joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4055e7
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, dword [0x417230]
sub eax, 0x100
cmp edi, eax
ja 0x4017ad
lodsb al, byte [esi]
cmp al, 1
je 0x40592d
jb 0x405963
cmp al, 3
jb 0x4056b9
je 0x4057fc
cmp al, 0xf
je 0x405637
cmp al, 0x13
je 0x40562c
cmp al, 0x10
jne 0x401867
lodsb al, byte [esi]
jmp 0x40ba07
lodsb al, byte [esi]
mov byte [0x4172f8], al
jmp 0x405961
lodsd eax, dword [esi]
mov dword [0x4171b4], eax
mov byte [0x4172fe], 0
cmp dword [0x41718c], 0
je fcn.004056ab
cmp byte [0x4172f5], 0
jne fcn.004056ab
mov ebx, dword [0x417230]
mov dword [ebx - 4], 1
mov dword [ebx - 8], 0x1c
sub ebx, 0x24
cmp ebx, edi
jbe 0x4017ad
mov dword [0x417230], ebx
mov dword [ebx], eax
mov dword [ebx + 4], edi
mov eax, dword [0x417200]
mov edx, dword [0x417204]
mov ecx, dword [0x417208]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], ecx
mov edx, dword [0x41720c]
mov eax, dword [0x4172f7]
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], eax
lodsd eax, dword [esi]
cmp eax, 0xf
jb 0x40198d
je 0x4019a2
mov ebx, eax
lodsb al, byte [esi]
mov byte [0x4172eb], al
call fcn.004056d8
jmp fcn.004056ab
lodsd eax, dword [esi]
inc esi
cmp eax, 0xf
jb 0x40198d
je 0x4019a2
mov edx, dword [eax + 8]
push edx
cmp word [0x417192], 0
je 0x405833
test dl, 4
jne 0x405833
mov cx, word [0x417192]
cmp cx, word [eax + 0x10]
je 0x405833
and dl, 0xfe
mov byte [eax + 8], dl
push eax
mov al, byte [esi - 1]
push eax
or byte [0x4172d9], 0xff
call fcn.00407c89
pop ebx
mov ch, bl
pop ebx
pop dword [ebx + 8]
cmp ebx, 0xf
jb 0x40198d
je 0x4019a2
xor cl, cl
mov ch, byte [0x4172ee]
cmp ch, 3
je 0x40198d
and byte [ebx + 9], 0xfe
cmp eax, dword [ebx]
mov dword [ebx], eax
setne ah
cmp edx, dword [ebx + 4]
mov dword [ebx + 4], edx
setne al
or ah, al
mov al, byte [0x4172ef]
xor al, byte [ebx + 9]
and al, 2
or ah, al
xor byte [ebx + 9], al
cmp cl, byte [ebx + 0xa]
mov byte [ebx + 0xa], cl
setne al
or ah, al
cmp ch, byte [ebx + 0xb]
mov byte [ebx + 0xb], ch
setne al
or ah, al
xor edx, edx
cmp edx, dword [ebx + 0xc]
mov dword [ebx + 0xc], edx
setne al
or ah, al
or ch, ch
je 0x4058c8
mov edx, dword [0x417270]
cmp edx, dword [ebx + 0x14]
mov dword [ebx + 0x14], edx
setne al
or ah, al
mov cx, word [0x417192]
xchg word [ebx + 0x10], cx
mov edx, dword [0x4171b4]
mov dword [ebx + 0x1c], edx
test byte [ebx + 8], 1
je 0x405927
cmp cx, word [ebx + 0x10]
jne 0x4058f8
test byte [ebx + 8], 2
je 0x4019a9
or byte [ebx + 8], 4
jmp 0x405953
inc cx
sub cx, word [ebx + 0x10]
setne al
or ah, al
je 0x405953
test byte [ebx + 8], 4
jne 0x405953
test byte [ebx + 8], 8
je 0x405953
mov cx, word [0x417192]
cmp cx, word [ebx + 0x12]
jne 0x405953
or byte [0x4172f5], 0xff
jmp 0x405953
or byte [ebx + 8], 3
jmp 0x405953
mov dword [0x4172d8], 0
mov dword [0x4172dc], 0
call 0x405946
movzx ebx, word [esi]
mov al, byte [esi + 2]
add esi, 3
add dword [esp], ebx
ret
mov al, byte [esi]
cmp al, 0xf
je 0x405961
or al, al
jne 0x4019c5
dec esi
stc
ret
mov ah, al
shr ah, 4
cmp ah, 6
jne 0x401867
and al, 0xf
mov byte [0x4172e4], al
call fcn.0041109b
or byte [0x4172fe], 0xff
jmp fcn.004056ab
Function at 0x4056d8
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, edi
xor edx, edx
xor cl, cl
sub eax, dword [0x417200]
sbb edx, dword [0x417204]
sbb cl, byte [0x4172fa]
jp 0x4056f7
call fcn.00407ac9
mov byte [0x4172f2], cl
cmp byte [0x4172f9], 0
jne 0x40573a
or byte [ebx + 9], 1
xchg dword [ebx], eax
xchg dword [ebx + 4], edx
mov ch, byte [ebx + 9]
shr ch, 1
and ch, 1
neg ch
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
sbb ch, cl
mov dword [0x417268], eax
mov dword [0x41726c], edx
mov byte [0x4172fb], ch
or al, ch
or eax, edx
setne ah
jmp 0x405750
and byte [ebx + 9], 0xfe
cmp eax, dword [ebx]
mov dword [ebx], eax
setne ah
cmp edx, dword [ebx + 4]
mov dword [ebx + 4], edx
setne al
or ah, al
mov ch, byte [0x4172f7]
mov cl, byte [0x4172eb]
mov ebp, dword [0x417208]
mov edx, dword [0x41720c]
Function at 0x406fc2
Capabilities:
Query environment variable
Terminate process

Disassembly:
or cl, cl
je 0x407009
cmp byte [esi + 8], cl
jne 0x406fd7
mov al, byte [ebx]
add byte [esi + 0xa], al
jne 0x407009
mov byte [esi + 8], 0
ret
cmp byte [esi + 9], cl
jne 0x406fe8
mov al, byte [ebx]
add byte [esi + 0xb], al
jne 0x407009
mov byte [esi + 9], 0
ret
cmp byte [esi + 8], 0
jne 0x406ff7
mov byte [esi + 8], cl
mov al, byte [ebx]
mov byte [esi + 0xa], al
ret
cmp byte [esi + 9], 0
jne 0x4018cb
mov byte [esi + 9], cl
mov al, byte [ebx]
mov byte [esi + 0xb], al
ret

Function at 0x407079
Capabilities:
Query environment variable
Terminate process

Disassembly:
or cl, cl
je 0x407009
neg byte [ebx]
jmp 0x406fc6

Function at 0x4071b5
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov al, byte [edi]
cbw
cwde
cdq
cmp edx, dword [edi + 4]
jne 0x4018e9
cmp eax, dword [edi]
jne 0x4018e9
ret

Function at 0x407730
Capabilities:
Query environment variable
Terminate process

Disassembly:
xor ebx, ebx
cmp dword [edi], 0
jne 0x40774f
cmp dword [edi + 4], 0
jne 0x40774f
cmp byte [0x4172f5], 0
je 0x4018e9
jmp 0x407819
cmp byte [esi + 0xd], 0
je 0x407775
mov eax, dword [esi]
mov edx, dword [esi + 4]
not eax
not edx
add eax, 1
adc edx, 0
mov dword [esi], eax
mov dword [esi + 4], edx
or eax, edx
je 0x4018e9
xor bx, 0xffff
cmp byte [edi + 0xd], 0
je 0x40779a
mov eax, dword [edi]
mov edx, dword [edi + 4]
not eax
not edx
add eax, 1
adc edx, 0
mov dword [edi], eax
mov dword [edi + 4], edx
or eax, edx
je 0x4018e9
xor bl, 0xff
cmp dword [edi + 4], 0
jne 0x4077b8
mov ecx, dword [edi]
mov eax, dword [esi + 4]
xor edx, edx
div ecx
mov dword [esi + 4], eax
mov eax, dword [esi]
div ecx
mov dword [esi], eax
mov eax, edx
xor edx, edx
jmp 0x407819
push ebx
mov eax, dword [esi + 4]
xor edx, edx
div dword [edi + 4]
mov ebx, dword [esi]
mov dword [esi], eax
mov dword [esi + 4], 0
mov ecx, edx
mul dword [edi]
cmp ecx, edx
ja 0x4077e3
jb 0x4077ee
cmp ebx, eax
jae 0x4077e3
dec dword [esi]
sub eax, dword [edi]
sbb edx, dword [edi + 4]
jae 0x4077d0
sub ebx, eax
sbb ecx, edx
mov edx, ecx
mov eax, ebx
pop ebx
jmp 0x407819
push eax
push edx
mov eax, edx
sub eax, ecx
xor edx, edx
div dword [edi + 4]
shr eax, 1
je 0x407815
sub dword [esi], eax
push eax
mul dword [edi + 4]
sub dword [esp + 4], eax
pop eax
mul dword [edi]
sub dword [esp + 4], eax
sbb dword [esp], edx
pop edx
pop eax
jmp 0x4077d0
pop edx
pop eax
jmp 0x4077da
or bh, bh
je 0x40782f
not eax
not edx
add eax, 1
adc edx, 0
mov ecx, eax
or ecx, edx
jne 0x40782f
not bh
or bl, bl
je 0x407848
not dword [esi]
not dword [esi + 4]
add dword [esi], 1
adc dword [esi + 4], 0
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x407848
not bl
mov byte [esi + 0xd], bl
ret

Function at 0x40784c
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, dword [0x417230]
mov dword [eax - 4], 2
mov dword [eax - 8], 4
sub eax, 0xc
cmp eax, edi
jbe 0x4017ad
mov dword [0x417230], eax
mov dword [eax], ebx
ret
Function at 0x407c89
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov byte [0x4172d8], 0
lodsb al, byte [esi]
call fcn.00410ef8
cmp al, 0x28
jne 0x4018df
mov al, byte [0x4172d8]
cmp al, 1
je 0x407d28
cmp al, 2
je 0x407d1c
cmp al, 4
je 0x407d13
cmp al, 6
je 0x407d09
cmp al, 8
je 0x407cfc
or al, al
jne 0x4018df
mov byte [0x4172e9], al
call fcn.00407cd3
mov eax, dword [edi]
mov edx, dword [edi + 4]
ret
call fcn.00407bfd
mov byte [0x4172ef], 0
ret
call fcn.00407bbc
movzx edx, dx
jmp 0x407d01
call fcn.00407b58
xor edx, edx
jmp 0x407d01
call fcn.00407b10
xor edx, edx
movzx eax, ax
jmp 0x407d01
call fcn.00407a87
xor edx, edx
movzx eax, al
jmp 0x407d01

Function at 0x407cd3
Capabilities:
Query environment variable
Terminate process

Disassembly:
call fcn.00406bd8
cmp word [edi + 8], 0
jne 0x4018df
mov eax, dword [edi + 0x10]
mov dword [0x417270], eax
mov al, byte [edi + 0xd]
mov byte [0x4172ef], al
mov al, byte [edi + 0xc]
mov byte [0x4172ee], al
ret
Function at 0x408768
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, dword [0x4171ac]
mov dword [0x4171b0], eax
mov edx, dword [0x4171a0]
mov ecx, dword [0x4171a4]
add dword [0x4171ac], ecx
lea eax, [edx + ecx]
call fcn.004013c3
jb 0x4017cb
ret

Function at 0x408af8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [0x4172f6]
cmp al, 3
je 0x40a1e5
cmp al, 4
je 0x40a5a9
cmp al, 5
je 0x40acd3
ret
call fcn.00409666
mov edx, dword [0x4171a0]
mov dword [edx + 0x50], eax
call fcn.004016ac
mov edx, dword [0x4171a0]
mov dword [edx + 8], eax
mov eax, dword [0x41728c]
mov word [edx + 6], ax
imul eax, eax, 0x28
movzx ecx, word [edx + 0x14]
lea eax, [eax + ecx + 0x18]
add eax, dword [0x417290]
mov ecx, dword [edx + 0x3c]
dec ecx
add eax, ecx
not ecx
and eax, ecx
cmp eax, dword [edx + 0x54]
je 0x40a231
or byte [0x4172f5], 0xff
xor ecx, ecx
add edx, 0x78
test dword [0x41727c], 4
je 0x40a245
add edx, 0x10
mov eax, dword [edx + ecx*8]
or eax, eax
je 0x40a263
cmp dword [edx + ecx*8 + 4], 0xffffffff
jne 0x40a263
mov ebx, dword [edx + ecx*8]
mov eax, dword [ebx + 0xc]
mov dword [edx + ecx*8], eax
mov eax, dword [ebx + 8]
mov dword [edx + ecx*8 + 4], eax
inc cl
cmp cl, 0x10
jb 0x40a245
cmp dword [edx + 0x28], 0
jne 0x40a291
mov eax, dword [0x417288]
shl eax, 2
sub dword [0x417198], eax
btr dword [0x417280], 0
jae 0x40a2b3
or byte [0x4172f5], 0xff
jmp 0x40a2b3
push edi
mov edi, dword [0x4172b8]
call fcn.00409b6e
pop edi
add dword [0x4172b4], eax
cmp eax, dword [0x4172bc]
je 0x40a2b3
or byte [0x4172f5], 0xff
mov ebx, dword [0x4171a0]
sub ebx, dword [0x417290]
mov ecx, edi
sub ecx, ebx
mov ebp, ecx
shr ecx, 1
xor eax, eax
cdq
mov dx, word [ebx]
add eax, edx
mov dx, ax
shr eax, 0x10
add eax, edx
add ebx, 2
loop 0x40a2ca
add eax, ebp
mov ebx, dword [0x4171a0]
mov dword [ebx + 0x58], eax
ret
call fcn.0040a4be
cmp byte [0x4172f5], 0
je 0x40a5c1
mov eax, dword [0x417284]
mov dword [0x417198], eax
ret
bt dword [0x41727c], 0
jb 0x40b8ec
call fcn.0040a4be
cmp byte [0x4172f5], 0
je 0x40acf9
mov eax, dword [0x417284]
mov dword [0x417198], eax
ret
test dword [0x41727c], 8
jne 0x40b928
call fcn.0040b6b9
mov edx, dword [0x4171a0]
mov eax, dword [0x41728c]
mov byte [edx + 0x1c], 0x34
mov word [edx + 0x2c], ax
shl eax, 5
add eax, edx
add eax, 0x34
cmp eax, dword [0x417284]
je 0x40b927
or byte [0x4172f5], 0xff
ret
call fcn.0040b85e
mov edx, dword [0x4171a0]
mov eax, dword [0x41728c]
mov byte [edx + 0x20], 0x40
mov word [edx + 0x38], ax
imul eax, eax, 0x38
add eax, edx
add eax, 0x40
cmp eax, dword [0x417284]
je 0x40b957
or byte [0x4172f5], 0xff
ret
Function at 0x408d83
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov edx, dword [0x417178]
bt dword [0x41727c], 4
jb 0x408daf
mov eax, dword [0x4171a8]
dec eax
shr eax, 4
inc eax
mov word [edx + 0xe], ax
shl eax, 4
movzx ecx, word [edx + 0x10]
add eax, ecx
mov dword [0x4171a8], eax
mov edi, dword [0x417198]
mov eax, dword [0x417288]
shl eax, 2
add eax, 0x1c
sub edi, eax
xchg dword [0x417198], edi
mov ecx, 0xf
add eax, 0xf
and eax, 0xf
sub ecx, eax
xor al, al
rep stosb byte es:[edi], al
sub edi, dword [0x417198]
mov ecx, edi
shr edi, 4
mov word [edx], 0x5a4d
mov word [edx + 8], di
mov eax, dword [0x417288]
mov word [edx + 6], ax
mov eax, dword [0x4171a4]
add eax, ecx
mov esi, eax
shr esi, 9
and eax, 0x1ff
inc si
or ax, ax
jne 0x408e10
dec si
mov word [edx + 2], ax
mov word [edx + 4], si
mov eax, dword [0x4171a8]
dec eax
shr eax, 4
inc eax
mov esi, dword [0x4171a4]
dec esi
shr esi, 4
inc esi
sub eax, esi
mov word [edx + 0xa], ax
add word [edx + 0xc], ax
salc
mov ah, al
or word [edx + 0xc], ax
mov word [edx + 0x18], 0x1c
add dword [0x4171ac], ecx
call fcn.004013c3
jb 0x4017cb
ret

Function at 0x409666
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov ebx, dword [0x417298]
mov edx, dword [0x4171a0]
mov eax, edi
sub eax, dword [ebx + 0x14]
jne 0x409687
bt dword [0x41727c], 5
jb 0x409687
mov eax, dword [ebx + 0xc]
ret
mov dword [ebx + 8], eax
cmp edi, dword [0x417218]
jne 0x4096a1
cmp dword [edx + 0x38], 0x1000
jb 0x4096a1
mov edi, dword [0x417214]
mov dword [0x417218], 0
mov ebp, edi
sub ebp, dword [ebx + 0x14]
mov ecx, dword [edx + 0x3c]
dec ecx
lea eax, [ebp + ecx]
not ecx
and eax, ecx
mov dword [ebx + 0x10], eax
sub eax, ebp
mov ecx, eax
xor al, al
rep stosb byte es:[edi], al
mov eax, dword [0x4171a0]
sub eax, dword [0x417290]
sub dword [ebx + 0x14], eax
mov ecx, dword [ebx + 0x10]
test byte [ebx + 0x24], 0x20
je 0x4096ed
add dword [edx + 0x1c], ecx
cmp dword [edx + 0x2c], 0
jne 0x4096ed
mov eax, dword [ebx + 0xc]
mov dword [edx + 0x2c], eax
test byte [ebx + 0x24], 0x40
je 0x40970e
add dword [edx + 0x20], ecx
test dword [0x41727c], 4
jne 0x40970e
cmp dword [edx + 0x30], 0
jne 0x40970e
mov eax, dword [ebx + 0xc]
mov dword [edx + 0x30], eax
mov eax, dword [ebx + 8]
or eax, eax
je 0x409722
cmp dword [ebx + 0x10], 0
jne 0x409722
or byte [ebx + 0x24], 0x80
add dword [edx + 0x24], ecx
mov ecx, dword [edx + 0x38]
dec ecx
add eax, ecx
not ecx
and eax, ecx
add eax, dword [ebx + 0xc]
add ebx, 0x28
mov dword [0x417298], ebx
inc word [0x41728c]
je 0x4017e3
ret

Function at 0x40ad86
Capabilities:
Query environment variable
Terminate process

Disassembly:
inc ecx
mov eax, ecx
shl eax, 8
mov dword [ebx], eax
inc dx
je 0x4017e3
mov eax, edx
shl eax, 0x10
mov al, 3
test byte [ebx + 0x14], 0x40
je 0x40adae
or ah, 0xff
inc dx
je 0x4017e3
stosd dword es:[edi], eax
ret
Function at 0x410ef8
Capabilities:
Query environment variable
Terminate process

Disassembly:
xor ah, ah
cmp al, 0x11
jne 0x410f2c
mov byte [0x4172ec], 1
lodsw ax, word [esi]
xchg ah, al
mov byte [0x4172d9], 1
cmp ah, byte [0x4172d8]
je 0x410f2b
cmp byte [0x4172d8], 0
jne 0x40188f
mov byte [0x4172d8], ah
ret
mov byte [0x4172ec], 0
cmp al, 0x5b
jne 0x410f2b
mov byte [0x4172d9], 0
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4093f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x409407
pop dword [ebp - 0x28]
mov eax, 0x171e1724
add eax, 0xe9227ce3
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2dc59d3c
sub dword [ebp - 0x38], 0xdf7357f1
mov dword [ebp - 0x34], 0x99625e64
add dword [ebp - 0x34], 0x98d0ede1
mov dword [ebp - 0x30], 0x848b2e5e
sub dword [ebp - 0x30], 0x383eea30
mov dword [ebp - 0x2c], 0x89556cee
sub dword [ebp - 0x2c], 0x89556cee
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd25f1f3b
add dword [ebp - 0x38], 0xa2134a1b
mov dword [ebp - 0x34], 0xbe9506f0
add dword [ebp - 0x34], 0x82d75a85
mov dword [ebp - 0x30], 0x5a6d1f6f
sub dword [ebp - 0x30], 0xf6fdb303
mov dword [ebp - 0x2c], 0xc7a00c1d
add dword [ebp - 0x2c], 0x385ff3e3
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x63659c18
sub eax, 0x6324cbd0
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3892e
push 0
call eax
mov ecx, 0xa594e2ff
sub ecx, 0xa5949e99
xor esi, esi
add esi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x28]
mov ebx, 0x7de663d8
add ebx, 0x372ce818
xor dword [ebp - 0x20], edi
mov edi, dword [edx]
sub dword [ebp - 0x24], 0xa5cb4c06
sub edi, ebx
mov dword [ebp - 0xc], 0x3627d76d
mov dword [esi], edi
add dword [ebp - 0x20], esi
add esi, 4
add edx, 4
loop 0x409520
add eax, 0x5bd43f25
add eax, 0xa42cc546
xor ebx, ebx
add ebx, eax
add eax, 0xf74c5786
sub eax, 0xf74c5781
mov ecx, 0x6a122c2b
add ecx, 0x962dd3d5
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40145b
Capabilities:
Check if file exists
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
sub esp, 0x540
xor eax, eax
mov dword [esp + 0x534], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov eax, esp
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
mov dword [esp + 0x538], 0x14
mov al, byte [esp + 0x534]
mov byte [esp + 0x524], al
mov eax, dword [esp + 0x534]
mov word [esp + 0x410], ax
lea eax, [esp + 0x410]
push eax
push eax
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
mov eax, dword [esp + 0x534]
mov word [esp + 0x208], ax
lea eax, [esp + 0x538]
push eax
lea eax, [esp + 0x514]
push eax
push 1
push 1
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringW]
mov al, byte [esp + 0x534]
mov byte [esp + 0x52c], al
lea eax, [esp + 0x52c]
push eax
lea eax, [esp + 0x528]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
movzx eax, word [esp + 0x510]
sub eax, 0x47
mov dword [esp + 0x53c], eax
mov eax, dword [esp + 0x538]
add dword [esp + 0x53c], eax
mov eax, dword [esp + 0x534]
push eax
mov eax, dword [esp + 0x538]
push eax
mov eax, dword [esp + 0x53c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov al, byte [esp + 0x534]
mov byte [esp + 0x4d0], al
lea eax, [esp + 0x4d0]
push eax
push eax
call dword [sym.imp.SHLWAPI.DLL_PathAppendA]
mov al, byte [esp + 0x534]
mov byte [esp + 0x490], al
lea eax, [esp + 0x490]
push eax
push eax
push eax
call dword [sym.imp.SHLWAPI.DLL_PathCombineA]
mov eax, dword [esp + 0x53c]
add esp, 0x540
pop edx
pop ecx
ret

Function at 0x4020f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
push eax
sub ebp, 0x82
mov ebx, eax
test eax, eax
je 0x402117
mov edx, dword [0x404050]
add edx, edx
jmp 0x40211d
mov edx, dword [0x404050]
mov eax, 0x404054
call fcn.00402049
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, dword [ebp - 6]
or al, 0x40
mov esi, 0x403112
push eax
sub esi, 0x4028ac
push esi
push 0x4028ac
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402174
mov ebx, dword [ebp - 6]
mov eax, 0x4028ac
mov edx, esi
call fcn.00402049
mov ebx, dword [ebp - 6]
mov edx, 0x1c000
mov eax, 0x404054
call fcn.004011ca
lea edx, [ebp - 2]
mov eax, dword [ebp - 6]
mov dword [ebp - 2], 0
call fcn.00401338
mov edx, dword [ebp - 6]
mov eax, dword [ebp - 6]
add edx, 0x1c000
dec eax
mov cl, byte [ebp - 6]
and edx, eax
mov eax, 0x404054
lea ebx, [ebp - 2]
shr eax, cl
call 0x4028ac
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x401c84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a064]
jne 0x401c8e
repz ret
jmp fcn.00402dd7

Function at 0x40484d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x41a278]
je 0x404868
inc edi
cmp edi, 0x17
jb 0x404859
cmp edi, 0x17
jae 0x4049e8
push ebp
push 3
call fcn.00409305
cmp eax, 1
pop ecx
je 0x4049b4
push 3
call fcn.00409305
test eax, eax
pop ecx
jne 0x40489c
cmp dword [0x41a040], 1
je 0x4049b4
cmp ebx, 0xfc
je 0x4049e7
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x41b6c8
push ebp
call fcn.00405322
add esp, 0xc
test eax, eax
je 0x4048d2
push esi
push esi
push esi
push esi
push esi
call fcn.00403245
add esp, 0x14
push 0x104
mov esi, 0x41b6e1
push esi
push 0
mov byte [0x41b7e5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404916
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00405322
add esp, 0xc
test eax, eax
je 0x404916
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00403245
add esp, 0x14
push esi
call fcn.00405390
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40495b
push esi
call fcn.00405390
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x41b9dc
push 0x416934
sub ecx, eax
push ecx
push eax
call fcn.00409252
add esp, 0x14
test eax, eax
je 0x40495b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00403245
add esp, 0x14
jmp 0x40495d
xor esi, esi
push 0x416930
push ebx
push ebp
call fcn.004091e1
add esp, 0xc
test eax, eax
je 0x40497d
push esi
push esi
push esi
push esi
push esi
call fcn.00403245
add esp, 0x14
push dword [edi*8 + 0x41a27c]
push ebx
push ebp
call fcn.004091e1
add esp, 0xc
test eax, eax
je 0x40499f
push esi
push esi
push esi
push esi
push esi
call fcn.00403245
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00409024
add esp, 0xc
jmp 0x4049e7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4049e7
cmp ebp, 0xffffffff
je 0x4049e7
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41a27c]
push dword [esi]
call fcn.00405390
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x409024
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00403721
xor ebx, ebx
cmp dword [0x41bdcc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4090fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4091da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4091da
push eax
call fcn.004036b3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41bdcc], eax
call esi
push eax
call fcn.004036b3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41bdd0], eax
call esi
push eax
call fcn.004036b3
mov dword [0x41bdd4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403e84
test eax, eax
pop ecx
pop ecx
je 0x4090c8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403245
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4090fa
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004036b3
cmp eax, ebx
pop ecx
mov dword [0x41bddc], eax
je 0x4090fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004036b3
pop ecx
mov dword [0x41bdd8], eax
mov eax, dword [0x41bdd8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40917f
cmp dword [0x41bddc], ecx
je 0x40917f
push eax
call fcn.0040372a
push dword [0x41bddc]
mov esi, eax
call fcn.0040372a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40917f
cmp edi, ebx
je 0x40917f
call esi
cmp eax, ebx
je 0x40914c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40914c
test byte [ebp - 0x18], 1
jne 0x40917f
lea eax, [ebp - 0x10]
push eax
call fcn.00403ebb
test eax, eax
pop ecx
je 0x409167
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403245
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x409176
or dword [ebp + 0x10], 0x200000
jmp 0x4091ba
or dword [ebp + 0x10], 0x40000
jmp 0x4091ba
mov eax, dword [0x41bdd0]
cmp eax, dword [ebp - 8]
je 0x4091ba
push eax
call fcn.0040372a
cmp eax, ebx
pop ecx
je 0x4091ba
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4091ba
mov eax, dword [0x41bdd4]
cmp eax, dword [ebp - 8]
je 0x4091ba
push eax
call fcn.0040372a
cmp eax, ebx
pop ecx
je 0x4091ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41bdcc]
call fcn.0040372a
cmp eax, ebx
pop ecx
je 0x4091da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4091dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret