joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
mov dword [0x65a498], 0xffffffff
push 1
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00484340
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48736f
push 0x5aeed4
call fcn.00402610
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x487434
mov edx, dword [ebp - 8]
push edx
call fcn.00403310
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x487396
push str.exec_shell
call fcn.00402610
add esp, 4
jmp 0x487434
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0050e710
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x100
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x28], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x24], ecx
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
je 0x4873fb
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
xor eax, eax
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x487434
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00485e70
add esp, 4
mov edx, dword [ebp - 0x1c]
mov dword [0x65a498], edx
cmp dword [ebp - 8], 0
je 0x487446
mov eax, dword [ebp - 8]
push eax
call fcn.0051f0d0
add esp, 4
xor ecx, ecx
jne 0x487434
cmp dword [ebp - 4], 0
je 0x48745c
mov edx, dword [ebp - 4]
push edx
call fcn.0051f0d0
add esp, 4
xor eax, eax
jne 0x48744a
mov eax, dword [0x65a498]
mov esp, ebp
pop ebp
ret

Function at 0x4879b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x65a4c8], 0
je 0x4879cd
mov eax, dword [0x65a4c8]
push eax
call fcn.0051f0d0
add esp, 4
cmp dword [0x65a4dc], 0
je 0x4879e5
mov ecx, dword [0x65a4dc]
push ecx
call fcn.0051f0d0
add esp, 4
cmp dword [0x65a4d8], 0
je 0x487a5e
cmp dword [0x65a4d4], 0
je 0x487a2a
push 0
mov edx, dword [0x65a4d4]
push edx
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov eax, dword [0x65a4d4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x487a23
push 1
mov ecx, dword [ebp - 4]
call fcn.00489150
mov dword [ebp - 8], eax
jmp 0x487a2a
mov dword [ebp - 8], 0
cmp dword [0x65a4cc], 0
je 0x487a40
mov ecx, dword [0x65a4cc]
push ecx
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
cmp dword [0x65a4d0], 0
je 0x487a58
push 0
mov edx, dword [0x65a4d0]
push edx
call dword [sym.imp.OLEAUT32.dll_GetActiveObject]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [ebp + 8]
push eax
call fcn.0051f710
mov esp, ebp
pop ebp
ret
Function at 0x513250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00512e70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x513282
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x5604c0]
call dword [ebp - 8]
jmp 0x51328c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x549446
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00548e31

Function at 0x54d260
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x54d287
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00522540
add esp, 4
or eax, 0xffffffff
jmp 0x54d289
xor eax, eax
pop ebp
ret
Function at 0x40528c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x4052ad
push 0xffffffffffffffff
mov ecx, dword [0x40dda0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 8]
push edx
mov eax, dword [0x40dda0]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x40dda4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x40dda0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00405000
call dword [0x40dec4]
mov eax, dword [0x40dfd4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x40e0dc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x40deb8]
mov eax, dword [edx]
sub eax, 1
mov ecx, dword [0x40deb8]
mov dword [ecx], eax
mov edx, dword [0x40deb8]
xor eax, eax
cmp dword [edx], 0
sete al
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
je 0x405343
xor edx, edx
mov dl, byte [0x40debc]
test edx, edx
jne 0x405343
push 0x40ddb0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov al, byte [0x40debc]
neg eax
sbb al, al
not al
and eax, dword [ebp - 4]
push eax
call fcn.0040537d
add esp, 4
mov ecx, dword [0x40deb8]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [0x40dd98]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40537d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [str.ARM.TMP]
mov dword [ebp - 0x31c], eax
mov ecx, dword [0x40d220]
mov dword [ebp - 0x318], ecx
mov dl, byte [0x40d224]
mov byte [ebp - 0x314], dl
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x310]
push ecx
call fcn.00408580
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4053e0
mov edx, dword [ebp - 4]
mov byte [edx + 1], 0
jmp 0x4053f4
push 0x40e1f8
lea eax, [ebp - 0x310]
push eax
call fcn.00408490
add esp, 8
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x420]
push edx
call fcn.00408580
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405479
mov eax, dword [ebp - 4]
add eax, 1
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00408490
add esp, 8
push 0x2e
lea edx, [ebp - 0x108]
push edx
call fcn.00408580
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405466
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004083d0
