joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403e59
pop dword [ebp - 0x2c]
mov eax, 0x403e59
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xaf0cc8bf
add dword [ebp - 0x3c], 0x9f457c8c
mov dword [ebp - 0x38], 0x2f2f495b
sub dword [ebp - 0x38], 0xfcfbfd16
mov dword [ebp - 0x34], 0xa6fbdb8
add dword [ebp - 0x34], 0x41dc8676
mov dword [ebp - 0x30], 0xc01a7e9d
sub dword [ebp - 0x30], 0xc01a7e9d
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xf97a98fb
add eax, 0x6c5e791
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4712ffcb
add dword [ebp - 0x3c], 0x2d5f698b
mov dword [ebp - 0x38], 0xcdc11276
add dword [ebp - 0x38], 0x73ab4eff
mov dword [ebp - 0x34], 0x136be723
add dword [ebp - 0x34], 0x50038549
mov dword [ebp - 0x30], 0x536fd1c3
add dword [ebp - 0x30], 0xac902e3d
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x6505ddf2
sub eax, 0x64c55d1e
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b1c5
push 0
call eax
mov ecx, 0x18be88ff
add ecx, 0xe741d075
xor ebx, ebx
add ebx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x2c]
mov edx, 0x7305ae77
xor dword [ebp - 0x18], edi
mov esi, dword [edi]
xor dword [ebp - 0x1c], edx
add esi, edx
add dword [ebp - 0xc], edx
mov dword [ebx], esi
add dword [ebp - 0x20], esi
add ebx, 0xd203ceb0
add ebx, 0x2dfc3154
add edi, 0xf7e06e43
add edi, 0x81f91c1
loop 0x403f6c
add eax, 0xfa96c43a
add eax, 0x56a9469
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x44cd40
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453310
push 0x44f060
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x45a0e0], eax
xor eax, eax
mov al, byte [0x45a0e1]
mov dword [0x45a0ec], eax
mov eax, dword [0x45a0e0]
shr dword [0x45a0e0], 0x10
and eax, 0xff
mov dword [0x45a0e8], eax
shl eax, 8
add eax, dword [0x45a0ec]
mov dword [0x45a0e4], eax
call fcn.0044d770
test eax, eax
jne 0x44cdb4
push 0x1c
call fcn.0051b000
add esp, 4
mov dword [ebp - 4], 0
call fcn.0044ee80
call fcn.0044ee70
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4656c4], eax
call fcn.0044ea20
mov dword [0x4594d0], eax
test eax, eax
je 0x44cde7
cmp dword [0x4656c4], 0
jne 0x44cdf1
push 0xffffffffffffffff
call fcn.0044e630
add esp, 4
call fcn.00412640
call fcn.0044e930
call fcn.0044e600
mov esi, dword [0x4656c4]
mov al, byte [esi]
cmp al, 0x22
je 0x44ce18
cmp al, 0x20
jbe 0x44ce45
inc esi
cmp byte [esi], 0x20
ja 0x44ce10
jmp 0x44ce45
inc esi
cmp byte [esi], 0x22
je 0x44ce44
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x44ce3f
xor eax, eax
mov al, bl
push eax
call fcn.0044e8d0
add esp, 4
test eax, eax
je 0x44ce39
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x44ce21
cmp byte [esi], 0x22
jne 0x44ce45
inc esi
cmp byte [esi], 0
je 0x44ce55
cmp byte [esi], 0x20
ja 0x44ce55
inc esi
cmp byte [esi], 0
jne 0x44ce4a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x44ce79
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0044e630
jmp 0x44ceba
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e670
Capabilities:
Terminate process

Disassembly:
cmp dword [0x45a11c], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x44e68e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x45a118], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x45a114], bl
jne 0x44e6e8
cmp dword [0x4656b8], 0
je 0x44e6d6
mov edi, dword [0x4656b4]
sub edi, 4
cmp edi, dword [0x4656b8]
jb 0x44e6d6
mov eax, dword [edi]
test eax, eax
je 0x44e6cb
call eax
sub edi, 4
cmp edi, dword [0x4656b8]
jae 0x44e6c3
push 0x45401c
push 0x454014
call fcn.0044e720
add esp, 8
push 0x454024
push 0x454020
call fcn.0044e720
add esp, 8
test ebx, ebx
jne 0x44e70f
mov dword [0x45a11c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402ee4
pop dword [ebp - 0x40]
mov eax, 0x402ee4
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb75312a9
sub dword [ebp - 0x50], 0x6900cd5e
mov dword [ebp - 0x4c], 0xdf130b26
sub dword [ebp - 0x4c], 0xacdfbee1
mov dword [ebp - 0x48], 0x3ef4bb2
add dword [ebp - 0x48], 0x485cf87c
mov dword [ebp - 0x44], 0x8736d231
add dword [ebp - 0x44], 0x78c92dcf
