joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ca0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push 0x1000
push 0
push dword [0x42d9f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 8], edx
test edx, edx
je 0x415e5f
mov ax, word [esp + 0x1c]
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x18], 0x7ff
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x415cf9
test ecx, ecx
je 0x415dbc
dec ecx
mov dword [esp + 0x30], ecx
cmp dword [ebx + 4], 0
lea ebp, [ebx + 4]
je 0x415d15
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.004160e0
mov dword [esp + 0x10], eax
jmp 0x415d2f
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, 2
mov ax, word [esp + 0x28]
jne 0x415dbf
test ax, ax
je 0x415d4d
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, edi
mov ecx, dword [esp + 0x18]
sub esi, edx
sar esi, 1
cmp esi, ecx
jle 0x415d94
mov eax, dword [esp + 0x1c]
add ecx, 0x800
add eax, 0x1000
mov dword [esp + 0x18], ecx
push eax
push edx
push 8
push dword [0x42d9f8]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
mov ax, word [esp + 0x28]
mov dword [esp + 0x14], edx
lea edi, [edx + esi*2]
test ax, ax
je 0x415dbf
cmp dword [esp + 0x2c], 0
jne 0x415ce3
cmp ax, 0xd
je 0x415dc6
cmp ax, 0xa
jne 0x415ce3
sub edi, 2
jmp 0x415e3e
lea ebp, [ebx + 4]
cmp dword [esp + 0x2c], 0
jne 0x415e3e
cmp ax, 0xa
jne 0x415dd1
sub edi, 2
jmp 0x415e3e
cmp ax, 0xd
jne 0x415e3e
sub edi, 2
cmp dword [ebp], 0
je 0x415df3
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.004160e0
mov dword [esp + 0x10], eax
jmp 0x415e09
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x28], 0xa
je 0x415e3e
cmp dword [ebp], 0
je 0x415e1d
add dword [ebx + 0xc], 2
jmp 0x415e3e
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, dword [esp + 0x14]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x415e70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x42d9f8]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x415fc0
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x415ebc
test edi, edi
je 0x415f2d
dec edi
push esi
push ebp
call fcn.00416210
mov dword [esp + 0x20], eax
test eax, eax
jne 0x415ecf
xor cl, cl
jmp 0x415ed1
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x415f14
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x42d9f8]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x415f2d
test eax, eax
jne 0x415eb2
cmp cl, 0xd
je 0x415f31
cmp cl, 0xa
jne 0x415eb2
dec esi
jmp 0x415fa3
test eax, eax
jne 0x415fa3
cmp cl, 0xa
jne 0x415f39
dec esi
jmp 0x415fa3
cmp cl, 0xd
jne 0x415fa3
dec esi
cmp dword [ebp + 4], 0
je 0x415f58
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004160e0
mov dword [esp + 0x20], eax
jmp 0x415f6f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x415fa3
cmp dword [ebp + 4], 0
je 0x415f81
inc dword [ebp + 0xc]
jmp 0x415fa3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x415fd0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4160cf
cmp word [edx], 0
je 0x4160cf
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x415ffe
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x416054
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416010
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x416036
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00416310
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.00416430
mov edi, eax
test edi, edi
je 0x41604a
cmp dword [esi + 4], 0
je 0x4160a2
push dword [esp + 0x14]
push edi
push esi
call fcn.00416310
push edi
push 0
push dword [0x42d9f8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x42d9f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x4160e0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0
jne 0x416102
push ebx
call fcn.004157d0
mov dword [ebx + 0x14], 1
mov dword [ebx + 0xc], 0
mov ebp, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x1c]
sub ecx, ebp
add ecx, dword [ebx + 0x10]
cmp ebp, esi
jl 0x41617e
mov eax, esi
sub eax, 1
je 0x41616a
sub eax, 1
je 0x416154
sub eax, 2
je 0x416140
push esi
push ecx
push dword [esp + 0x20]
call fcn.00413270
add esp, 0xc
mov eax, esi
sub dword [ebx + 0xc], esi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx]
pop edi
mov dword [eax], ecx
mov eax, esi
sub dword [ebx + 0xc], esi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov cx, word [ecx]
pop edi
mov word [eax], cx
mov eax, esi
sub dword [ebx + 0xc], esi
pop esi
pop ebp
pop ebx
ret 0xc
mov dl, byte [ecx]
mov eax, esi
mov ecx, dword [esp + 0x18]
pop edi
mov byte [ecx], dl
sub dword [ebx + 0xc], esi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
push ebp
push ecx
push eax
call fcn.00413270
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [ebx + 8]
add eax, ebp
mov ecx, dword [ebx]
sub esi, ebp
mov dword [esp + 0x18], eax
push 0
cmp esi, edx
jl 0x4161c6
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
add eax, ebp
mov dword [ebx + 0xc], 0
pop ebp
pop ebx
ret 0xc
lea eax, [esp + 0x18]
push eax
push edx
push dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
cmp esi, eax
jle 0x4161e6
mov esi, eax
mov eax, dword [esp + 0x18]
push esi
push dword [ebx + 4]
push eax
call fcn.00413270
sub dword [ebx + 0xc], esi
lea eax, [esi + ebp]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x416210
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 4], 0
je 0x416237
push 1
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004160e0
mov dword [esp + 4], eax
jmp 0x416251
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x416308
mov cl, byte [esp + 0xc]
test cl, cl
js 0x416276
mov eax, dword [esp + 0x10]
pop esi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push edi
cmp al, 0xc0
jne 0x416286
mov edi, 2
jmp 0x4162a2
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x416295
mov edi, 3
jmp 0x4162a2
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x4162f4
mov edi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [edi - 1]
mov byte [eax], cl
inc eax
cmp dword [esi + 4], 0
je 0x4162ce
push ebx
push eax
push esi
call fcn.004160e0
mov ecx, eax
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x416310
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x416427
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x41635d
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x4163e6
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x4163cf
sub eax, 1
je 0x4163b6
sub eax, 2
je 0x41639f
push esi
push dword [esp + 0x24]
push ecx
call fcn.00413270
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.004157d0
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x416415
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x416387
xor eax, eax
pop edi
add esp, 8
ret 0xc

Function at 0x4178c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4178ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4178ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x7003567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x7003576
pop dword [ebp - 0x24]
mov eax, 0xec9b1ef2
add eax, 0x1a651684
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xb7665218
add dword [ebp - 0x34], 0x96ebf333
mov dword [ebp - 0x30], 0x694a865a
sub dword [ebp - 0x30], 0x37173a15
mov dword [ebp - 0x2c], 0xb037fbe4
sub dword [ebp - 0x2c], 0x63ebb7b6
mov dword [ebp - 0x28], 0xfb87c30f
sub dword [ebp - 0x28], 0xfb87c30f
lea eax, [ebp - 0x34]
push eax
mov eax, 0x8345558b
sub eax, 0x7c44255b
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x409c8e6f
add dword [ebp - 0x34], 0x33d5dae7
mov dword [ebp - 0x30], 0xd7531fe1
add dword [ebp - 0x30], 0x6a194194
mov dword [ebp - 0x2c], 0xedc1e284
add dword [ebp - 0x2c], 0x75ad89e8
mov dword [ebp - 0x28], 0x39cb970
add dword [ebp - 0x28], 0xfc634690
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x49634e2
add eax, 0x26afb52
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3e62f
push 0
call eax
mov ecx, 0x56c2
mov esi, eax
mov edi, 0x4b86c0f7
sub edi, 0x4484bef7
add edi, dword [ebp - 0x24]
mov edx, 0xcfef29c6
add edx, 0x54b550a
xor dword [ebp - 0x18], ebx
mov ebx, dword [edi]
add ebx, edx
xor dword [ebp - 0xc], 0xa647f5ad
mov dword [esi], ebx
sub dword [ebp - 0x20], 0x1363dfba
add esi, 4
add edi, 0x914559a2
sub edi, 0x9145599e
loop 0x7003692
add eax, 0x2eb2109e
sub eax, 0x2eb0c2c3
xor ebx, ebx
add ebx, eax
add eax, 0xee19cbca
sub eax, 0xee19cbc5
mov ecx, 0x7000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003567
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003567
int3
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x447004]
jne 0x40100a
repz ret
jmp fcn.00401368

Function at 0x40425b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403568
and dword [ebp - 0x14], 0
cmp dword [0x449940], 0
mov dword [ebp - 0x18], eax
jne 0x40430e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4043b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4043b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x449940], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x449944], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x449948], eax
call edi
push eax
call esi
mov dword [0x449950], eax
test eax, eax
je 0x40430e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44994c], eax
mov eax, dword [0x44994c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404367
cmp dword [0x449950], ecx
je 0x404367
push eax
call esi
push dword [0x449950]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404367
test ebx, ebx
je 0x404367
call edi
test eax, eax
je 0x40435e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40435e
test byte [ebp - 8], 1
jne 0x404367
or dword [ebp + 0x10], 0x200000
jmp 0x40439a
mov eax, dword [0x449944]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40439a
mov eax, dword [0x449948]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x449940]
call esi
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4043b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x443a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1f1bde4]
mov eax, dword [0x1f1bb08]
xor ecx, ecx
mov word [0x1f1be00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1f1bdec], 0x6e0072
mov dword [0x1f1bdf0], 0x6c0065
mov dword [0x1f1bdf4], 0x320033
mov dword [0x1f1bdf8], 0x64002e
mov dword [0x1f1bdfc], 0x6c006c
mov dword [0x1f1bde8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x443bf0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp edi, 0x182
jne 0x443c1d
lea eax, [ebp - 0x820]
push eax
push str.wosevir
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push esi
xor esi, esi
test edi, edi
jle 0x443c64
cmp edi, 0x2d
jne 0x443c31
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call fcn.00443b30
xor byte [ebx + esi], al
cmp edi, 0xf
jne 0x443c5f
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
inc esi
cmp esi, edi
jl 0x443c24
pop esi
cmp edi, 0x2d
jne 0x443c7e
mov dword [0x1f1c170], 0xa62e7790
mov dword [0x1f1c174], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x443c90
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x447dc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1f1bb08]
push edi
mov edi, dword [0x1f1bde4]
push eax
call fcn.00443ba0
add esp, 4
cmp dword [0x1f1bde4], 0x2f
jne 0x443ced
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00443bf0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4028d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4033e8
push 0x402a40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4040c4], 0xffffffff
or dword [0x4040c8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4040c0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4040bc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4040cc], eax
call fcn.00402a37
cmp dword [0x4040a0], 0
jne 0x402953
push 0x402a34
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00402a22
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4040b8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4040b4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00402560
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x64503450
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x645034d0
test ebx, ebx
je 0x645034d0
mov dword [ebx], 0
mov edi, dword fs:[0x18]
mov dword [esp + 8], 0x140
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x64503520
mov dword [eax], fcn.64501d30
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.64501d30
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x645034f8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x2c5
mov dword [esp + 4], str..._dlls_avifil32_acmstream.c
mov dword [esp], 0x64526183
call dword [sym.imp.ucrtbase.dll__assert]
jmp 0x64503467
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x80044067
jmp 0x645034c2