joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
cmp dword [0x40b014], 0
mov ebx, dword [ebp + 0xc]
je 0x401a12
mov eax, dword [0x40b064]
test eax, eax
je 0x401a12
mov dword [esp + 8], esi
mov dword [esp + 4], str.Resource__d:_t
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x413820]
movzx esi, si
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], esi
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sub.kernel32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x401a9b
mov dword [esp + 4], eax
mov eax, dword [0x413820]
mov dword [esp], eax
call sub.kernel32.dll_LoadResource
test eax, eax
push ecx
push ecx
je 0x401aab
mov dword [esp], eax
call sub.kernel32.dll_LockResource
test eax, eax
push edx
je 0x401aab
xor edx, edx
mov cl, byte [eax + edx]
mov byte [ebx + edx], cl
inc edx
test cl, cl
jne 0x401a63
cmp dword [0x40b014], 0
mov esi, 1
je 0x401acf
mov eax, dword [0x40b064]
test eax, eax
je 0x401acf
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x408117
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x401acf
mov dword [esp], 0
call sub.kernel32.dll_SetLastError
push esi
mov byte [ebx], 0
xor esi, esi
cmp dword [0x40b014], 0
je 0x401acf
mov eax, dword [0x40b064]
test eax, eax
je 0x401acf
mov dword [esp + 4], eax
mov dword [esp], str._NULL__n
call sub.msvcrt.dll_fputs
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x401b4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], str.HKEY_CLASSES_ROOT
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401bcb
mov dword [esp + 4], str.HKEY_CURRENT_USER
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401bd2
mov dword [esp + 4], str.HKEY_LOCAL_MACHINE
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401bd9
mov dword [esp + 4], str.HKEY_USERS
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401be0
mov dword [esp + 4], str.HKEY_CURRENT_CONFIG
xor esi, esi
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
jne 0x401cbc
mov esi, 0x80000005
jmp 0x401be5
mov esi, 0x80000000
jmp 0x401be5
mov esi, 0x80000001
jmp 0x401be5
mov esi, 0x80000002
jmp 0x401be5
mov esi, 0x80000003
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_strchr
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
lea edi, [eax + 1]
call sub.msvcrt.dll_strrchr
lea edx, [ebp - 0x20]
mov byte [eax], 0
mov ebx, eax
cmp dword [0x40b00c], 0
jne 0x401c44
mov dword [esp], esi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], edi
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401cb9
jmp 0x401c71
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x2c], edx
call sub.advapi32.dll_RegOpenKeyExA
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
jne 0x401c19
lea eax, [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
lea eax, [ebx + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete al
movzx eax, al
mov esi, eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push edi
mov byte [ebx], 0x5c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40213b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x41
push edi
push esi
push ebx
sub esp, 0x24c
mov edx, dword [ebp + 0xc]
lea edi, [ebp - 0x220]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x220]
and edx, 0x100
or edx, 0x20019
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x402235
lea edi, [ebp - 0x11c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x224]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x22c]
lea edi, [ebp - 0x11c]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], str.JavaHome
mov dword [esp], eax
mov dword [ebp - 0x228], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x402210
mov dl, byte [edi + eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x4021fb
mov dword [esp], esi
call fcn.00401fc7
mov ebx, eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
push eax
je 0x402235
mov dword [esp + 4], esi
mov dword [esp], 0x413618
call sub.msvcrt.dll_strcpy
jmp 0x402241
mov dword [0x413290], 1
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40224b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x35c
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x40b064]
and ebx, 0x100
test edx, edx
je 0x402294
mov esi, dword [ebp + 8]
mov eax, 0x408209
test ebx, ebx
mov ecx, 0x40820c
cmove eax, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s_bit_search:_t_s..._n
mov dword [esp], edx
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x334]
or ebx, 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x402493
lea edi, [ebp - 0x324]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov dword [ebp - 0x330], 0x104
lea esi, [ebp - 0x324]
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edx, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x334]
lea ecx, [ebp - 0x330]
mov dword [ebp - 0x33c], edx
lea ebx, [ebp - 0x220]
lea edx, [ebp - 0x32c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExA
sub esp, 0x20
test eax, eax
jne 0x402484
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00401f56
mov eax, dword [0x40b064]
test eax, eax
je 0x402393
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x220]
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00401d28
mov dword [esp + 4], 0x413394
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x40244c
cmp byte [0x413414], 0
je 0x4023e0
mov dword [esp + 4], 0x413414
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
jg 0x40244c
mov dword [esp + 4], 0x413494
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
jle 0x40244c
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x324]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040213b
test eax, eax
je 0x40244c
mov dword [esp + 4], ebx
mov dword [esp], 0x413494
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], edi
mov dword [esp], 0x413514
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [0x413288], eax
mov eax, dword [0x40b064]
test eax, eax
je 0x40246f
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Match:_t_t_s_n
jmp 0x402467
mov eax, dword [0x40b064]
test eax, eax
je 0x40246f
lea edx, [ebp - 0x11c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Ignore:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x330], 0x104
mov eax, dword [ebp - 0x33c]
jmp 0x4022ff
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40249b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
cmp dword [0x413284], 9
mov ebx, dword [ebp + 0xc]
jne 0x4024c3
mov dword [esp], 0x1e
call fcn.00401b1b
mov dword [0x413284], eax
mov eax, dword [0x413284]
cmp eax, 2
je 0x402503
jg 0x4024d4
dec eax
je 0x4024f5
jmp 0x402540
cmp eax, 3
je 0x4024e0
cmp eax, 4
je 0x40252f
jmp 0x402540
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0040224b
mov eax, dword [0x413288]
test eax, eax
jne 0x402528
cmp dword [0x40b00c], 0
je 0x40255e
or bh, 1
jmp 0x40252f
cmp dword [0x40b00c], 0
je 0x40252f
mov eax, ebx
or ah, 1
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0040224b
test byte [0x413289], 1
jne 0x40255e
jmp 0x40252f
test ah, 1
jne 0x4024f5
jmp 0x40255e
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], esi
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.0040224b
mov eax, dword [0x40b064]
test eax, eax
je 0x40255e
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], str.Runtime_bits:_tFailed_to_load._n
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp sub.msvcrt.dll_fputs
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402565
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [ebx - 2]
cmp eax, 1
ja 0x4025a0
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.0040249b
cmp ebx, 3
je 0x4025ca
mov dword [ebp + 0xc], 1
mov dword [ebp + 8], edi
jmp 0x4025be
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.0040249b
test ebx, ebx
je 0x4025ca
mov dword [ebp + 0xc], 2
mov dword [ebp + 8], esi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040249b
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402aa4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x48], 0x40
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp], ebx
mov dword [esp + 0x14], str._Xms
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 0x19
call fcn.00402953
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [esp], ebx
mov dword [esp + 0x14], str._Xmx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0x1b
call fcn.00402953
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x402b22
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov eax, dword [ebp + 8]
mov dword [esp], 0xc
mov ebx, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.004019de
test eax, eax
je 0x402b5b
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x408453
mov dword [esp], eax
call sub.msvcrt.dll_strcat
xor eax, eax
mov ecx, 0x41
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x11c]
mov dword [esp], ebx
not ecx
sub ecx, 4
mov dword [esp + 8], ecx
call sub.msvcrt.dll_strncpy
mov dword [esp + 4], str.l4j.ini
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov dword [ebp - 0x12c], eax
inc eax
je 0x402c7b
mov eax, dword [0x40b064]
test eax, eax
je 0x402bd6
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Loading:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edi, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
xor ebx, ebx
mov esi, 1
repne scasb al, byte es:[edi]
mov eax, 0x7c00
mov edi, dword [ebp + 8]
not ecx
dec ecx
sub eax, ecx
add edi, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov edx, edi
cmp ebx, eax
jge 0x402c4d
mov cl, byte [edi + ebx]
cmp cl, 0x23
je 0x402c48
cmp cl, 0xa
je 0x402c24
cmp cl, 0xd
jne 0x402c3a
cmp edx, dword [ebp + 8]
mov esi, 1
jbe 0x402c4a
cmp byte [edx - 1], 0x20
je 0x402c4a
mov byte [edx], 0x20
inc edx
jmp 0x402c4a
test esi, esi
je 0x402c4a
mov byte [edx], cl
mov esi, 1
inc edx
jmp 0x402c4a
xor esi, esi
inc ebx
jmp 0x402c0e
test eax, eax
mov byte [edx], 0
jle 0x402c6d
cmp byte [edx - 1], 0x20
je 0x402c6d
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x408453
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll__close
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402c86
Capabilities:
Check mutex on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x20
push edi
lea edi, [ebp - 0x88]
sub esp, 0xa4
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x88]
mov dword [esp + 4], edi
mov dword [esp], 0x17
call fcn.004019de
mov edx, 1
cmp byte [ebp - 0x88], 0
je 0x402d53
mov eax, dword [0x40b064]
test eax, eax
je 0x402ce4
mov dword [esp + 8], edi
mov dword [esp + 4], str.Create_mutex:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x94]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x94], 0xc
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x90], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
call sub.kernel32.dll_GetLastError
mov edx, 1
cmp eax, 0xb7
jne 0x402d53
mov eax, dword [0x40b064]
test eax, eax
je 0x402d51
mov dword [esp + 8], str.Instance_already_exists.
mov dword [esp + 4], str.Error:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
mov eax, edx
mov edi, dword [ebp - 4]
leave
ret

Function at 0x40336c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00405d50
xor esi, esi
mov ecx, 0x7fff
sub esp, eax
mov eax, esi
lea edi, [ebp - 0x8017]
rep stosb byte es:[edi], al
lea ebx, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], str.Path
call sub.kernel32.dll_GetEnvironmentVariableA
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
mov edx, eax
mov eax, esi
repne scasb al, byte es:[edi]
mov esi, 0x7ffe
sub esp, 0xc
sub esi, edx
xor eax, eax
not ecx
dec ecx
cmp esi, ecx
jb 0x4033fd
mov dword [esp + 4], 0x408381
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], ebx
mov dword [esp], str.Path
call sub.kernel32.dll_SetEnvironmentVariableA
push esi
push esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403483
Capabilities:
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00405d50
mov ecx, 0x2000
sub esp, eax
xor eax, eax
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10017]
lea ebx, [ebp - 0x10017]
mov cx, 0x7fff
rep stosb byte es:[edi], al
mov dword [esp + 4], ebx
mov dword [esp], 0x13
call fcn.004019de
mov dword [esp], ebx
lea ebx, [ebp - 0x8018]
mov dword [esp + 4], 0x408581
call sub.msvcrt.dll_strtok
mov esi, eax
test esi, esi
je 0x40355e
mov dword [esp + 4], 0x3d
mov dword [esp], esi
call sub.msvcrt.dll_strchr
mov edx, dword [ebp + 0xc]
mov byte [eax], 0
inc eax
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov byte [ebp - 0x8018], 0
mov dword [esp + 8], edx
call fcn.00402700
mov eax, dword [0x40b064]
test eax, eax
je 0x403538
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.Set_var:_t_s___s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.kernel32.dll_SetEnvironmentVariableA
push edi
push edi
mov dword [esp + 4], 0x408581
mov dword [esp], 0
call sub.msvcrt.dll_strtok
mov esi, eax
jmp 0x4034de
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403cd7
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x808c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00405d50
mov edx, 0x413270
mov ecx, 4
mov edi, edx
sub esp, eax
xor eax, eax
mov esi, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
lea ebx, [ebp - 0x805c]
mov edi, ebx
mov cl, 0x11
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x8018]
mov dword [ebp - 0x805c], 0x44
mov cx, 0x2000
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x8018]
mov dword [esp + 4], 0x408604
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x40b16c
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x4085fa
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x40b270
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov eax, dword [0x413280]
mov dword [esp + 0x24], 0x413270
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.kernel32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x403dfc
cmp dword [ebp + 8], 0
je 0x403def
mov eax, dword [0x413270]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_WaitForSingleObject
push eax
push eax
mov eax, dword [0x413270]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.kernel32.dll_GetExitCodeProcess
push eax
push eax
call fcn.00403cb3
jmp 0x403df5
mov dword [esi], 0
mov eax, 1
jmp 0x403e04
mov dword [esi], 0xffffffff
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403ee0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x403f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x403ffb
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x403f81
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x403f69
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x403f79
cmp ecx, 0x40
je 0x403f79
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403ee0
lea esi, [esi]
lea edi, [edi]
Function at 0x406150
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
and esp, 0xfffffff0
sub esp, 0x410
call fcn.00403eb0
call fcn.00401834
call sub.kernel32.dll_GetCommandLineA
cmp byte [eax], 0x22
jne 0x40618e
inc eax
mov dword [esp + 4], 0x22
mov dword [esp], eax
call sub.msvcrt.dll_strchr
lea edx, [eax + 1]
lea ecx, [eax + 2]
cmp byte [eax + 1], 0
jmp 0x4061a8
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sub.msvcrt.dll_strchr
mov edx, section..rdata
lea ecx, [eax + 1]
test eax, eax
cmovne edx, ecx
mov dword [esp], edx
call fcn.00403aa0
cmp eax, 0xb7
jne 0x4061f2
xor al, al
mov ecx, 0x100
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x10]
mov dword [esp + 4], edi
mov dword [esp], 0x69
call fcn.004019de
mov dword [esp], edi
call fcn.00401843
call fcn.00401691
mov eax, 2
jmp 0x4062a4
dec eax
je 0x406204
call fcn.004018a6
mov eax, 1
jmp 0x4062a4
mov dword [esp], 0x1f
lea edi, [esp + 0x10]
call fcn.00401ad8
mov dword [0x40b008], eax
mov dword [esp + 4], edi
mov dword [esp], 1
mov dword [esp + 0x10], 0
call fcn.00403cd7
test eax, eax
jne 0x40623c
call fcn.004018a6
jmp 0x40627a
cmp dword [0x40b008], 0
je 0x40626a
mov edx, dword [esp + 0x10]
test edx, edx
je 0x40626a
mov eax, dword [0x40b064]
test eax, eax
je 0x40626a
mov dword [esp + 8], edx
mov dword [esp + 4], str.Exit_code:_t_d__restarting_the_application__n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [0x40b008], 0
je 0x40627a
cmp dword [esp + 0x10], 0
jne 0x406219
mov eax, dword [0x40b064]
test eax, eax
je 0x40629b
mov edx, dword [esp + 0x10]
mov dword [esp + 4], str.Exit_code:_t_d_n
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
call fcn.00401691
mov eax, dword [esp + 0x10]
mov edi, dword [ebp - 4]
leave
ret
Function at 0x1026cb6
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1029920
call fcn.01027094
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x102fd04
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1026a71
cmp eax, esi
jne 0x1026a64
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1026a74
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1026a4b
xor esi, esi
inc esi
mov eax, dword [0x102fd00]
cmp eax, esi
jne 0x1026a87
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1026ab6
mov eax, dword [0x102fd00]
test eax, eax
jne 0x1026ab0
mov dword [0x102fd00], esi
push 0x10018d8
push 0x10018cc
call fcn.010269ad
pop ecx
pop ecx
test eax, eax
je 0x1026ab6
jmp 0x1026bda
mov dword [0x102f9c8], esi
mov eax, dword [0x102fd00]
cmp eax, esi
jne 0x1026ada
push 0x10018c8
push 0x10018a4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x102fd00], 2
cmp dword [ebp - 0x20], ebx
jne 0x1026ae7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x102fd10], ebx
je 0x1026b08
push 0x102fd10
call fcn.01027009
pop ecx
test eax, eax
je 0x1026b08
push ebx
push 2
push ebx
call dword [0x102fd10]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1026bda
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1026b72
cmp cx, bx
je 0x1026b2d
cmp dword [ebp - 0x1c], ebx
jne 0x1026b72
movzx ecx, word [eax]
cmp cx, bx
je 0x1026b42
cmp cx, 0x20
ja 0x1026b42
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1026b2d
test byte [ebp - 0x40], 1
je 0x1026b4e
movzx ecx, word [ebp - 0x3c]
jmp 0x1026b51
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x102f9c4], eax
cmp dword [0x102f9b8], ebx
jne 0x1026bb7
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1026b83
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1026b17
cmp dword [0x102f9c8], ebx
jne 0x1026bc5
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x102f9c4]
jmp 0x1026be6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010270d9
ret
call fcn.010271e1
jmp 0x1026a0e