joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a910
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [eax]
push edi
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.0042a4b0
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
jne 0x42a93e
pop edi
mov eax, 0x1b
pop ebp
pop ecx
ret
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a943
push ebx
sub eax, edx
push esi
mov ebx, eax
mov eax, dword [esp + 0x18]
push 0
push ebx
push edi
push eax
call sub.WS2_32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x42a973
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x2733
jne 0x42a973
xor esi, esi
xor ecx, ecx
cmp esi, 0xffffffff
setne cl
dec ecx
and ecx, 0x37
mov dword [esp + 0x10], ecx
jne 0x42a9ae
mov al, byte [ebp + 0x154]
test al, al
je 0x42a9a4
mov eax, dword [ebp + 0x78]
test eax, eax
je 0x42a9a4
mov edx, dword [ebp + 0xc]
push edx
push esi
push edi
push 4
push ebp
call eax
add esp, 0x14
cmp esi, ebx
je 0x42a9ae
sub ebx, esi
add edi, esi
jmp 0x42a950
mov eax, dword [esp + 0x1c]
push eax
call fcn.00450572
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret

Function at 0x42ab00
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
lea eax, [esp]
push eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x114]
push edx
push 0
lea eax, [esi + 1]
push eax
mov dword [esp + 0x124], esi
mov dword [esp + 0x120], 1
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x42ab74
or eax, eax
add esp, 0x210
ret
test eax, eax
jne 0x42ab84
mov eax, 1
add esp, 0x210
ret
lea ecx, [esp + 8]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
neg eax
sbb eax, eax
and eax, 2
add esp, 0x210
ret
Function at 0x42e720
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x2b0]
mov al, byte [esp + 8]
push esi
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.0042e610
add esp, 4
pop esi
pop ecx
ret
Function at 0x42eec0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x908
mov eax, dword [0x48db98]
push ebx
push ebp
mov ebp, dword [esp + 0x914]
mov ebx, dword [ebp + 0x354]
push esi
mov esi, dword [ebp]
mov dword [esp + 0x910], eax
mov eax, dword [ebx + 0x1ab0]
push edi
sub eax, dword [ebx + 0x1aac]
add eax, 2
push eax
lea ecx, [ebx + 0x18ac]
push ecx
push 0x3c
mov dword [esp + 0x1c], esi
call fcn.0042ea10
mov eax, dword [ebx + 0x1aac]
movzx ecx, byte [eax]
add esp, 0xc
inc eax
cmp ecx, 0x18
mov dword [ebx + 0x1aac], eax
je 0x42f0a5
cmp ecx, 0x23
je 0x42f02e
cmp ecx, 0x27
jne 0x42f121
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea edx, [esp + 0x128]
push 0x800
push edx
call fcn.0042a3b0
mov esi, dword [ebx + 0x18a8]
add esp, 0x1c
test esi, esi
mov edi, 4
je 0x42efdb
lea esp, [esp]
mov edx, dword [esi]
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ef77
sub eax, ebx
lea ebx, [eax + edi + 1]
cmp ebx, 0x7fa
jge 0x42efd4
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x98]
push ecx
push str._127_____s
push edx
call fcn.004532fc
lea edx, [esp + 0x24]
push edx
push 1
lea eax, [esp + 0xac]
push eax
push 0
mov ecx, 0x800
push str._c_s_c_s
sub ecx, edi
push ecx
lea edx, [esp + edi + 0x13c]
push edx
call fcn.0042a3b0
add esp, 0x2c
mov edi, ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x42ef70
push 0xf0
push 0xff
mov eax, 0x800
push str._c_c
sub eax, edi
push eax
lea ecx, [esp + edi + 0x124]
push ecx
call fcn.0042a3b0
mov eax, dword [ebp + 0x2b0]
add esp, 0x14
push 0
add edi, 2
push edi
lea edx, [esp + 0x11c]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
add edi, 0xfffffffe
push edi
lea ecx, [esp + 0x11a]
push ecx
jmp 0x42f113
lea ecx, [ebx + 0x1828]
mov eax, ecx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f040
push 0xf0
push 0xff
push ecx
push 0
push 0x23
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
lea edx, [esp + 0x134]
sub eax, esi
push 0x800
push edx
lea edi, [eax + 6]
call fcn.0042a3b0
mov ecx, dword [ebp + 0x2b0]
add esp, 0x28
push 0
push edi
lea eax, [esp + 0x11c]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
add edi, 0xfffffffe
push edi
lea edx, [esp + 0x11a]
push edx
jmp 0x42f113
lea ecx, [ebx + 0x1808]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f0b0
push 0xf0
push 0xff
push ecx
push 0
push 0x18
push 0xfa
push 0xff
sub eax, esi
push str._c_c_c_c_s_c_c
lea edi, [eax + 6]
lea eax, [esp + 0x134]
push 0x800
push eax
call fcn.0042a3b0
mov edx, dword [ebp + 0x2b0]
add esp, 0x28
push 0
push edi
lea ecx, [esp + 0x11c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
add edi, 0xfffffffe
push edi
lea eax, [esp + 0x11a]
push eax
mov esi, dword [esp + 0x18]
push 0x3e
call fcn.0042ea10
add esp, 0xc
mov ecx, dword [esp + 0x914]
pop edi
pop esi
pop ebp
pop ebx
call fcn.0044ffb2
add esp, 0x908
ret
Function at 0x42f620
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp + 0x354]
push esi
xor ebx, ebx
add eax, 0x1408
push edi
mov edi, 0x408
mov dword [esp + 0x14], eax
cmp dword [eax - 0xc00], 1
jne 0x42f6c8
mov eax, dword [ebp + 0x354]
mov ecx, dword [edi + eax - 0x400]
sub ecx, 0
je 0x42f682
sub ecx, 2
je 0x42f673
dec ecx
jne 0x42f6c8
cmp dword [edi + eax], 0
jne 0x42f6c8
mov dword [edi + eax], 1
jmp 0x42f6c8
mov ecx, dword [edi + eax]
dec ecx
jne 0x42f6c8
mov dword [edi + eax], 0
jmp 0x42f6c8
push 0
mov dword [edi + eax - 0x400], 2
mov ecx, dword [ebp + 0x2b0]
push 3
lea eax, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x2c], 0xff
mov byte [esp + 0x2d], 0xfb
mov byte [esp + 0x2e], bl
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp]
push str.SENT
mov eax, ebx
mov esi, 0xfb
call fcn.0042e610
add esp, 4
mov edx, dword [esp + 0x14]
cmp dword [edx], 1
jne 0x42f764
mov eax, dword [ebp + 0x354]
mov ecx, dword [edi + eax + 0x800]
sub ecx, 0
je 0x42f71e
sub ecx, 2
je 0x42f707
dec ecx
jne 0x42f764
mov ecx, dword [edi + eax + 0xc00]
test ecx, ecx
jne 0x42f764
mov dword [edi + eax + 0xc00], 1
jmp 0x42f764
mov ecx, dword [edi + eax + 0xc00]
dec ecx
jne 0x42f764
mov dword [edi + eax + 0xc00], 0
jmp 0x42f764
push 0
mov dword [edi + eax + 0x800], 2
mov ecx, dword [ebp + 0x2b0]
push 3
lea eax, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], 0xfd
mov byte [esp + 0x22], bl
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp]
push str.SENT
mov eax, ebx
mov esi, 0xfd
call fcn.0042e610
add esp, 4
mov eax, dword [esp + 0x14]
add edi, 4
add eax, 4
inc ebx
cmp edi, 0x4a8
mov dword [esp + 0x14], eax
jl 0x42f641
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x431140
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x48db98]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004557e6
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x4311a1
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov al, byte [esp]
test al, al
je 0x4311a1
lea edx, [esp]
push edx
call fcn.0045605e
add esp, 4
mov ecx, dword [esp + 0x104]
call fcn.0044ffb2
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor eax, eax
call fcn.0044ffb2
add esp, 0x108
ret
jmp 0x431140

Function at 0x4311c0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x48db98]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004557e6
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x4311a1
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov al, byte [esp]
test al, al
je 0x4311a1
lea edx, [esp]
push edx
call fcn.0045605e
add esp, 4
mov ecx, dword [esp + 0x104]
call fcn.0044ffb2
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor eax, eax
call fcn.0044ffb2
add esp, 0x108
ret
jmp 0x431140

Function at 0x434e2b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x48db98]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x434e6b
push 0x479828
push 4
push eax
call fcn.00455f88
push eax
call fcn.00404dd0
add esp, 0x10
jmp 0x434e7d
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x434eeb
push edi
call fcn.004548d0
mov edi, dword [eax]
call fcn.004548d0
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004517fd
add esp, 0x18
mov ebx, eax
call fcn.004548d0
cmp dword [eax], 0
je 0x434ecb
call fcn.004548d0
push dword [eax]
call fcn.00421650
pop ecx
jmp 0x434ed2
call fcn.004548d0
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x434eeb
cmp ebx, esi
jae 0x434eeb
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x434eed
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ffb2
leave
ret
Function at 0x43ac3a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x43ac73
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00434852
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0043482d
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x43c787
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x43c7ca
call fcn.0043df26
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43c7ca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43c7e5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0043c33e
test ebx, ebx
mov esi, eax
je 0x43c7e3
test edi, edi
je 0x43c7e3
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x43cc75
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x43ccbb
call fcn.0043df26
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43ccbb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x43ccfe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x43cce7
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x43cce7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x43ccfb
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x440322
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x440350
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44036e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044028c
jmp 0x44036e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44036e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0044028c
test edi, edi
mov eax, edi
jne 0x440358
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x491338]
test ecx, ecx
je 0x440431
jmp 0x440321
ret 8
Function at 0x44ffb2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48db98]
jne 0x44ffbc
repz ret
jmp fcn.00459bac
Function at 0x453350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x45338d
cmp dword [ebp + 0x14], edi
je 0x45338d
cmp ecx, edi
jne 0x453394
call fcn.004548d0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0044fb6d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4533a8
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4533c9
cmp ebx, 0xffffffff
je 0x4533b8
push ebx
push edi
push ecx
call fcn.004501b0
add esp, 0xc
cmp esi, edi
je 0x453375
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x453375
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4533e5
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4533ec
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4534dd
test word [esi + 0xc], 0x10c
je 0x453440
mov eax, dword [esi + 4]
test eax, eax
je 0x453440
jl 0x45353e
cmp ebx, eax
mov edi, ebx
jb 0x453411
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4534e5
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044f991
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4534d5
cmp ebx, dword [ebp - 0xc]
jb 0x4534ad
cmp dword [ebp - 0xc], 0
je 0x45346a
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x45345f
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x453466
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x453475
mov eax, SysReAllocString
cmp ebx, eax
ja 0x453475
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x453511
push eax
push dword [ebp - 8]
push esi
call fcn.0045fa12
pop ecx
push eax
call fcn.0046324b
add esp, 0xc
test eax, eax
je 0x453550
cmp eax, 0xffffffff
je 0x45353e
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4534d5
push esi
call fcn.0045f8f2
cmp eax, 0xffffffff
pop ecx
je 0x453542
cmp dword [ebp - 4], 0
je 0x453511
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4533f4
mov eax, dword [ebp + 0x14]
jmp 0x45338f
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4534fc
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004501b0
add esp, 0xc
call fcn.004548d0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x453385
cmp dword [ebp + 0xc], 0xffffffff
je 0x453527
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004501b0
add esp, 0xc
call fcn.004548d0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x453385
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x45338f
or dword [esi + 0xc], 0x10
jmp 0x453542
Function at 0x45b773
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x48e210]
je 0x45b78e
inc edi
cmp edi, 0x17
jb 0x45b77f
cmp edi, 0x17
jae 0x45b90e
push ebp
push 3
call fcn.004659c5
cmp eax, 1
pop ecx
je 0x45b8da
push 3
call fcn.004659c5
test eax, eax
pop ecx
jne 0x45b7c2
cmp dword [0x48dba8], 1
je 0x45b8da
cmp ebx, 0xfc
je 0x45b90d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x491ae8
push ebp
call fcn.00455f88
add esp, 0xc
test eax, eax
je 0x45b7f8
push esi
push esi
push esi
push esi
push esi
call fcn.0044fa71
add esp, 0x14
push 0x104
mov esi, 0x491b01
push esi
push 0
mov byte [0x491c05], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45b83c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00455f88
add esp, 0xc
test eax, eax
je 0x45b83c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0044fa71
add esp, 0x14
push esi
call fcn.004559b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x45b881
push esi
call fcn.004559b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x491dfc
push 0x47c914
sub ecx, eax
push ecx
push eax
call fcn.00457789
add esp, 0x14
test eax, eax
je 0x45b881
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0044fa71
add esp, 0x14
jmp 0x45b883
xor esi, esi
push 0x47c910
push ebx
push ebp
call fcn.00455fed
add esp, 0xc
test eax, eax
je 0x45b8a3
push esi
push esi
push esi
push esi
push esi
call fcn.0044fa71
add esp, 0x14
push dword [edi*8 + 0x48e214]
push ebx
push ebp
call fcn.00455fed
add esp, 0xc
test eax, eax
je 0x45b8c5
push esi
push esi
push esi
push esi
push esi
call fcn.0044fa71
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00465808
add esp, 0xc
jmp 0x45b90d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x45b90d
cmp ebp, 0xffffffff
je 0x45b90d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x48e214]
push dword [esi]
call fcn.004559b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x465808
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004588aa
xor ebx, ebx
cmp dword [0x492084], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4658de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4659be
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47d2f8
push edi
call esi
cmp eax, ebx
je 0x4659be
push eax
call fcn.0045883c
mov dword [esp], 0x47d2e8
push edi
mov dword [0x492084], eax
call esi
push eax
call fcn.0045883c
mov dword [esp], 0x47d2d4
push edi
mov dword [0x492088], eax
call esi
push eax
call fcn.0045883c
mov dword [0x49208c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00455d15
test eax, eax
pop ecx
pop ecx
je 0x4658ac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044fa71
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4658de
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0045883c
cmp eax, ebx
pop ecx
mov dword [0x492094], eax
je 0x4658de
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045883c
pop ecx
mov dword [0x492090], eax
mov eax, dword [0x492090]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x465963
cmp dword [0x492094], ecx
je 0x465963
push eax
call fcn.004588b3
push dword [0x492094]
mov esi, eax
call fcn.004588b3
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x465963
cmp edi, ebx
je 0x465963
call esi
cmp eax, ebx
je 0x465930
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x465930
test byte [ebp - 0x18], 1
jne 0x465963
lea eax, [ebp - 0x10]
push eax
call fcn.00455d4c
test eax, eax
pop ecx
je 0x46594b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044fa71
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x46595a
or dword [ebp + 0x10], 0x200000
jmp 0x46599e
or dword [ebp + 0x10], 0x40000
jmp 0x46599e
mov eax, dword [0x492088]
cmp eax, dword [ebp - 8]
je 0x46599e
push eax
call fcn.004588b3
cmp eax, ebx
pop ecx
je 0x46599e
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x46599e
mov eax, dword [0x49208c]
cmp eax, dword [ebp - 8]
je 0x46599e
push eax
call fcn.004588b3
cmp eax, ebx
pop ecx
je 0x46599e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x492084]
call fcn.004588b3
cmp eax, ebx
pop ecx
je 0x4659be
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4659c0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46c36f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x48db98]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0046c304
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004501b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x46c3be
cmp dword [ebp - 0x1c], 5
jb 0x46c3d6
jmp 0x46c3d2
cmp dword [ebp - 0x10], 1
jne 0x46c3d6
cmp dword [ebp - 0x1c], 4
ja 0x46c3d2
jne 0x46c3d6
cmp dword [ebp - 0x18], 0
jbe 0x46c3d6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x47ed84
call fcn.0046c1f5
test eax, eax
jge 0x46c3f7
mov byte [0x48f1c0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044ffb2
add ebp, 0x78
leave
ret
Function at 0x1010582d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10290060]
jne 0x10105837
repz ret
jmp fcn.101078dd

Function at 0x1010aa9f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10106836
and dword [ebp - 4], 0
cmp dword [0x102920e8], 0
mov ebx, eax
jne 0x1010ab50
push 0x1021b0f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1010ac01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1021b0ec
push edi
call esi
test eax, eax
je 0x1010ac01
push eax
call fcn.101067c4
mov dword [esp], 0x1021b0dc
push edi
mov dword [0x102920e8], eax
call esi
push eax
call fcn.101067c4
mov dword [esp], 0x1021b0c8
push edi
mov dword [0x102920ec], eax
call esi
push eax
call fcn.101067c4
mov dword [esp], 0x1021b0ac
push edi
mov dword [0x102920f0], eax
call esi
push eax
call fcn.101067c4
pop ecx
mov dword [0x102920f8], eax
test eax, eax
je 0x1010ab50
push 0x1021b094
push edi
call esi
push eax
call fcn.101067c4
pop ecx
mov dword [0x102920f4], eax
mov eax, dword [0x102920f4]
cmp eax, ebx
je 0x1010aba8
cmp dword [0x102920f8], ebx
je 0x1010aba8
push eax
call fcn.1010683f
push dword [0x102920f8]
mov esi, eax
call fcn.1010683f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1010aba8
test edi, edi
je 0x1010aba8
call esi
test eax, eax
je 0x1010ab9f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1010ab9f
test byte [ebp - 0xc], 1
jne 0x1010aba8
or dword [ebp + 0x10], 0x200000
jmp 0x1010abe1
mov eax, dword [0x102920ec]
cmp eax, ebx
je 0x1010abe1
push eax
call fcn.1010683f
pop ecx
test eax, eax
je 0x1010abe1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1010abe1
mov eax, dword [0x102920f0]
cmp eax, ebx
je 0x1010abe1
push eax
call fcn.1010683f
pop ecx
test eax, eax
je 0x1010abe1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102920e8]
call fcn.1010683f
pop ecx
test eax, eax
je 0x1010ac01
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1010ac03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret