joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409bd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x42c410], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x42c40c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x42c410], eax
cmp ecx, 0x26f
jl 0x409be0
mov dword [0x422920], 0x270
ret

Function at 0x409c20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x42b010]
cmp eax, dword [0x422440]
je 0x409c38
mov dword [0x422920], 0x271
cmp dword [0x422920], 0x270
jl 0x409d57
cmp dword [0x422920], 0x271
jne 0x409c6f
mov eax, dword [0x42b010]
call fcn.00409bd0
mov eax, dword [0x42b010]
not eax
mov dword [0x42b010], eax
mov dword [0x422440], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x42c414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x42c410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x42ca44]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x422930]
xor edx, eax
mov dword [ebx*4 + 0x42c410], edx
cmp ebx, 0xe2
jl 0x409c78
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x42c414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x42c410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x42c084]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x422930]
xor edx, eax
mov dword [ebx*4 + 0x42c410], edx
cmp ebx, 0x26e
jl 0x409ccc
mov eax, dword [0x42cdcc]
and eax, 0x80000000
mov edx, dword [0x42c410]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x42ca40]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x422930]
xor eax, edx
mov dword [0x42cdcc], eax
mov dword [0x422920], 0
mov eax, dword [0x422920]
mov eax, dword [eax*4 + 0x42c410]
add dword [0x422920], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x40b770
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4221b0]
cmp ax, 0xcb
je 0x40b86c
cmp ax, 0xcc
je 0x40b86c
mov edx, dword [0x42d020]
test edx, edx
je 0x40b7a2
mov eax, dword [0x42cec0]
call edx
mov ebx, eax
jmp 0x40b7a7
mov ebx, 0x42cec4
cmp word [0x42ceb0], 0
jle 0x40b7ca
mov eax, 0x42ce90
call fcn.0040b9e0
mov eax, ebx
call fcn.0040b350
mov eax, ebx
call fcn.0040b3c0
mov edi, dword [ebx]
jmp 0x40b7ea
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40b7e5
mov edx, edi
mov eax, ebx
call fcn.0040a820
jmp 0x40b7e8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40b7d0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x42ceb0], 0
jle 0x40b86c
mov edx, 0x42cdd0
mov eax, ebx
call fcn.0040a950
mov edi, eax
test edi, edi
je 0x40b83f
mov eax, dword [0x42ce64]
mov dword [edi + 0xc], eax
cmp dword [0x42ce64], 0
je 0x40b834
mov eax, dword [0x42ce64]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x42ce64], eax
sub word [0x42ceb0], 1
cmp word [0x42ceb0], 0
sete bl
mov eax, 0x42ce90
call fcn.0040b9f0
test bl, bl
je 0x40b86c
mov eax, 0x42ce90
call fcn.0040b9d0
pop edi
pop esi
pop ebx
ret
Function at 0x40d240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x42c250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.0040d420
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x42c250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402460
call sub.kernel32.dll_GetCommandLineA
mov dword [0x422220], eax
mov esi, dword [0x422220]
jmp 0x40d3e0
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x40d2d0
cmp byte [esi], 0
je 0x40d3e9
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x40d345
mov al, byte [esi]
cmp al, 1
jb 0x40d33b
sub al, 0x20
jbe 0x40d30c
sub al, 2
je 0x40d31f
jmp 0x40d33b
mov al, byte [ebp - 0x10c]
test al, al
je 0x40d34a
add dword [ebp - 0x110], 1
jmp 0x40d342
cmp byte [esi + 1], 0x22
je 0x40d336
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40d342
add esi, 1
jmp 0x40d342
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x40d2fc
test dword [ebp - 0x114], 0xffffffff
je 0x40d3d9
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.0040d420
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x42c250]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x40d3d1
mov al, byte [esi]
cmp al, 1
jb 0x40d3c7
sub al, 0x20
jbe 0x40d398
sub al, 2
je 0x40d3ab
jmp 0x40d3c7
mov al, byte [ebp - 0x10c]
test al, al
je 0x40d3d6
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40d3ce
cmp byte [esi + 1], 0x22
je 0x40d3c2
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40d3ce
add esi, 1
jmp 0x40d3ce
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x40d388
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x40d2d3
mov ebx, dword [ebp - 0x114]
mov dword [0x42c240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x42c250
call fcn.0040b5d0
mov eax, dword [0x42c250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41eb30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00409250
call fcn.0040a610
push eax
test eax, eax
jne 0x41ebf4
mov ebx, 1
sub ebx, 1
mov esi, esi
add ebx, 1
lea eax, [ebx*4 + 0x42d8dc]
mov edx, 0
call fcn.00405f00
mov dword [ebx*4 + 0x42d8fc], 0xffffffff
cmp ebx, 7
jl 0x41eb68
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x41ebf4
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0xa
call fcn.004068c0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.0041a950
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x41ebf4
push 4
push ebx
push esi
mov eax, 0x41e9f0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x41ea90
push eax
call sub.kernel32.dll_EnumCalendarInfoA
call fcn.004094d0
lea eax, [ebp - 0x38]
call fcn.00402ac0
pop eax
test eax, eax
je 0x41ec0b
call fcn.00409600
pop esi
pop ebx
leave
ret

Function at 0x41fb30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, esi
mov cl, 0
mov edx, 0x20
call fcn.004024a0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
push 0
lea eax, [esi + 4]
push eax
mov eax, esi
push eax
push 0
push 0
push 0
push dword [ebx + 0x10]
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete bl
test bl, bl
je 0x41fb95
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.0041d5e0
fstp qword [esi + 0x18]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x41fd40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x88]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x88], 0
mov eax, 1
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.00409250
call fcn.0040a610
push eax
test eax, eax
jne 0x41fe48
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0xb8]
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0041fb30
test al, al
je 0x41fe48
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x34]
call fcn.0040a690
mov eax, 1
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x68]
call fcn.00409250
call fcn.0040a610
push eax
test eax, eax
jne 0x41fe31
mov eax, dword [ebp - 0x30]
lea ebx, [eax - 1]
mov dword [ebp - 0x10], 0
cmp ebx, dword [ebp - 0x10]
jl 0x41fe31
sub dword [ebp - 0x10], 1
mov esi, esi
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
call sub.advapi32.dll_RegEnumKeyExA
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x34]
call fcn.0041d840
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
cmp ebx, dword [ebp - 0x10]
jg 0x41fde0
call fcn.004094d0
mov eax, dword [ebp - 0x34]
call fcn.0040a6c0
pop eax
test eax, eax
je 0x41fe48
call fcn.00409600
call fcn.004094d0
lea eax, [ebp - 0x88]
call fcn.00402ac0
pop eax
test eax, eax
je 0x41fe62
call fcn.00409600
pop ebx
leave
ret
Function at 0x41fe70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x88]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x88], 0
mov eax, 1
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
call fcn.00409250
call fcn.0040a610
push eax
test eax, eax
jne 0x41ff78
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0xb8]
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.0041fb30
test al, al
je 0x41ff78
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x34]
call fcn.0040a690
mov eax, 1
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x68]
call fcn.00409250
call fcn.0040a610
push eax
test eax, eax
jne 0x41ff61
mov eax, dword [ebp - 0x28]
lea ebx, [eax - 1]
mov dword [ebp - 0x10], 0
cmp ebx, dword [ebp - 0x10]
jl 0x41ff61
sub dword [ebp - 0x10], 1
mov esi, esi
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
call sub.advapi32.dll_RegEnumValueA
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x34]
call fcn.0041d840
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
cmp ebx, dword [ebp - 0x10]
jg 0x41ff10
call fcn.004094d0
mov eax, dword [ebp - 0x34]
call fcn.0040a6c0
pop eax
test eax, eax
je 0x41ff78
call fcn.00409600
call fcn.004094d0
lea eax, [ebp - 0x88]
call fcn.00402ac0
pop eax
test eax, eax
je 0x41ff92
call fcn.00409600
pop ebx
leave
ret
Function at 0x52bde0
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xd3
mov edi, 0xd9178c6d
adc ecx, dword [eax - 0x55e60bd]
or ebx, edi
cld
invalid

Function at 0x5d7487
Capabilities:
Encode data using xor

Disassembly:
dec byte [ebx]
or cl, byte [di + 0x17]
xchg ebp, eax
push ebp
mov bh, 0x3e
stosd dword es:[edi], eax
dec edx
retf 0xacdb
insb byte es:[edi], dx
loope 0x5d747c
push esp
insb byte es:[edi], dx
or ch, ah
salc
retf
invalid
push esi
jge 0x5d73c8
pop esp
ret 0xdbca
aad 0x9a
sti
mov word [edx], ds
out dx, al
mov bh, 0xe3
movsb byte es:[edi], byte [esi]
loopne 0x5d743f
jae 0x5d742f
test dword [esp + edx*2 - 0x583d7009], esi
je 0x5d749b
push ebp
inc esi
inc eax
mov dword [0x4e10a471], eax
fcmovu st(0), st(6)
mov byte [edi + 1], al
in eax, dx
lodsd eax, dword [esi]
fimul word [eax - 0x5212feb9]
and eax, 0xe3c47688
jne 0x5d74e7
dec eax
or al, 0x37
je 0x5d74d9
call dword [ebx + 0x32fa8a71]
mov ebp, 0xc276af45
xchg ebx, eax
jno 0x5d743b
cli
xor bh, byte [ebp - 0x3d8950bb]
mov dl, 0x34
push ecx
pop ds
pushfd
mov esi, 0x58c43b9f
xchg esp, eax
pop edi
pop ebp
add esi, dword [edx - 0x56d3d264]
salc
movsb byte es:[edi], byte [esi]
pushfd
sub eax, 0xa4d6a92c
cwde
jl 0x5d74ae
inc edi
pop ebp
invalid
stosb byte es:[edi], al
mov ebp, 0x5d3c05bc
jnp 0x5d7554
outsb dx, byte [esi]
or ebp, dword [0xb624f725]
and ebp, dword [ecx]
push esi
movsd dword es:[edi], dword [esi]
mov dh, 0x23
sub dword [esi - 0x5b], edx
loopne 0x5d750b
adc ah, dh
adc byte [0x3dbbfc37], dh
jb 0x5d74c7
fstp dword [esp + eax*4 - 0x7d9ad6e6]
sbb esi, ebp
hlt
ret 0xabea
stosb byte es:[edi], al
sbb al, 0x98
fld qword [ecx]
mov es, word [ebx - 0x59655b84]
cmp bh, byte [esi]
invalid
Function at 0x65a88c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6634a0
cmp edx, dword [eax]
je 0x65a8ae
add eax, 8
inc ecx
cmp eax, 0x663530
jl 0x65a89f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6634a0]
jne 0x65a9dc
mov eax, dword [0xa5bd14]
cmp eax, 1
je 0x65a9b6
test eax, eax
jne 0x65a8df
cmp dword [0x6612e4], 1
je 0x65a9b6
cmp edx, 0xfc
je 0x65a9dc
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x65a916
lea eax, [ebp - 0x1a4]
push 0x65e9a0
push eax
call fcn.0065b9f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065bae0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65a959
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065bae0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e99c
push edi
call fcn.0065c4a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e980
push eax
call fcn.0065b9f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065ba00
lea eax, [ebp - 0xa0]
push 0x65e97c
push eax
call fcn.0065ba00
push dword [esi + 0x6634a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065ba00
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e954
push eax
call fcn.0065c412
add esp, 0x2c
pop edi
jmp 0x65a9dc
lea eax, [ebp + 8]
lea esi, [esi + 0x6634a4]
push 0
push eax
push dword [esi]
call fcn.0065bae0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401c10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401c5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c54
test esi, esi
je 0x401c54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c30
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e40
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f68
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401ece
cmp eax, 4
jne 0x401ef0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401ede
cmp edx, 4
je 0x401ede
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e40
Function at 0x400260
Capabilities:
Accept command line arguments
Download url
Receive data
Terminate process

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
xor esi, esi
push eax
mov dword [esp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 4], 3
jge 0x40029e
push 0x40023c
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
push esi
push esi
push ecx
push edx
push esi
call sub.urlmon.dll_URLDownloadToFileW
cmp eax, esi
je 0x4002c6
push eax
push 0x400224
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
mov esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4244b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e07c
and dword [ebp - 4], 0
cmp dword [0x44c378], 0
mov ebx, eax
jne 0x424566
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424617
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424617
push eax
call fcn.0041e00a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c378], eax
call esi
push eax
call fcn.0041e00a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c37c], eax
call esi
push eax
call fcn.0041e00a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c380], eax
call esi
push eax
call fcn.0041e00a
pop ecx
mov dword [0x44c388], eax
test eax, eax
je 0x424566
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e00a
pop ecx
mov dword [0x44c384], eax
mov eax, dword [0x44c384]
cmp eax, ebx
je 0x4245be
cmp dword [0x44c388], ebx
je 0x4245be
push eax
call fcn.0041e085
push dword [0x44c388]
mov esi, eax
call fcn.0041e085
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4245be
test edi, edi
je 0x4245be
call esi
test eax, eax
je 0x4245b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4245b5
test byte [ebp - 0xc], 1
jne 0x4245be
or dword [ebp + 0x10], 0x200000
jmp 0x4245f7
mov eax, dword [0x44c37c]
cmp eax, ebx
je 0x4245f7
push eax
call fcn.0041e085
pop ecx
test eax, eax
je 0x4245f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4245f7
mov eax, dword [0x44c380]
cmp eax, ebx
je 0x4245f7
push eax
call fcn.0041e085
pop ecx
test eax, eax
je 0x4245f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c378]
call fcn.0041e085
pop ecx
test eax, eax
je 0x424617
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424619
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040dcc3

Function at 0x409dd8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409e32
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409e32
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x409e22
cmp esi, ecx
jae 0x409e32
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x409e10
cmp esi, ecx
jae 0x409e32
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
jmp 0x409e34
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40afed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x40b032
call fcn.00428738
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40b02f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b079
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x40b055
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x595a54]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x40b076
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x595a54]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc