joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480c65
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x480c8b
push 0x110
push str.appui3.cpp
call fcn.004aed70
test eax, eax
je 0x480c8b
int3
xor eax, eax
test eax, eax
jne 0x480c71
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x80], 0
je 0x480d76
cmp dword [ebp + 0xc], 0
jne 0x480cdf
mov ecx, dword [ebp - 0x14]
call fcn.004c5f2c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x480cbf
xor eax, eax
jmp 0x480de9
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d6b
cmp dword [ebp + 0x10], 0
jne 0x480d1e
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004c6032
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x480d01
xor eax, eax
jmp 0x480de9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d6b
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004c6032
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x480d3a
xor eax, eax
jmp 0x480de9
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x480de9
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x94], 0
jne 0x480d96
push 0x132
push str.appui3.cpp
call fcn.004aed70
test eax, eax
je 0x480d96
int3
xor ecx, ecx
test ecx, ecx
jne 0x480d76
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xfff
jl 0x480dc7
push 0x133
push str.appui3.cpp
call fcn.004aed70
test eax, eax
je 0x480dc7
int3
xor ecx, ecx
test ecx, ecx
jne 0x480d9c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x498be8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x498cd7
mov eax, dword [ebp - 4]
push eax
call fcn.00457df8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x498cc3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x498cc3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00498800
test eax, eax
je 0x498cc3
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x498c89
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x498c89
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x498cc3
cmp dword [ebp + 8], 0
je 0x498cc3
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x498cc3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x498cc3
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x498c03
mov esp, ebp
pop ebp
ret 4
Function at 0x49cb3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x49cb62
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x49cb9c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49cbb6
push 0xc9
push str.dlgprop.cpp
call fcn.004aed70
test eax, eax
je 0x49cbb6
int3
xor eax, eax
test eax, eax
jne 0x49cb9c
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x49cc91
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x49cc61
push 0x53b6f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49cc0e
push 0xe1
push str.dlgprop.cpp
call fcn.004aed70
test eax, eax
je 0x49cc0e
int3
xor ecx, ecx
test ecx, ecx
jne 0x49cbf4
cmp dword [ebp - 0x18], 0
je 0x49cc5f
push 0x53b704
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x49cc55
mov eax, 1
test eax, eax
je 0x49cc4f
push 0xe6
push str.dlgprop.cpp
call fcn.004aed70
test eax, eax
je 0x49cc4f
int3
xor ecx, ecx
test ecx, ecx
jne 0x49cc32
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x49cc91
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x49cc91
mov ecx, 1
test ecx, ecx
je 0x49cc8b
push 0xed
push str.dlgprop.cpp
call fcn.004aed70
test eax, eax
je 0x49cc8b
int3
xor edx, edx
test edx, edx
jne 0x49cc6e
call fcn.004c59f3
cmp dword [eax + 0x1038], 0
je 0x49ccae
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0049caf3
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0049c9b5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x49ccde
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x49ccf3
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c4cbc
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x4c4ce2
push 0x146
push str.afxtls.cpp
call fcn.004aed70
test eax, eax
je 0x4c4ce2
int3
xor eax, eax
test eax, eax
jne 0x4c4cc8
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x4c4d01
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x4c4d84
cmp dword [ebp + 0xc], 0
je 0x4c4d24
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4c4d69
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4c4d50
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x4c4d57
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x4c4d7f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x4c4d7f
mov dword [ebp - 4], 0
jmp 0x4c4cf8
cmp dword [ebp - 4], 0
je 0x4c4df8
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004c5380
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c4de3
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x4c4dea
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c4e01
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x4c4e44
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c4e42
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004c4cbc
jmp 0x4c4e79
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004c53a0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c4e79
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004c4cbc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4c4e52
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8
Function at 0x4c94ad
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x4c94f9
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x4c94f2
mov eax, dword [ebp + 8]
push eax
push 0x53c85c
call fcn.0042ef05
add esp, 8
xor eax, eax
jmp 0x4c9565
mov eax, 1
jmp 0x4c9565
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4c9552
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4c9552
cmp dword [ebp - 8], 0
jne 0x4c9552
mov eax, 1
jmp 0x4c9565
mov edx, dword [ebp + 8]
push edx
push str.Warning:_registration_database_update_failed_for_key__s._n
call fcn.0042ef05
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404933
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x61b110], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x40497b
push 0x404728
push 0x404750
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4a74a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4a74ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00404922
mov eax, dword [0x4a74b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4a74b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x4049ba
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x61b110], 0xc
mov dword [ebp - 4], eax
jne 0x404a1c
push ebx
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x44c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x61b110]
cmp eax, 0xfa9
jne 0x404a38
mov dword [0x61a6ac], 0xedeb2e40
cmp eax, 0x3eb
jne 0x404a45
mov dword [0x61a05c], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x61a6a8], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x61b110], 0x213
mov dword [ebp - 0x18], edx
jne 0x404a81
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea eax, [edi + esi]
xor dword [ebp - 4], eax
shr esi, cl
add esi, dword [ebp - 0x30]
cmp dword [0x61b110], 0x121
jne 0x404ac2
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor dword [ebp - 4], esi
push dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00404929
add dword [ebp - 0x10], 0x61c88647
dec dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
jne 0x4049b7
cmp dword [0x61b110], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x404afd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
pop esi
pop ebx
leave
ret 4
Function at 0x404c7c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
xor esi, esi
cmp dword [0x61b110], 0x5b1
push edi
jne 0x404d1e
push esi
lea eax, [ebp - 0x808]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 0x4047c8
push esi
call fcn.004057d2
call fcn.00404f64
push esi
call fcn.004055ba
add esp, 0xc
push esi
push esi
call fcn.004055c5
push esi
call fcn.004056f7
add esp, 0xc
push esi
call fcn.00405954
mov dword [esp], esi
call fcn.00404903
fstp st(0)
call fcn.00404f69
push esi
call fcn.004056f7
pop ecx
call fcn.0040590a
add dword [0x61b110], 0x1134b
push dword [0x61b110]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x61a060], eax
call fcn.00404bc7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x404d60
inc edi
cmp edi, 0x4f6a4
jl 0x404d47
xor edi, edi
cmp dword [0x61b110], esi
jbe 0x404dac
cmp dword [0x61b110], 0xa8
mov eax, dword [0x61b114]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x61a060]
mov byte [ecx + edi], al
jne 0x404da3
push esi
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
inc edi
cmp edi, dword [0x61b110]
jb 0x404d6a
xor edi, edi
mov eax, dword [0x61b110]
add eax, edi
cmp eax, 0xe
jne 0x404dcb
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
inc edi
cmp edi, 0x39621
jl 0x404dae
mov edi, 0x4e320c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
dec edi
jne 0x404dd9
call fcn.00404b09
call ebx
cmp edi, 0x26
jne 0x404e08
call fcn.00404bad
inc edi
cmp edi, 0x6753f
jl 0x404dfc
push 0x7b
pop edi
cmp dword [0x61b110], 0x86
jne 0x404e55
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
dec edi
jne 0x404e14
push 0x4047d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404e68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
push ebx
push esi
xor esi, esi
cmp dword [0x61b110], 0x400
push edi
jne 0x404ec9
push esi
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
push esi
push esi
call fcn.00405432
push esi
call fcn.004054c1
add esp, 0xc
push esi
push esi
call fcn.00405432
push esi
push esi
call fcn.004057d2
push esi
call fcn.00405964
add esp, 0x14
push esi
push esi
call fcn.00405207
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004048e0
fstp st(0)
mov eax, dword [0x4a7b34]
mov dword [0x61b110], eax
mov eax, dword [0x4a7b0c]
mov dword [0x61b114], eax
call fcn.00404c7c
xor ebx, ebx
mov edi, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp ebx, edi
jle 0x404f10
cmp dword [esp + 0x14], 0x785074d5
jne 0x404f19
inc ebx
cmp ebx, 0x1c1b
jl 0x404ee9
xor ebx, ebx
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4047f0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp ebx, edi
jle 0x404f44
cmp dword [esp + 0x14], 0x785074d5
jne 0x404f4d
inc ebx
cmp ebx, 0x11915
jl 0x404f1b
mov eax, dword [0x61a060]
mov dword [0x61a6a4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406340
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a60e8]
jne 0x40634a
repz ret
jmp fcn.0040b482
Function at 0x40b1a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408ccd
and dword [ebp - 4], 0
cmp dword [0x4a83c0], 0
mov ebx, eax
jne 0x40b256
push 0x401c98
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b307
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c8c
push edi
call esi
test eax, eax
je 0x40b307
push eax
call fcn.00408c5b
mov dword [esp], 0x401c7c
push edi
mov dword [0x4a83c0], eax
call esi
push eax
call fcn.00408c5b
mov dword [esp], 0x401c68
push edi
mov dword [0x4a83c4], eax
call esi
push eax
call fcn.00408c5b
mov dword [esp], 0x401c4c
push edi
mov dword [0x4a83c8], eax
call esi
push eax
call fcn.00408c5b
pop ecx
mov dword [0x4a83d0], eax
test eax, eax
je 0x40b256
push 0x401c34
push edi
call esi
push eax
call fcn.00408c5b
pop ecx
mov dword [0x4a83cc], eax
mov eax, dword [0x4a83cc]
cmp eax, ebx
je 0x40b2ae
cmp dword [0x4a83d0], ebx
je 0x40b2ae
push eax
call fcn.00408cd6
push dword [0x4a83d0]
mov esi, eax
call fcn.00408cd6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2ae
test edi, edi
je 0x40b2ae
call esi
test eax, eax
je 0x40b2a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2a5
test byte [ebp - 0xc], 1
jne 0x40b2ae
or dword [ebp + 0x10], 0x200000
jmp 0x40b2e7
mov eax, dword [0x4a83c4]
cmp eax, ebx
je 0x40b2e7
push eax
call fcn.00408cd6
pop ecx
test eax, eax
je 0x40b2e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2e7
mov eax, dword [0x4a83c8]
cmp eax, ebx
je 0x40b2e7
push eax
call fcn.00408cd6
pop ecx
test eax, eax
je 0x40b2e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a83c0]
call fcn.00408cd6
pop ecx
test eax, eax
je 0x40b307
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b309
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40163a
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
dec eax
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov dword [ebp - 0x1c], 1
jmp 0x401727
mov eax, dword [ebp + 0x1c]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
shl eax, 4
add eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x4016c0
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
shl eax, 4
add eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x18]
jne 0x4016a2
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov byte [eax], 0x30
jmp 0x4016ab
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov byte [eax], 0x31
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shl eax, 4
add eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401683
mov edx, dword [ebp - 0x1c]
mov eax, edx
shl eax, 1
add eax, edx
shl eax, 2
add eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
mov ebx, ecx
sub ebx, edx
mov edx, ebx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
shl eax, 2
mov ebx, eax
add ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x1c]
mov ecx, edx
sub ecx, eax
mov eax, ecx
mov dword [esp], eax
call sym._malloc
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
shl eax, 2
add eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcpy
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0x1c]
jle 0x401665
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov dword [esp], str.pause
call sym._system
add esp, 0x34
pop ebx
leave
ret