joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403238
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40325c
cmp dword [edi + 0x54], 0
jne 0x40325c
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040c977
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004031f9
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4095d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x409620
call fcn.0040c977
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x409620
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40963c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00409153
mov esi, eax
test edi, edi
je 0x40963a
test ebx, ebx
je 0x40963a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x410ec1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42dcd8]
jne 0x410ecb
repz ret
jmp fcn.004176cc
Function at 0x41e700
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004170bf
and dword [ebp - 4], 0
cmp dword [0x431954], 0
mov ebx, eax
jne 0x41e7b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e862
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x427fe0
push edi
call esi
test eax, eax
je 0x41e862
push eax
call fcn.0041704d
mov dword [esp], 0x427fd0
push edi
mov dword [0x431954], eax
call esi
push eax
call fcn.0041704d
mov dword [esp], 0x427fbc
push edi
mov dword [0x431958], eax
call esi
push eax
call fcn.0041704d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43195c], eax
call esi
push eax
call fcn.0041704d
pop ecx
mov dword [0x431964], eax
test eax, eax
je 0x41e7b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041704d
pop ecx
mov dword [0x431960], eax
mov eax, dword [0x431960]
cmp eax, ebx
je 0x41e809
cmp dword [0x431964], ebx
je 0x41e809
push eax
call fcn.004170c8
push dword [0x431964]
mov esi, eax
call fcn.004170c8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41e809
test edi, edi
je 0x41e809
call esi
test eax, eax
je 0x41e800
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41e800
test byte [ebp - 0xc], 1
jne 0x41e809
or dword [ebp + 0x10], 0x200000
jmp 0x41e842
mov eax, dword [0x431958]
cmp eax, ebx
je 0x41e842
push eax
call fcn.004170c8
pop ecx
test eax, eax
je 0x41e842
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41e842
mov eax, dword [0x43195c]
cmp eax, ebx
je 0x41e842
push eax
call fcn.004170c8
pop ecx
test eax, eax
je 0x41e842
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431954]
call fcn.004170c8
pop ecx
test eax, eax
je 0x41e862
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e864
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x70a51085
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x70a510fd
jmp 0x70a51164
jmp 0x70a511cb
jmp 0x70a51232
jmp 0x70a51299
jmp 0x70a51300
jmp 0x70a51367
jmp 0x70a513ce
jmp 0x70a51435
jmp 0x70a5149c
jmp 0x70a51503
jmp 0x70a5156a
jmp 0x70a515d1
jmp 0x70a51638
jmp 0x70a5169f
jmp 0x70a51706
jmp 0x70a5176d
jmp 0x70a517d4
jmp 0x70a5183b
jmp 0x70a518a2
jmp 0x70a51909
jmp 0x70a51970
jmp 0x70a519d7
jmp 0x70a51a3e
jmp 0x70a51aa5
jmp 0x70a51b0c
jmp 0x70a51b73
jmp 0x70a51bda
jmp 0x70a51c41
jmp 0x70a51ca8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x70a51d15
jmp 0x70a51d7c
jmp 0x70a51de3
jmp 0x70a51e4a
jmp 0x70a51eb1
jmp 0x70a51f18
jmp 0x70a51f7f
jmp 0x70a51fe6
jmp 0x70a5204d
jmp 0x70a520b4
jmp 0x70a5211b
jmp 0x70a52182
jmp 0x70a521e9
jmp 0x70a52250
jmp 0x70a522b7
jmp 0x70a5231e
jmp 0x70a52385
jmp 0x70a523ec
jmp 0x70a52453
jmp 0x70a524ba
jmp 0x70a52521
jmp 0x70a52588
jmp 0x70a525ef
jmp 0x70a52656
jmp 0x70a526bd
jmp 0x70a52724
jmp 0x70a5278b
jmp 0x70a527f2
jmp 0x70a52859
jmp 0x70a528c0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x70a52941
jmp 0x70a529a8
jmp 0x70a52a0f
jmp 0x70a52a76
jmp 0x70a52add
jmp 0x70a52b44
jmp 0x70a52bab
jmp 0x70a52c12
jmp 0x70a52c79
jmp 0x70a52ce0
jmp 0x70a52d47
jmp 0x70a52dae
jmp 0x70a52e15
jmp 0x70a52e7c
jmp 0x70a52ee3
jmp 0x70a52f4a
jmp 0x70a52fb1
jmp 0x70a53018
jmp 0x70a5307f
jmp 0x70a530e6
jmp 0x70a5314d
jmp 0x70a531b4
jmp 0x70a5321b
jmp 0x70a53282
jmp 0x70a532e9
jmp 0x70a53350
jmp 0x70a533b7
jmp 0x70a5341e
jmp 0x70a53485
jmp 0x70a534ec
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x70a5355c
jmp 0x70a535c3
jmp 0x70a5362a
jmp 0x70a53691
jmp 0x70a536f8
jmp 0x70a5375f
jmp 0x70a537c6
jmp 0x70a5382d
jmp 0x70a53894
jmp 0x70a538fb
jmp 0x70a53962
jmp 0x70a539c9
jmp 0x70a53a30
jmp 0x70a53a97
jmp 0x70a53afe
jmp 0x70a53b65
jmp 0x70a53bcc
jmp 0x70a53c33
jmp 0x70a53c9a
jmp 0x70a53d01
jmp 0x70a53d68
jmp 0x70a53dcf
jmp 0x70a53e36
jmp 0x70a53e9d
jmp 0x70a53f04
jmp 0x70a53f6b
jmp 0x70a53fd2
jmp 0x70a54039
jmp 0x70a540a0
jmp 0x70a54107
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x70a54187
jmp 0x70a541ee
jmp 0x70a54255
jmp 0x70a542bc
jmp 0x70a54323
jmp 0x70a5438a
jmp 0x70a543f1
jmp 0x70a54458
jmp 0x70a544bf
Function at 0x70a740f4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x71348018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x71348018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x70a7417b
jmp 0x70a741e2
jmp 0x70a74249
jmp 0x70a742b0
jmp 0x70a74317
jmp 0x70a7437e
jmp 0x70a743e5
jmp 0x70a7444c
jmp 0x70a744b3
jmp 0x70a7451a
jmp 0x70a74581
jmp 0x70a745e8
jmp 0x70a7464f
jmp 0x70a746b6
jmp 0x70a7471d
jmp 0x70a74784
jmp 0x70a747eb
jmp 0x70a74852
jmp 0x70a748b9
jmp 0x70a74920
jmp 0x70a74987
jmp 0x70a749ee
jmp 0x70a74a55
jmp 0x70a74abc
jmp 0x70a74b23
jmp 0x70a74b8a
jmp 0x70a74bf1
jmp 0x70a74c58
jmp 0x70a74cbf
jmp 0x70a74d26
mov dword [ebp - 0x14], 0
jmp 0x70a74d94
jmp 0x70a74dfb
jmp 0x70a74e62
jmp 0x70a74ec9
jmp 0x70a74f30
jmp 0x70a74f97
jmp 0x70a74ffe
jmp 0x70a75065
jmp 0x70a750cc
jmp 0x70a75133
jmp 0x70a7519a
jmp 0x70a75201
jmp 0x70a75268
jmp 0x70a752cf
jmp 0x70a75336
jmp 0x70a7539d
jmp 0x70a75404
jmp 0x70a7546b
jmp 0x70a754d2
jmp 0x70a75539
jmp 0x70a755a0
jmp 0x70a75607
jmp 0x70a7566e
jmp 0x70a756d5
jmp 0x70a7573c
jmp 0x70a757a3
jmp 0x70a7580a
jmp 0x70a75871
jmp 0x70a758d8
jmp 0x70a7593f
mov dword [ebp - 0x18], 0
jmp 0x70a759ad
jmp 0x70a75a14
jmp 0x70a75a7b
jmp 0x70a75ae2
jmp 0x70a75b49
jmp 0x70a75bb0
jmp 0x70a75c17
jmp 0x70a75c7e
jmp 0x70a75ce5
jmp 0x70a75d4c
jmp 0x70a75db3
jmp 0x70a75e1a
jmp 0x70a75e81
jmp 0x70a75ee8
jmp 0x70a75f4f
jmp 0x70a75fb6
jmp 0x70a7601d
jmp 0x70a76084
jmp 0x70a760eb
jmp 0x70a76152
jmp 0x70a761b9
jmp 0x70a76220
jmp 0x70a76287
jmp 0x70a762ee
jmp 0x70a76355
jmp 0x70a763bc
jmp 0x70a76423
jmp 0x70a7648a
jmp 0x70a764f1
jmp 0x70a76558
mov dword [ebp - 0x10], 0
jmp 0x70a765c6
jmp 0x70a7662d
jmp 0x70a76694
jmp 0x70a766fb
jmp 0x70a76762
jmp 0x70a767c9
jmp 0x70a76830
jmp 0x70a76897
jmp 0x70a768fe
jmp 0x70a76965
jmp 0x70a769cc
jmp 0x70a76a33
jmp fcn.70a76a9a
Function at 0x401f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov eax, dword fs:[0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0xc]
mov edi, ebx
mov edi, edi
mov ecx, dword [edi + 0x30]
mov esi, dword [0x476ae4]
push ecx
call fcn.004143ee
movzx ecx, word [eax]
add esp, 4
test ecx, ecx
je 0x401f6f
lea esp, [esp]
imul esi, esi, 0x21
add eax, 2
add esi, ecx
movzx ecx, word [eax]
test ecx, ecx
jne 0x401f60
cmp esi, ebp
je 0x401f80
mov edi, dword [edi]
cmp edi, ebx
jne 0x401f40
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x402100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x45c8
call fcn.00416070
push ebx
push ebp
mov ebp, dword [esp + 0x45dc]
push esi
push edi
mov ebx, ecx
xor esi, esi
mov edi, edx
xor ecx, ecx
lea ecx, [ecx]
mov eax, ecx
cdq
idiv edi
mov byte [esp + ecx + 0x20], cl
inc ecx
cmp ecx, 0x22db
mov al, byte [edx + ebp]
mov byte [esp + ecx + 0x22fb], al
jl 0x402120
xor edi, edi
mov edi, edi
mov cl, byte [esp + edi + 0x20]
movzx edx, byte [esp + edi + 0x22fc]
add edx, esi
movzx eax, cl
add eax, edx
cdq
mov esi, 0x22db
idiv esi
inc edi
cmp edi, 0x22db
mov esi, edx
mov al, byte [esp + esi + 0x20]
mov byte [esp + esi + 0x20], cl
mov byte [esp + edi + 0x1f], al
jl 0x402140
mov ecx, dword [esp + 0x45e0]
xor ebp, ebp
test ecx, ecx
jle 0x402267
mov eax, dword [esp + 0x45dc]
sub eax, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x4021a0
lea eax, [edi + 1]
cdq
mov ecx, 0x22db
idiv ecx
push str.RTDAFSGDFSDSFWERTEWDSFGGSDSGFSDSFG
push 0x4790f0
mov edi, edx
movzx eax, byte [esp + edi + 0x28]
add eax, ebp
cdq
idiv ecx
mov ebp, edx
mov dl, byte [esp + edi + 0x28]
mov al, byte [esp + ebp + 0x28]
mov byte [esp + ebp + 0x28], dl
mov byte [esp + edi + 0x28], al
movzx ecx, byte [esp + ebp + 0x28]
movzx eax, al
add eax, ecx
cdq
mov ecx, 0x22db
idiv ecx
mov dword [esp + 0x24], edx
call fcn.00403390
add esp, 8
mov esi, eax
push esi
mov cl, 0xa
call fcn.00402ef0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov cl, byte [eax + esi + 8]
add eax, esi
xor ebx, ebx
test cl, 6
jne 0x402221
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402221
mov ebx, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test ebx, ebx
je 0x402243
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, ebx
test edx, edx
jne 0x40223b
or eax, 4
push 0
push eax
call fcn.0042703a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dl, byte [ecx + eax]
mov ecx, dword [esp + 0x1c]
xor dl, byte [esp + ecx + 0x20]
mov byte [eax], dl
inc eax
mov dword [esp + 0x10], eax
dec dword [esp + 0x14]
jne 0x4021a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c8
ret
Function at 0x403bc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403bd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x403bed
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403c0e
cmp esi, eax
jae 0x403be7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403c00
cmp esi, eax
jae 0x403be7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x406550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4065a3
call fcn.0044dc13
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4065a3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x406599
xor eax, eax
jmp 0x4066bc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4065d3
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4065d3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4066b9
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x406600
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.004049fc
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4066b9
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x406649
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x406649
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x406643
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.004049fc
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4066a9
and dword [ebp + 0xc], 0
jmp 0x4066a9
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4066a9
push 0xc
call fcn.004340f0
mov esi, eax
test esi, esi
pop ecx
je 0x40668b
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40668d
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4066a4
push dword [ebp - 8]
call fcn.0042ebf6
jmp 0x4066a9
call fcn.0042eb53
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x40660e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4146be
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00416070
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414759
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x478b54]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x414759
cmp eax, 1
je 0x41477a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414759
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x414726
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x414755
xor eax, eax
inc eax
jmp 0x414799
cmp edi, eax
jae 0x41475d
xor eax, eax
jmp 0x414799
cmp eax, esi
jae 0x414764
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x478b54]
jmp 0x41477d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414886
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x462278
call fcn.00416150
mov edi, 0x94
mov eax, edi
call fcn.00416070
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x478b54], ecx
mov eax, dword [esi + 4]
mov dword [0x478b60], eax
mov edx, dword [esi + 8]
mov dword [0x478b64], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x478b58], esi
cmp ecx, 2
je 0x4148e6
or esi, 0x8000
mov dword [0x478b58], esi
shl eax, 8
add eax, edx
mov dword [0x478b5c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x414921
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414921
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x414939
cmp eax, 0x20b
je 0x414926
mov dword [ebp - 0x1c], esi
jmp 0x41494d
cmp dword [ecx + 0x84], 0xe
jbe 0x414921
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x414947
cmp dword [ecx + 0x74], 0xe