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xaefb06ba
sub dword [ebp - 0x50], 0x3a889d64
mov dword [ebp - 0x4c], 0xeeaf4709
sub dword [ebp - 0x4c], 0xad42e594
mov dword [ebp - 0x48], 0xab64b449
add dword [ebp - 0x48], 0xb80ab823
mov dword [ebp - 0x44], 0x635906c
add dword [ebp - 0x44], 0xf9ca6f94
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3566f
push 0
call eax
mov ecx, 0x62b65ffc
add ecx, 0x9d49e17b
xor ebx, ebx
add ebx, eax
mov edi, 0x101167bb
add edi, 0xf0357c45
add edi, dword [ebp - 0x40]
mov edx, 0xe8c8a08e
add dword [ebp - 0x1c], eax
mov esi, dword [edi]
xor dword [ebp - 0x28], ebx
xor esi, edx
sub dword [ebp - 0x20], esi
mov dword [ebx], esi
xor dword [ebp - 0x14], ecx
add ebx, 0xfd903ef4
sub ebx, 0xfd903ef0
add edi, 0x49f6d71c
sub edi, 0x49f6d718
loop 0x402ff3
add eax, 0xf1605392
sub eax, 0xf15f5ae3
xor ebx, ebx
add ebx, eax
add eax, 0x858aa9b
add eax, 0xf7a7556a
mov ecx, 0x970b34cd
sub ecx, 0x96cb34cd
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10004160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkPlatformLocation_Awareness
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100041c3
push 0x380
push dword [ebp + 0xc]
push 3
push eax
push str.LastBackup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
test eax, eax
je 0x100041c9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100049c0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a0
mov eax, dword [0x10018008]
xor eax, esp
mov dword [esp + 0x39c], eax
movaps xmm0, xmmword [str.F147EC_C7F5_F89]
lea eax, [esp + 0x380]
push esi
push edi
push eax
push 1
push 0
movups xmmword [esp + 0x394], xmm0
mov dword [esp + 0x3a4], 0x394a2d41
mov dword [esp + 0x3a8], 0x44353941
mov word [esp + 0x3ac], 0x7d
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test esi, esi
je 0x10004a43
test al, al
je 0x10004a59
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.1000599e
mov esp, ebp
pop ebp
ret
mov ecx, 0xe0
lea edi, [esp + 8]
mov esi, str.FunctionSSDPSystem
xor eax, eax
rep movsd dword es:[edi], dword [esi]
nop dword [eax + eax]
mov cl, byte [esp + eax + 0xc8]
lea eax, [eax + 1]
mov byte [eax + 0x1001b71f], cl
test cl, cl
jne 0x10004a70
push ecx
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.10004160
mov ecx, dword [esp + 0x3b0]
add esp, 0xc
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1000599e
mov esp, ebp
pop ebp
ret

Function at 0x10004cc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
test edi, edi
je 0x10004d2e
cmp dword [0x1001b718], 0
jne 0x10004cef
push 4
call fcn.100059af
add esp, 4
mov dword [0x1001b718], eax
mov dword [eax], 0
mov dword [eax], vtable.PluginProvider.0
push esi
push 4
call fcn.100059af
mov ecx, dword [0x1001b718]
mov esi, eax
push 8
mov dword [esi], ecx
call fcn.100059af
add esp, 8
lea ecx, [ebp - 4]
mov dword [eax + 4], edi
push ecx
push 0
push eax
push 0x10004ca0
push 0
mov dword [eax], esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4012b0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1af0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0x1ae8]
mov ebx, dword [esi + 0x1aec]
shr ecx, 0x1c
mov eax, edi
and eax, 0xf
shl ebx, 4
add ecx, ebx
mov edx, edi
shr edx, 4
shl eax, 0x1c
cmp edi, ecx
sbb ecx, ecx
and ecx, 0x10000000
push ecx
push eax
push edx
mov edx, dword [esi + 0x28]
push 4
push edx
mov dword [esi + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0x1af0], eax
je 0x401316
mov dword [esi + 0x18], edi
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x43c484]
push 0x42b4ac
push str.Debug.txt
mov esi, eax
call fcn.0041648d
push esi
push esi
push 0x42b4c8
push str._s_d__x__n
push eax
mov dword [edi], eax
call fcn.004163d3
mov eax, dword [edi]
push eax
call fcn.00416382
push 0xdf
call fcn.004124e0
push eax
call fcn.00412530
add esp, 0x28
pop edi
pop esi
pop ebx
ret 4
Function at 0x4020e0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4020f1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esi + 0x1af0]
push eax
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x402135
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x402135
mov ecx, dword [esi + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esi + 0x48], 0x7e
lea eax, [esi + 0x48]
mov dword [esi + 0x10], 0
jne 0x402135
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x40a410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42a1c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x2c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.004125a0
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esi + 0x4a7f34], ecx
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esi], 0x42bf90
mov dword [esi + 0x48ba08], eax
call fcn.0040d040
mov ecx, dword [esp + 8]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x20
Function at 0x414c60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x4c
push esi
xor esi, esi
cmp word [0x43dab0], si
push edi
jne 0x414c82
push 0x43dab0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x414c98
push 0x5c
push 0x43dab0
call fcn.0041709d
add esp, 8
cmp eax, esi
je 0x414c98
mov word [eax], si
push 0x43dab0
call fcn.004164a0
add esp, 4
cmp eax, 3
jne 0x414cbb
cmp word [0x43dab4], 0x5c
jne 0x414cbb
mov word [0x43dab4], si
mov eax, dword [esp + 0x6c]
cmp eax, esi
je 0x414cd1
push eax
push 0x43dab0
call fcn.00416c4e
add esp, 8
mov eax, dword [esp + 0x68]
push ebx
push eax
push 0x43dab0
call fcn.00416c24
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x64]
push 0x42b964
push edi
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0x43dab0
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x200
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0x88002c
mov word [esp + 0x54], si
mov word [esp + 0x56], si
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 1
mov dword [esp + 0x60], 0x414b20
mov dword [esp + 0x64], esi
call fcn.00417285
add esp, 0x10
test eax, eax
jne 0x414d80
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
mov ebx, eax
jmp 0x414d84
mov ebx, dword [esp + 0x70]
push 0x42b9c0
push edi
call fcn.00417285
add esp, 8
test eax, eax
jne 0x414da3
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
mov ebx, eax
cmp ebx, esi
pop ebx
jne 0x414db0
pop edi
xor eax, eax
pop esi
add esp, 0x4c
ret
push 0x42b9c0
push edi
call fcn.00417285
add esp, 8
test eax, eax
jne 0x414e04
cmp word [esp + 0x42], si
mov edx, dword [esp + 0x14]
jne 0x414e04
mov ecx, dword [esp + 0x20]
lea ecx, [ecx + ecx - 1]
cmp ecx, esi
jbe 0x414df3
lea esp, [esp]
mov si, word [edx]
add edx, 2
test si, si
jne 0x414de0
inc eax
movzx esi, ax
cmp esi, ecx
jb 0x414de0
add edx, 2
push edx
push 0x43dab0
call fcn.00416c24
add esp, 8
pop edi
mov eax, 0x43dab0
pop esi
add esp, 0x4c
ret

Function at 0x414f86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x414f9b
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x414fad
xor eax, eax
jmp 0x414fdf
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x414fd1
cmp esi, eax
jae 0x414fa9
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x414fc3
cmp esi, eax
jae 0x414fa9
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x4179f5
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x42d6b0
call fcn.00417f10
mov edi, 0x94
mov eax, edi
call fcn.00416b20
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x43fea8], ecx
mov eax, dword [esi + 4]
mov dword [0x43feb4], eax
mov edx, dword [esi + 8]
mov dword [0x43feb8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x43feac], esi
cmp ecx, 2
je 0x417a55
or esi, 0x8000
mov dword [0x43feac], esi
shl eax, 8
add eax, edx
mov dword [0x43feb0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x417a90
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x417a90
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x417aa8
cmp eax, 0x20b
je 0x417a95
mov dword [ebp - 0x1c], esi
jmp 0x417abc
cmp dword [ecx + 0x84], 0xe
jbe 0x417a90
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x417ab6
cmp dword [ecx + 0x74], 0xe
jbe 0x417a90
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0041e224
pop ecx
test eax, eax
jne 0x417ad0
push 0x1c
call fcn.004179d1
pop ecx
call fcn.0041ae70
test eax, eax
jne 0x417ae1
push 0x10
call fcn.004179d1
pop ecx
call fcn.0041e182
mov dword [ebp - 4], esi
call fcn.0041df84
test eax, eax
jge 0x417afa
push 0x1b
call fcn.004179ac
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x441774], eax
call fcn.0041de62
mov dword [0x43fe94], eax
call fcn.0041ddc0
test eax, eax
jge 0x417b20
push 8
call fcn.004179ac
pop ecx
call fcn.0041db8d
test eax, eax
jge 0x417b31
push 9
call fcn.004179ac
pop ecx
push 1
call fcn.00418905
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x417b47
push eax
call fcn.004179ac
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0041db30
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x417b68
movzx eax, word [ebp - 0x40]
jmp 0x417b6b
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00409f30
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x417b89
push edi
call fcn.00418a32
call fcn.00418a54
jmp 0x417bbb
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00417f4b
ret
Function at 0x41871e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00416b20
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4187b9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x43fea8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4187b9
cmp eax, 1
je 0x4187da
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4187b9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x418786
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4187b5
xor eax, eax
inc eax
jmp 0x4187f9
cmp edi, eax
jae 0x4187bd
xor eax, eax
jmp 0x4187f9
cmp eax, esi
jae 0x4187c4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x43fea8]
jmp 0x4187dd
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41896f
Capabilities:
Terminate process

Disassembly:
push 8
push 0x42d770
call fcn.00417f10
push 8
call fcn.0041e3c8
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x43fee8], esi
jne 0x4189a3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x43fee4], esi
mov al, byte [ebp + 0x10]
mov byte [0x43fee0], al
cmp dword [ebp + 0xc], edi
jne 0x4189ed
cmp dword [0x44176c], edi
je 0x4189dd
mov eax, dword [0x441768]
sub eax, 4
mov dword [0x441768], eax
cmp eax, dword [0x44176c]
jb 0x4189dd
mov eax, dword [eax]
cmp eax, edi
je 0x4189be
call eax
jmp 0x4189be
push 0x432070
mov eax, 0x432068
call fcn.004188ed
pop ecx
push 0x43207c
mov eax, 0x432074
call fcn.004188ed
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x418a1e
cmp dword [ebp + 0x10], edi
jne 0x418a2c
mov dword [0x43fee8], esi
push dword [ebp + 8]
call fcn.004188ab
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x418a2b
push 8
call fcn.0041e313
pop ecx
ret
call fcn.00417f4b
ret
Function at 0x41d81c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x432ebc]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4334e0]
je 0x41d851
inc eax
cmp eax, 0x13
jb 0x41d842
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4334e0]
jne 0x41d977
mov eax, dword [0x43fe9c]
cmp eax, 1
je 0x41d94f
cmp eax, edx
jne 0x41d881
cmp dword [0x432ef4], 1
je 0x41d94f
cmp ecx, 0xfc
je 0x41d977
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41d8b7
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0041f4c0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00418560
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41d8eb
mov eax, edi
push eax
call fcn.00418560
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x42d7b4
push edi
call fcn.0041f5c0
add esp, 0x10
push edi
call fcn.00418560
push dword [esi + 0x4334e4]
mov ebx, eax
call fcn.00418560
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00416b20
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0041f4c0
push edi
push ebx
call fcn.0041f4d0
push 0x42d7b0
push ebx
call fcn.0041f4d0
push dword [esi + 0x4334e4]
push ebx
call fcn.0041f4d0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0041f3c3
add esp, 0x2c
jmp 0x41d977
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4334e4]
push dword [esi]
call fcn.00418560
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00416328
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret