c]
add esp, 8
test eax, eax
jne 0x425527
movzx eax, cl
movzx eax, word [eax*2 + 0x4a55c0]
and eax, 0x400
je 0x425527
test bp, bp
je 0x425513
cmp dword [0x488940], 0
jne 0x425527
movsx ecx, cx
movzx dx, byte [ecx + 0x4a63c0]
movzx eax, dx
mov dword [esp + 0x24], eax
mov ecx, eax
cmp bx, cx
jne 0x425546
movzx eax, word [esi + 2]
add dword [esp + 0x10], 1
add esi, 2
add edi, 2
test ax, ax
jne 0x425443
jmp 0x42554c
cmp word [esi], 0
jne 0x425552
cmp word [edi], 0
jne 0x425570
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea ecx, [ebx + ebx]
push ecx
mov ecx, dword [eax]
push edx
push ecx
call fcn.0044cf70
add esp, 0xc
jmp 0x425574
mov ebx, dword [esp + 0x10]
pop ebp
mov eax, dword [esp + 0x14]
mov word [esi], 0
sub esi, dword [eax]
sar esi, 1
mov dword [eax + 4], esi
cmp dword [0x4a6b90], 0
jne 0x4255bd
push 0x4a50e0
push 0x4a7b24
call fcn.00401334
add esp, 8
test eax, eax
jne 0x4255bd
cmp dword [esp + 0x24], eax
je 0x4255af
cmp word [edi], ax
jne 0x4255bd
cmp ebx, dword [esp + 0x1c]
jne 0x4255bd
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4404c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x4404c0
sub esp, 0x20c
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
test esi, esi
jne 0x440504
call fcn.0044ad41
mov dword [eax], 2
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044b8bd
add esp, 0x20c
ret
push ebx
push ebp
push edi
push esi
push 0x47bdd8
lea eax, [esp + 0x20]
push 0x200
push eax
call fcn.0046f0bd
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], 1
jne 0x4405c3
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne case.default.0x44055b
test byte [esp + 0x224], 1
je case.default.0x44055b
cmp edi, 3
ja case.default.0x44055b
jmp dword [edi*4 + 0x44062c]
push esi
push str._s.exe
jmp 0x440594
push esi
push str._s.cmd
push 0x200
lea eax, [esp + 0x24]
push eax
jmp 0x44059e
push esi
push str._s.bat
push 0x200
lea ecx, [esp + 0x24]
push ecx
jmp 0x44059e
push esi
push str._s.com
push 0x200
lea edx, [esp + 0x24]
push edx
call fcn.0046f0bd
add esp, 0x10
lea eax, [esp + 0x18]
push eax
call ebp
add dword [esp + 0x10], 1
mov ebx, eax
add edi, 1
cmp ebx, 0xffffffff
je 0x440541
jmp 0x4405c3
cmp ebx, 0xffffffff
je 0x4405e0
mov al, byte [esp + 0x224]
test al, 2
je 0x4405d3
test bl, 1
jne 0x4405e0
test al, 1
je 0x440610
test al, 9
je 0x4405f0
test bl, 0x10
je 0x4405f5
call fcn.0044ad41
mov dword [eax], 0xd
or eax, 0xffffffff
jmp 0x440612
test bl, 0x10
jne 0x440610
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
jne 0x440610
cmp dword [esp + 0x10], 4
jg 0x4405e0
xor eax, eax
mov ecx, dword [esp + 0x218]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.0044b8bd
add esp, 0x20c
ret
Function at 0x441730
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x441730
sub esp, 0x144
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
mov ebp, dword [esp + 0x150]
xor ebx, ebx
push 0x13c
lea eax, [esp + 0x10]
push ebx
push eax
mov dword [esp + 0x14], ebx
call fcn.0044d2e0
add esp, 0xc
cmp ebp, ebx
jne 0x441783
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0044b8bd
add esp, 0x144
ret
mov eax, dword [ebp + 0xc]
test al, 2
push esi
push edi
je 0x44179e
mov edi, ebp
call fcn.00441180
test eax, eax
jge 0x441809
xor eax, eax
jmp 0x44186e
test al, 1
je 0x441809
lea ecx, [esp + 0x10]
push ecx
lea edx, [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x30]
mov edx, dword [ebp + 0x118]
mov eax, dword [section..data]
mov dword [ebp + 8], ecx
mov dword [ebp], esi
mov dword [edx], eax
add eax, 1
mov dword [section..data], eax
mov eax, dword [ebp + 0x118]
mov dword [eax + 4], ebx
mov ecx, dword [ebp + 0x118]
mov word [ecx + 8], bx
mov edi, dword [ebp + 0x118]
add edi, 0xa
mov ecx, 0x41
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
and dword [ebp + 0xc], 0xfffffffe
jmp 0x441868
test byte [ebp + 0xc], 2
jne 0x441826
mov eax, dword [ebp]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x441797
mov ecx, dword [ebp + 0x118]
mov eax, dword [section..data]
mov dword [ecx], eax
mov edx, dword [ebp + 0x118]
add eax, 1
mov dword [edx + 4], ebx
mov dword [section..data], eax
mov eax, dword [ebp + 0x118]
mov word [eax + 8], bx
test byte [ebp + 0xc], 2
jne 0x441868
mov edi, dword [ebp + 0x118]
add edi, 0xa
mov ecx, 0x41
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x118]
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b8bd
add esp, 0x144
ret

