joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417a21
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x48ff80]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417a64
cmp word [esi], dx
jne 0x417a64
or byte [edi + eax + 0x28], 4
jmp 0x417a69
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x417bbc
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x417b9c
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x417aab
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x417ae1
cmp eax, edx
jae 0x417aed
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x417a83
jmp 0x417bbc
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417b98
cmp dword [ebp - 0x14], 0
je 0x417b98
mov eax, dword [ebx*4 + 0x48ff80]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x417b70
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x417b39
mov word [esi], cx
jmp 0x417b6c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x48ff80]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x48ff80]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x48ff80]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x417bbc
pop ebx
cmp word [ebp - 4], bx
jne 0x417b81
cmp esi, dword [ebp + 0xc]
jne 0x417b81
mov word [esi], bx
jmp 0x417bb9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00418455
add esp, 0x10
cmp word [ebp - 4], bx
je 0x417bbc
push 0xd
jmp 0x417bb5
mov ecx, dword [ebx*4 + 0x48ff80]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x417bb3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x417bbc
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x66fe29c4
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x39f620e1
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x7813166c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
je 0x7813167e
xor eax, eax
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7813167b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x781316b0
cmp eax, 0x20b
jne 0x7813167b
xor eax, eax
cmp dword [ecx + 0x84], 0xe
jbe 0x781316c1
cmp dword [ecx + 0xf8], eax
jmp 0x781316be
xor eax, eax
cmp dword [ecx + 0x74], 0xe
jbe 0x781316c1
cmp dword [ecx + 0xe8], eax
setne al
ret
Function at 0x7813480f
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
push ebx
mov ebp, str.__MSVCRT_HEAP_SELECT
push ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x78134961
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x7813495f
push esi
push ebx
push ebp
call edi
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
jbe 0x78134953
cmp eax, esi
ja 0x78134953
cmp byte [ebx], 0
mov ecx, ebx
je 0x78134889
mov al, byte [ecx]
cmp al, 0x61
jl 0x78134883
cmp al, 0x7a
jg 0x78134883
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x78134875
push 0x16
push ebx
push str.__GLOBAL_HEAP_SELECTED
call sym.MSVCR80.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x781348a1
mov edi, ebx
jmp 0x781348fc
push 0x105
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78134953
push 3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov ecx, esi
je 0x781348e5
mov al, byte [ecx]
cmp al, 0x61
jl 0x781348df
cmp al, 0x7a
jg 0x781348df
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x781348d1
push esi
push ebx
call sym.MSVCR80.dll_strstr
pop ecx
pop ecx
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
test edi, edi
je 0x78134953
push 0x2c
push edi
call sym.MSVCR80.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x78134953
inc eax
cmp byte [eax], 0x20
je 0x7813490e
mov cl, byte [eax]
xor esi, esi
cmp cl, 0x30
jl 0x78134953
cmp cl, 0x39
jg 0x78134934
imul esi, esi, 0xa
movsx ecx, cl
inc eax
lea esi, [esi + ecx - 0x30]
mov cl, byte [eax]
cmp cl, 0x30
jge 0x7813491d
cmp esi, 2
je 0x78134943
cmp esi, 3
je 0x78134943
cmp esi, 1
jne 0x78134953
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov eax, esi
jmp 0x781349c1
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
je 0x7813497d
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x78134999
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [esp + 0x10], 2
jne 0x781349ac
cmp dword [esp + 0x14], 5
jb 0x781349ac
xor eax, eax
inc eax
jmp 0x781349c1
lea eax, [esp + 0x18]
push eax
call fcn.781347e2
cmp byte [esp + 0x1c], 6
pop ecx
sbb eax, eax
add eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x781394c3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call sym.MSVCR80.dll__encoded_null
xor ebx, ebx
cmp dword [0x781c4054], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x78139598
push 0x78194ebc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x78139503
xor eax, eax
jmp 0x7813965c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x781394fc
push eax
call sym.MSVCR80.dll__encode_pointer
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x781c4054], eax
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x781c4058], eax
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
mov dword [0x781c405c], eax
lea eax, [ebp - 8]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
pop ecx
je 0x78139566
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x78139598
push str.GetUserObjectInformationA
push edi
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
cmp eax, ebx
pop ecx
mov dword [0x781c4064], eax
je 0x78139598
push str.GetProcessWindowStation
push edi
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
pop ecx
mov dword [0x781c4060], eax
mov eax, dword [0x781c4060]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x78139611
cmp dword [0x781c4064], esi
je 0x78139611
push eax
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
cmp eax, ebx
je 0x781395de
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x781c4064]
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
test eax, eax
je 0x781395de
test byte [ebp - 0x18], 1
jne 0x78139611
lea eax, [ebp - 0xc]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x781395f9
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x78139608
or dword [ebp + 0x10], 0x200000
jmp 0x78139642
or dword [ebp + 0x10], 0x40000
jmp 0x78139642
mov eax, dword [0x781c4058]
cmp eax, esi
je 0x78139642
push eax
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x78139642
mov eax, dword [0x781c405c]
cmp eax, esi
je 0x78139642
push dword [ebp - 4]
push eax
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x781c4054]
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure
Function at 0x7813b350
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call sym.MSVCR80.dll__encoded_null
xor ebx, ebx
cmp dword [0x781c40a0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x7813b425
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
jne 0x7813b390
xor eax, eax
jmp 0x7813b4e9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x7813b389
push eax
call sym.MSVCR80.dll__encode_pointer
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x781c40a0], eax
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x781c40a4], eax
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
mov dword [0x781c40a8], eax
lea eax, [ebp - 8]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
pop ecx
je 0x7813b3f3
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x7813b425
push str.GetUserObjectInformationW
push edi
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
cmp eax, ebx
pop ecx
mov dword [0x781c40b0], eax
je 0x7813b425
push str.GetProcessWindowStation
push edi
call esi
push eax
call sym.MSVCR80.dll__encode_pointer
pop ecx
mov dword [0x781c40ac], eax
mov eax, dword [0x781c40ac]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x7813b49e
cmp dword [0x781c40b0], esi
je 0x7813b49e
push eax
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
cmp eax, ebx
je 0x7813b46b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x781c40b0]
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
test eax, eax
je 0x7813b46b
test byte [ebp - 0x18], 1
jne 0x7813b49e
lea eax, [ebp - 0xc]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x7813b486
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x7813b495
or dword [ebp + 0x10], 0x200000
jmp 0x7813b4cf
or dword [ebp + 0x10], 0x40000
jmp 0x7813b4cf
mov eax, dword [0x781c40a4]
cmp eax, esi
je 0x7813b4cf
push eax
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x7813b4cf
mov eax, dword [0x781c40a8]
cmp eax, esi
je 0x7813b4cf
push dword [ebp - 4]
push eax
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x781c40a0]
call sym.MSVCR80.dll__decode_pointer
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__invalid_parameter
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__invalid_parameter
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret

Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__invalid_parameter
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__invalid_parameter
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret

Function at 0x401210
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
push esi
push edi
mov ecx, 9
mov esi, str.SoftwarePortrait_DisplaysWinPortrait
lea edi, [esp + 0x18]
mov eax, 4
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
movsw word es:[edi], word [esi]
push eax
push 0xf003f
push 0
push ecx
push 0x80000001
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x4012ab
lea edx, [esp + 8]
lea eax, [esp + 4]
push edx
mov edx, dword [esp + 4]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.CTRL_HWND
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4012a0
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov ecx, dword [esp + 4]
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x38
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x38
ret
Function at 0x4010a0
Capabilities:
Terminate process

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
lea edi, [ebp - 0x10]
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov dword [0x412138], eax
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x10], edi
mov eax, section..data
mov dword [esp + 0xc], eax
mov eax, str.chilqswv
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00408790
cmp eax, 0xffffffff
je 0x40118f
sub eax, 0x63
cmp eax, 0x14
ja case.0x4010ec.100
jmp dword [eax*4 + 0x40c3b8]
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00401040
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
mov eax, 1
mov dword [0x412510], eax
jmp 0x4010b9
call fcn.004073e0
mov dword [esp], 0
call sub.cygwin1.dll_exit
mov eax, 1
mov dword [0x4123f0], eax
jmp 0x4010b9
mov edx, 1
mov dword [0x4124f0], edx
jmp 0x4010b9
mov ecx, 1
mov dword [0x412440], ecx
jmp 0x4010b9
mov byte [0x4123d0], 1
jmp 0x4010b9
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00401040
jmp 0x401125
mov eax, 1
mov dword [0x4124a0], eax
jmp 0x4010b9
cmp dword [0x412138], esi
jge 0x4011d8
mov dword [esp], 8
call fcn.00407510
mov ecx, dword [0x412138]
mov edx, eax
mov dword [edx + 4], 0
mov eax, dword [ebx + ecx*4]
mov dword [edx], eax
mov eax, dword [0x412008]
test eax, eax
jne 0x4011e0
mov dword [0x412540], edx
mov dword [0x412008], edx
lea eax, [ecx + 1]
cmp eax, esi
mov dword [0x412138], eax
jl 0x401197
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [eax + 4], edx
jmp 0x4011c6
Function at 0x402bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebx
mov ecx, 0x40f09c
mov dword [esp + 4], ecx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 2
call sub.cygwin1.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x406f00
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ecx, dword [0x4124a0]
mov byte [0x412380], 1
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x406f28
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00405680
mov dword [esp + 4], ebx
mov dword [esp], 0x40fab7
call sub.cygwin1.dll_printf
mov dword [esp], ebx
call sub.cygwin1.dll_strlen
mov edx, dword [0x412410]
add eax, edx
cmp eax, 0x3c
mov dword [0x412410], eax
jg 0x406f58
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [esp], 0xa
call sub.cygwin1.dll_putchar
xor eax, eax
mov dword [0x412410], eax
jmp 0x406f52

Function at 0x4074d0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov edx, 0x27
mov dword [esp + 8], edx
mov dword [esp], str.Fatal_error:_Out_of_memory_for_malloc._n
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
Function at 0x407920
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [esp], esi
call sub.cygwin1.dll_strlen
dec eax
je 0x407950
mov dword [esp + 4], esi
mov dword [esp], str.multiple_letter_name____s
call fcn.00407760
mov dword [esp + 4], esi
mov eax, dword [0x412550]
mov dword [esp], eax
call fcn.00407150
test eax, eax
mov ebx, eax
je 0x407a80
cmp edi, 1
je 0x407993
jle 0x407a33
cmp edi, 3
jle 0x4079e0
mov dword [esp], str.End_of_util.c_lookup___reached.__Please_report_this_bug.
call fcn.00407890
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov eax, dword [ebx + 4]
test eax, eax
jne 0x407ac2
mov edx, dword [0x412490]
lea eax, [edx + 1]
cmp edx, 0x7ffe
mov dword [0x412490], eax
mov eax, dword [0x412390]
mov dword [ebx + 4], edx
mov dword [eax + edx*4], esi
jg 0x407b3e
cmp edx, dword [0x412470]
jge 0x407a2c
mov eax, dword [ebx + 4]
neg eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
test eax, eax
jne 0x407acf
mov edx, dword [0x412530]
lea eax, [edx + 1]
cmp edx, 0x7ffe
mov dword [0x412530], eax
mov eax, dword [0x412340]
mov dword [ebx + 8], edx
mov dword [eax + edx*4], esi
jg 0x407b4a
cmp edx, dword [0x4124b0]
jge 0x407b14
mov eax, dword [ebx + 8]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00405aa0
jmp 0x4079cb
test edi, edi
jne 0x40797b
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x407b2e
mov edx, dword [0x4125e0]
lea eax, [edx + 1]
cmp edx, 0x7fff
mov dword [0x4125e0], eax
mov eax, dword [0x412420]
mov dword [ebx + 0xc], edx
mov dword [eax + edx*4 - 4], esi
jg 0x407b56
cmp edx, dword [0x4123a0]
jge 0x407b21
mov eax, dword [ebx + 0xc]
jmp 0x4079d0
mov dword [esp], 0x1c
call fcn.00407510
mov dword [esp], esi
mov ebx, eax
call fcn.00407730
mov dword [ebx], eax
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x412550
call fcn.004071b0
jmp 0x40796b
mov dword [esp], esi
call sub.cygwin1.dll_free
jmp 0x4079cb
mov dword [esp], esi
call sub.cygwin1.dll_free
mov esi, dword [0x412440]
test esi, esi
setne al
xor edx, edx
cmp edi, 3
sete dl
test edx, eax
je 0x407a1c
mov eax, dword [ebx + 8]
cmp eax, 6
jg 0x4079d0
mov eax, dword [0x412530]
lea edx, [eax + 1]
mov dword [0x412530], edx
mov dword [ebx + 8], eax
jmp 0x4079d0
call fcn.00405c00
mov eax, dword [ebx + 8]
jmp 0x407a1f
call fcn.00405b50
mov eax, dword [ebx + 0xc]
jmp 0x4079d0
mov dword [esp], esi
call sub.cygwin1.dll_free
mov eax, dword [ebx + 0xc]
jmp 0x4079d0
mov dword [esp], str.Too_many_array_variables
jmp 0x407982
mov dword [esp], str.Too_many_functions
jmp 0x407982
mov dword [esp], str.Too_many_variables
jmp 0x407982