joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4222bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00417a80
and dword [ebp - 4], 0
cmp dword [0x435abc], 0
mov ebx, eax
jne 0x422370
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422421
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422421
push eax
call fcn.00417a0e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435abc], eax
call esi
push eax
call fcn.00417a0e
mov dword [esp], 0x42a684
push edi
mov dword [0x435ac0], eax
call esi
push eax
call fcn.00417a0e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435ac4], eax
call esi
push eax
call fcn.00417a0e
pop ecx
mov dword [0x435acc], eax
test eax, eax
je 0x422370
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00417a0e
pop ecx
mov dword [0x435ac8], eax
mov eax, dword [0x435ac8]
cmp eax, ebx
je 0x4223c8
cmp dword [0x435acc], ebx
je 0x4223c8
push eax
call fcn.00417a89
push dword [0x435acc]
mov esi, eax
call fcn.00417a89
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4223c8
test edi, edi
je 0x4223c8
call esi
test eax, eax
je 0x4223bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4223bf
test byte [ebp - 0xc], 1
jne 0x4223c8
or dword [ebp + 0x10], 0x200000
jmp 0x422401
mov eax, dword [0x435ac0]
cmp eax, ebx
je 0x422401
push eax
call fcn.00417a89
pop ecx
test eax, eax
je 0x422401
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422401
mov eax, dword [0x435ac4]
cmp eax, ebx
je 0x422401
push eax
call fcn.00417a89
pop ecx
test eax, eax
je 0x422401
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435abc]
call fcn.00417a89
pop ecx
test eax, eax
je 0x422421
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422423
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x406a48
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
pop ebp
ret 0x1c

Function at 0x4072f8
Capabilities:
Create thread

Disassembly:
mov eax, 0x4189e2
call fcn.004174ac
sub esp, 0xd0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x74]
lea eax, [ecx + eax*8]
push edi
push dword [eax + 4]
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, dword [eax]
call fcn.00406b5d
and dword [ebp - 4], 0
add esi, 0x6c
lea edi, [ebp - 0xdc]
mov dword [ebp - 0x10], esi
call fcn.0040799c
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ebx, dword [ecx + eax*4 - 4]
call fcn.00406cb4
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xb4]
mov edi, esi
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov ecx, dword [edx + ecx*4 - 4]
mov dword [ecx + 4], eax
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
mov eax, dword [eax + 8]
push dword [eax]
lea esi, [ebx + 0x9c]
call fcn.0040234e
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax*4 - 4]
lea ecx, [ebp - 0x14]
push ecx
xor esi, esi
push esi
push eax
push 0x407053
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
jne 0x4073b6
push 0x41bd98
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0x425d0
call fcn.004174cb
push eax
lea esi, [ebx + 0x80]
call fcn.0040234e
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xdc]
push eax
call fcn.00406d22
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x409c65
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, dword [esp + 8]
mov eax, dword [eax]
push edi
jmp 0x409c89
test esi, esi
jbe 0x409c8e
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x421090]
dec esi
inc ecx
test cl, 3
jne 0x409c71
cmp esi, 4
jb 0x409cd7
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
sub esi, 4
movzx edi, al
shr eax, 8
xor eax, dword [edi*4 + 0x421090]
add ecx, 4
movzx edi, al
shr eax, 8
xor eax, dword [edi*4 + 0x421090]
movzx edi, al
shr eax, 8
xor eax, dword [edi*4 + 0x421090]
movzx edi, al
shr eax, 8
xor eax, dword [edi*4 + 0x421090]
dec edx
jne 0x409c98
xor edx, edx
test esi, esi
jbe 0x409cf7
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x421090]
inc edx
cmp edx, esi
jb 0x409cde
pop ebx
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], eax
pop esi
ret 4

Function at 0x40a99e
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x40add9
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40aded
xor al, al
jmp 0x40adfd
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret 4

Function at 0x40af06
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov eax, 0x4189c1
call fcn.004174ac
sub esp, 0x6c
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
call fcn.00409f47
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x5c
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0040b7e8
push 0x2a
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040b7e8
lea ecx, [ebp - 0x38]
push ecx
mov edi, eax
mov byte [ebp - 4], 2
call fcn.0040aa00
mov byte [ebp - 4], 4
push dword [ebp - 0x24]
call fcn.00411f3d
pop ecx
jmp 0x40af7f
lea eax, [ebp - 0x78]
push eax
sub esp, 0xc
lea edi, [ebp - 0x18]
mov eax, esp
mov dword [ebp + 8], esp
call fcn.00409f60
call fcn.0040ae8b
test al, al
je 0x40afe6
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040bc89
test al, al
jne 0x40af62
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.0040aff7
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40aff3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne bl
mov byte [ebp - 4], 0
push dword [ebp - 0x18]
call fcn.00411f3d
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x48]
call fcn.00411f3d
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret 4
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.0040aff7
xor bl, bl
jmp 0x40afb9

Function at 0x40b50d
Capabilities:
Delete file

Disassembly:
mov eax, 0x418995
call fcn.004174ac
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 0x1c], bl
call fcn.00409f47
jmp 0x40b582
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40b5bd
push dword [edi]
call fcn.0040bc22
test al, al
jne 0x40b562
push dword [edi]
call fcn.0040ab83
test al, al
jne 0x40b5d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b596
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x1c]
call fcn.0040b4ee
push dword [ebp - 0x18]
call fcn.00411f3d
pop ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 0x1c], bl
call fcn.00409f47
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], ebx
call fcn.0040b46e
test al, al
jne 0x40b52b
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x1c]
call fcn.0040b4ee
push dword [ebp - 0x18]
call fcn.00411f3d
xor al, al
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x1c]
call fcn.0040b4ee
push dword [ebp - 0x18]
call fcn.00411f3d
mov al, bl
jmp 0x40b5ac
mov bl, 1
jmp 0x40b5bd
Function at 0x40b96a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4184f2
call fcn.004174ac
sub esp, 0x18
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edi
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
push 1
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
push 0
push 0
mov dword [esi + 0x18], eax
push dword [ebx + 0x1c]
call fcn.00416e80
mov ecx, dword [ebx + 0x20]
xor edi, edi
add eax, ecx
mov dword [esi + 0x20], eax
lea eax, [ebx + 0x2c]
adc edx, edi
push eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x24], edx
call fcn.0040b5f5
and dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040b86a
mov edi, eax
lea eax, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0040992e
mov byte [ebp - 4], 0
push dword [ebp - 0x24]
call fcn.00411f3d
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call fcn.00411f3d
mov eax, dword [ebx + 0x24]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x40bde9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40be12
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40be12
xor al, al
jmp 0x40be2d
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.00416e80
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
pop ebp
ret 4

Function at 0x40ec38
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x40fa35
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0040ef80
xor eax, eax
mov cl, byte [edi + eax + 0x108]
xor byte [eax + esi], cl
inc eax
cmp eax, 0x10
jl 0x40fa43
xor eax, eax
pop esi
mov cl, byte [eax + ebx]
mov byte [edi + eax + 0x108], cl
inc eax
cmp eax, 0x10
jl 0x40fa56
ret

Function at 0x410a47
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x41853a
call fcn.004174ac
sub esp, 0xc
mov al, byte [ebx + 0x104]
push esi
push 0
lea esi, [ebx + 0x68]
mov byte [ebx + 0x70], al
call fcn.0041095a
push 0x45
lea eax, [ebp - 0x18]
push eax
call fcn.0040c264
and dword [ebp - 4], 0
mov eax, dword [eax]
lea esi, [ebx + 0x6c]
mov ecx, eax
call fcn.0040c3d3
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call fcn.00411f3d
pop ecx
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x411491
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00414310
push esi
push edi
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1008]
rep stosd dword es:[edi], eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret

Function at 0x411512
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00414310
push ebx
push edi
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x2008]
rep stosd dword es:[edi], eax
push 0x1000
lea eax, [ebp - 0x2008]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1008]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1008]
push str.Applications_
push eax
call fcn.00412930
lea eax, [ebp - 0x2008]
push 0x5c
push eax
call fcn.00412a30
inc eax
push eax
lea eax, [ebp - 0x1008]
push eax
call fcn.00412940
add esp, 0x18
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1008]
push eax
push SysReAllocString
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 1
lea eax, [ebp - 1]
push eax
push 1
push ebx
push str.IsHostApp
push dword [ebp - 8]
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret
Function at 0x412b20
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x41a2b8
call fcn.00412eec
mov edi, 0x94
mov eax, edi
call fcn.00414310
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x420d44], ecx
mov eax, dword [esi + 4]
mov dword [0x420d50], eax
mov edx, dword [esi + 8]
mov dword [0x420d54], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x420d48], esi
cmp ecx, 2
je 0x412b80
or esi, 0x8000
mov dword [0x420d48], esi
shl eax, 8
add eax, edx
mov dword [0x420d4c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x412bbb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412bbb
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x412bd3
cmp eax, 0x20b
je 0x412bc0
mov dword [ebp - 0x1c], esi
jmp 0x412be7
cmp dword [ecx + 0x84], 0xe
jbe 0x412bbb
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x412be1
cmp dword [ecx + 0x74], 0xe
jbe 0x412bbb
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004142b8
pop ecx
test eax, eax
jne 0x412bfb
push 0x1c
call fcn.00412afc
pop ecx
call fcn.004141af
test eax, eax
jne 0x412c0c
push 0x10
call fcn.00412afc
pop ecx
call fcn.00413f49
mov dword [ebp - 4], esi
call fcn.00413d4b
test eax, eax
jge 0x412c25
push 0x1b
call fcn.00412ad7
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x421974], eax
call fcn.00413c29
mov dword [0x420be0], eax
call fcn.00413b87
test eax, eax
jge 0x412c4b
push 8
call fcn.00412ad7
pop ecx
call fcn.00413954
test eax, eax
jge 0x412c5c
push 9
call fcn.00412ad7
pop ecx
push 1
call fcn.004133ff
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x412c72
push eax
call fcn.00412ad7
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004138f7
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x412c93
movzx eax, word [ebp - 0x40]
jmp 0x412c96
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004115ce
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x412cb4
push edi
call fcn.0041352c
call fcn.0041354e
jmp 0x412ce6
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00412f27
ret
Function at 0x413469
Capabilities:
Terminate process

Disassembly:
push 8
push 0x41a340
call fcn.00412eec
push 8
call fcn.00412eb9
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x420d84], esi
jne 0x41349d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x420d80], esi
mov al, byte [ebp + 0x10]
mov byte [0x420d7c], al
cmp dword [ebp + 0xc], edi
jne 0x4134e7
cmp dword [0x421968], edi
je 0x4134d7
mov eax, dword [0x421964]
sub eax, 4
mov dword [0x421964], eax
cmp eax, dword [0x421968]
jb 0x4134d7
mov eax, dword [eax]
cmp eax, edi
je 0x4134b8
call eax
jmp 0x4134b8
push 0x42008c
mov eax, 0x420088
call fcn.004133e7
pop ecx
push 0x420098
mov eax, 0x420090
call fcn.004133e7
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x413518
cmp dword [ebp + 0x10], edi
jne 0x413526
mov dword [0x420d84], esi
push dword [ebp + 8]
call fcn.004133a5
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x413525
push 8
call fcn.00412e04
pop ecx
ret
call fcn.00412f27
ret

Function at 0x4135e2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4204d0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4201f8]
je 0x413619
inc eax
cmp eax, 0x13
jb 0x41360a
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4201f8]
jne 0x41373c
mov eax, dword [0x420be8]
cmp eax, 1
je 0x413717
cmp eax, edx
jne 0x413649
cmp dword [0x4200c4], 1
je 0x413717
cmp ecx, 0xfc
je 0x41373c
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41367f
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.00412930
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00415490
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4136b3
mov eax, edi
push eax
call fcn.00415490
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x41a748
push edi
call fcn.00415360
add esp, 0x10
push edi
call fcn.00415490
push dword [esi + 0x4201fc]
mov ebx, eax
call fcn.00415490
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00414310
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00412930
push edi
push ebx
call fcn.00412940
push 0x41a728
push ebx
call fcn.00412940
push dword [esi + 0x4201fc]
push ebx
call fcn.00412940
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0041525e
add esp, 0x2c
jmp 0x41373c
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x4201fc]
push dword [esi]
call fcn.00415490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.0041554c
add ebp, 0x90
leave
ret
Function at 0x415002
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x415030
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x415037
cmp ebx, dword [eax + 4]
jae 0x415037
xor eax, eax
jmp 0x415227
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x415048
xor eax, eax
inc eax
jmp 0x415226
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x41505e
cmp ecx, edx
jae 0x4151a3
cmp dword [eax + 4], 0
je 0x415067
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x41504f
cmp dword [ebp + 8], 0
je 0x415089
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4151a3
cmp eax, esi
jae 0x4151a3
mov eax, dword [0x420eb0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4150ae
cmp dword [esi*4 + 0x420eb8], edi
je 0x4151a7
inc esi
cmp esi, eax
jl 0x41509c
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x415223
cmp dword [ebp - 8], 0x1000000
jne 0x415223
test byte [ebp - 0xc], 0xcc
je 0x41512c
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x415223
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x415223
cmp word [eax + 0x18], 0x10b
jne 0x415223
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x415223
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x41512c
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x41512c
test byte [ecx + 0x27], 0x80
jne 0x4151a3
push 1
push 0x420ef8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x415040
mov ecx, dword [0x420eb0]
test ecx, ecx
mov edx, ecx
jle 0x415160
lea eax, [ecx*4 + 0x420eb4]
cmp dword [eax], edi
je 0x415160
dec edx
sub eax, 4
test edx, edx
jg 0x415154
test edx, edx
jne 0x415191
push 0xf
pop ebx
cmp ecx, ebx
jg 0x41516d
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x415185
lea eax, [edx*4 + 0x420eb8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x415173
cmp ecx, 0x10
jge 0x415191
inc ecx
mov dword [0x420eb0], ecx
push 0
push 0x420ef8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x415040
xor eax, eax
jmp 0x415226
test esi, esi
jle 0x415040
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x420ef8
call ebx
test eax, eax
jne 0x415040
cmp dword [esi*4 + 0x420eb8], edi
je 0x4151fd
mov eax, dword [0x420eb0]
lea esi, [eax - 1]
test esi, esi
jl 0x4151eb
cmp dword [esi*4 + 0x420eb8], edi
je 0x4151e7
dec esi
jns 0x4151db
test esi, esi
jge 0x4151fb
cmp eax, 0x10
jge 0x4151f6
inc eax
mov dword [0x420eb0], eax
lea esi, [eax - 1]
jmp 0x4151fd
je 0x415215
xor ecx, ecx
test esi, esi
jl 0x415215
lea eax, [ecx*4 + 0x420eb8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x415203
push 0
push 0x420ef8
call ebx
jmp 0x415040
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret