joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412556
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x424840]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x412596
call esi
test eax, eax
je 0x41257b
mov dword [0x424840], 1
jmp 0x41259b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x412592
mov dword [0x424840], 2
jmp 0x4125a4
xor eax, eax
jmp 0x4125f2
cmp eax, 1
jne 0x41259f
call esi
jmp 0x4125f2
cmp eax, 2
jne 0x412592
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x4125ea
lea eax, [esi + esi]
push eax
call fcn.0040c394
mov ebp, eax
test ebp, ebp
pop ecx
je 0x4125ea
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x4125ee
push ebp
call fcn.0040c27c
pop ecx
xor eax, eax
jmp 0x4125f0
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x4128c7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x424844], ebx
push esi
push edi
jne 0x412947
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x412982
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x424844], eax
je 0x412982
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x424848], eax
call esi
cmp dword [0x4245c0], 2
mov dword [0x42484c], eax
jne 0x412947
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x424854], eax
je 0x412947
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x424850], eax
mov eax, dword [0x424850]
test eax, eax
je 0x41298c
call eax
test eax, eax
je 0x412973
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x424854]
test eax, eax
je 0x412973
test byte [ebp - 8], 1
jne 0x41298c
cmp dword [0x4245cc], 4
jb 0x412986
or byte [ebp + 0x12], 0x20
jmp 0x4129ab
xor eax, eax
jmp 0x4129bb
or byte [ebp + 0x12], 4
jmp 0x4129ab
mov eax, dword [0x424848]
test eax, eax
je 0x4129ab
call eax
mov ebx, eax
test ebx, ebx
je 0x4129ab
mov eax, dword [0x42484c]
test eax, eax
je 0x4129ab
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x424844]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412d23
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x423190]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x412d54
xor eax, eax
jmp 0x412edd
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x425c80]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x412d90
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00416f91
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x412e6b
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x412ea9
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x412df4
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x412de5
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x412dc5
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412e34
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x412e3d
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x412db6
jmp 0x412e3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x412ed8
cmp dword [ebp - 0x6c], edi
je 0x412ea9
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x412e9e
call fcn.00412b7f
mov dword [eax], 9
call fcn.00412b88
mov dword [eax], esi
jmp 0x412ed3
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412e93
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x412e3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x412e3f
push dword [ebp - 0x6c]
call fcn.00412b91
pop ecx
jmp 0x412ed3
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x412ec1
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x412ec1
xor eax, eax
jmp 0x412edb
call fcn.00412b7f
mov dword [eax], 0x1c
call fcn.00412b88
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x412edb
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040c26e
add ebp, 0x3a0
leave
ret
Function at 0x418e14
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41f2d0
call fcn.0040d640
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x4249b8], edi
jne 0x418e58
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x418e43
mov dword [0x4249b8], ebx
jmp 0x418e58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x418e58
mov dword [0x4249b8], 2
mov eax, dword [0x4249b8]
cmp eax, ebx
jne 0x418e78
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x418f3b
cmp eax, 2
je 0x418e81
cmp eax, edi
jne 0x418ea9
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x418e94
mov eax, dword [0x42487c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x418eb0
xor eax, eax
jmp 0x418f3b
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040ced0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x418ee3
cmp esi, edi
jne 0x418ef9
push dword [ebp - 0x20]
call fcn.0040c394
pop ecx
mov esi, eax
cmp esi, edi
je 0x418ea9
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x418f2c
cmp dword [ebp + 0x14], edi
jne 0x418f16
push edi
push edi
jmp 0x418f1c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x418f38
push esi
call fcn.0040c27c
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0040d67b
ret
Function at 0x418f44
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41f2e0
call fcn.0040d640
xor esi, esi
cmp dword [0x4249bc], esi
jne 0x418f88
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x418f73
mov dword [0x4249bc], edi
jmp 0x418f88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x418f88
mov dword [0x4249bc], 2
mov eax, dword [0x4249bc]
cmp eax, 2
je 0x419069
cmp eax, esi
je 0x419069
cmp eax, 1
jne 0x418fcd
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x418fb6
mov eax, dword [0x42487c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x418fd4
xor eax, eax
jmp 0x41907b
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0040ced0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x41900a
cmp edi, esi
jne 0x419025
lea eax, [ebx + ebx]
push eax
call fcn.0040c394
pop ecx
mov edi, eax
cmp edi, esi
je 0x418fcd
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x419058
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x419042
push esi
push esi
jmp 0x419048
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x419064
push edi
call fcn.0040c27c
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x41907b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0040d67b
ret
Function at 0x419856
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x41986f
or eax, 0xffffffff
jmp 0x4198d0
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4198cc
push 0x3d
push esi
call fcn.00419a56
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4198cc
cmp esi, eax
je 0x4198cc
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x4245e0]
sete cl
cmp eax, dword [0x4245e4]
mov dword [ebp - 8], ecx
jne 0x4198b2
mov edi, eax
call fcn.004197f5
mov dword [0x4245e0], eax
cmp eax, ebx
jne 0x41990b
cmp dword [ebp + 0xc], ebx
je 0x4198d4
cmp dword [0x4245e8], ebx
je 0x4198d4
call fcn.00419378
test eax, eax
je 0x41990b
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x4198dd
xor eax, eax
jmp 0x4198cf
push 4
call fcn.0040c394
cmp eax, ebx
pop ecx
mov dword [0x4245e0], eax
je 0x4198cc
mov dword [eax], ebx
cmp dword [0x4245e8], ebx
jne 0x41990b
push 4
call fcn.0040c394
cmp eax, ebx
pop ecx
mov dword [0x4245e8], eax
je 0x4198cc
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x4245e0]
call fcn.004197a8
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x41996c
cmp dword [esi], ebx
je 0x41996c
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0040c27c
cmp dword [ebp - 8], ebx
pop ecx
jne 0x41994f
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x4199ad
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x419946
mov eax, edi
shl eax, 2
push eax
push dword [0x4245e0]
call fcn.0040cd16
cmp eax, ebx
pop ecx
pop ecx
je 0x4199ad
jmp 0x4199a8
cmp dword [ebp - 8], ebx
jne 0x419a18
cmp edi, ebx
jge 0x41997b
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4245e0]
call fcn.0040cd16
cmp eax, ebx
pop ecx
pop ecx
je 0x4198cc
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x4245e0], eax
cmp dword [ebp + 0xc], ebx
je 0x419a02
push dword [ebp - 4]
call fcn.0040d6e0
inc eax
inc eax
push eax
call fcn.0040c394
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x419a02
push dword [ebp - 4]
push esi
call fcn.00410e00
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4199fb
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0040c27c
pop ecx
cmp dword [ebp - 8], ebx
je 0x419a10
push dword [ebp - 4]
call fcn.0040c27c
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4198cf
push dword [ebp - 4]
call fcn.0040c27c
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x4198d9
Function at 0x419c62
Capabilities:
Parse pe header

Disassembly:
push 0x2c
push 0x41f318
call fcn.0040d640
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x419cce
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
je 0x419ca6
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x419cd4
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x419c9e
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x419c9e
mov al, 1
jmp 0x419ca0
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.0040d67b
ret
Function at 0x419e14
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
cmp esi, 0x7ff80000
push edi
mov ebx, 0x10000
jbe 0x419e37
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x419e3a
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x419e4d
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x419e54
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x4249c8]
test eax, eax
mov ecx, dword [0x4249c4]
jne 0x419e6e
test ecx, ecx
je 0x419e83
mov eax, ecx
mov dword [0x4249c8], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x419e83
cmp edx, dword [ebp - 4]
jb 0x419e83
cmp edx, dword [ebp - 8]
jbe 0x419f57
mov eax, ecx
test ecx, ecx
jmp 0x419ea7
test eax, eax
je 0x419ea2
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x419ea2
cmp ecx, dword [ebp - 4]
jb 0x419ea2
cmp ecx, dword [ebp - 8]
jbe 0x419f57
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x4249c8], eax
jne 0x419e89
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp - 4]
mov edi, esi
jbe 0x419ff2
cmp edi, 0x70000000
jb 0x419ed7
cmp edi, 0x80000000
ja 0x419ed7
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x419ff2
cmp dword [ebp - 0x30], ebx
jne 0x419ef6
cmp dword [ebp - 0x34], ebx
jae 0x419f09
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x419ec2
jmp 0x419ff2
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4249c8], eax
je 0x419ff2
mov ecx, dword [0x4249c4]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x4249c4], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x419f49
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x419ff7
cmp esi, dword [ebp - 8]
ja 0x419ff7
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.0040d5e0
add esp, 0xc
mov eax, esi
jmp 0x419ff9
cmp esi, 0x70000000
jb 0x419f9b
cmp esi, 0x80000000
ja 0x419f9b
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x419ff7
cmp dword [ebp - 0x14], ebx
jne 0x419fe9
cmp dword [ebp - 0x18], ebx
jb 0x419fe9
mov ecx, esi
and ecx, 0xffff
je 0x419fcd
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4249c8], eax
jne 0x419f25
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x419f86
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a01f
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x41f328
call fcn.0040d640
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41a07a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x41a076
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x41a076
cmp word [eax + 0x14], 0
jne 0x41a06b
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x41a07c
mov eax, ecx
jmp 0x41a065
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.0040d67b
ret

Function at 0x41a0a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x4249d0], edi
jne 0x41a0c3
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4249d0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x41a0ca
mov eax, 0x10dd
jmp 0x41a10e
push esi
mov esi, dword [0x4249c4]
mov dword [0x4249cc], edi
mov dword [0x4249e0], edi
mov dword [0x4249dc], edi
mov dword [0x4249d4], edi
mov dword [0x4249d8], edi
jmp 0x41a107
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x41a0f1
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x41a111
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4249d0], eax
je 0x41a127
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x4249e0]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x41a172
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x41a163
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x41a163
call fcn.00419ffe
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.0040c611
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x41a136
mov dword [0x4249e0], ebx
call fcn.00419ded
mov esi, dword [0x4249dc]
cmp esi, ebx
je 0x41a19f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.0040c611
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x41a187
pop edi
pop esi
mov dword [0x4249dc], ebx
mov dword [0x4249d0], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x41a3f2
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x4249d4]
test eax, eax
jne 0x41a462
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x41a40e
xor eax, eax
jmp 0x41a461
push esi
push 8
call fcn.0040bda3
mov esi, eax
test esi, esi
pop ecx
jne 0x41a422
push 8
pop edi
jmp 0x41a43d
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x41a44e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.0040c611
pop ecx
and dword [0x4249d8], 0
mov dword [0x4249d4], edi
mov eax, edi
jmp 0x41a460
mov eax, dword [0x4249dc]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x4249dc], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x41a6a2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4249d0], eax
je 0x41a6be
mov eax, 0x10dd
jmp 0x41a79a
mov eax, dword [0x4249d4]
test eax, eax
jne 0x41a79a
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x41a6db
push 6
pop eax
jmp 0x41a799
cmp dword [edi], 0
push ebx
push esi
jne 0x41a6ef
push 6
pop eax
mov dword [0x4249d4], eax
jmp 0x41a791
push 0x18
call fcn.0040bda3
mov esi, eax
test esi, esi
pop ecx
jne 0x41a702
push 8
pop edi
jmp 0x41a77b
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.0041a082
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x41a770
cmp ecx, 0x17
ja 0x41a770
cmp dword [edi + 0x1c], eax
jne 0x41a770
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push ebx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41a746
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x41a77b
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x4249e0]
mov dword [esi], eax
mov dword [0x4249e0], esi
xor eax, eax
jmp 0x41a797
cmp dword [0x4249cc], edx
push 9
pop edi
jne 0x41a781
mov dword [0x4249d4], edi
test esi, esi
je 0x41a78c
push esi
call fcn.0040c611
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x4249d8], edi
pop esi
pop ebx
pop edi
leave
ret 8
Function at 0x409a60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432449
mov eax, dword fs:[0]
push eax
sub esp, 0x398
mov eax, dword [0x43e460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x3a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x409ac6
push str.Error:_Failed_to_setup_networking_n
call fcn.0041c5af
add eax, 0x40
push eax
call fcn.0041c4a3
add esp, 8
mov eax, 1
jmp 0x409bca
lea ecx, [ebp - 0x210]
call fcn.00409bf0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp esi, 1
jle 0x409b8f
mov eax, dword [edi + 4]
mov ecx, str.console
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409b10
test dl, dl
je 0x409b0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409b10
add eax, 2
add ecx, 2
test dl, dl
jne 0x409af0
xor eax, eax
jmp 0x409b15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x409b8f
push 0x14
call fcn.0041bdc4
add esp, 4
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x409b48
lea ecx, [ebp - 0x210]
push ecx
push 0x4099e0
mov ecx, eax
call fcn.004199f0
mov esi, eax
jmp 0x409b4a
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], 0
call fcn.00419a70
push str.Press_Enter_to_end..._n
call fcn.0041c026
add esp, 4
call fcn.0041cb80
lea ecx, [ebp - 0x210]
call fcn.00409d70
test esi, esi
je 0x409b80
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
push str.Main_ended_n
call fcn.0041c026
add esp, 4
jmp 0x409bb6
push edi
push esi
lea ecx, [ebp - 0x210]
call fcn.0040a990
test eax, eax
jne 0x409bb6
push str.Error:_cant_run_service_n
call fcn.0041c5af
add eax, 0x40
push eax
call fcn.0041c4a3
add esp, 8
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00409c90
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bdb5
mov esp, ebp
pop ebp
ret