joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100104b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10011bfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x100123c8
mov dword [ebp - 4], 1
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100104f1
inc ebx
push edi
je 0x1001054a
pop eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x13c
call fcn.10004cd0
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.10004cd0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x13c
call fcn.10003860
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.10003860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
dec ebp
call 0x13c138a0
sal byte [ebx], 0xc0
xor eax, eax
je 0x1001055e
inc ebx
push edi
je 0x100105b7
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7fff00
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
ja 0x10010649
push 0
lea ecx, [ebp - 8]
push ecx
push 1
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100105ae
cmp dword [ebp - 8], 0
jne 0x100105b5
xor eax, eax
jmp 0x1001064c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
or byte [ebx], al
push ebp
cld
mov al, byte [ebp - 0x14]
mov byte [edx], al
movsx ecx, byte [ebp - 0x14]
cmp ecx, 0x3e
jne 0x1001063b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jb 0x10010639
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x3e
jne 0x10010639
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 2]
cmp eax, 0x52
jne 0x10010639
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 3]
cmp edx, 0x49
jne 0x10010639
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 4]
cmp ecx, 0x44
jne 0x10010639
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 5]
cmp eax, 0x3c
jne 0x10010639
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp ecx, 0x50
jge 0x10010639
jmp 0x1001057f
jmp 0x10010649
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1001057f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10010540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
Function at 0x10010700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1001071e
inc ebx
push edi
je 0x10010777
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0xffff
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, 1
test ecx, ecx
je 0x1001078e
push 1
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
call fcn.10004d20
test eax, eax
jne 0x1001076b
jmp 0x1001078e
cmp dword [ebp - 4], 0
je 0x1001078c
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10010743
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
jne 0x100107c0
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x14], 0
jne 0x100107e0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0xc], 0
jne 0x10010800
mov edx, dword [ebp - 0x18]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x18], 0
jne 0x10010820
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010890
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x100108ae
inc ebx
push edi
je 0x10010907
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f47
mov ecx, dword [ebp - 0xc]
add ecx, 0x13c
call fcn.10004b20
test eax, eax
je 0x100108e2
mov ecx, dword [ebp + 8]
push ecx
push 0x1f53
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.10004b20
test eax, eax
jne 0x100108e7
jmp 0x100109f6
push 0x1f55
push 0x10015a06
call fcn.10009cb0
add esp, 8
test eax, eax
jne 0x10010902
jmp 0x100109f6
mov ecx, dword [ebp - 0xc]
call fcn.10010a00
test eax, eax
je 0x100109f6
add byte [eax], al
add byte [ebp - 0x1b7bf040], al
add byte [eax], al
add bh, al
inc ebp
clc
add byte [eax], al
add byte [eax], al
mov dword [ebp - 8], 0
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x10010830
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0x10010860
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push 0
lea edx, [ebp - 8]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x1001097c
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x14], 0
jne 0x1001099c
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0
jne 0x100109bc
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x18], 0
jne 0x100109dc
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010a00
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10010a1e
inc ebx
push edi
je 0x10010a77
pop eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x20], eax
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x10010a67
xor eax, eax
jmp 0x10010b8d
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x14]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x10010a81
sal byte [ebp + 7], 0x33
shr cl, 0xc
add dword [eax], eax
add byte [edx + 2], ch
xor eax, eax
jmp 0x10010b8d
push 2
push 0
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10010ab9
xor eax, eax
jmp 0x10010b8d
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x10010b05
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
push eax
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x10010b0c
xor eax, eax
jmp 0x10010b8d
push 2
push 0
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10010b41
xor eax, eax
jmp 0x10010b8d
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
call fcn.10010ba0
test eax, eax
jne 0x10010b5e
xor eax, eax
jmp 0x10010b8d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1c]
push ecx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
je 0x10010b84
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x20]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x10010b88
xor eax, eax
jmp 0x10010b8d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010ba0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10010bbe
inc ebx
push edi
je 0x10010c17
pop eax
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x12], 0
mov dword [ebp - 0x18], 0x101
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov word [ebp - 0x14], 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0
add byte [edx], ch
push 0x8000000
push 1
push 0
push 0
push 0x10015a06
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10010c3a
xor eax, eax
jmp 0x10010c48
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov dword [edx + 0x24], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010df0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10010e08
inc ebx
push edi
je 0x10010e61
pop eax
mov eax, dword [ebp + 8]
push eax
call fcn.10009e50
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4
add ch, byte [edx + 1]
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10010e70
jge 0x10010e4f
add byte [edx + ecx - 0x75], dh
inc ebp
in al, dx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push 0x2000000
push 1
push 1
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10010e97
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov byte [ebp - 0xc], 0
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
push 0xc
lea eax, [ebp - 0xc]
push eax
push 0x10015806
call fcn.1000a540
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10010ee1
cmp dword [ebp - 4], 0
je 0x10010ee1
lea edx, [ebp - 0xc]
push edx
push 0x10015b06
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
mov dword [0x10016038], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10016034], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10016030], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1001601c], eax
cmp dword [0x10015008], 0
je 0x10010f29
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10015606
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x1001500c], 0
jbe 0x10010f37
call fcn.10009160
push 0
push 0
push 0x10010dc0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
push 0
mov ecx, dword [0x1001601c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10010fbc
push 0
push 0
push 0
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10010fbc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
sub dword [ebp - 0x38], 0x5b6
cmp dword [ebp - 0x38], 0
je 0x10010f95
sub dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], 0
je 0x10010fa4
jmp 0x10010fba
mov edx, dword [0x1001601c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10010fba
mov eax, dword [0x1001601c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x100146d8
call fcn.10002dd0
jmp 0x10010f49
mov ecx, 0x10014748
call fcn.10004cd0
cmp dword [0x1001500c], 0
jbe 0x10010fd4
call fcn.100090c0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1001601c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010e20
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10010e3b
inc ebx
push edi
je 0x10010e94
pop eax
mov ecx, 0x411
mov esi, dword [ebp + 8]
mov edi, section.Share
rep movsd dword es:[edi], dword [esi]
push 0x2000000
push 1
and al, byte [ecx]
adc dh, al
inc ebp
hlt
Function at 0x403910
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp byte [esi + 0x1110], bl
je 0x40392c
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push edi
mov eax, dword [ecx + 4]
mov dword [esi + 0x1104], eax
lea eax, [esi + 7]
mov edi, dword [ecx]
mov ecx, 0x10
mov word [esi], 0x9090
nop dword [eax + eax]
mov byte [eax - 5], 0x90
lea eax, [eax + 0xb]
mov dword [eax - 0xf], 0x90909090
mov word [eax - 0xb], 0x9090
mov dword [eax - 9], 0x90909090
sub ecx, 1
jne 0x403950
push 0x1040
push ecx
lea eax, [esi + 0xb8]
mov word [esi + 0xb2], 0x25ff
push eax
mov dword [esi + 0xb4], ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esi + 0x10f8], 0
push dword [eax + 8]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x10fc], eax
test eax, eax
je 0x403adf
push 0x40
push 0x1000
push 0x10fc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esi + 0x1100], eax
test eax, eax
je 0x403ac7
push eax
push str.remote_memory___08X
mov dword [ebp + 0xc], 0
call fcn.00401210
add esp, 8
lea ecx, [ebp + 0xc]
lea eax, [edi + 1]
push ecx
push 4
lea ecx, [ebp + 8]
push ecx
push eax
push dword [esi + 0x10fc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x403aaf
cmp dword [ebp + 0xc], 4
jne 0x403aaf
mov eax, dword [ebp + 8]
add eax, 5
add eax, edi
push eax
push str.old_winmain___08X
mov dword [ebp + 8], eax
call fcn.00401210
mov ecx, dword [esi + 0x1100]
add esp, 8
mov eax, dword [ebp + 8]
mov dword [esi + 0x10f8], eax
lea eax, [ecx + 0x10f8]
sub ecx, edi
mov dword [esi + 0xb4], eax
sub ecx, 5
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ecx
push eax
push 4
lea eax, [ebp - 4]
push eax
lea eax, [edi + 1]
push eax
push dword [esi + 0x10fc]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x403a97
cmp dword [ebp + 0xc], 4
jne 0x403a97
pop edi
mov bl, 1
mov byte [esi + 0x1110], 1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_write_memory__update_winmain_
call fcn.00403b00
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_read_memory__update_winmain_
call fcn.00403b00
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_allocate_memory_in_remote_process
call fcn.00403b00
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_open_process
call fcn.00403b00
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405d70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x405d8e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
je 0x405ddc
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
setne al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x405df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x405e50
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0xc]
jl 0x405e72
jg 0x405e69
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 8]
jbe 0x405e72
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov ecx, 0
add eax, dword [esi + 0x10]
mov dword [esi + 0x10], eax
adc ecx, dword [esi + 0x14]
mov dword [esi + 0x14], ecx
cmp dword [esi + 0xc], ecx
jg 0x405ead
jl 0x405ea7
cmp dword [esi + 8], eax
jae 0x405ead
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x408c80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430c30]
jne 0x408c8a
repz ret
jmp fcn.0040b79c

Function at 0x40af67
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405117
and dword [ebp - 4], 0
cmp dword [0x431fc4], 0
mov ebx, eax
jne 0x40b018
push 0x402ab4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b0c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402aa8
push edi
call esi
test eax, eax
je 0x40b0c9
push eax
call fcn.004050a5
mov dword [esp], 0x402a98
push edi
mov dword [0x431fc4], eax
call esi
push eax
call fcn.004050a5
mov dword [esp], 0x402a84
push edi
mov dword [0x431fc8], eax
call esi
push eax
call fcn.004050a5
mov dword [esp], 0x402a68
push edi
mov dword [0x431fcc], eax
call esi
push eax
call fcn.004050a5
pop ecx
mov dword [0x431fd4], eax
test eax, eax
je 0x40b018
push 0x402a50
push edi
call esi
push eax
call fcn.004050a5
pop ecx
mov dword [0x431fd0], eax
mov eax, dword [0x431fd0]
cmp eax, ebx
je 0x40b070
cmp dword [0x431fd4], ebx
je 0x40b070
push eax
call fcn.00405120
push dword [0x431fd4]
mov esi, eax
call fcn.00405120
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b070
test edi, edi
je 0x40b070
call esi
test eax, eax
je 0x40b067
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b067
test byte [ebp - 0xc], 1
jne 0x40b070
or dword [ebp + 0x10], 0x200000
jmp 0x40b0a9
mov eax, dword [0x431fc8]
cmp eax, ebx
je 0x40b0a9
push eax
call fcn.00405120
pop ecx
test eax, eax
je 0x40b0a9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b0a9
mov eax, dword [0x431fcc]
cmp eax, ebx
je 0x40b0a9
push eax
call fcn.00405120
pop ecx
test eax, eax
je 0x40b0a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431fc4]
call fcn.00405120
pop ecx
test eax, eax
je 0x40b0c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b0cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret