joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3e2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00425181
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4e3e68
call fcn.004e404e
mov dword [esi + 0xc], 1
jmp 0x4e3e6d
call fcn.004e404e
cmp dword [esi], 0
je 0x4e3eb6
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4e3e90
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004202cc
jmp 0x4e3ea1
push 0xff
mov ecx, esi
call fcn.0041079a
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041c35c
jmp 0x4e3eda
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4e3eda
push dword [esi]
push dword [ebp - 4]
call fcn.00428d0a
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e3fa3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004e404e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4e3feb
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004202cc
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041c35c
jmp 0x4e3ff6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00428d0a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x56ee0d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056ead0

Function at 0x56ee18
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056ec51

Function at 0x5705d3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00570293
Function at 0x5779e6
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x58c066
call fcn.00552eab
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x577b03
cmp byte [ebx + 0x3e], 0
je 0x577b03
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.00552e3a
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x577a32
xor al, al
jmp 0x577b05
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00577d09
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x577a62
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.00552e3a
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x577a97
sub eax, 1
je 0x577a9b
dec eax
sub eax, 1
je 0x577af1
xor bl, bl
jmp 0x577af3
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x577aab
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x577ad3
cmp eax, 0x10
jae 0x577aba
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00564165
add esp, 0x10
cmp esi, eax
jne 0x577a93
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x577af1
test esi, esi
jne 0x577a56
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00409e67
jmp 0x577a50
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040980b
mov al, bl
jmp 0x577b05
mov al, 1
call fcn.00552e55
ret
Function at 0x10028bea
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028c11
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0xc], 0
jmp 0x10028c32
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10028c32
push 0
push 0x7a3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esp, ebp
pop ebp
ret

Function at 0x10029129
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002914d
xor eax, eax
jmp 0x1002925d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002916b
xor eax, eax
jmp 0x1002925d
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10028fec
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002918a
xor eax, eax
jmp 0x1002925d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x30f6
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
push 1
call fcn.10028e96
add esp, 0x1c
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push 0
call fcn.10024ab4
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.10029041
add esp, 0xc
push dword [ebp - 4]
call fcn.10027e76
pop ecx
test eax, eax
jne 0x100291ed
xor eax, eax
jmp 0x1002925d
push 0x46b6
lea eax, [ebp - 4]
push eax
push 1
call fcn.100290aa
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10029245
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002921f
xor eax, eax
jmp 0x1002925d
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10029238
xor eax, eax
jmp 0x1002925d
push 1
lea eax, [ebp - 4]
push eax
call fcn.100290ef
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10029256
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002925a
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1003b9e9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1003ba0e
push 0
push 0x7a3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1003ba6c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + eax]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10077172
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007f38c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10067f7c
mov dword [ebp - 0x14], eax
cmp dword [0x1066c7e4], esi
jne 0x10077265
push 0x800
push esi
push 0x10007d9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100771f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10077345
push esi
push esi
push 0x10007d9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10077345
push 0x10007db4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10077345
push eax
call ebx
push 0x10007dc0
push edi
mov dword [0x1066c7e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007dd0
push edi
mov dword [0x1066c7e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007de4
push edi
mov dword [0x1066c7ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066c7f4], eax
test eax, eax
je 0x10077262
push 0x10007e00
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066c7f0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007728a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007727d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007729f
push 4
pop eax
jmp 0x10077347
cmp dword [ebp - 0x14], esi
je 0x1007729f
push dword [0x1066c7e4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10077284
mov eax, dword [0x1066c7f0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100772fd
cmp dword [0x1066c7f4], edi
je 0x100772fd
push eax
call ebx
push dword [0x1066c7f4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100772fd
test eax, eax
je 0x100772fd
call ecx
test eax, eax
je 0x100772f2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100772f2
test byte [ebp - 8], 1
jne 0x100772fd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007732d
mov eax, dword [0x1066c7e8]
cmp eax, edi
je 0x1007732a
push eax
call ebx
test eax, eax
je 0x1007732a
call eax
mov esi, eax
test esi, esi
je 0x1007732a
mov eax, dword [0x1066c7ec]
cmp eax, edi
je 0x1007732a
push eax
call ebx
test eax, eax
je 0x1007732a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066c7e4]
call ebx
test eax, eax
je 0x10077345
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10077347
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x4038e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40390c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x403934
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40393a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4039a2
jg 0x403951
test esi, esi
je 0x4039a2
test ecx, ecx
jl 0x40399d
jg 0x40395b
test eax, eax
je 0x40399d
cmp edi, ecx
jg 0x40396f
jl 0x403965
cmp esi, eax
jae 0x40396f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4039a5
mov ecx, dword [ebp + 8]
jmp 0x4039af
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4039c9
jg 0x4039af
test esi, esi
je 0x4039c9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4039c9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4039e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x403a0c
jl 0x403a00
test ecx, ecx
jne 0x403a0c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x403a25
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x403a73
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x403a79
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x403a79
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x403ae6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403aa2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x403ad4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403ae6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x403ab0
test edi, edi
je 0x403ae6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x403ea0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403edc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x403edc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x403fb3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x403f04
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403f10
movsx eax, bl
jmp 0x403f48
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x403f72
sub eax, 1
je 0x403f72
sub eax, 2
jne 0x403fb3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403f90
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403fb3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a08
mov esp, ebp
pop ebp
ret 4
Function at 0x404440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4044fc
cmp byte [esi + 0x3d], 0
je 0x4044fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4044ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4044b1
sub eax, 1
je 0x4044b5
sub eax, 2
jne 0x4044ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4044d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4044ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a08
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00405a08
mov esp, ebp
pop ebp
ret

Function at 0x405f7d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405fbc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405fbc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405fbc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405fbc
cmp dword [ecx + 0x74], 0xe
jbe 0x405fbc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4065aa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4065d1
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4065d4
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00406586
pop esi
leave
ret 8
Function at 0x409d10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422d58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x46c080
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.0040a1b0
add esp, 8
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
je 0x409e16
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ebx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00409ef0
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x409e09
test ebx, ebx
je 0x409e14
mov edx, dword [section..rsrc]
mov eax, dword [edx + 0xc]
mov ecx, section..rsrc
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x427668
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00406de0
mov edi, dword [ebp - 0x14]
mov eax, edi
add esp, 8
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409dc0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
lea eax, [edi - 0x10]
inc esi
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409e09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x409e14
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409e5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402a4f
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x405ed0]
call fcn.004030ef
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x402b4f
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x402aa5
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x402a9d
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x402ae5
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x402b27
push 0x22
pop edx
cmp cx, dx
je 0x402ad7
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x402ac7
xor ecx, ecx
cmp word [eax], cx
je 0x402b27
mov ecx, eax
add eax, 2
jmp 0x402b29
test dx, dx
je 0x402b2f
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x402ad7
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x402b1d
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x402b27
cmp cx, dx
je 0x402b1a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x402b0a
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x402aef
jmp 0x402ad7
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x402b31
xor edx, edx
cmp dword [ebp], ebx
jne 0x402b3a
test edi, edi
jne 0x402b57
test edx, edx
je 0x402b3f
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x402a93
test edi, edi
jne 0x402b68
mov eax, ebx
jmp 0x402b6c
test esi, esi
je 0x402b68
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x402b6c
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret