joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4363d9
Capabilities:
Read file on windows
Terminate process

Disassembly:
push 0x144
mov eax, 0x444b23
call fcn.0041cec6
xor ebx, ebx
push 3
mov dword [ebp - 0x10c], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x43615c
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, 0x2800
push edi
mov dword [ebp - 0x10c], eax
call fcn.0041a320
pop ecx
push ebx
lea ecx, [ebp - 0x114]
push ecx
push edi
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ebx
push eax
jmp 0x43647d
push dword [ebp - 0x114]
lea esi, [ebp - 0x134]
push dword [ebp - 0x118]
call fcn.00419530
push 0xffffffffffffffff
push ebx
mov esi, 0x460008
mov dword [ebp - 4], ebx
call fcn.00407b61
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.0040172c
push ebx
lea eax, [ebp - 0x114]
push eax
push edi
push dword [ebp - 0x118]
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x114], ebx
jne 0x436435
push dword [ebp - 0x118]
call fcn.0041b531
mov dword [esp], 0x7530
push 0xea60
lea eax, [ebp - 0x108]
push eax
call fcn.0043ec32
sub esp, 0x1c
mov dword [ebp - 0x10c], esp
mov edi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10c], esp
push 0x45fbc8
mov dword [ebp - 4], 1
call fcn.004018a5
call fcn.0043e769
add esp, 0x1c
lea edi, [ebp - 0x108]
call fcn.0043e8a3
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x10c], esp
push str._launch_info
call fcn.00401900
mov eax, edi
push eax
call fcn.0043e86d
sub esp, 0x1c
mov dword [ebp - 0x10c], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10c], esp
push 0x460008
call fcn.00401424
mov ecx, esi
call fcn.0043fd9f
add esp, 0x1c
lea eax, [ebp - 0x134]
push eax
mov ecx, edi
call fcn.0043fa38
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.0040172c
lea ecx, [ebp - 0x134]
mov eax, edi
call fcn.0043e71c
cmp dword [eax + 0x14], ebx
je 0x43656f
mov byte [ebp - 0x10d], 1
cmp dword [ebp - 0x6c], ebx
je 0x436575
mov byte [ebp - 0x10d], bl
push ebx
push 1
lea esi, [ebp - 0x134]
call fcn.0040115a
cmp byte [ebp - 0x10d], bl
je 0x436625
sub esp, 0x1c
mov dword [ebp - 0x10c], esp
mov edi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10c], esp
push str.http:__forces.my_pix.ru_get_json_stb4did1326146354ext_partner_idfile_id21617538
call fcn.004018a5
call fcn.0043e769
add esp, 0x1c
lea edi, [ebp - 0x108]
call fcn.0043e8a3
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x10c], esp
push str._launch_info
call fcn.00401900
mov eax, edi
push eax
call fcn.0043e86d
sub esp, 0x1c
mov dword [ebp - 0x10c], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10c], esp
push 0x460008
call fcn.00401424
mov ecx, esi
call fcn.0043fd9f
add esp, 0x1c
lea eax, [ebp - 0x150]
push eax
mov ecx, edi
call fcn.0043fa38
push ebx
push 1
lea ecx, [ebp - 0x150]
call fcn.0040172c
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x43dbc0
Capabilities:
Accept command line arguments
Create pipe
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [0x45e2a0]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea esi, [esp + 0x9c]
call fcn.00401900
push str.watch
mov eax, esi
call fcn.004072a7
pop ecx
test al, al
je 0x43dc06
call fcn.004363d9
mov esi, str.start
push esi
lea eax, [esp + 0x9c]
call fcn.004072a7
pop ecx
test al, al
je 0x43dc22
call fcn.0043bfd6
lea eax, [esp + 0x7c]
push eax
call fcn.0043199c
xor eax, eax
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], 0xc
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00420380
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 0xfffffffffffffff6
stosd dword es:[edi], eax
call ebx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0xc]
push 0xfffffffffffffff4
mov dword [esp + 0x70], eax
call ebx
cmp dword [esp + 0x94], 8
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x70], eax
mov dword [esp + 0x5c], 0x100
jae 0x43dcb6
lea ecx, [esp + 0x80]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x18]
call esi
push dword [esp + 0x14]
call esi
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00420380
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
push 0xfffffffffffffff5
mov dword [esp + 0x6c], eax
call ebx
push 0xfffffffffffffff4
mov dword [esp + 0x70], eax
call ebx
cmp dword [esp + 0x94], 8
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x5c], 0x100
jae 0x43dd3c
lea eax, [esp + 0x80]
lea ecx, [esp + 0x14]
push ecx
xor edi, edi
lea ecx, [esp + 0x34]
push ecx
push edi
push edi
push edi
push 1
push edi
push edi
push str.watch
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x10]
call esi
push dword [esp + 0x18]
call esi
push dword [esp + 0x14]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x43fcc7
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x444081
call fcn.0041cec6
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x1c], esi
jne 0x43fd01
push 0x44d790
call fcn.004018a5
push esi
push 1
lea ecx, [ebp + 8]
call fcn.0040172c
mov eax, edi
jmp 0x43fd99
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004017f3
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
dec eax
lea esi, [ebp - 0x2c]
call fcn.004071e8
xor edi, edi
lea eax, [ebp + 8]
call fcn.00406125
movzx eax, byte [eax]
push ebx
push eax
call fcn.0043fc8e
cmp dword [ebp - 0x3c], ebx
pop ecx
pop ecx
mov dword [ebp - 0x30], ebx
jle 0x43fd74
mov edi, dword [ebp - 0x30]
lea eax, [ebp + 8]
call fcn.00406125
movzx eax, byte [eax]
mov al, byte [eax + 0x467280]
xor al, byte [ebp - 0x30]
lea edi, [ebp - 0x2c]
mov byte [ebp - 0x38], al
push dword [ebp - 0x38]
call fcn.0040724d
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x3c]
jl 0x43fd44
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401424
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040172c
push 0
push ebx
lea ecx, [ebp + 8]
call fcn.0040172c
mov eax, dword [ebp - 0x34]
call fcn.0041cf49
ret

Function at 0x43fd9f
Capabilities:
Encode data using xor

Disassembly:
push 0x2c
mov eax, 0x4440b6
call fcn.0041cec6
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x1c], edi
jne 0x43fdd9
push 0x44d790
call fcn.004018a5
push edi
push 1
lea ecx, [ebp + 8]
call fcn.0040172c
mov eax, esi
jmp 0x43fe80
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004017f3
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
inc eax
lea esi, [ebp - 0x2c]
call fcn.004071e8
call fcn.00430580
mov byte [ebp - 0x30], al
movzx eax, al
push edi
push eax
call fcn.0043fc8e
pop ecx
pop ecx
push dword [ebp - 0x30]
mov edi, esi
call fcn.0040724d
mov esi, dword [ebp - 0x34]
and dword [ebp - 0x30], 0
test esi, esi
jle 0x43fe5b
mov edi, dword [ebp - 0x30]
lea eax, [ebp + 8]
call fcn.00406125
mov cl, byte [ebp - 0x30]
movzx eax, byte [eax]
inc cl
movzx ecx, cl
xor ecx, eax
mov al, byte [ecx + 0x467280]
mov byte [ebp - 0x34], al
push dword [ebp - 0x34]
lea edi, [ebp - 0x2c]
call fcn.0040724d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x43fe27
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401424
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040172c
push 0
push ebx
lea ecx, [ebp + 8]
call fcn.0040172c
mov eax, dword [ebp - 0x38]
call fcn.0041cf49
ret
Function at 0x440d37
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44384f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20c4
call fcn.0042d000
mov eax, dword [0x45e2a0]
xor eax, esp
mov dword [esp + 0x20c0], eax
push ebx
push esi
push edi
mov eax, dword [0x45e2a0]
xor eax, esp
push eax
lea eax, [esp + 0x20d8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0xcc]
push eax
xor ebx, ebx
push 0x1000
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x440db1
push 0x44d238
call fcn.00401900
mov eax, esi
jmp 0x440fb2
xor eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc8], 7
mov dword [esp + 0xc4], ebx
mov word [esp + 0xb4], ax
mov dword [esp + 0x20e0], ebx
cmp word [esp + 0xcc], bx
je 0x440f8e
mov edi, 0x44d404
mov eax, dword [esp + 0x14]
cmp eax, 0x1000
jae 0x440f76
lea eax, [esp + eax*2 + 0xcc]
push eax
lea esi, [esp + 0x98]
call fcn.00401900
mov byte [esp + 0x20e0], 1
mov eax, dword [esp + 0xa8]
cmp eax, ebx
je 0x440f60
cmp dword [esp + 0xac], 8
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax + 1]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x98]
jae 0x440e49
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x440f36
cmp dword [esp + 0xac], 8
mov eax, dword [esp + 0x98]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jae 0x440e79
lea eax, [esp + 0x98]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x440f36
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push dword [esp + 0x20]
push eax
call fcn.00430e0d
mov esi, eax
push edi
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x20f8], 2
call fcn.00403075
push esi
push eax
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x2104], 3
call fcn.00403116
push edi
push eax
lea eax, [esp + 0x6c]
push eax
mov byte [esp + 0x2110], 4
call fcn.00403075
add esp, 0x30
push 0xffffffffffffffff
push ebx
lea esi, [esp + 0xb8]
mov byte [esp + 0x20e8], 5
call fcn.004023f0
push ebx
push 1
lea esi, [esp + 0x48]
call fcn.0040115a
push ebx
push 1
lea esi, [esp + 0x80]
call fcn.0040115a
push ebx
push 1
lea esi, [esp + 0x64]
call fcn.0040115a
push ebx
push 1
lea esi, [esp + 0x2c]
call fcn.0040115a
push ebx
push 1
lea esi, [esp + 0x9c]
mov byte [esp + 0x20e8], bl
call fcn.0040115a
mov eax, dword [esp + 0x14]
cmp word [esp + eax*2 + 0xcc], bx
jne 0x440deb
jmp 0x440f76
push ebx
push 1
lea esi, [esp + 0x9c]
mov byte [esp + 0x20e8], bl
call fcn.0040115a
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x440f8e
dec eax
lea ecx, [esp + 0xb0]
call fcn.00401937
mov esi, dword [esp + 0x18]
lea eax, [esp + 0xb0]
push eax
call fcn.004010aa
push ebx
push 1
lea esi, [esp + 0xb8]
call fcn.0040115a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c0]
xor ecx, esp
call fcn.0041b522
mov esp, ebp
pop ebp
ret
Function at 0x4411af
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
and dword [esp], 0
push esi
push 0x40
pop esi
push esi
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00420380
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x4411f4
mov esi, dword [ebp + 8]
push 0x44d238
call fcn.00401900
mov eax, esi
jmp 0x441205
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.00403289
mov eax, dword [ebp + 8]
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push edi
xor ebp, ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov esi, 1
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x10], eax
je 0x401064
push eax
call fcn.00401f42
mov ecx, dword [esp + 0x14]
add esp, 4
mov ebx, eax
push ebx
push ecx
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401064
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 0x40916c
push ebx
call sub.VERSION.dll_VerQueryValueA
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
push edi
mov dword [esp + 0x18], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x10], eax
je 0x4010b5
push eax
call fcn.00401f42
mov edx, dword [esp + 0x14]
add esp, 4
mov ebp, eax
push ebp
push edx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4010b5
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x40916c
push ebp
call sub.VERSION.dll_VerQueryValueA
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4010e3
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4010e3
mov eax, dword [edi + 8]
mov ecx, dword [edx + 8]
cmp ecx, eax
jne 0x4010dd
mov eax, dword [edi + 0xc]
mov ecx, dword [edx + 0xc]
cmp ecx, eax
jne 0x4010dd
xor esi, esi
jmp 0x4010e3
sbb esi, esi
and esi, 2
dec esi
test ebx, ebx
je 0x4010f0
push ebx
call fcn.0040250d
add esp, 4
test ebp, ebp
je 0x4010fd
push ebp
call fcn.0040250d
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x401110
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push 0x409178
push 0x85
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401198
push ebx
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x401196
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40118e
mov eax, dword [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x40118e
push 0
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x402ca3
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x409298
call fcn.00403768
mov edi, 0x94
mov eax, edi
call fcn.00405cb0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40b900], ecx
mov eax, dword [esi + 4]
mov dword [0x40b90c], eax
mov edx, dword [esi + 8]
mov dword [0x40b910], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40b904], esi
cmp ecx, 2
je 0x402d03
or esi, 0x8000
mov dword [0x40b904], esi
shl eax, 8
add eax, edx
mov dword [0x40b908], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x402d3e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402d3e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x402d56
cmp eax, 0x20b
je 0x402d43
mov dword [ebp - 0x1c], esi
jmp 0x402d6a
cmp dword [ecx + 0x84], 0xe
jbe 0x402d3e
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x402d64
cmp dword [ecx + 0x74], 0xe
jbe 0x402d3e
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00405c5c
pop ecx
test eax, eax
jne 0x402d96
cmp dword [0x40b8ac], 1
jne 0x402d83
call fcn.00405411
push 0x1c
call fcn.00405299
push 0xff
call fcn.004050fe
pop ecx
pop ecx
call fcn.00405bba
mov dword [ebp - 4], esi
call fcn.00405a0f
test eax, eax
jge 0x402daf
push 0x1b
call fcn.00402c7e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40ce94], eax
call fcn.004058ed
mov dword [0x40b8a4], eax
call fcn.0040584b
test eax, eax
jge 0x402dd5
push 8
call fcn.00402c7e
pop ecx
call fcn.00405618
test eax, eax
jge 0x402de6
push 9
call fcn.00402c7e
pop ecx
push 1
call fcn.0040512e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x402dfc
push eax
call fcn.00402c7e
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004055bb
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x402e1d
movzx eax, word [ebp - 0x40]
jmp 0x402e20
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401be0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x402e3e
push edi
call fcn.00405259
call fcn.0040527b
jmp 0x402e70
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004037a3
ret
Function at 0x405198
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40b940], esi
push edi
jne 0x4051b8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40b93c], esi
mov byte [0x40b938], al
jne 0x40521e
mov ecx, dword [0x40ce88]
test ecx, ecx
je 0x4051ff
mov eax, dword [0x40ce84]
sub eax, 4
cmp eax, ecx
jmp 0x4051f8
mov eax, dword [eax]
test eax, eax
je 0x4051ea
call eax
mov eax, dword [0x40ce84]
sub eax, 4
cmp eax, dword [0x40ce88]
mov dword [0x40ce84], eax
jae 0x4051e2
mov eax, 0x40b024
mov esi, 0x40b02c
cmp eax, esi
mov edi, eax
jae 0x40521e
mov eax, dword [edi]
test eax, eax
je 0x405217
call eax
add edi, 4
cmp edi, esi
jb 0x40520f
mov eax, 0x40b030
mov esi, 0x40b038
cmp eax, esi
mov edi, eax
jae 0x40523d
mov eax, dword [edi]
test eax, eax
je 0x405236
call eax
add edi, 4
cmp edi, esi
jb 0x40522e
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x405257
push dword [ebp + 8]
mov dword [0x40b940], 1
call fcn.004050fe
pop ebp
ret

Function at 0x405299
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x40b0e0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40b168]
je 0x4052d0
inc eax
cmp eax, 0x13
jb 0x4052c1
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40b168]
jne 0x4053f3
mov eax, dword [0x40b8ac]
cmp eax, 1
je 0x4053ce
cmp eax, edx
jne 0x405300
cmp dword [0x40b104], 1
je 0x4053ce
cmp ecx, 0xfc
je 0x4053f3
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405336
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.004068a0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00402f20
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40536a
mov eax, edi
push eax
call fcn.00402f20
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x409304
push edi
call fcn.004071f0
add esp, 0x10
push edi
call fcn.00402f20
push dword [esi + 0x40b16c]
mov ebx, eax
call fcn.00402f20
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00405cb0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004068a0
push edi
push ebx
call fcn.004068b0
push 0x409300
push ebx
call fcn.004068b0
push dword [esi + 0x40b16c]
push ebx
call fcn.004068b0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004070ed
add esp, 0x2c
jmp 0x4053f3
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x40b16c]
push dword [esi]
call fcn.00402f20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.004025ce
add ebp, 0x90
leave
ret
Function at 0x4070ed
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40ba68], ebx
push esi
push edi
jne 0x40716d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4071a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x40ba68], eax
je 0x4071a8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40ba6c], eax
call esi
cmp dword [0x40b900], 2
mov dword [0x40ba70], eax
jne 0x40716d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40ba78], eax
je 0x40716d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40ba74], eax
mov eax, dword [0x40ba74]
test eax, eax
je 0x4071b2
call eax
test eax, eax
je 0x407199
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40ba78]
test eax, eax
je 0x407199
test byte [ebp - 8], 1
jne 0x4071b2
cmp dword [0x40b90c], 4
jb 0x4071ac
or byte [ebp + 0x12], 0x20
jmp 0x4071d1
xor eax, eax
jmp 0x4071e1
or byte [ebp + 0x12], 4
jmp 0x4071d1
mov eax, dword [0x40ba6c]
test eax, eax
je 0x4071d1
call eax
mov ebx, eax
test ebx, ebx
je 0x4071d1
mov eax, dword [0x40ba70]
test eax, eax
je 0x4071d1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40ba68]
pop edi
pop esi
pop ebx
leave
ret