jbe 0x414921
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004195ec
pop ecx
test eax, eax
jne 0x414961
push 0x1c
call fcn.0041480c
pop ecx
call fcn.00418b23
test eax, eax
jne 0x414972
push 0x10
call fcn.0041480c
pop ecx
call fcn.0041b243
mov dword [ebp - 4], esi
call fcn.0041aff9
test eax, eax
jge 0x41498b
push 0x1b
call fcn.004147e7
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x47a6d0], eax
call fcn.0041aed7
mov dword [0x478b40], eax
call fcn.0041ae35
test eax, eax
jge 0x4149b1
push 8
call fcn.004147e7
pop ecx
call fcn.0041ac02
test eax, eax
jge 0x4149c2
push 9
call fcn.004147e7
pop ecx
push 1
call fcn.00415b3b
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4149d8
push eax
call fcn.004147e7
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0041aba5
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4149f9
movzx eax, word [ebp - 0x40]
jmp 0x4149fc
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00429cf6
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x414a1a
push edi
call fcn.00415c68
call fcn.00415c8a
jmp 0x414a4c
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0041618b
ret
Function at 0x415ba5
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4622e8
call fcn.00416150
push 8
call fcn.0041982d
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x478b94], esi
jne 0x415bd9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x478b90], esi
mov al, byte [ebp + 0x10]
mov byte [0x478b8c], al
cmp dword [ebp + 0xc], edi
jne 0x415c23
cmp dword [0x47a6c8], edi
je 0x415c13
mov eax, dword [0x47a6c4]
sub eax, 4
mov dword [0x47a6c4], eax
cmp eax, dword [0x47a6c8]
jb 0x415c13
mov eax, dword [eax]
cmp eax, edi
je 0x415bf4
call eax
jmp 0x415bf4
push 0x4740c0
mov eax, 0x4740b8
call fcn.00415b05
pop ecx
push 0x4740cc
mov eax, 0x4740c4
call fcn.00415b05
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x415c54
cmp dword [ebp + 0x10], edi
jne 0x415c62
mov dword [0x478b94], esi
push dword [ebp + 8]
call fcn.00415ac3
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x415c61
push 8
call fcn.00419760
pop ecx
ret
call fcn.0041618b
ret

Function at 0x415d99
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x415db6
call fcn.0041744a
mov dword [eax], 0x16
xor eax, eax
jmp 0x415e20
push esi
push 0x8c
push 1
call fcn.00417a1c
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x415e0b
push esi
call fcn.0041891d
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x415de9
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x415d04
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x415e1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00414594
test ebx, ebx
pop ecx
je 0x415e1d
push ebx
call fcn.0041745c
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41a820
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x475894]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x475e48]
je 0x41a855
inc eax
cmp eax, 0x13
jb 0x41a846
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x475e48]
jne 0x41a97b
mov eax, dword [0x478b48]
cmp eax, 1
je 0x41a953
cmp eax, edx
jne 0x41a885
cmp dword [0x475878], 1
je 0x41a953
cmp ecx, 0xfc
je 0x41a97b
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41a8bb
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0041d030
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004153c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41a8ef
mov eax, edi
push eax
call fcn.004153c0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x462a60
push edi
call fcn.0041f600
add esp, 0x10
push edi
call fcn.004153c0
push dword [esi + 0x475e4c]
mov ebx, eax
call fcn.004153c0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00416070
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0041d030
push edi
push ebx
call fcn.0041d040
push 0x462a40
push ebx
call fcn.0041d040
push dword [esi + 0x475e4c]
push ebx
call fcn.0041d040
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0042220f
add esp, 0x2c
jmp 0x41a97b
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x475e4c]
push dword [esi]
call fcn.004153c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00414b58
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret