joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b211
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 8]
push eax
xor esi, esi
mov dword [ebp - 0xc], edi
push 0x1005bcc0
inc esi
mov dword [ebp - 8], edi
push esi
mov dword [ebp - 4], edi
mov dword [0x1005c25c], edi
mov dword [0x1005c258], edi
mov dword [0x1005c254], edi
mov dword [0x1005c250], edi
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoSizeExW]
mov ebx, eax
test ebx, ebx
je 0x1002b2e1
push ebx
mov esi, edi
call fcn.10019caa
mov edi, eax
pop ecx
test edi, edi
jne 0x1002b272
mov esi, 0x8007000e
jmp 0x1002b2e1
push ebx
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push ebx
push 0
push 0x1005bcc0
push 3
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_GetFileVersionInfoExW]
test eax, eax
jne 0x1002b29a
mov esi, 0x80004005
jmp 0x1002b2da
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x100063bc
push edi
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x1002b2da
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 0xa]
mov dword [0x1005c25c], eax
movzx eax, word [ecx + 8]
mov dword [0x1005c258], eax
movzx eax, word [ecx + 0xe]
mov dword [0x1005c254], eax
movzx ecx, word [ecx + 0xc]
mov dword [0x1005c250], ecx
push edi
call fcn.10019cd9
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002b864
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002b8cf
cmp dword [ebp - 4], 1
je 0x1002b8a4
cmp dword [ebp - 4], 2
jne 0x1002b8bf
mov ecx, dword [ebp - 8]
test esi, esi
je 0x1002b8c9
test ecx, ecx
je 0x1002b8c4
test cl, 1
jne 0x1002b8bf
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x1002b8c9
push 0xd
pop eax
jmp 0x1002b8cf
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004424a
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push eax
mov dword [ebp - 0x10], ebx
mov edi, 0x80004005
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
lea edx, [ebx + 2]
mov dword [ebp - 0x14], esi
xor ecx, ecx
mov ax, word [ebx]
add ebx, 2
cmp ax, cx
jne 0x10044272
sub ebx, edx
sar ebx, 1
test ebx, ebx
jle 0x100443b1
xor ecx, ecx
lea eax, [ebx + ebx]
push 0x1c
pop edx
mov dword [ebp - 0x1c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10019caa
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x100443b1
lea edi, [eax + 4]
xor edx, edx
mov eax, ebx
mov dword [ebp - 4], edi
mov ecx, edx
neg eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x10044329
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
lea esi, [edi - 4]
push dword [ebp - 0x14]
mov dword [esi], 1
push edx
movzx eax, word [eax + ecx*2]
push eax
mov word [edi], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
xor ecx, ecx
mov word [edi + 2], ax
mov dword [edi + 4], ecx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov edx, dword [ebp - 0xc]
add eax, edx
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
add edi, 0x18
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
or dword [edi + 0x20], 2
inc ecx
inc edx
mov dword [ebp - 8], ecx
add edi, 0x38
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], edi
pop edx
cmp ecx, ebx
jl 0x100442c7
jmp 0x1004438c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
lea esi, [edi - 4]
push edx
mov dword [esi], 1
movzx eax, word [eax + ecx*2]
push eax
mov word [edi], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [edi + 2], ax
xor eax, eax
mov dword [edi + 4], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov edx, dword [ebp - 8]
add eax, edx
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
add edi, 0x18
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push eax
or dword [edi + 0x20], 2
inc ecx
inc edx
mov dword [ebp - 0xc], ecx
add edi, 0x38
mov dword [ebp - 8], edx
mov dword [ebp - 4], edi
pop edx
cmp ecx, ebx
jl 0x1004432f
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push 0x1c
push esi
push ebx
call dword [sym.imp.USER32.dll_SendInput]
sub ebx, eax
neg ebx
push esi
sbb ebx, ebx
and ebx, 0x80004005
mov edi, ebx
call fcn.10019cd9
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100573a9
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x1005c668]
push esi
push edi
test eax, eax
jne 0x100573c2
call fcn.10057486
test eax, eax
je 0x1005740a
mov eax, dword [0x1005c668]
cmp eax, 1
jne 0x100573da
push 0xd
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
jmp 0x10057450
push eax
call dword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPopEntrySList]
mov ecx, eax
test ecx, ecx
je 0x100573f3
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, ecx
jmp 0x10057450
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1005740e
xor eax, eax
jmp 0x10057450
mov eax, dword [esi]
push dword [0x1005c668]
call dword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x10057434
push 0x8000
push 0
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualFree]
mov eax, edi
jmp 0x10057450
lea edi, [esi + 0xff0]
push esi
push dword [0x1005c668]
call dword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1005743a
mov eax, esi
pop edi
pop esi
ret
Function at 0x40620b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41771b
call fcn.004117f0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x419210
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x419238
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00409525
push dword [esi + 8]
mov ecx, ebx
call fcn.00409525
push dword [esi + 0xc]
mov ecx, edi
call fcn.00409525
push dword [esi + 0xc]
mov ecx, edi
call fcn.00409525
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x406217
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41771b
call fcn.004117f0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x419210
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x419238
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00409525
push dword [esi + 8]
mov ecx, ebx
call fcn.00409525
push dword [esi + 0xc]
mov ecx, edi
call fcn.00409525
push dword [esi + 0xc]
mov ecx, edi
call fcn.00409525
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40a43e
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 8
Function at 0x40a466
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42176c], 0
jne 0x40a49d
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040a4b2
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.0040a43e
push dword [ebp - 0xc]
mov bl, al
call fcn.0040966b
pop ecx
mov al, bl
pop ebx
jmp 0x40a4ae
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
leave
ret 8

Function at 0x40a504
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42176c], 0
jne 0x40a537
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040a4b2
push dword [eax]
call fcn.0040a454
push dword [ebp - 0xc]
mov bl, al
call fcn.0040966b
pop ecx
mov al, bl
pop ebx
jmp 0x40a545
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x40a55d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42176c], 0
jne 0x40a590
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040a4b2
push dword [eax]
call fcn.0040a549
push dword [ebp - 0xc]
mov bl, al
call fcn.0040966b
pop ecx
mov al, bl
pop ebx
jmp 0x40a5a0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x40a7d3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42176c], 0
jne 0x40a806
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040a4b2
push dword [eax]
call fcn.0040a7b2
push dword [ebp - 0xc]
mov bl, al
call fcn.0040966b
pop ecx
mov al, bl
pop ebx
jmp 0x40a822
push 0
push dword [ebp + 8]
call fcn.0040a466
test al, al
je 0x40a822
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
leave
ret 4

Function at 0x40adc2
Capabilities:
Delete file

Disassembly:
mov eax, 0x417ce4
call fcn.004117f0
sub esp, 0x10
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040ae7c
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.0040ad13
test al, al
je 0x40ae59
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40ae44
push dword [esi]
call fcn.0040b4de
test al, al
jne 0x40ae20
push dword [esi]
call fcn.0040a549
test al, al
jne 0x40ae42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ae59
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040ad9e
push dword [ebp - 0x18]
call fcn.0040966b
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0040ae7c
mov dword [ebp - 4], ebx
jmp 0x40ade1
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0040ad9e
push dword [ebp - 0x18]
call fcn.0040966b
pop ecx
mov al, bl
jmp 0x40ae6c
lea ecx, [ebp - 0x1c]
call fcn.0040ad9e
push dword [ebp - 0x18]
call fcn.0040966b
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40b356
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x417d64
call fcn.004117f0
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.004123c0
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.0040940e
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040b40f
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00408e3a
push dword [ebp - 0x24]
call fcn.0040966b
push dword [ebp - 0x18]
call fcn.0040966b
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40b697
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b6bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40b6bd
xor al, al
jmp 0x40b6dd
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004123c0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x40ef77
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jb 0x40f0c7
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x40efb7
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x40efb7
inc esi
jmp 0x40efa8
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x40f0a7
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x40efec
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x40f019
cmp cl, 0xff
je 0x40f019
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x40ef9b
dec ecx
shl edx, cl
and edx, 7
je 0x40efd2
movzx ecx, byte [edx + 0x41970c]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x419704], 0
mov cl, byte [edi + 4]
je 0x40f014
test cl, cl
je 0x40f014
cmp cl, 0xff
jne 0x40efd2
mov dword [ebp - 4], eax
jmp 0x40efe1
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x40f042
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x40f049
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x40f07d
movzx edi, byte [edx + 0x41970c]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x40f068
cmp al, 0xff
jne 0x40f07a
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x40f034
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x40ef9b
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret 0x14

Function at 0x40f0ff
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 4]
test edx, edx
jbe 0x40f12c
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x421ae0]
xor eax, esi
inc ecx
dec edx
jne 0x40f10d
pop edi
pop esi
ret 4

Function at 0x40f1e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0041241f
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.0040f1b0
pop ebp
ret 0xc
Function at 0x40fdf0
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4183c8
call fcn.004117f0
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00408e3a
push 0
push 0x1f4
mov ecx, edi
call fcn.0040a00b
lea eax, [ebp - 0x18]
push 0x45
push eax
call fcn.0040bc2a
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040bc4a
push dword [ebp - 0x18]
call fcn.0040966b
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4112b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4112d8
xor al, al
leave
ret
cmp dword [ebp - 0x84], 2
jne 0x4112ef
cmp dword [ebp - 0x90], 5
jb 0x4112ef
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4156e1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x420ec8
cmp edx, dword [eax]
je 0x415703
add eax, 8
inc ecx
cmp eax, 0x420f58
jl 0x4156f4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x420ec8]
jne 0x415831
mov eax, dword [0x421778]
cmp eax, 1
je 0x41580b
test eax, eax
jne 0x415734
cmp dword [0x41eba4], 1
je 0x41580b
cmp edx, 0xfc
je 0x415831
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41576b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004160e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004161d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4157ae
lea eax, [ebp - 0x1a4]
push eax
call fcn.004161d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x419da4
push edi
call fcn.004162e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004160e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004160f0
lea eax, [ebp - 0xa0]
push 0x419d84
push eax
call fcn.004160f0
push dword [esi + 0x420ecc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004160f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041624b
add esp, 0x2c
pop edi
jmp 0x415831
lea eax, [ebp + 8]
lea esi, [esi + 0x420ecc]
push 0
push eax
push dword [esi]
call fcn.004161d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x70], eax
or dword [ebx + 0x30], 0xffffffff
or dword [ebx + 0x54], 0xffffffff
or dword [ebx + 0x78], 0xffffffff
or dword [ebx + 0x34], 0xffffffff
or dword [ebx + 0x58], 0xffffffff
or dword [ebx + 0x7c], 0xffffffff
xor eax, eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x64], eax
or dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
mov edi, ebx
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
jmp dword [eax*4 + 0x40105b]
Function at 0x406037
Capabilities:
Allocate or change rwx memory

Disassembly:
xor ebx, ebx
push ebx
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4082e0], eax
push eax
mov eax, sub.gdi32.dll_CombineRgn
mov ecx, entry0
sub eax, ecx
push 0x4082b0
push 0x40
push eax
push ecx
call sub.kernel32.dll_VirtualProtect
pop eax
push ebx
push 0x406075
push ebx
push 0x65
push eax
call sub.user32.dll_DialogBoxParamA
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0x10
jne 0x4060a0
push 0
push dword [ebp + 8]
call sub.user32.dll_EndDialog
push dword [0x4082ac]
push 0
call sub.user32.dll_KillTimer
jmp 0x4061f2
cmp dword [ebp + 0xc], 0x100
jne 0x40615d
shl dword [0x4060ce], 8
push 4
push 0x4060c4
push dword [ebp + 0x14]
call sub.user32.dll_GetKeyNameTextA
mov eax, 0x87654321
mov byte [0x4060ce], al
mov eax, 0x12345678
xor eax, 0x91450a56
cmp eax, 0xd90a4613
jne 0x406158
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x14]
push eax
call sub.gdi32.dll_CreateRectRgnIndirect
mov dword [ebp - 4], eax
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowRgn
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call sub.gdi32.dll_GetRgnBox
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
shr eax, 3
lea edx, [eax*2]
lea ecx, [eax + eax*2]
add dword [ebp - 0x14], ecx
sub dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
sub eax, edx
shr eax, 1
add dword [ebp - 0x10], eax
sub dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
call sub.gdi32.dll_CreateEllipticRgnIndirect
push 4
push eax
push dword [ebp - 4]
push dword [ebp - 4]
call sub.gdi32.dll_CombineRgn
push 1
push dword [ebp - 4]
push dword [ebp + 8]
call sub.user32.dll_SetWindowRgn
jmp 0x4061f2
cmp dword [ebp + 0xc], 0x110
jne 0x406186
push dword [ebp + 8]
pop dword [0x4082b0]
push 0x40636a
push 0x64
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x4082ac], eax
jmp 0x4061f2
cmp dword [ebp + 0xc], 0x111
jne 0x4061e6
mov eax, dword [ebp + 0x10]
cmp ax, 0x9c41
jne 0x4061a8
push 0
push 0
push 0x10
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
jmp 0x4061f2
cmp ax, 0x9c42
jne 0x4061c7
push 0
push 0x4063a8
push dword [ebp + 8]
push 0x67
push dword [0x4082e0]
call sub.user32.dll_DialogBoxParamA
jmp 0x4061f2
cmp ax, 0x9c43
jne 0x4061f2
push 0
push 0x4061fe
push dword [ebp + 8]
push 0x68
push dword [0x4082e0]
call sub.user32.dll_DialogBoxParamA
jmp 0x4061f2
mov eax, 0
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret 0x10