joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414730
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x434210
call fcn.004149a0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x449b94
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x414558
cmp eax, esi
jne 0x41454b
xor esi, esi
inc esi
mov edi, esi
jmp 0x41455b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41452f
xor esi, esi
inc esi
cmp dword [0x449b98], esi
jne 0x41456d
push 0x1f
call fcn.0057d000
pop ecx
jmp 0x4145a7
cmp dword [0x449b98], ebx
jne 0x4145a1
mov dword [0x449b98], esi
push 0x401034
push 0x401028
call fcn.0041468c
pop ecx
pop ecx
test eax, eax
je 0x4145a7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41467c
mov dword [0x448f6c], esi
cmp dword [0x449b98], esi
jne 0x4145ca
push 0x401024
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x449b98], 2
test edi, edi
jne 0x4145d7
xor eax, eax
mov ecx, 0x449b94
xchg dword [ecx], eax
cmp dword [0x449ba4], 0
je 0x414603
push 0x449ba4
call fcn.00414cb0
pop ecx
test eax, eax
je 0x414603
push ebx
push 2
push ebx
mov esi, dword [0x449ba4]
mov ecx, esi
call dword [0x44a2fc]
call esi
push dword [0x448f78]
push dword [0x448f74]
push dword [0x448f70]
call fcn.0041368b
add esp, 0xc
mov dword [0x448f68], eax
cmp dword [0x448f80], 0
jne 0x414661
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x448f6c], 0
jne 0x414675
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x448f68]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00414da5
jmp 0x414513

Function at 0x414ba4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x434250
call fcn.004149a0
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x414c04
cmp eax, 0xffffffff
je 0x414c04
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x414bfd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x414bfd
cmp edx, 0x10000000
jae 0x414bfd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x414bfa
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x414c60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x414c9e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x414c96
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x414ca0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x414c86
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x414d70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x414da1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x414da1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x414da1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41af11
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x44
mov eax, 0x430242
call fcn.004148fb
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x14]
dec esi
xor ebx, ebx
jmp 0x41af87
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x2c]
lea eax, [esi + 1]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push edi
call fcn.0040b6f9
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41af52
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x2c]
cmp eax, 0xffffffff
jne 0x41af8e
push 0x5c
pop eax
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x18]
push 1
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0042b129
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040b613
cmp esi, 0xffffffff
jne 0x41af28
jmp 0x41af9b
push ebx
push 1
call fcn.0040b613
cmp esi, 0xffffffff
jne 0x41af9e
or esi, 0xffffffff
mov eax, dword [edi + 0x14]
dec eax
cmp esi, eax
je 0x41b05c
push 0x5c
pop eax
mov word [ebp - 0x4c], ax
inc esi
push 1
push esi
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.00427f58
and dword [ebp - 0x34], 0
lea ecx, [ebp - 0x48]
mov ebx, eax
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
lea esi, [ebx + 1]
push esi
push eax
push edi
call fcn.0040b6f9
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x41aff1
lea eax, [ebp - 0x44]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41b00c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push eax
call fcn.0042afd1
jmp 0x41b040
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41b040
sub esp, 0x1c
mov ecx, esp
push 0x4057f4
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41b03a
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
push 0
push 1
call fcn.0040b613
mov eax, dword [edi + 0x14]
dec eax
cmp ebx, eax
jne 0x41afb2
call fcn.004148aa
ret 8
Function at 0x425f25
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xf0
mov eax, 0x4319ff
call fcn.004148fb
mov esi, dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
and dword [ebp - 0xf8], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0x34], 0
push 0xffffffffffffffff
push dword [esi + 0x14]
mov dword [ebp - 0xfc], edi
mov dword [ebp - 0xfc], eax
xor eax, eax
push ebx
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.0040b6f9
mov dword [ebp - 0xf8], 8
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
add esi, 0x3c
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0040e0d5
lea ecx, [ebx + 0x1c]
mov byte [ebp - 4], 1
push ecx
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040e0d5
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.0040b613
cmp byte [ebp + 0x14], 0
je 0x42601f
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040e0d5
add esp, 0xc
push eax
xor esi, esi
mov byte [ebp - 4], 4
push esi
lea eax, [ebx + 0x1c]
push eax
push ebx
lea ecx, [ebp - 0xf4]
call fcn.0041d3a5
push dword [ebp - 0xfc]
mov byte [ebp - 4], 5
push eax
call fcn.0042cb18
push esi
push 1
lea ecx, [ebp - 0xb8]
call fcn.0040b613
lea ecx, [ebp - 0xf4]
call fcn.004103e2
push esi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040b613
jmp 0x426021
xor esi, esi
cmp dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x60]
jae 0x42602d
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426050
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040b470
mov byte [ebp - 4], 6
push 9
jmp 0x426074
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push 0x4061bc
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
call fcn.0040b660
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push 0xa
pop ebx
push eax
mov ecx, edi
mov dword [ebp - 0xf8], ebx
call fcn.0040b470
or ebx, 4
test bl, 2
je 0x426099
push esi
push 1
lea ecx, [ebp - 0x2c]
and ebx, 0xfffffffd
call fcn.0040b613
test bl, 1
je 0x4260ac
push esi
push 1
lea ecx, [ebp - 0x9c]
call fcn.0040b613
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.0040b613
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0040b613
mov eax, edi
call fcn.004148aa
ret 0x14
Function at 0x426a79
Capabilities:
Delete directory

Disassembly:
push 0x24
mov eax, 0x42fcd9
call fcn.004148fb
mov edi, ecx
lea esi, [edi + 0x28]
jmp 0x426af4
mov eax, dword [edi + 0x30]
lea ecx, [ebp - 0x2c]
add eax, 0xffffffe4
push eax
call fcn.0040b470
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x426aab
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x426add
sub esp, 0x1c
mov ecx, esp
push 0x40481c
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426ad7
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004161f4
mov ecx, esi
call fcn.004294a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push 0
push 1
call fcn.0040b613
mov ecx, esi
call fcn.0042b581
test eax, eax
jne 0x426a8c
call fcn.004148aa
ret
Function at 0x426d00
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
push 0x90
mov eax, 0x431bbd
call fcn.004148fb
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0
push 0
push ebx
push eax
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x426d55
sub esp, 0x1c
mov ecx, esp
push 0x404dcc
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426d4f
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
push edi
lea eax, [ebp - 0x80]
push eax
call fcn.00415833
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00415833
push 0x405008
push eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
call fcn.0041932e
push esi
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
call fcn.004192e1
add esp, 0x18
xor ebx, ebx
lea ecx, [ebp - 0x48]
push ebx
push 1
call fcn.0040b78b
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040b78b
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.0040b78b
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x426dc7
lea eax, [ebp - 0x28]
push ebx
push dword [ebp - 0x18]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x426e00
sub esp, 0x1c
mov ecx, esp
push 0x40500c
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426dfa
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
push 0x401903
push 0x100000
call fcn.00414796
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x84], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x426edf
test edi, edi
je 0x426ec5
mov eax, 0x100000
mov ebx, edi
cmp edi, eax
jb 0x426e3a
mov ebx, eax
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push 0
push eax
push ebx
push esi
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426e83
sub esp, 0x1c
mov ecx, esp
push 0x404e6c
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426e7d
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
push 0
push ebx
push esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x426ebb
sub esp, 0x1c
mov ecx, esp
push 0x40500c
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426eb5
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
sub edi, ebx
jne 0x426e2d
xor ebx, ebx
push esi
call sub.msvcrt.dll_free
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040b78b
call fcn.004148aa
ret 0x10
lea ecx, [ebp - 0x9c]
call fcn.004138cb
push 0x438704
lea eax, [ebp - 0x9c]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x428078
Capabilities:
Get disk information

Disassembly:
push 0x454
mov eax, 0x431e31
call fcn.004148fb
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x428097
mov eax, dword [eax]
mov ebx, 0x104
lea ecx, [ebp - 0x218]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x4280ca
sub esp, 0x1c
mov ecx, esp
push 0x4047b0
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004150e1
push ebx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x4280fe
sub esp, 0x1c
mov ecx, esp
push 0x4047d8
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004150e1
lea eax, [ebp - 0x45c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x45c], ebx
push eax
push esi
call fcn.0041e9bd
sub esp, 0x1c
mov esi, eax
mov ecx, esp
push 0x404cec
call fcn.0040b41d
push esi
call fcn.004150e1
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42813a
sub ecx, edx
mov dword [ebp - 0x424], 7
sar ecx, 1
xor eax, eax
mov word [ebp - 0x438], ax
push 0xffffffffffffffff
mov dword [ebp - 0x428], ebx
lea eax, [ecx - 1]
push eax
push edi
lea ecx, [ebp - 0x43c]
call fcn.0040b6f9
lea eax, [ebp - 0x43c]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x45c]
lea eax, [ebp - 0x458]
push eax
call fcn.004193c3
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040b6f9
push ebx
push 1
lea ecx, [ebp - 0x458]
call fcn.0040b613
push ebx
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040b613
call fcn.004148aa
ret 4
Function at 0x42c6ad
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x4327cb
call fcn.004148c8
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [ebp + 0x20], 8
mov dword [ebp - 4], ebx
jae 0x42c6ca
lea eax, [ebp + 0xc]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
mov edi, 0x80070000
cmp esi, 0xffffffff
jne 0x42c713
sub esp, 0x1c
mov ecx, esp
push 0x404bec
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42c70d
movzx eax, ax
or eax, edi
push eax
call fcn.004150e1
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42c747
sub esp, 0x1c
mov ecx, esp
push 0x404dcc
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42c741
movzx eax, ax
or eax, edi
push eax
call fcn.004150e1
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 0x23
push 0x4025c8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42c796
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x13
je 0x42c798
sub esp, 0x1c
mov ecx, esp
push 0x404dec
call fcn.0040b41d
test edi, edi
jle 0x42c790
movzx edi, di
or edi, 0x80070000
push edi
call fcn.004150e1
mov bl, 1
cmp esi, 0xffffffff
je 0x42c7a4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040b613
mov al, bl
call fcn.00414896
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x2ac
cmp edx, 1
push ebx
mov byte [esp + 0x58], 0
push esi
push edi
push ebp
jle 0x40108a
mov ebx, dword [esp + 0x2c4]
dec edx
add ebx, 4
mov edi, dword [ebx]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x404020
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x64]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebp
shr ecx, 2
add ebx, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
dec edx
jne 0x401023
lea edi, [esp + 0x20]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x44
push eax
push ecx
lea edx, [esp + 0x6c]
push 0
push 0
push 0x28
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2ac
ret

Function at 0x4010d0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x401fd4
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
shr eax, 0x10
mov dword [0x404050], edx
mov dword [0x40404c], ecx
mov dword [0x404044], eax
shl ecx, 8
add ecx, edx
mov dword [0x404048], ecx
call fcn.00401f90
test eax, eax
jne 0x40113a
push 0x1c
call fcn.004011f0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00401db0
call fcn.00401da0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x404e70], eax
call fcn.00401950
mov dword [0x404024], eax
test eax, eax
je 0x40116d
cmp dword [0x404e70], 0
jne 0x401177
push 0xffffffffffffffff
call fcn.00401250
add esp, 4
call fcn.004016d0
call fcn.004015e0
call fcn.00401220
mov eax, dword [0x404060]
mov dword [0x404064], eax
push eax
mov eax, dword [0x404058]
push eax
mov eax, dword [0x404054]
push eax
call section..text
add esp, 0xc
push eax
call fcn.00401250
jmp 0x4011d4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401290
Capabilities:
Terminate process

Disassembly:
cmp dword [0x404080], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x4012ae
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x40407c], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x404078], bl
jne 0x401308
cmp dword [0x404e68], 0
je 0x4012f6
mov edi, dword [0x404e64]
sub edi, 4
cmp edi, dword [0x404e68]
jb 0x4012f6
mov eax, dword [edi]
test eax, eax
je 0x4012eb
call eax
sub edi, 4
cmp edi, dword [0x404e68]
jae 0x4012e3
push 0x404014
push 0x404010
call fcn.00401340
add esp, 8
push 0x40401c
push 0x404018
call fcn.00401340
add esp, 8
test ebx, ebx
jne 0x40132f
mov dword [0x404080], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x401950
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x404128], ebx
jne 0x40199f
call esi
cmp eax, ebx
mov edi, eax
je 0x40197d
mov dword [0x404128], 1
jmp 0x40199f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x401995
mov dword [0x404128], 2
jmp 0x40199f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x404128], 1
jne 0x401a4e
test edi, edi
jne 0x4019c2
call esi
mov edi, eax
test edi, edi
jne 0x4019c2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x4019dc
add esi, 2
cmp word [esi], 0
jne 0x4019ca
add esi, 2
cmp word [esi], 0
jne 0x4019ca
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x401a3d
push ebp
call fcn.00402340
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x401a3d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x401a2c
push ebx
call fcn.004022f0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x404128], 2
jne 0x401ad2
test ebx, ebx
jne 0x401a71
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x401a71
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x401a86
inc ebp
cmp byte [ebp], 0
jne 0x401a78
inc ebp
cmp byte [ebp], 0
jne 0x401a78
sub ebp, ebx
inc ebp
push ebp
call fcn.00402340
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x401aab
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4020f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x404358
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x402117
add eax, 8
inc ecx
cmp eax, 0x4043e8
jb 0x402108
cmp dword [ecx*8 + 0x404358], edx
lea ebx, [ecx*8]
jne 0x4022db
cmp dword [0x404030], 1
je 0x402297
cmp dword [0x404030], 0
jne 0x40214e
cmp dword [0x404034], 1
je 0x402297
cmp edx, 0xfc
je 0x4022db
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40218b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x4021cf
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4032e0
push ebp
call fcn.00402bf0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4032c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x40435c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00402b50
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x404d60], 0
je 0x4022ad
mov eax, dword [0x404d60]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x4022b7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x40435c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret