joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011f9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100043c0
sub esp, 0x24
mov al, 1
push ebx
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 6], al
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 0xb], al
mov byte [esp + 0xe], al
mov byte [esp + 0x10], al
xor eax, eax
push esi
mov dword [esp + 0x18], eax
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, edi
mov dword [esp + 0x28], eax
xor edx, edx
mov word [esp + 0x2c], ax
mov eax, dword [ecx]
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], dl
mov cx, word [ecx + 4]
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], dl
mov byte [esp + 0x17], dl
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], cx
xor esi, esi
mov al, byte [esp + esi + 0x1c]
lea ecx, [esp + esi + 0x1c]
cmp al, dl
je 0x10004447
xor eax, eax
mov bl, byte [esp + eax + 0xc]
xor byte [ecx + eax], bl
inc eax
cmp eax, 0xc
jle 0x1000443a
inc esi
cmp esi, 6
jl 0x1000442c
mov edx, dword [esp + 0x22]
mov ecx, dword [esp + 0x26]
lea eax, [edi + 6]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov edx, dword [esp + 0x1e]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
xor eax, eax
add esp, 0x24
ret 4

Function at 0x1000124e
Capabilities:
Terminate thread

Disassembly:
jmp 0x10007740
push esi
mov esi, ecx
mov eax, dword [esi + 0x2e8]
test eax, eax
je 0x10007783
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000776c
mov eax, dword [esi + 0x2e8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x2e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2e8], 0
pop esi
ret

Function at 0x1000125d
Capabilities:
Set registry value

Disassembly:
jmp 0x1000b5d0
sub esp, 0x20c
push ebx
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x114]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x14], ebx
call fcn.10001032
mov edx, dword [esp + 0x228]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x1c]
push 0x10020ea4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0xc]
mov esi, eax
push edx
push 0x10029e30
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1000b667
lea eax, [esp + 0xc]
push eax
push 0x10029e30
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x1000b6a9
lea ecx, [esp + 0x10]
push esi
push ecx
push 1
lea edx, [esp + 0x120]
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
inc esi
cmp eax, ebx
je 0x1000b69d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x20c
ret
Function at 0x10001271
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x100069b0
sub esp, 0x800
xor eax, eax
lea edx, [esp + 0x400]
push ebx
mov ebx, ecx
push edi
mov ecx, 0x100
lea edi, [esp + 0x408]
rep stosd dword es:[edi], eax
mov ax, word [ebx + 0x16]
lea ecx, [ebx + 0x15c]
push eax
push ecx
push str.CONNECT__s:_d_HTTP_1.1_r_nUser_Agent:_t_t___________MyApp_0.1_r_n_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x408]
mov ecx, ebx
push 0
push eax
call fcn.100011d6
test eax, eax
jne 0x10006a0a
pop edi
pop ebx
add esp, 0x800
ret
push ebp
push esi
xor esi, esi
xor ebp, ebp
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x400
jge 0x10006a67
push 5
call edi
mov edx, dword [ebx + 0x10]
push 0
lea ecx, [esp + esi + 0x14]
push 0x400
push ecx
push edx
inc ebp
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jl 0x10006a67
add esi, eax
lea eax, [esp + 0x10]
push 0x1002096c
push eax
call fcn.1000c990
add esp, 8
test eax, eax
ja 0x10006a67
cmp ebp, 0xa
jl 0x10006a23
lea ecx, [esp + 0x10]
push 0x1002096c
push ecx
xor ebp, ebp
call fcn.1000c990
add esp, 8
test eax, eax
je 0x10006a9a
lea edx, [esp + 0x10]
push str.HTTP_1.0_200_Connection_established
push edx
call fcn.1000c990
add esp, 8
test eax, eax
je 0x10006a9a
mov ebp, 1
push 5
call edi
mov ecx, dword [ebx + 0x10]
push 0
lea eax, [esp + esi + 0x14]
push 0x400
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov eax, ebp
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x800
ret

Function at 0x1000128a
Capabilities:
Create thread
Resume thread

Disassembly:
jmp 0x10007a00
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov esi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10007a32
lea edx, [esi + 0x2c]
mov ecx, 0x41
xor eax, eax
mov edi, edx
push ebx
push 0x1001fd54
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x10007a4d
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, esi
call fcn.100010a5
test eax, eax
jne 0x10007a5e
pop edi
pop esi
pop ebx
ret 8
mov ecx, 0x800
xor eax, eax
lea edi, [esi + 0x238]
mov dword [esi + 0x234], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
push ecx
push 4
push esi
push 0x1000110e
push ebx
push ebx
call fcn.1000caec
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x10007aa3
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 8], 1
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebx
ret 8

Function at 0x100012ad
Capabilities:
Create thread
Resume thread

Disassembly:
jmp 0x100073f0
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x2f0]
test eax, eax
jne 0x1000743a
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 4
push esi
push 0x100010c8
push 0
push 0
call fcn.1000caec
add esp, 0x18
mov dword [esi + 0x2e8], eax
test eax, eax
je 0x1000743a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x2f0], 1
pop esi
pop ecx
ret
Function at 0x100012b7
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x100081d0
xor eax, eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
ret

Function at 0x100012f3
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
jmp 0x100065f0
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x10006603
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x10006631
push 0x848
push str.Open_socket_error
mov ecx, esi
mov byte [esi + 4], 0xd
call fcn.1000113b
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 4]
push 4
push ecx
push 0x1002
push 0xffff
push eax
mov dword [esp + 0x18], 0x2000
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x100012fd
Capabilities:
Read file on windows

Disassembly:
jmp 0x10007b90
mov eax, 0x2008
call fcn.1000cc30
push ebx
push ebp
mov ebp, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x14]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
test eax, eax
mov dword [esp + 0x10], ebx
je 0x10007c79
push esi
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x1b]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10007bee
mov al, byte [esp + 0x13]
mov byte [esp + ebx + 0x18], al
inc ebx
jmp 0x10007c6d
lea edx, [ebp + 0x238]
mov ecx, 0x800
xor eax, eax
mov edi, edx
mov dword [ebp + 0x234], ebx
test ebx, ebx
rep stosd dword es:[edi], eax
jle 0x10007c63
mov ecx, ebx
mov edi, edx
mov edx, ecx
lea esi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
mov ecx, ebp
call fcn.10001127
test eax, eax
je 0x10007c4a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10007c4a
push 0
push 0xff
push 0x100
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x800
xor eax, eax
lea edi, [ebp + 0x238]
mov dword [ebp + 0x234], 0
rep stosd dword es:[edi], eax
push 0xa
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10007bc3
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x2008
ret
Function at 0x10011285
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10021668
cmp edx, dword [eax]
je 0x100112a7
add eax, 8
inc ecx
cmp eax, 0x100216f8
jl 0x10011298
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10021668]
jne 0x100113d5
mov eax, dword [0x1002a004]
cmp eax, 1
je 0x100113af
test eax, eax
jne 0x100112d8
cmp dword [0x1002a008], 1
je 0x100113af
cmp edx, 0xfc
je 0x100113d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001130f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10012a40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10011d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10011352
lea eax, [ebp - 0x1a4]
push eax
call fcn.10011d00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1001d410
push edi
call fcn.10012fc0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10012a40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10012a50
lea eax, [ebp - 0xa0]
push 0x1001d3f0
push eax
call fcn.10012a50
push dword [esi + 0x1002166c]
lea eax, [ebp - 0xa0]
push eax
call fcn.10012a50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10012f34
add esp, 0x2c
pop edi
jmp 0x100113d5
lea eax, [ebp + 8]
lea esi, [esi + 0x1002166c]
push 0
push eax
push dword [esi]
call fcn.10011d00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402274
Capabilities:
Delete directory

Disassembly:
push ebx
xor eax, eax
push eax
mov eax, dword [esp + 0xc]
mov dword [0x413a50], eax
mov edx, dword [0x41353c]
xor ecx, ecx
call fcn.0040f0c0
jne 0x4022b0
mov edx, dword [0x41353c]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 4]
push eax
call fcn.0040f040
jmp 0x40242c
push 0xc80001
push dword [0x413538]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.0040ab60
push dword [0x4134bc]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00409d43
push 0x20
push 0x41201e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00409f1c
push 0x412053
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.0040a229
push 4
push 0xd
push 0
call fcn.0040ab83
push 2
call fcn.0040a249
call fcn.0040ad87
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x402390
push dword [0x413544]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 0
jmp 0x4017ab
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4023dc
call fcn.0040d19d
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4023d9
push dword [0x413a50]
push dword [0x413a50]
push 2
call fcn.0040a284
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push 0
call fcn.0040a723
add esp, 8
jmp 0x40242c
pop eax
jmp 0x402426
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x402426
call fcn.0040d1ac
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x402425
push dword [0x413a50]
push dword [0x413a50]
push 2
call fcn.0040a284
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push 0
call fcn.0040a723
add esp, 8
jmp 0x40242c
pop eax
pop eax
jmp 0x402366
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.004052c0
push eax
mov eax, dword [esp + 0xc]
push eax
call fcn.0040d890
inc dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413474]
push dword [0x413460]
call fcn.0040c210
pop edx
pop ecx
mov dword [0x413a50], ecx
add ecx, dword [0x412324]
add edx, dword [0x412324]
call fcn.0040f0c0
jne 0x4024b5
push 0x10
push dword [0x413520]
push dword [0x413548]
call fcn.004080d0
push dword [0x413544]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 1
jmp 0x4017ab
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
pop eax
add eax, dword [0x412324]
jmp 0x4024da
push dword [esp]
call fcn.0040f0f0
add esp, 4
pop ebx
ret
Function at 0x402a04
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402a0b
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00405060
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00405060
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00405060
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, 0x412037
push eax
pop eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
push eax
pop eax
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call fcn.0040a702
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.DLL_GetExitCodeProcess
and eax, eax
je 0x402aba
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x402aba
jmp 0x402abc
jmp 0x402a8d
mov eax, dword [esp + 0x4c]
jmp 0x402ac4
push dword [esp]
call fcn.0040f0f0
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp + 8]
call fcn.0040f0f0
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x402ae6
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x412035
push dword [0x4134cc]
call fcn.004033e3
and eax, eax
je 0x402c3c
push 0x400
call fcn.0040c1d0
mov dword [esp], eax
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c4ad
lea eax, [esp + 8]
push eax
call fcn.0040f040
push dword [esp]
push 0
push 0x41201e
push dword [esp + 0x10]
call sub.KERNEL32.DLL_GetTempFileNameA
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.0040c280
lea eax, [0x413540]
push eax
call fcn.0040f040
push dword [esp]
call fcn.0040c2d0
push dword [0x413540]
call fcn.0040c53c
push dword [0x413540]
call fcn.0040c437
push dword [0x413540]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x413540]
push dword [0x413a50]
call fcn.0040f120
mov edx, dword [0x413508]
call fcn.0040f120
mov edx, dword [0x4134dc]
call fcn.0040f120
lea eax, [0x4134d0]
push eax
call fcn.0040f040
push dword [0x4134d0]
push 0
call fcn.0040c930
push dword [0x413474]
push dword [0x413460]
push 0
call fcn.0040cab0
push 0
call fcn.0040c710
mov edx, dword [0x4134d0]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push dword [esp + 8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [esp + 8]
push dword [0x4134b4]
call fcn.004085cd
push dword [0x4134ac]
push dword [0x413508]
call fcn.004085cd
mov dword [0x413470], 1
xor eax, eax
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp + 8]
call fcn.0040f0f0
add esp, 0xc
ret
Function at 0x402c54
Capabilities:
Delete directory

Disassembly:
xor eax, eax
push eax
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c54a
inc dword [0x413a50]
push dword [0x413514]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.00408143
lea eax, [esp + 4]
push eax
call fcn.0040f040
mov edx, dword [esp]
xor ecx, ecx
call fcn.0040f0c0
jne 0x402d12
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
lea eax, [0x4134d8]
push eax
call fcn.0040f040
push dword [0x4134d8]
call fcn.0040c58a
mov edx, dword [0x413484]
xor ecx, ecx
call fcn.0040f0c0
jne 0x402ce4
push dword [0x413484]
call fcn.00402faa
push dword [0x4134e4]
push 1
call fcn.0040c930
and eax, eax
je 0x402d12
push dword [0x4134e0]
push 1
call fcn.0040cb10
push 1
call fcn.0040c710
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.00408450
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c59c
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c58a
pop dword [0x413a50]
push dword [0x413544]
call sub.KERNEL32.DLL_RemoveDirectoryA
push 0
jmp 0x4017ab

Function at 0x402d7a
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.0040c1d0
mov dword [esp], eax
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c4ad
lea eax, [esp + 8]
push eax
call fcn.0040f040
push dword [esp]
push 0
push 0x41201e
push dword [esp + 0x10]
call sub.KERNEL32.DLL_GetTempFileNameA
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.0040c280
lea eax, [0x413544]
push eax
call fcn.0040f040
push dword [esp]
call fcn.0040c2d0
push dword [0x413544]
call fcn.0040c53c
push dword [0x413544]
call fcn.0040c437
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c54a
lea eax, [0x4134d8]
push eax
call fcn.0040f040
push dword [esp + 0x14]
pop eax
call fcn.0040c1f0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x402e53
mov edx, dword [0x413544]
push dword [0x413a50]
call fcn.0040f120
lea eax, [0x4134d8]
push eax
call fcn.0040f040
mov dword [esp + 0xc], 2
jmp 0x402e65
mov ebx, 1
cmp ebx, dword [esp]
jne 0x402e65
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.0040c1f0
mov dword [0x41350c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.0040c1f0
mov dword [0x41345c], eax
mov eax, 1
jmp 0x402e98
push dword [esp + 4]
call fcn.0040f0f0
add esp, 0xc
pop ebx
ret 4
Function at 0x402ea8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x1c]
mov dword [0x413a50], eax
push dword [0x413a50]
push dword [0x413a50]
call sub.KERNEL32.DLL_GetCommandLineA
push eax
call fcn.0040c280
lea eax, [esp + 4]
push eax
call fcn.0040f040
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 8]
push eax
call fcn.0040f040
mov eax, dword [esp + 4]
push eax
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov dword [esp + 8], eax
push dword [esp + 4]
call fcn.004052c0
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jle 0x402f65
push dword [0x413a50]
mov edx, str.__BFINOPSX
call fcn.0040f120
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
mov ebx, dword [esp + 0x20]
inc ebx
push ebx
push dword [esp + 0x18]
call fcn.004055a0
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.00405190
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0040f040
mov edx, dword [esp + 0x10]
push dword [0x413a50]
call fcn.0040f120
pop eax
add eax, dword [0x412324]
jmp 0x402f8b
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp]
call fcn.0040f0f0
push dword [esp + 0x10]
call fcn.0040f0f0
add esp, 0x14
pop ebx
ret
Function at 0x4033af
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033b5
lea eax, [esp]
push eax
call sub.KERNEL32.DLL_GetNativeSystemInfo
lea ebp, [esp]
cmp word [ebp], 0
je 0x4033dc
mov eax, 1
jmp 0x4033de
xor eax, eax
add esp, 0x24
pop ebp
ret

Function at 0x4033e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033e9
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00405060
push 0x21
call fcn.0040c1d0
mov dword [esp + 4], eax
push 0x21
push dword [esp + 8]
call fcn.0040c2f0
push 0x20
push dword [esp + 8]
mov eax, dword [0x41355c]
push eax
call fcn.0040c310
push 1
push dword [esp + 4]
mov ebx, dword [esp + 0xc]
add ebx, 0x20
push ebx
call fcn.0040c340
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push 0x21
push dword [esp + 0x18]
call fcn.0040d890
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.00405af0
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push dword [esp + 4]
call fcn.0040c2d0
push 0xa
push dword [esp + 0xc]
push dword [esp + 0x34]
call sub.KERNEL32.DLL_FindResourceA
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4035ce
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.DLL_LoadResource
mov dword [0x413460], eax
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x413474], eax
push dword [esp]
mov edx, 0x412027
pop ecx
call fcn.0040f0c0
jne 0x403516
push dword [esp]
mov edx, 0x41202b
pop ecx
call fcn.0040f0c0
jne 0x403516
push dword [esp]
mov edx, 0x41202d
pop ecx
call fcn.0040f0c0
jne 0x403516
push dword [esp]
mov edx, 0x412035
pop ecx
call fcn.0040f0c0
jne 0x403516
jmp 0x40351d
mov eax, 1
jmp 0x40351f
xor eax, eax
and eax, eax
je 0x4035ce
push dword [0x413474]
call fcn.0040c1d0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov ebx, dword [0x413474]
dec ebx
cmp ebx, dword [esp + 0x14]
jl 0x403584
mov ebx, dword [0x413460]
add ebx, dword [esp + 0x14]
push ebx
pop eax
call fcn.0040c1f0
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
imul ebx, ebx, 0xffffffff
mov dword [esp + 0x1c], ebx
push dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x18]
push ebx
pop eax
call fcn.0040c200
inc dword [esp + 0x14]
jno 0x40353e
push dword [0x41355c]
push dword [0x413474]
push dword [esp + 0x18]
call fcn.00402000
push dword [esp + 0x10]
pop eax
mov dword [0x413460], eax
push dword [0x413474]
push dword [esp + 0x14]
call fcn.0040419e
mov dword [esp + 0x20], eax
push dword [esp + 0x20]
pop eax
mov dword [0x413460], eax
push dword [esp + 0x20]
call fcn.0040c380
mov dword [0x413474], eax
mov eax, dword [esp + 0xc]
jmp 0x4035d6
push dword [esp + 8]
call fcn.0040f0f0
push dword [esp]
call fcn.0040f0f0
add esp, 0x24
pop ebx
ret 8