joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9174
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b9216
cmp dword [ebx + 0x94], 0
jne 0x4b9210
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b90c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b9210
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b91d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b9210
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00436874
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b91e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b9434
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x573284]
cmp dword [eax + 0x170], 0
je 0x4b9599
test bl, bl
jne 0x4b94e7
cmp dword [esi + 0x9c], 0
jne 0x4b94dc
mov eax, esi
call fcn.004bc324
push eax
push 0x4b9340
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b94ad
mov eax, dword [0x573284]
cmp byte [eax + 0xd3], 0
je 0x4b94ad
mov eax, dword [esi + 0xd8]
call fcn.00408614
mov edi, eax
cmp edi, 0
jl 0x4b94ad
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b9496
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b94dc
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00436874
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b94bc
inc dword [esi + 0x9c]
jmp 0x4b9599
cmp dword [esi + 0x9c], 0
jle 0x4b9599
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b9599
cmp dword [esi + 0x44], 0
je 0x4b9544
mov eax, dword [0x573284]
cmp byte [eax + 0xd3], 0
je 0x4b9544
mov eax, dword [esi + 0xd8]
call fcn.00408614
mov edi, eax
cmp edi, 0
jl 0x4b9544
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b952d
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b9573
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00436874
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b9553
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4ac6bc]
call fcn.004087d4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4ba1e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4ba253
cmp byte [ebx + 0xd3], 0
jne 0x4ba253
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406fb4
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4ba240
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ba260
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406e78
jmp 0x4ba260
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406e78
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4bba88
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4bbaf6
mov eax, esi
call fcn.00493fec
test al, al
je 0x4bbaf6
mov eax, dword [ebx + 0x84]
call fcn.00493c40
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4bbaf6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4bbaea
push 0
mov eax, dword [ebx + 0x84]
call fcn.00493c40
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0048abdc
jmp 0x4bbaf6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004bb8c0
pop esi
pop ebx
ret
Function at 0x4bd350
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40cad4]
call fcn.00407b00
xor eax, eax
push ebp
push 0x4bd49a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x56a068], 0
jne 0x4bd3a4
mov ecx, dword [0x56cd60]
mov dl, 1
mov eax, dword [0x40df44]
call fcn.004190d4
call fcn.004059c8
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.004047f0
mov eax, ebx
call fcn.00406c80
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4bd4a8
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00409c40
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4bd3eb
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4bd440
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4bd439
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.004070d8
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00407070
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.00413208
test eax, eax
jne 0x4bd439
mov ebx, 0x15
jmp 0x4bd445
mov ebx, 0x10
jmp 0x4bd445
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x56a068]
call fcn.004bd1bc
mov eax, dword [ebp - 4]
call fcn.004bd1bc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00409c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd4a1
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00406e70
lea eax, [ebp - 0xc]
mov edx, dword [0x40cad4]
call fcn.00407bd8
ret
Function at 0x4c22b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x4c22cc
add esp, 0xfffffff0
call fcn.00405360
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4c23e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00404240
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x4c23d0
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004bd1bc
xor eax, eax
push ebp
push 0x4c23bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004bd1bc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004070d8
jmp 0x4c238e
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407680
mov eax, dword [ebx + 4]
call fcn.004071e0
dec eax
jle 0x4c23a2
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x4c237c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c23c4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c23ed
lea eax, [ebp - 4]
call fcn.00406ab4
ret
Function at 0x546fdc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x54700a
mov eax, ebx
call fcn.00547a90
cmp dword [ebx + 0x40], 0
je 0x547003
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x54707b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x54706d
cmp dword [ebx + 8], 0
je 0x54702c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x54703e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x54706d
cmp dword [ebx + 8], 0
je 0x54701f
cmp eax, 3
je 0x547051
dec eax
jne 0x54701f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x54701f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x54701f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x547099
cmp dword [ebx + 0x14], 0xcc
je 0x547099
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005470a4
pop ebx
ret
Function at 0x55c874
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x274], ecx
mov esi, edx
lea eax, [ebp - 0x270]
mov edx, dword [0x40dd84]
call fcn.00407b00
xor eax, eax
push ebp
push 0x55c980
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x1ff
lea ecx, [ebp - 0x270]
mov edx, ebx
mov eax, esi
call fcn.004143d4
test eax, eax
jne 0x55c956
mov eax, dword [ebp - 0x260]
mov edx, eax
and edx, ebx
cmp edx, eax
jne 0x55c938
mov eax, dword [ebp - 0x25c]
mov edx, 0x55c99c
call fcn.00407548
je 0x55c938
mov eax, dword [ebp - 0x25c]
mov edx, 0x55c9ac
call fcn.00407548
je 0x55c938
lea edx, [ebp - 0x274]
mov eax, esi
call fcn.0041467c
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 0x25c]
call fcn.00407284
mov edi, dword [ebp - 0x274]
mov dword [ebp - 0x278], edi
mov eax, dword [ebp - 0x278]
call fcn.00406f04
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x270]
call fcn.00414424
test eax, eax
je 0x55c8c5
lea eax, [ebp - 0x270]
call fcn.00414448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c987
lea eax, [ebp - 0x274]
call fcn.00406e68
lea eax, [ebp - 0x270]
mov edx, dword [0x40dd84]
call fcn.00407bd8
ret
Function at 0x4034ac
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x40353c
mov eax, dword [ebp + 8]
push dword [eax + 8]
inc dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
call fcn.004050e4
test eax, eax
pop ecx
pop ecx
je 0x403522
test ebx, ebx
je 0x403513
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.00404fab
test eax, eax
pop ecx
pop ecx
jle 0x403522
push ebx
call fcn.004042ab
pop ecx
lea eax, [ebp - 0x110]
push eax
call fcn.0040428a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4034da
xor edi, edi
cmp ebx, edi
jne 0x403540
xor eax, eax
jmp 0x4035b4
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
push ebx
je 0x403561
call fcn.004042ab
pop ecx
jmp 0x403589
call fcn.004042ab
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403599
cmp dword [ebp - 4], edi
je 0x40353c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40353c
cmp dword [ebp - 4], edi
je 0x4035a7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call fcn.0040428a
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403fd3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push dword [ebp + 0x14]
mov esi, edi
call fcn.00403b22
test al, al
pop ecx
jne 0x404001
push 1
push str.Error:_could_not_find_Java_SE_Runtime_Environment.
call fcn.004032f4
pop ecx
pop ecx
push 2
jmp 0x404091
push edi
call fcn.00403d09
push 0
push str.i386
push edi
call fcn.004028ab
add esp, 0x10
cmp eax, 1
jge 0x40402e
push 1
push str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call fcn.004032f4
pop ecx
pop ecx
push 1
jmp 0x404091
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004021b8
mov ebx, dword [ebp + 0x18]
mov esi, eax
push ebx
push edi
mov dword [ebp - 4], esi
mov byte [ebx], 0
call fcn.00402fe5
add esp, 0x14
test al, al
jne 0x404096
push esi
call fcn.00406fc0
push ebx
mov esi, eax
call fcn.00406fc0
mov edi, str.Error:_no___s_JVM_at___s.
push edi
add esi, eax
call fcn.00406fc0
add esi, eax
push esi
call fcn.00404243
push ebx
push dword [ebp - 4]
mov esi, eax
push edi
push esi
call fcn.0040743d
push 1
push esi
call fcn.004032f4
add esp, 0x28
push 4
call fcn.0040761c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40444a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
push 0x10
pop edi
call fcn.004042b0
push 8
mov esi, eax
call fcn.00404243
mov ebx, eax
pop ecx
lea eax, [ebp - 0x14c]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40449a
mov dword [ebx], eax
lea eax, [ebp - 0x120]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x4044a1
and dword [ebx + 4], 0
jmp 0x4044be
xor eax, eax
jmp 0x40458d
lea eax, [ebp - 0x28c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
neg edi
sbb edi, edi
lea eax, [ebp - 0x260]
and edi, eax
test edi, edi
je 0x404573
push edi
call fcn.00406fc0
cmp eax, 4
pop ecx
jl 0x40448d
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x40448d
add eax, 0xfffffffd
push 0x414e1c
push eax
mov dword [ebp - 4], eax
call fcn.004077d0
test eax, eax
pop ecx
pop ecx
je 0x404504
push 0x414e18
push dword [ebp - 4]
call fcn.004077d0
test eax, eax
pop ecx
pop ecx
jne 0x40448d
push 0x3b
push edi
call fcn.00408040
test eax, eax
pop ecx
pop ecx
jne 0x40448d
push dword [ebp + 8]
call fcn.00406fc0
push edi
mov ebx, eax
call fcn.00406fc0
mov dword [ebp - 4], eax
add eax, ebx
push eax
call fcn.00404243
lea ecx, [ebx - 1]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
call fcn.00407100
mov eax, dword [ebp - 4]
inc eax
push eax
push edi
mov edi, dword [ebp - 0xc]
lea eax, [edi + ebx - 1]
push eax
call fcn.00407100
mov edx, dword [esi + 4]
add esp, 0x24
inc edx
call fcn.00404306
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 8]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x40448d
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.004042ab
push ebx
call fcn.004042ab
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407559
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4153e0
call fcn.0040aea0
push 8
call fcn.0040acf4
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x419ebc], esi
jne 0x40758d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x419eb8], esi
mov al, byte [ebp + 0x10]
mov byte [0x419eb4], al
cmp dword [ebp + 0xc], edi
jne 0x4075d7
cmp dword [0x41b76c], edi
je 0x4075c7
mov eax, dword [0x41b768]
sub eax, 4
mov dword [0x41b768], eax
cmp eax, dword [0x41b76c]
jb 0x4075c7
mov eax, dword [eax]
cmp eax, edi
je 0x4075a8
call eax
jmp 0x4075a8
push 0x418028
mov eax, 0x418020
call fcn.004074d7
pop ecx
push 0x418030
mov eax, 0x41802c
call fcn.004074d7
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x407608
cmp dword [ebp + 0x10], edi
jne 0x407616
mov dword [0x419ebc], esi
push dword [ebp + 8]
call fcn.00407495
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x407615
push 8
call fcn.0040ac3f
pop ecx
ret
call fcn.0040aedb
ret

Function at 0x40853e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40855e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040820c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x408581
test byte [esp + 8], 2
je 0x408581
call fcn.004081fa
mov dword [eax], 0xd
call fcn.00408203
mov dword [eax], 5
jmp 0x40855a
xor eax, eax
ret

Function at 0x40864a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x408667
call fcn.004081fa
mov dword [eax], 0x16
xor eax, eax
jmp 0x4086d1
push esi
push 0x8c
push 1
call fcn.004093b3
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4086bc
push esi
call fcn.0040bdf7
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x40869a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4085b5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4086d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00408e44
test ebx, ebx
pop ecx
je 0x4086ce
push ebx
call fcn.0040820c
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40895c
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4154b8
call fcn.0040aea0
mov edi, 0x94
mov eax, edi
call fcn.0040d5b0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x419e7c], ecx
mov eax, dword [esi + 4]
mov dword [0x419e88], eax
mov edx, dword [esi + 8]
mov dword [0x419e8c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x419e80], esi
cmp ecx, 2
je 0x4089bc
or esi, 0x8000
mov dword [0x419e80], esi
shl eax, 8
add eax, edx
mov dword [0x419e84], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4089f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4089f7
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x408a0f
cmp eax, 0x20b
je 0x4089fc
mov dword [ebp - 0x1c], esi
jmp 0x408a23
cmp dword [ecx + 0x84], 0xe
jbe 0x4089f7
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x408a1d
cmp dword [ecx + 0x74], 0xe
jbe 0x4089f7
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040d551
pop ecx
test eax, eax
jne 0x408a37
push 0x1c
call fcn.00408938
pop ecx
call fcn.0040bff1
test eax, eax
jne 0x408a48
push 0x10
call fcn.00408938
pop ecx
call fcn.0040ae17
mov dword [ebp - 4], esi
call fcn.0040b185
test eax, eax
jge 0x408a61
push 0x1b
call fcn.00408913
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41a740], eax
call fcn.0040d415
mov dword [0x41a058], eax
call fcn.0040423e
test eax, eax
jge 0x408a87
push 8
call fcn.00408913
pop ecx
call fcn.0040d34e
test eax, eax
jge 0x408a98
push 9
call fcn.00408913
pop ecx
push 1
call fcn.004074ef
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x408aae
push eax
call fcn.00408913
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040d2f1
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x408acf
movzx eax, word [ebp - 0x40]
jmp 0x408ad2
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040307d
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x408af0
push edi
call fcn.0040761c
call fcn.0040763e
jmp 0x408b22
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040aedb
ret
Function at 0x40b567
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x419bb0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x40b598
xor eax, eax
jmp 0x40b721
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x41a640]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x40b5d4
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0040f3dd
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40b6af
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x40b6ed
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x40b638
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40b629
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x40b609
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b678
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x40b681
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x40b5fa
jmp 0x40b683
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x40b71c
cmp dword [ebp - 0x6c], edi
je 0x40b6ed
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x40b6e2
call fcn.004081fa
mov dword [eax], 9
call fcn.00408203
mov dword [eax], esi
jmp 0x40b717
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b6d7
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x40b683
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x40b683
push dword [ebp - 0x6c]
call fcn.0040820c
pop ecx
jmp 0x40b717
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40b705
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x40b705
xor eax, eax
jmp 0x40b71f
call fcn.004081fa
mov dword [eax], 0x1c
call fcn.00408203
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x40b71f
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040e953
add ebp, 0x3a0
leave
ret