add esp, 8
mov dword [ebp - 4], eax
push str..TMP
mov ecx, dword [ebp - 4]
push ecx
call fcn.00408490
add esp, 8
jmp 0x40548d
push 0x40e1fc
lea edx, [ebp - 0x108]
push edx
call fcn.00408490
add esp, 8
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x4054d8
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.00405508
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.00405508
add esp, 8
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.00405508
add esp, 8
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.00405508
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x405508
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.00408490
add esp, 8
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.004083d0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00408490
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jne 0x40556d
jmp 0x4055bf
mov ecx, 1
test ecx, ecx
je 0x4055b2
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00408490
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4055b0
jmp 0x4055b2
jmp 0x40556d
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret
Function at 0x4055c3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push str.ArmAccess
mov eax, dword [0x40dfd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x4055f6
mov eax, 1
jmp 0x405692
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push 0x40d23c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str..mailslotclient_
lea edx, [ebp - 0x100]
push edx
call fcn.00408490
add esp, 8
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.004084a0
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x40e0e0], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x40e0e0]
push edx
mov eax, dword [0x40e0dc]
push eax
call dword [ebp - 0x208]
add esp, 0x10
mov dword [ebp - 0x204], eax
mov ecx, dword [0x40e0e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x204]
mov esp, ebp
pop ebp
ret

Function at 0x4063c7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4063fc
mov dword [0x40e0e8], 1
xor al, al
jmp 0x4064b9
mov eax, dword [ebp - 8]
and eax, 0x80000000
test eax, eax
je 0x406418
mov ecx, dword [ebp - 8]
and ecx, 0x7fffffff
mov dword [ebp - 8], ecx
mov byte [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4064af
cmp dword [ebp + 0xc], 0
je 0x40649d
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406452
mov dword [0x40e0e8], 1
xor al, al
jmp 0x4064b9
cmp dword [ebp + 0x14], 0
je 0x40646c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.0040438b
add esp, 0xc
mov eax, dword [ebp - 0xc]
and eax, 0xff
test eax, eax
jne 0x40649b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00404549
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x40649b
xor al, al
jmp 0x4064b9
jmp 0x4064af
push 1
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4064bd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [0x40dfcc], 1
lea eax, [ebp - 4]
push eax
push 0
push 0x40dda0
push 0x405005
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov cl, byte [0x40dfcc]
cmp ecx, 1
jne 0x4064fb
push 0
push 0x7d
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x4064e2
mov esp, ebp
pop ebp
ret
Function at 0x406720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push pe_overlay
call fcn.00407bc5
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 1
mov ecx, dword [ebp - 8]
and ecx, 0xff
test ecx, ecx
je 0x4067b9
mov dword [ebp - 4], pe_overlay
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004063c7
add esp, 0x10
and eax, 0xff
test eax, eax
je 0x4067a9
cmp dword [ebp - 4], 0
jne 0x40677d
jmp 0x4067b9
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4067a7
mov dword [0x40e0e8], 2
mov byte [ebp - 8], 0
jmp 0x4067b7
mov dword [0x40e0e8], 0
mov byte [ebp - 8], 0
jmp 0x406740
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00407bba
add esp, 4
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4067d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
jne 0x40681b
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x108]
push edx
call fcn.00408580
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40681b
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x40683a
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp + 8]
push eax
push 0
push 0x40d398
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406871
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
jne 0x406871
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004067d2
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x406c8a
Capabilities:
Create mailslot
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x40dfc8]
push eax
push str._08X
lea ecx, [ebp - 0x200]
push ecx
call fcn.004085a7
add esp, 0xc
lea edx, [ebp - 0x200]
push edx
push str.ArmServerInfo
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str..mailslot_server_
lea eax, [ebp - 0x100]
push eax
call fcn.00408490
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.004084a0
add esp, 8
push 0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [0x40e0dc], eax
mov esp, ebp
pop ebp
ret

Function at 0x406d19
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push 1
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00406875
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x406d59
xor eax, eax
jmp 0x406e8c
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 5
call fcn.00406d05
add esp, 4
test eax, eax
je 0x406e83
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffff
jne 0x406daa
xor eax, eax
jmp 0x406e8c
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x14c], 0
push 0
lea edx, [ebp - 0x148]
push edx
push 0x40
lea eax, [ebp - 0x284]
push eax
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x148], 0x40
jne 0x406e5e
mov edx, dword [ebp - 0x284]
and edx, 0xffff
cmp edx, 0x5a4d
jne 0x406e5e
push 0
push 0
mov eax, dword [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x148]
push edx
push 0xf8
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x148], 0xf8
jne 0x406e5e
cmp dword [ebp - 0x244], 0x4550
jne 0x406e5e
mov edx, dword [ebp - 0x21c]
add edx, dword [ebp - 0x210]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call fcn.00406d05
add esp, 4
cmp dword [ebp - 0x14c], eax
je 0x406e81
xor eax, eax
jmp 0x406e8c
jmp 0x406e87
xor eax, eax
jmp 0x406e8c
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x406e90
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push edi
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov cl, byte [0x40e208]
mov byte [ebp - 0x2e0], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x2df]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x406eff
cmp dword [ebp - 0xcc], 0
jne 0x406eff
lea eax, [ebp - 0x2e0]
push eax
call fcn.00406fa8
add esp, 4
and eax, 0xff
test eax, eax
je 0x406eff
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x94], 0x94
lea edx, [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x406f27
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x104
lea eax, [ebp - 0x1dc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x1dc]
push ecx
push str.PROTECTEDFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x40dda0
lea edx, [ebp - 0xd8]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406fa1
mov dword [0x40e0e8], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_code__u_
push 0x40e0ec
call fcn.004085a7
add esp, 0xc
xor al, al
jmp 0x406fa3
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40786d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], str.Bitmap_Window
mov al, byte [ebp + 0x14]
mov byte [0x40e230], al
mov ecx, dword [ebp + 8]
mov dword [0x40e220], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x40e21c], edx
xor eax, eax
mov al, byte [0x40e231]
test eax, eax
jne 0x407913
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x30], 0x4079b9
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov cl, byte [0x40e230]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 0x7f02
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov byte [0x40e231], 1
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x40e220]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x40e21c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0
push 0
mov ecx, dword [0x40e21c]
push ecx
mov edx, dword [0x40e220]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x80000000
push str.Loading...
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
and eax, 0xff
neg eax
sbb eax, eax
and eax, 8
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x40e224], eax
push 5
mov ecx, dword [0x40e224]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x40e224]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
cmp dword [0x40e224], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x409d85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d578
cmp edx, dword [eax]
je 0x409da7
add eax, 8
inc ecx
cmp eax, 0x40d608
jl 0x409d98
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d578]
jne 0x409ed5
mov eax, dword [0x40e23c]
cmp eax, 1
je 0x409eaf
test eax, eax
jne 0x409dd8
cmp dword [0x40d4d4], 1
je 0x409eaf
cmp edx, 0xfc
je 0x409ed5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409e0f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408490
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004087d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x409e52
lea eax, [ebp - 0x1a4]
push eax
call fcn.004087d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c53c
push edi
call fcn.00408850
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408490
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004084a0
lea eax, [ebp - 0xa0]
push 0x40c51c
push eax
call fcn.004084a0
push dword [esi + 0x40d57c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004084a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040b017
add esp, 0x2c
pop edi
jmp 0x409ed5
lea eax, [ebp + 8]
lea esi, [esi + 0x40d57c]
push 0
push eax
push dword [esi]
call fcn.004087d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret