joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405140
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [esp + 0x418]
push 0x1b6
push 0xa
push esi
mov ecx, 0x4262d4
call fcn.00404050
test eax, eax
jne 0x40518a
mov eax, dword [0x4262d0]
mov ecx, dword [eax + 4]
add ecx, 0x4262d0
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, 2
test edx, edx
jne 0x405182
or eax, 4
push 0
push eax
call fcn.0040bd00
lea ecx, [esp + 4]
push ecx
call fcn.0040e261
mov eax, dword [0x42632c]
add esp, 4
test eax, eax
je 0x4051e8
push str.____
push 0x4262d0
call fcn.004035f0
mov eax, dword [0x42632c]
add esp, 8
test eax, eax
je 0x4051e8
lea edx, [esp + 4]
push edx
push 0x4262d0
call fcn.004035f0
mov eax, dword [0x42632c]
add esp, 8
test eax, eax
je 0x4051e8
push 0x41c8f4
push 0x4262d0
call fcn.004035f0
add esp, 8
push str.started__command_line_is__
call fcn.004042a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [0x42632c]
test ecx, ecx
je 0x40522e
push eax
push 0x4262d0
call fcn.004035f0
mov eax, dword [0x42632c]
add esp, 8
test eax, eax
je 0x40522e
push str.___current_dir_is__
push 0x4262d0
call fcn.004035f0
add esp, 8
lea eax, [esp + 0x10]
push 0x401
push eax
call fcn.0040d89a
mov ecx, dword [0x42632c]
add esp, 8
test ecx, ecx
je 0x40529c
push eax
push 0x4262d0
call fcn.004035f0
mov eax, dword [0x42632c]
add esp, 8
test eax, eax
je 0x40529c
push 0x41c8c0
push 0x4262d0
call fcn.004035f0
mov eax, dword [0x42632c]
add esp, 8
test eax, eax
je 0x40529c
mov edx, 0x424e78
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405285
mov eax, 1
pop esi
add esp, 0x410
ret
xor eax, eax
pop esi
add esp, 0x410
ret

Function at 0x406c20
Capabilities:
Accept command line arguments

Disassembly:
call fcn.004052b0
test al, al
je 0x406c2c
mov al, 1
ret
mov eax, dword [esp + 4]
push esi
push edi
push eax
call fcn.0040e08d
mov edi, eax
push 0x41c960
push edi
call fcn.0040e636
mov esi, eax
add esp, 0xc
test esi, esi
je 0x406c6e
mov edi, edi
cmp byte [esi], 0x69
je 0x406cea
push 0x41c960
push 0
call fcn.0040e636
mov esi, eax
add esp, 8
test esi, esi
jne 0x406c50
mov al, byte [0x423648]
test al, al
jne 0x406c8b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0x423648
call fcn.00401bf0
add esp, 8
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x423648]
mov byte [eax + 0x423240], cl
inc eax
test cl, cl
jne 0x406c90
push str.install.ini
push 0x423240
call fcn.00401a30
push 0
push 0x423240
call fcn.0040ca38
add esp, 0x10
test eax, eax
je 0x406cca
mov byte [0x423240], 0
push edi
call fcn.0040c9c7
mov al, byte [0x423240]
add esp, 4
test al, al
pop edi
pop esi
jne 0x406d13
call fcn.004052b0
test al, al
jne 0x406d13
xor eax, eax
ret
inc esi
push 0
push esi
call fcn.0040ca38
add esp, 8
test eax, eax
jne 0x406c6e
mov edx, 0x423240
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x406d07
jmp 0x406cca
mov eax, 1
ret
Function at 0x406d20
Capabilities:
Read .ini file

Disassembly:
call fcn.004052b0
test al, al
je 0x406d48
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 1
push eax
push ecx
push str.SOFTWARETRUMPFManager_2007
push 0x80000002
call fcn.00404e00
add esp, 0x14
ret
mov al, byte [0x423240]
test al, al
jne 0x406d5a
call fcn.004052b0
test al, al
je 0x406d88
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0x423240
push 0x401
push edx
push 0x41c246
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x406d88
mov eax, 1
ret
xor eax, eax
ret

Function at 0x406f10
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x41af42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push edi
xor edi, edi
mov dword [esp + 4], edi
cmp dword [0x4262b4], edi
je 0x406f49
xor eax, eax
pop edi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret
mov eax, dword [esp + 0x80]
cmp eax, edi
push ebx
push esi
je 0x406f74
push eax
mov eax, dword [esp + 0x7c]
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00403a50
add esp, 0xc
mov dword [esp + 0x70], edi
mov ebx, 1
jmp 0x406fb5
mov edx, dword [esp + 0x78]
mov eax, edx
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], edi
mov byte [esp + 0x18], 0
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f90
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.00404180
lea eax, [esp + 0x14]
mov dword [esp + 0x70], 1
mov ebx, 2
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], edi
mov byte [esp + 0x40], 0
call fcn.00403f60
test bl, 2
mov esi, 0x10
je 0x40700a
mov eax, dword [esp + 0x2c]
and ebx, 0xfffffffd
cmp eax, esi
jb 0x406ff9
mov edx, dword [esp + 0x18]
push edx
call fcn.0040c9bd
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], edi
mov byte [esp + 0x18], 0
test bl, 1
je 0x407022
cmp dword [esp + 0x64], esi
jb 0x407022
mov eax, dword [esp + 0x50]
push eax
call fcn.0040c9bd
add esp, 4
cmp dword [esp + 0x48], esi
jb 0x407034
mov ecx, dword [esp + 0x34]
mov dword [0x4262a4], ecx
jmp 0x40703e
lea edx, [esp + 0x34]
mov dword [0x4262a4], edx
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov dword [0x4262a8], eax
lea eax, [esp + 0x10]
push eax
push edi
push 0x4262a4
push 0x402060
push edi
push edi
mov dword [0x4262ac], ecx
mov dword [0x4262b0], edx
mov byte [0x4262b8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x4262b4]
cmp eax, edi
jne 0x40709d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0xa
call esi
mov eax, dword [0x4262b4]
cmp eax, edi
je 0x407090
mov esi, eax
cmp dword [esp + 0x48], 0x10
jb 0x4070b3
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0040c9bd
add esp, 4
mov ecx, dword [esp + 0x68]
mov eax, esi
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x4070d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push 0
push eax
call fcn.00406f10
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40713b
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
mov byte [0x4262b8], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [str.InstGenWndClass]
push eax
push edx
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [0x4262b4], 0
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x4073a0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push str.finished._n_n
call fcn.004042a0
mov eax, dword [0x42632c]
add esp, 4
test eax, eax
je 0x4073ed
mov ecx, 0x4262d4
call fcn.00405810
test eax, eax
jne 0x4073ed
mov eax, dword [0x4262d0]
mov ecx, dword [eax + 4]
add ecx, 0x4262d0
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, 2
test edx, edx
jne 0x4073e5
or eax, 4
push 0
push eax
call fcn.0040bd00
call fcn.004052b0
test al, al
je 0x40745e
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0x20006
push 0
push 0x41c246
push 0
push str.SOFTWARETRUMPFManager_2007
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40745e
mov eax, 0x424e78
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407430
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 4]
push 0x424e78
push 1
push 0
push str.LogFile
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x424e78], 0
add esp, 8
ret

Function at 0x4078a0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x42638c]
test eax, eax
jne 0x407937
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0040e08d
mov esi, eax
push 0x41ca84
push esi
call fcn.0040e636
add esp, 0xc
test eax, eax
je 0x407916
mov edi, edi
cmp byte [eax], 0x2d
jne 0x4078e2
mov cl, byte [eax + 1]
cmp cl, 0x6c
je 0x4078f7
cmp cl, 0x4c
je 0x4078f7
push 0x41ca84
push 0
call fcn.0040e636
add esp, 8
test eax, eax
jne 0x4078d0
jmp 0x407916
push 0x42638c
add eax, 2
push 0x41ca80
push eax
call fcn.0040cf26
add esp, 0xc
test eax, eax
jne 0x407916
mov dword [0x42638c], eax
push esi
call fcn.0040c9c7
mov eax, dword [0x42638c]
add esp, 4
test eax, eax
pop esi
jne 0x407937
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov dword [0x42638c], eax
ret
Function at 0x40ca38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40ca58
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041014a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40ca7b
test byte [esp + 8], 2
je 0x40ca7b
call fcn.00410138
mov dword [eax], 0xd
call fcn.00410141
mov dword [eax], 5
jmp 0x40ca54
xor eax, eax
ret

Function at 0x40d614
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x41cd20
call fcn.004100ec
mov eax, dword [0x4212e8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x40d724
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x40d6d5
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.0040e050
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x40d6c2
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x40d724
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x40d724
mov al, byte [edi]
cmp al, 0x5c
je 0x40d6e3
cmp al, 0x2f
jne 0x40d6e8
cmp al, byte [edi + 1]
je 0x40d71e
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.00414aec
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x40d724
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041014a
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x40d740
push edi
call fcn.0040c9c7
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040c31b
call fcn.00410127
ret

Function at 0x40d75c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x40d78a
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x40d78f
cmp eax, 1
je 0x40d78f
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40d793
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4212e8]
push ebx
mov ebx, dword [ebp + 0x98]
xor eax, ebp
test ebx, ebx
push edi
mov edi, dword [ebp + 0x9c]
mov dword [ebp + 0x8c], eax
je 0x40d825
push ebx
call fcn.0040d75c
test eax, eax
pop ecx
jne 0x40d7fa
call fcn.00410141
mov dword [eax], 0xf
call fcn.00410138
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp + 0x8c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040c31b
add ebp, 0x90
leave
ret
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x104
lea eax, [ebp - 0x7c]
add bl, 0x40
push eax
mov byte [ebp - 0x7c], bl
mov byte [ebp - 0x7b], 0x3a
mov byte [ebp - 0x7a], 0x2e
mov byte [ebp - 0x79], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x40d834
lea eax, [ebp - 0x78]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40d7e1
inc eax
cmp eax, 0x104
ja 0x40d7e1
test edi, edi
mov ecx, edi
jne 0x40d871
cmp eax, dword [ebp + 0xa0]
jg 0x40d854
mov eax, dword [ebp + 0xa0]
push eax
call fcn.0040d02b
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x40d889
call fcn.00410138
mov dword [eax], 0xc
jmp 0x40d7e1
cmp eax, dword [ebp + 0xa0]
jle 0x40d889
call fcn.00410138
mov dword [eax], 0x22
jmp 0x40d7e1
lea eax, [ebp - 0x78]
push eax
push ecx
call fcn.004146a0
pop ecx
pop ecx
jmp 0x40d7e3

Function at 0x411be8
Capabilities:
Terminate process

Disassembly:
push 8
push 0x41d8e8
call fcn.004100ec
push 8
call fcn.0040f24b
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x426a98], esi
jne 0x411c1c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x426a94], esi
mov al, byte [ebp + 0x10]
mov byte [0x426a90], al
cmp dword [ebp + 0xc], edi
jne 0x411c66
cmp dword [0x428148], edi
je 0x411c56
mov eax, dword [0x428144]
sub eax, 4
mov dword [0x428144], eax
cmp eax, dword [0x428148]
jb 0x411c56
mov eax, dword [eax]
cmp eax, edi
je 0x411c37
call eax
jmp 0x411c37
push 0x421050
mov eax, 0x421048
call fcn.00411b66
pop ecx
push 0x42105c
mov eax, 0x421054
call fcn.00411b66
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x411c97
cmp dword [ebp + 0x10], edi
jne 0x411ca5
mov dword [0x426a98], esi
push dword [ebp + 8]
call fcn.00411b24
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x411ca4
push 8
call fcn.0040f196
pop ecx
ret
call fcn.00410127
ret
Function at 0x411ceb
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4212e8]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x421820]
je 0x411d22
inc eax
cmp eax, 0x13
jb 0x411d13
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x421820]
jne 0x411e45
mov eax, dword [0x4268cc]
cmp eax, 1
je 0x411e20
cmp eax, edx
jne 0x411d52
cmp dword [0x4212f0], 1
je 0x411e20
cmp ecx, 0xfc
je 0x411e45
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x411d88
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.004146a0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00410280
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x411dbc
mov eax, edi
push eax
call fcn.00410280
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x41d6b4
push edi
call fcn.0040cb80
add esp, 0x10
push edi
call fcn.00410280
push dword [esi + 0x421824]
mov ebx, eax
call fcn.00410280
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0040e050
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004146a0
push edi
push ebx
call fcn.004146b0
push 0x41d6b0
push ebx
call fcn.004146b0
push dword [esi + 0x421824]
push ebx
call fcn.004146b0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004187c2
add esp, 0x2c
jmp 0x411e45
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x421824]
push dword [esi]
call fcn.00410280
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.0040c31b
add ebp, 0x90
leave
ret
Function at 0x414808
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x414836
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x41483d
cmp ebx, dword [eax + 4]
jae 0x41483d
xor eax, eax
jmp 0x414a2d
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x41484e
xor eax, eax
inc eax
jmp 0x414a2c
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x414864
cmp ecx, edx
jae 0x4149a9
cmp dword [eax + 4], 0
je 0x41486d
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x414855
cmp dword [ebp + 8], 0
je 0x41488f
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4149a9
cmp eax, esi
jae 0x4149a9
mov eax, dword [0x426bb8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4148b4
cmp dword [esi*4 + 0x426bc0], edi
je 0x4149ad
inc esi
cmp esi, eax
jl 0x4148a2
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414a29
cmp dword [ebp - 8], 0x1000000
jne 0x414a29
test byte [ebp - 0xc], 0xcc
je 0x414932
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x414a29
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x414a29
cmp word [eax + 0x18], 0x10b
jne 0x414a29
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x414a29
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x414932
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x414932
test byte [ecx + 0x27], 0x80
jne 0x4149a9
push 1
push 0x426c00
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x414846
mov ecx, dword [0x426bb8]
test ecx, ecx
mov edx, ecx
jle 0x414966
lea eax, [ecx*4 + 0x426bbc]
cmp dword [eax], edi
je 0x414966
dec edx
sub eax, 4
test edx, edx
jg 0x41495a
test edx, edx
jne 0x414997
push 0xf
pop ebx
cmp ecx, ebx
jg 0x414973
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x41498b
lea eax, [edx*4 + 0x426bc0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x414979
cmp ecx, 0x10
jge 0x414997
inc ecx
mov dword [0x426bb8], ecx
push 0
push 0x426c00
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x414846
xor eax, eax
jmp 0x414a2c
test esi, esi
jle 0x414846
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x426c00
call ebx
test eax, eax
jne 0x414846
cmp dword [esi*4 + 0x426bc0], edi
je 0x414a03
mov eax, dword [0x426bb8]
lea esi, [eax - 1]
test esi, esi
jl 0x4149f1
cmp dword [esi*4 + 0x426bc0], edi
je 0x4149ed
dec esi
jns 0x4149e1
test esi, esi
jge 0x414a01
cmp eax, 0x10
jge 0x4149fc
inc eax
mov dword [0x426bb8], eax
lea esi, [eax - 1]
jmp 0x414a03
je 0x414a1b
xor ecx, ecx
test esi, esi
jl 0x414a1b
lea eax, [ecx*4 + 0x426bc0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x414a09
push 0
push 0x426c00
call ebx
jmp 0x414846
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414b71
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040e050
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414c0c
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x426a58]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x414c0c
cmp eax, 1
je 0x414c2d
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414c0c
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x414bd9
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x414c08
xor eax, eax
inc eax
jmp 0x414c4c
cmp edi, eax
jae 0x414c10
xor eax, eax
jmp 0x414c4c
cmp eax, esi
jae 0x414c17
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x426a58]
jmp 0x414c30
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415102
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x4212e8]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x41513e
xor eax, eax
jmp 0x4152a8
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x428040]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x41517c
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.00418b5c
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x415216
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x415279
jmp 0x4151a0
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x4151db
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4151cc
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x4151ac
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41523a
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x415243
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x41519e
jmp 0x415243
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41523a
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x415243
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x4152a3
cmp dword [ebp - 0x68], eax
je 0x415276
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x41526b
call fcn.00410138
mov dword [eax], 9
call fcn.00410141
mov dword [eax], esi
jmp 0x41529e
push dword [ebp - 0x68]
call fcn.0041014a
pop ecx
jmp 0x41529e
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x41528b
cmp byte [edi], 0x1a
jne 0x41528b
xor eax, eax
jmp 0x4152a6
call fcn.00410138
mov dword [eax], 0x1c
call fcn.00410141
and dword [eax], 0
or eax, 0xffffffff
jmp 0x4152a6
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.0040c31b
add ebp, 0x3a4
leave
ret