joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087ee
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x41d11c], esi
push edi
jne 0x40880e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x41d118], esi
mov byte [0x41d114], al
jne 0x408874
mov ecx, dword [0x41d7b0]
test ecx, ecx
je 0x408855
mov eax, dword [0x41d7ac]
sub eax, 4
cmp eax, ecx
jmp 0x40884e
mov eax, dword [eax]
test eax, eax
je 0x408840
call eax
mov eax, dword [0x41d7ac]
sub eax, 4
cmp eax, dword [0x41d7b0]
mov dword [0x41d7ac], eax
jae 0x408838
mov eax, 0x417044
mov esi, 0x417050
cmp eax, esi
mov edi, eax
jae 0x408874
mov eax, dword [edi]
test eax, eax
je 0x40886d
call eax
add edi, 4
cmp edi, esi
jb 0x408865
mov eax, 0x417054
mov esi, 0x41705c
cmp eax, esi
mov edi, eax
jae 0x408893
mov eax, dword [edi]
test eax, eax
je 0x40888c
call eax
add edi, 4
cmp edi, esi
jb 0x408884
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4088ad
push dword [ebp + 8]
mov dword [0x41d11c], 1
call fcn.00408754
pop ebp
ret

Function at 0x4089e5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408a05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b004
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x408a26
test byte [esp + 8], 2
je 0x408a26
mov dword [0x41d0d0], 0xd
mov dword [0x41d0d4], 5
jmp 0x408a01
xor eax, eax
ret
Function at 0x408d91
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x414160
call fcn.0040d8d4
mov eax, dword [0x417960]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x408e9e
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x408e4f
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00407d40
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x408e3c
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x408e9e
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x408e9e
mov al, byte [edi]
cmp al, 0x5c
je 0x408e5d
cmp al, 0x2f
jne 0x408e62
cmp al, byte [edi + 1]
je 0x408e98
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.0040d779
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x408e9e
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b004
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x408eba
push edi
call fcn.00407eae
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
call fcn.0040982c
call fcn.0040d90f
ret
Function at 0x40cbfe
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x40cc17
or eax, 0xffffffff
jmp 0x40cc78
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x40cc74
push 0x3d
push esi
call fcn.004101d0
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x40cc74
cmp esi, eax
je 0x40cc74
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x41d0fc]
sete cl
cmp eax, dword [0x41d100]
mov dword [ebp - 8], ecx
jne 0x40cc5a
mov edi, eax
call fcn.0040cb9d
mov dword [0x41d0fc], eax
cmp eax, ebx
jne 0x40ccb3
cmp dword [ebp + 0xc], ebx
je 0x40cc7c
cmp dword [0x41d104], ebx
je 0x40cc7c
call fcn.0040ceaa
test eax, eax
je 0x40ccb3
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x40cc85
xor eax, eax
jmp 0x40cc77
push 4
call fcn.00407d2b
cmp eax, ebx
pop ecx
mov dword [0x41d0fc], eax
je 0x40cc74
mov dword [eax], ebx
cmp dword [0x41d104], ebx
jne 0x40ccb3
push 4
call fcn.00407d2b
cmp eax, ebx
pop ecx
mov dword [0x41d104], eax
je 0x40cc74
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x41d0fc]
call fcn.0040cb50
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x40cd14
cmp dword [esi], ebx
je 0x40cd14
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00407eae
cmp dword [ebp - 8], ebx
pop ecx
jne 0x40ccf7
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x40cd55
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x40ccee
mov eax, edi
shl eax, 2
push eax
push dword [0x41d0fc]
call fcn.0040ba4c
cmp eax, ebx
pop ecx
pop ecx
je 0x40cd55
jmp 0x40cd50
cmp dword [ebp - 8], ebx
jne 0x40cdc0
cmp edi, ebx
jge 0x40cd23
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x41d0fc]
call fcn.0040ba4c
cmp eax, ebx
pop ecx
pop ecx
je 0x40cc74
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x41d0fc], eax
cmp dword [ebp + 0xc], ebx
je 0x40cdaa
push dword [ebp - 4]
call fcn.0040cde0
inc eax
inc eax
push eax
call fcn.00407d2b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40cdaa
push dword [ebp - 4]
push esi
call fcn.004099e0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x40cda3
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00407eae
pop ecx
cmp dword [ebp - 8], ebx
je 0x40cdb8
push dword [ebp - 4]
call fcn.00407eae
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x40cc77
push dword [ebp - 4]
call fcn.00407eae
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x40cc81
Function at 0x40d1b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x41d660]
push edi
jae 0x40d389
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x41d680]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x40d389
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x40d25f
test dl, 2
jne 0x40d25f
test dl, 0x48
je 0x40d229
cmp byte [eax + 5], 0xa
je 0x40d229
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d272
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x40d25a
mov dword [0x41d0d4], ecx
jmp 0x40d390
cmp eax, 0x6d
jne 0x40d266
xor eax, eax
jmp 0x40d39d
push eax
call fcn.0040b004
pop ecx
jmp 0x40d39a
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x40d384
test eax, eax
je 0x40d299
cmp byte [ebx], 0xa
jne 0x40d299
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40d2a2
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x40d37e
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x40d36e
cmp al, 0xd
je 0x40d2d4
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x40d360
dec ecx
cmp dword [ebp - 8], ecx
jae 0x40d2ee
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x40d2e9
add dword [ebp - 8], 2
jmp 0x40d342
mov dword [ebp - 8], eax
jmp 0x40d35c
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d316
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40d35c
cmp dword [ebp - 0x10], 0
je 0x40d35c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40d337
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40d342
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40d35f
cmp ebx, dword [ebp + 0xc]
jne 0x40d347
cmp byte [ebp - 1], 0xa
jne 0x40d347
mov byte [ebx], 0xa
jmp 0x40d35f
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040d6ed
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40d360
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x40d2b8
jmp 0x40d37e
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40d37e
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x40d39d
and dword [0x41d0d4], 0
mov dword [0x41d0d0], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d7f1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00407d40
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40d88c
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x41d0dc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40d88c
cmp eax, 1
je 0x40d8ad
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40d88c
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40d859
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40d888
xor eax, eax
inc eax
jmp 0x40d8cc
cmp edi, eax
jae 0x40d890
xor eax, eax
jmp 0x40d8cc
cmp eax, esi
jae 0x40d897
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x41d0dc]
jmp 0x40d8b0
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e0cc
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x417960]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x417b88]
je 0x40e101
inc eax
cmp eax, 0x13
jb 0x40e0f2
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x417b88]
jne 0x40e227
mov eax, dword [0x41d128]
cmp eax, 1
je 0x40e1ff
cmp eax, edx
jne 0x40e131
cmp dword [0x417954], 1
je 0x40e1ff
cmp ecx, 0xfc
je 0x40e227
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40e167
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004099e0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0040cde0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40e19b
mov eax, edi
push eax
call fcn.0040cde0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x414c1c
push edi
call fcn.00409280
add esp, 0x10
push edi
call fcn.0040cde0
push dword [esi + 0x417b8c]
mov ebx, eax
call fcn.0040cde0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00407d40
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004099e0
push edi
push ebx
call fcn.004099f0
push 0x413580
push ebx
call fcn.004099f0
push dword [esi + 0x417b8c]
push ebx
call fcn.004099f0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004114ec
add esp, 0x2c
jmp 0x40e227
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x417b8c]
push dword [esi]
call fcn.0040cde0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040982c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x40ea28
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x41d660]
mov eax, dword [0x417960]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x40ebee
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x41d680]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x40ebee
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x40ea92
xor eax, eax
jmp 0x40ec02
test al, 0x20
je 0x40eaa3
push 2
push edi
push edi
push ecx
call fcn.004115e5
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40eb78
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x40ebbf
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x40eb05
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40eaf6
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x40ead8
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40eb45
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x40eb51
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x40eacc
jmp 0x40eb53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x40ebe9
cmp dword [ebp + 0x3a4], edi
je 0x40ebbf
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x40ebb1
mov dword [0x41d0d4], eax
jmp 0x40ebf5
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40eba3
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x40eb53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x40eb53
push dword [ebp + 0x3a4]
call fcn.0040b004
pop ecx
jmp 0x40ebff
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40ebd7
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x40ea8b
mov dword [0x41d0d0], 0x1c
mov dword [0x41d0d4], edi
jmp 0x40ebff
sub eax, dword [ebp - 0x7c]
jmp 0x40ec02
and dword [0x41d0d4], 0
mov dword [0x41d0d0], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.0040982c
add ebp, 0x39c
leave
ret
Function at 0x4105d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
je 0x410602
cmp eax, 1
je 0x410602
jle 0x41060a
cmp eax, 3
jle 0x410602
cmp eax, 4
jne 0x41060a
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x410633
mov dword [0x41d0d0], 0x16
mov dword [0x41d0d4], ebx
or eax, 0xffffffff
jmp 0x4107a5
inc eax
cmp byte [eax], bl
jne 0x410622
lea ecx, [eax + 1]
cmp byte [ecx], bl
je 0x410633
mov byte [eax], 0x20
mov eax, ecx
cmp byte [eax], bl
jne 0x410622
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0040f460
mov dword [ebp - 0x68], esi
mov esi, dword [0x41d660]
add esp, 0xc
cmp esi, ebx
je 0x410676
lea eax, [esi - 1]
mov ecx, eax
sar ecx, 5
mov ecx, dword [ecx*4 + 0x41d680]
mov edx, eax
and edx, 0x1f
cmp byte [ecx + edx*8 + 4], bl
jne 0x410676
dec esi
dec eax
cmp esi, ebx
jne 0x410659
lea eax, [esi + esi*4 + 4]
mov word [ebp - 0x36], ax
push edi
movzx eax, ax
push 1
push eax
call fcn.0040bf8e
cmp esi, ebx
mov dword [ebp - 0x34], eax
pop ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
pop ecx
mov dword [ebp - 8], ebx
lea ecx, [eax + 4]
lea edx, [eax + esi + 4]
jle 0x4106db
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 8]
sar eax, 5
mov eax, dword [eax*4 + 0x41d680]
and edi, 0x1f
lea edi, [eax + edi*8]
mov al, byte [edi + 4]
test al, 0x10
jne 0x4106c7
mov byte [ecx], al
mov eax, dword [edi]
mov dword [edx], eax
jmp 0x4106cc
mov byte [ecx], bl
or dword [edx], 0xffffffff
inc dword [ebp - 8]
inc ecx
add edx, 4
cmp dword [ebp - 8], esi
jl 0x4106a2
mov eax, dword [ebp - 0x34]
cmp byte [ebp - 1], bl
je 0x41070c
lea ecx, [eax + 4]
xor edx, edx
lea eax, [eax + esi + 4]
cmp esi, 3
jge 0x4106f2
mov edi, esi
jmp 0x4106f5
push 3
pop edi
cmp edx, edi
jge 0x410705
mov byte [ecx], bl
or dword [eax], 0xffffffff
inc edx
inc ecx
add eax, 4
jmp 0x4106e9
mov dword [ebp - 0xc], 8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
mov dword [0x41d0d0], ebx
push dword [ebp - 0xc]
mov dword [0x41d0d4], ebx
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
mov edi, eax
call fcn.00407eae
cmp esi, ebx
pop ecx
jne 0x41075a
push edi
call fcn.0040b004
pop ecx
or eax, 0xffffffff
jmp 0x4107a3
cmp dword [ebp + 8], 2
jne 0x410766
push ebx
call fcn.004088c0
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x410793
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x24]
call esi
jmp 0x41079c
cmp dword [ebp + 8], 4
je 0x41078c
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410a0b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x410a39
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x410a40
cmp ebx, dword [eax + 4]
jae 0x410a40
xor eax, eax
jmp 0x410c30
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x410a51
xor eax, eax
inc eax
jmp 0x410c2f
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x410a67
cmp ecx, edx
jae 0x410bac
cmp dword [eax + 4], 0
je 0x410a70
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x410a58
cmp dword [ebp + 8], 0
je 0x410a92
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x410bac
cmp eax, esi
jae 0x410bac
mov eax, dword [0x41d3b0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x410ab7
cmp dword [esi*4 + 0x41d3b8], edi
je 0x410bb0
inc esi
cmp esi, eax
jl 0x410aa5
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x410c2c
cmp dword [ebp - 8], 0x1000000
jne 0x410c2c
test byte [ebp - 0xc], 0xcc
je 0x410b35
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x410c2c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x410c2c
cmp word [eax + 0x18], 0x10b
jne 0x410c2c
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x410c2c
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x410b35
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x410b35
test byte [ecx + 0x27], 0x80
jne 0x410bac
push 1
push 0x41d3f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x410a49
mov ecx, dword [0x41d3b0]
test ecx, ecx
mov edx, ecx
jle 0x410b69
lea eax, [ecx*4 + 0x41d3b4]
cmp dword [eax], edi
je 0x410b69
dec edx
sub eax, 4
test edx, edx
jg 0x410b5d
test edx, edx
jne 0x410b9a
push 0xf
pop ebx
cmp ecx, ebx
jg 0x410b76
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x410b8e
lea eax, [edx*4 + 0x41d3b8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x410b7c
cmp ecx, 0x10
jge 0x410b9a
inc ecx
mov dword [0x41d3b0], ecx
push 0
push 0x41d3f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x410a49
xor eax, eax
jmp 0x410c2f
test esi, esi
jle 0x410a49
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x41d3f8
call ebx
test eax, eax
jne 0x410a49
cmp dword [esi*4 + 0x41d3b8], edi
je 0x410c06
mov eax, dword [0x41d3b0]
lea esi, [eax - 1]
test esi, esi
jl 0x410bf4
cmp dword [esi*4 + 0x41d3b8], edi
je 0x410bf0
dec esi
jns 0x410be4
test esi, esi
jge 0x410c04
cmp eax, 0x10
jge 0x410bff
inc eax
mov dword [0x41d3b0], eax
lea esi, [eax - 1]
jmp 0x410c06
je 0x410c1e
xor ecx, ecx
test esi, esi
jl 0x410c1e
lea eax, [ecx*4 + 0x41d3b8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x410c0c
push 0
push 0x41d3f8
call ebx
jmp 0x410a49
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4114ec
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41d400], ebx
push esi
push edi
jne 0x41156c
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4115a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x41d400], eax
je 0x4115a7
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41d404], eax
call esi
cmp dword [0x41d0dc], 2
mov dword [0x41d408], eax
jne 0x41156c
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41d410], eax
je 0x41156c
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41d40c], eax
mov eax, dword [0x41d40c]
test eax, eax
je 0x4115b1
call eax
test eax, eax
je 0x411598
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41d410]
test eax, eax
je 0x411598
test byte [ebp - 8], 1
jne 0x4115b1
cmp dword [0x41d0e8], 4
jb 0x4115ab
or byte [ebp + 0x12], 0x20
jmp 0x4115d0
xor eax, eax
jmp 0x4115e0
or byte [ebp + 0x12], 4
jmp 0x4115d0
mov eax, dword [0x41d404]
test eax, eax
je 0x4115d0
call eax
mov ebx, eax
test ebx, ebx
je 0x4115d0
mov eax, dword [0x41d408]
test eax, eax
je 0x4115d0
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41d400]
pop edi
pop esi
pop ebx
leave
ret