Function at 0x441ed0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4859f0
push 0x44f500
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x487180]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x1c], esi
push 0x488e18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b7c
add esp, 8
mov edx, dword [0x488e34]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 4], esi
push 0xf
call fcn.00401451
add esp, 4
jmp 0x441f53
mov dword [ebp - 4], 0xfffffffe
mov edx, dword [0x488e34]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x488e18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442850
Capabilities:
Get system information on windows
Terminate process

Disassembly:
jmp 0x442850
sub esp, 0x1bc
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x1b8], eax
push 0x94
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0044d2e0
xor eax, eax
push str.Microsoft
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.00401429
push eax
push 0x4a732c
call fcn.00401a3c
add esp, 0x18
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4428e8
push 0x10
push str.tcsh
push str.GetVersionEx_failed_in_getmachine
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x44295b
cmp byte [esp + 0x3c], 0
mov esi, str.WindowsNT
lea eax, [esp + 0x3c]
jne 0x442912
mov eax, 0x47bce9
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x38]
push eax
push ecx
push edx
push str.Windows_NT
push str._s__d._d_Build__d___s_
lea eax, [esp + 0xd4]
push 0x100
push eax
call fcn.0046f0bd
lea ecx, [esp + 0xdc]
push ecx
call fcn.00401429
push eax
push 0x4a7318
call fcn.00401a3c
add esp, 0x2c
jmp 0x4429c2
cmp eax, 1
jne 0x4429a9
movzx edx, word [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
push str.Win9x__d._d:_d
lea edx, [esp + 0xcc]
push 0x100
push edx
mov esi, str.Windows9x
call fcn.0046f0bd
lea eax, [esp + 0xd4]
push eax
call fcn.00401429
push eax
push 0x4a7318
call fcn.00401a3c
add esp, 0x24
jmp 0x4429c2
push 0x10
push str.tcsh
push str.Unknown_platform
push 0
mov esi, str.WindowsWhoKnows
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00401429
push eax
push 0x4a7350
call fcn.00401a3c
movzx eax, word [esp + 0x10]
add esp, 0xc
cmp eax, 9
pop esi
ja case.0x4429e5.4
jmp dword [eax*4 + 0x442ab4]
mov ax, word [esp + 0x20]
cmp ax, 3
jb 0x4429fd
cmp ax, 9
jbe 0x442a06
mov ax, 3
mov word [esp + 0x20], ax
movzx ecx, ax
push ecx
push str.i_d86
lea edx, [esp + 0xc0]
push 0x100
push edx
call fcn.0046f0bd
add esp, 0x10
jmp 0x442a83
push str.Alpha
push 0x100
lea eax, [esp + 0xc0]
push eax
jmp 0x442a7b
push str.Mips
jmp 0x442a6e
push 0x482124
push 0x100
lea edx, [esp + 0xc0]
push edx
jmp 0x442a7b
push str.AMD64
push 0x100
lea eax, [esp + 0xc0]
push eax
jmp 0x442a7b
push str.Unknown
push 0x100
lea ecx, [esp + 0xc0]
push ecx
call fcn.0046f0bd
add esp, 0xc
lea edx, [esp + 0xb8]
push edx
call fcn.00401429
push eax
push 0x4a733c
call fcn.00401a3c
mov ecx, dword [esp + 0x1c4]
add esp, 0xc
xor ecx, esp
call fcn.0044b8bd
add esp, 0x1bc
ret
Function at 0x446270
Capabilities:
Query environment variable

Disassembly:
jmp 0x446270
sub esp, 0x404
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x400], eax
push edi
push 0x400
lea eax, [esp + 8]
push eax
push str.TCSHSUBSTHB
mov byte [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [esp + 4], 0
lea edi, [esp + 4]
je 0x4462ee
push ebx
push ebp
push esi
mov ebx, edi
mov ebp, 0x489290
cmp byte [edi], 0x3b
jne 0x4462e3
mov eax, edi
sub eax, ebx
je 0x4462e3
lea esi, [eax + 1]
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push esi
push eax
mov dword [ebp], eax
call fcn.0046ecda
add ebp, 4
lea ebx, [edi + 1]
add edi, 1
cmp byte [edi], 0
jne 0x4462b4
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x404]
pop edi
xor ecx, esp
call fcn.0044b8bd
add esp, 0x404
ret

Function at 0x446870
Capabilities:
Get common file path

Disassembly:
jmp 0x446870
sub esp, 0x108
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push esi
mov byte [esp + 0xe], 0x2f
call fcn.00450d80
mov ecx, dword [esp + 0x110]
add esp, 8
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0044b8bd
add esp, 0x108
ret
Function at 0x446ba0
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
jmp 0x446ba0
sub esp, 0x158
mov eax, dword [0x487180]
xor eax, esp
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x15c]
push ebx
push esi
push edi
mov edi, dword [eax]
xor ebx, ebx
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebx
mov esi, edi
call fcn.00401249
add esp, 4
test eax, eax
jne 0x446c1b
cmp byte [edi], bl
je 0x446bef
lea ecx, [ecx]
cmp byte [esi], 0x2f
jne 0x446be8
mov byte [esi], 0x5c
add esi, 1
cmp byte [esi], bl
jne 0x446be0
cmp esi, edi
mov eax, esi
je 0x446c1b
cmp byte [eax], 0x2e
je 0x446c03
sub eax, 1
cmp eax, edi
jne 0x446bf5
jmp 0x446c1b
add eax, 1
cmp eax, edi
je 0x446c1b
push eax
call fcn.0040150a
add esp, 4
test eax, eax
jne 0x446da3
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x410
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
add edx, 4
push edx
mov dword [esp + 0x34], 0x410
mov dword [esp + 0x3c], ebx
call fcn.0040163b
add esp, 0x18
test eax, eax
jne 0x446c96
call fcn.0044ad41
mov dword [eax], 0xc
mov eax, dword [esp + 0x10]
push eax
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x446da2
mov ecx, dword [esp + 0x18]
push 0x3c
lea edx, [esp + 0x2c]
push ebx
push edx
mov byte [ecx], bl
call fcn.0044d2e0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x2c], 0x500
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 0xa
call fcn.004015aa
lea ecx, [esp + 0x28]
push ecx
mov esi, eax
call dword [0x4892e4]
test eax, eax
je 0x446d1d
cmp dword [esp + 0x170], ebx
je 0x446d02
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0044ad41
mov dword [eax], ebx
mov edx, dword [esp + 0x10]
push edx
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x446da2
cmp dword [esp + 0x174], ebx
je 0x446d7f
push esi
call fcn.00401c17
mov ebx, dword [esp + 0x18]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x200
push ebx
push 0x409
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push edi
push 0x47bdd8
lea eax, [esp + 0x6c]
push 0x100
push eax
call fcn.0046f0bd
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x78]
push edx
push 0x36
call fcn.0040100a
add esp, 0x1c
xor ebx, ebx
mov eax, dword [esp + 0x10]
push eax
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call fcn.00401c17
add esp, 4
call fcn.0044ad41
mov dword [eax], 8
pop ebp
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044b8bd
add esp, 0x158
ret