joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
xor esi, esi
mov dword [ebp - 0xc], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40103a
xor eax, eax
jmp 0x40107a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.ProgramFilesDir
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40106f
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.00405dc3
leave
ret 4

Function at 0x40108a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0xf003f
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, esi
jne 0x401145
push edi
mov edi, 0x200
push edi
lea eax, [ebp - 0x408]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x40112d
lea eax, [ebp - 0x208]
push eax
call fcn.00405de0
lea eax, [ebp - 0x208]
push 0x40b390
push eax
call fcn.00405df0
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00405df0
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0040108a
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x401144
push edi
lea eax, [ebp - 0x408]
push eax
push ebx
push dword [ebp - 8]
call esi
test eax, eax
push dword [ebp + 0xc]
je 0x4010dc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebx, eax
pop edi
cmp dword [ebp - 8], 0
je 0x401154
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
mov eax, ebx
pop ebx
call fcn.00405dc3
leave
ret

Function at 0x4013b9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [ebp + 0xc]
lea edi, [eax + ecx]
mov dword [ebp + 0xc], edi
call esi
cmp eax, edi
jae 0x401413
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
xor ebx, ebx
jmp 0x4013ed
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call edi
test eax, eax
jne 0x4013e3
push 0x12
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
jne 0x40141c
call esi
cmp eax, dword [ebp + 0xc]
jb 0x4013ed
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
inc eax
jmp 0x401415
Function at 0x401428
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov ebx, str.winfile.ini
push ebx
push 0x104
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10c]
push eax
push 0x40b307
mov edi, 0x40b644
push edi
mov esi, str.AddOns
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x10c], 0
je 0x4014b7
push 0
push str.WFS_Frame
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [ebp - 8], eax
je 0x4014b7
push ebx
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor esi, esi
push esi
push esi
push 0x607
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7d0
lea eax, [ebp - 0x10c]
push eax
call fcn.004013b9
test eax, eax
je 0x4014bc
xor eax, eax
inc eax
jmp 0x4014d8
push 0x10
push 0x4189e0
push 0x414
call fcn.00405c5f
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00405dc3
leave
ret

Function at 0x401765
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareNico_Mak_ComputingWinZipWinZip
push 0x80000001
mov dword [ebp - 8], ebx
mov byte [ebp - 0x2c], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4017c3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push str.Quick_Pick_Window_Handle
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4017c3
mov byte [ebp - 0x2c], bl
cmp dword [ebp - 8], ebx
pop ebx
je 0x4017d2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2c]
push eax
call fcn.00405f70
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00405dc3
leave
ret

Function at 0x401f40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x401f6f
push edi
call fcn.004066c7
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x401f73
xor eax, eax
jmp 0x401fb7
push eax
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401fac
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40b390
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401fac
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov dword [esi], ecx
mov eax, dword [eax + 0xc]
xor ebx, ebx
mov dword [esi + 4], eax
inc ebx
push dword [ebp - 4]
call fcn.0040661d
pop ecx
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x4020cc
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
mov edi, 0x2001f
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x4021a0
cmp dword [ebp - 8], ebx
je 0x4021a0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x402163
cmp dword [ebp - 4], ebx
je 0x402163
push 2
push 0x40b74c
push 1
push ebx
mov esi, str.X13D5SY3FG7WZ
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402159
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x402159
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
jmp 0x40219b
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40219b
cmp dword [ebp - 4], ebx
je 0x40219b
push dword [ebp - 4]
call edi
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40219b
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40255e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [ebp + 8]
lea edi, [eax + ecx]
mov dword [ebp + 8], edi
call esi
cmp eax, edi
jae 0x4025c0
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
xor ebx, ebx
jmp 0x402592
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call edi
test eax, eax
jne 0x402588
mov eax, dword [ebp + 0xc]
call fcn.00402020
test eax, eax
je 0x4025b9
mov eax, dword [ebp + 0x10]
call fcn.00402020
test eax, eax
jne 0x4025c7
call esi
cmp eax, dword [ebp + 8]
jb 0x402592
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x4025c2
Function at 0x4034f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
mov eax, dword [0x410528]
je 0x40351d
mov ecx, dword [esp + 4]
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
mov esi, dword [esi*4 + 0x40e1e8]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x403503
pop edi
pop esi
mov dword [0x410528], eax
ret

Function at 0x4038f2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4182ee]
push edi
xor edi, edi
cmp eax, edi
ja 0x403908
mov dword [0x418190], edi
xor eax, eax
pop edi
ret
push esi
mov esi, 0x7000
cmp eax, esi
ja 0x403914
mov esi, eax
push esi
push dword [0x41818c]
push dword [0x418300]
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, esi
mov dword [0x418190], eax
je 0x403935
call fcn.004037e5
push dword [0x418190]
push edi
call fcn.00403561
mov ecx, dword [0x418190]
sub dword [0x4182ee], ecx
cmp dword [0x418194], edi
mov esi, dword [0x41818c]
mov dword [0x418668], esi
je 0x403982
cmp ecx, edi
je 0x403982
mov edi, ecx
call fcn.00404e8f
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00404ea6
inc esi
dec edi
pop ecx
jne 0x403967
mov ecx, dword [0x418190]
mov eax, ecx
dec ecx
pop esi
mov dword [0x418190], ecx
pop edi
ret

Function at 0x404ea6
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [0x418160]
mov eax, ecx
xor eax, dword [esp + 4]
shr ecx, 8
mov edx, 0xff
and eax, edx
mov eax, dword [eax*4 + 0x40e1e8]
xor eax, ecx
mov dword [0x418160], eax
and eax, edx
add eax, dword [0x418164]
xor ecx, ecx
imul eax, eax, 0x8088405
inc eax
mov dword [0x418164], eax
mov cl, byte [0x418167]
mov eax, dword [0x418168]
xor ecx, eax
and ecx, edx
mov ecx, dword [ecx*4 + 0x40e1e8]
shr eax, 8
xor ecx, eax
mov dword [0x418168], ecx
ret

Function at 0x404f3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
push esi
push dword [0x40e1b4]
mov dword [ebp - 4], eax
call fcn.00404f02
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004062e0
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.00404e8f
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.00404ea6
inc esi
cmp esi, 0xc
pop ecx
jl 0x404f6a
cmp dword [0x418180], 0
movzx ax, byte [ebp - 5]
movzx cx, byte [0x4182e7]
pop esi
jne 0x404fa4
movzx cx, byte [0x4182ed]
cmp ax, cx
je 0x404fae
or eax, 0xffffffff
jmp 0x404fb0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00405dc3
leave
ret
Function at 0x40501a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
and byte [ebp - 0x44], 0
and byte [ebp - 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareNico_Mak_ComputingWinZipWinIni
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
push 0x29
pop ebx
mov esi, str.Name
jne 0x4050a9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x44]
push eax
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
call edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x40b918
push dword [ebp - 0xc]
mov dword [ebp - 8], 0xb
call edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x44], 0
je 0x4050a9
cmp byte [ebp - 0x18], 0
jne 0x4050de
push ebx
lea eax, [ebp - 0x44]
push eax
mov ebx, 0x40b307
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov edi, 0x40b644
push edi
call esi
push 0xb
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x40b918
push edi
call esi
cmp byte [ebp - 0x44], 0
je 0x4050e3
cmp byte [ebp - 0x18], 0
je 0x4050e3
xor eax, eax
inc eax
jmp 0x4050e5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00405dc3
leave
ret

Function at 0x4050f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
and byte [ebp - 0x2c], 0
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x20019
xor edi, edi
push edi
push str.SoftwareNico_Mak_ComputingWinZipWinIni
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, str.win32_version
jne 0x405166
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push edi
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x2c], 0
je 0x405166
cmp byte [ebp - 0x2c], 0x52
jne 0x405166
xor eax, eax
inc eax
jmp 0x4051aa
push ebx
push 0x20
lea eax, [ebp - 0x2c]
push eax
mov ebx, 0x40b307
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov edi, 0x40b644
push edi
call esi
cmp byte [ebp - 0x2c], 0
je 0x40518c
xor eax, eax
jmp 0x4051a2
push 0x20
lea eax, [ebp - 0x2c]
push eax
push ebx
push str.version
push edi
call esi
xor eax, eax
cmp byte [ebp - 0x2c], al
je 0x4051a9
cmp byte [ebp - 0x2c], 0x52
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.00405dc3
leave
ret
Function at 0x4056da
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
push esi
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00405de0
lea eax, [ebp - 0x108]
push eax
call fcn.00406250
mov byte [ebp + eax - 0x109], 0x5f
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004055b5
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
add esp, 0x28
test esi, esi
je 0x405793
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40578f
lea eax, [ebp - 0x20c]
push eax
push 0x10
push 0x3fa
push dword [0x418a0c]
xor esi, esi
call fcn.00401993
add esp, 0x10
test esi, esi
jne 0x4057a0
lea eax, [ebp - 0x108]
push eax
call edi
xor eax, eax
jmp 0x4057a3
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.00405dc3
leave
ret

Function at 0x4057b2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
cmp byte [0x41052c], 0
push esi
mov dword [ebp - 4], eax
push edi
jne 0x405804
xor eax, eax
push 8
xor esi, esi
lea ecx, [eax + eax]
pop edi
sar ecx, 1
mov edx, esi
xor edx, ecx
shr esi, 1
test dl, 1
je 0x4057eb
xor esi, 0xedb88320
dec edi
jne 0x4057d8
mov dword [eax*4 + 0x410128], esi
inc eax
cmp eax, 0x100
jl 0x4057d0
mov byte [0x41052c], 1
or dword [0x410528], 0xffffffff
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405821
xor eax, eax
jmp 0x405872
push ebx
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
je 0x40585c
mov ecx, dword [0x410528]
lea edx, [ebp - 0x44]
movzx edi, byte [edx]
movzx ebx, cl
xor edi, ebx
mov edi, dword [edi*4 + 0x410128]
shr ecx, 8
xor ecx, edi
inc edx
dec eax
jne 0x40583c
mov dword [0x410528], ecx
jmp 0x405822
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
or eax, 0xffffffff
sub eax, dword [0x410528]
pop ebx
mov dword [0x410528], eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.00405dc3
leave
ret
Function at 0x406c6a
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40be20
call fcn.00407094
mov edi, 0x94
mov eax, edi
call fcn.00409770
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x410b9c], ecx
mov eax, dword [esi + 4]
mov dword [0x410ba8], eax
mov edx, dword [esi + 8]
mov dword [0x410bac], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x410ba0], esi
cmp ecx, 2
je 0x406cca
or esi, 0x8000
mov dword [0x410ba0], esi
shl eax, 8
add eax, edx
mov dword [0x410ba4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406d05
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406d05
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406d1d
cmp eax, 0x20b
je 0x406d0a
mov dword [ebp - 0x1c], esi
jmp 0x406d31
cmp dword [ecx + 0x84], 0xe
jbe 0x406d05
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x406d2b
cmp dword [ecx + 0x74], 0xe
jbe 0x406d05
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0040721e
pop ecx
test eax, eax
jne 0x406d5d
cmp dword [0x410b54], 1
jne 0x406d4a
call fcn.004093af
push 0x1c
call fcn.00409238
push 0xff
call fcn.00408c75
pop ecx
pop ecx
call fcn.004096e4
mov dword [ebp - 4], esi
call fcn.004089f7
test eax, eax
jge 0x406d76
push 0x1b
call fcn.00406c45
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x418fc4], eax
call fcn.004095c2
mov dword [0x410b4c], eax
call fcn.00401b33
test eax, eax
jge 0x406d9c
push 8
call fcn.00406c45
pop ecx
call fcn.00401b33
test eax, eax
jge 0x406dad
push 9
call fcn.00406c45
pop ecx
call fcn.00408ca5
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x406dc0
push eax
call fcn.00406c45
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00409559
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x406de1
movzx eax, word [ebp - 0x34]
jmp 0x406de4
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00402db1
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x406e02
push edi
call fcn.00408dcc
call fcn.00408dee
jmp 0x406e34
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004070cf
ret
Function at 0x408d0a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x410bdc], esi
push edi
jne 0x408d2a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x410bd8], esi
mov byte [0x410bd4], al
jne 0x408d90
mov ecx, dword [0x418e84]
test ecx, ecx
je 0x408d71
mov eax, dword [0x418e80]
sub eax, 4
cmp eax, ecx
jmp 0x408d6a
mov eax, dword [eax]
test eax, eax
je 0x408d5c
call eax
mov eax, dword [0x418e80]
sub eax, 4
cmp eax, dword [0x418e84]
mov dword [0x418e80], eax
jae 0x408d54
mov eax, 0x40e020
mov esi, 0x40e028
cmp eax, esi
mov edi, eax
jae 0x408d90
mov eax, dword [edi]
test eax, eax
je 0x408d89
call eax
add edi, 4
cmp edi, esi
jb 0x408d81
mov eax, 0x40e02c
mov esi, 0x40e030
cmp eax, esi
mov edi, eax
jae 0x408daf
mov eax, dword [edi]
test eax, eax
je 0x408da8
call eax
add edi, 4
cmp edi, esi
jb 0x408da0
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x408dca
push dword [ebp + 8]
mov dword [0x410bdc], 1
call fcn.00408c75
pop ecx
pop ebp
ret
Function at 0x408fa6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x40f644]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x418e90]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
jae 0x409136
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x418ea0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x18], ebx
je 0x409136
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
jne 0x409005
xor eax, eax
jmp 0x40914a
test al, 0x20
je 0x409016
push 2
push edi
push edi
push ecx
call fcn.0040ac34
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4090d2
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jbe 0x40910a
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
cmp ecx, dword [ebp + 0x10]
jae 0x40906c
mov edx, dword [ebp - 8]
inc dword [ebp - 8]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40905d
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x18]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x409042
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4090ac
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
cmp eax, edi
jl 0x4090b5
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x409036
jmp 0x4090b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x409131
cmp dword [ebp + 8], edi
je 0x40910a
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x4090ff
mov dword [0x410b94], eax
jmp 0x40913d
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4090f4
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jmp 0x4090b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x4090b7
push dword [ebp + 8]
call fcn.004070e0
pop ecx
jmp 0x409147
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40911f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x408ffe
mov dword [0x410b90], 0x1c
mov dword [0x410b94], edi
jmp 0x409147
sub eax, dword [ebp - 0x14]
jmp 0x40914a
and dword [0x410b94], 0
mov dword [0x410b90], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00405dc3
leave
ret