joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x478148
xor eax, eax
push ebp
push 0x4782d6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x47cf0c], 1
jne 0x47819e
mov eax, dword [0x47bb18]
cmp dword [eax], 0
je 0x478185
mov eax, dword [0x47bb18]
mov eax, dword [eax]
call fcn.004558ec
mov eax, dword [0x47bb18]
xor edx, edx
mov dword [eax], edx
push 3
mov eax, dword [0x47ce68]
call fcn.0043fb80
push eax
call sub.user32.dll_ShowWindow
mov byte [0x47cf0c], 0
lea ecx, [ebp - 0x24]
mov eax, dword [0x47ce68]
mov eax, dword [eax + 0x2f0]
mov edx, 0xcb
call fcn.0045f474
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
mov ecx, 0x4782e4
call fcn.00406398
cmp dword [ebp - 4], 0
je 0x478280
lea eax, [ebp - 0x20]
mov edx, 1
mov cl, 1
call fcn.00405570
lea eax, [ebp - 0x34]
call fcn.004055a0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
call fcn.00406354
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x5c]
call fcn.00406460
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
call fcn.00406460
lea edx, [ebp - 0x34]
lea eax, [ebp - 8]
call fcn.004054fc
cmp dword [ebp - 8], 0
je 0x478280
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x4782f4
call fcn.00406398
cmp dword [ebp - 0xc], 0
je 0x478280
lea eax, [ebp - 0x3c]
mov edx, dword [0x47ce7c]
call fcn.00404e18
mov eax, dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
call fcn.00406354
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
call fcn.00406460
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
call fcn.00406460
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 4]
call fcn.00406354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4782dd
lea eax, [ebp - 0x40]
call fcn.00406354
lea eax, [ebp - 0x3c]
call fcn.00404ccc
lea eax, [ebp - 0x38]
call fcn.00406354
lea eax, [ebp - 0x34]
call fcn.004055a0
lea eax, [ebp - 0x24]
call fcn.00406354
lea eax, [ebp - 0x20]
call fcn.004055a0
lea eax, [ebp - 0xc]
call fcn.00406354
lea eax, [ebp - 8]
call fcn.00406354
lea eax, [ebp - 4]
call fcn.00406354
ret
Function at 0x10001c70
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor edx, 0x3652
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x14]
lea eax, [ebp - 0x3664]
mov ebx, edi
mov ecx, edi
xor ebx, 8
add esi, 3
xor ecx, 0x366d
cmp edx, eax
je 0x10001d33
xor edx, 0x3651
cmp edi, edx
jl 0x10001ce3
mov edx, dword [0x101650f0]
mov eax, ebp
mov ecx, dword [0x10164fb4]
cmp ecx, dword [edx + 0x12c]
je 0x10001d35
mov ecx, dword [edx + 0x10]
add ecx, 0x4aa75
imul ecx, dword [edx + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
mov dword [edx + 0x9c], ecx
ret
mov edi, dword [esp + 0x28]
mov eax, ecx
or eax, 0x3652
mov edi, dword [edi + 0x134]
cmp edi, eax
je 0x10001d33
xor esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
mov eax, ebx
cmp ebx, esi
jl 0x10001d1c
mov edx, dword [ebp + 0x144]
imul edx, dword [0x101650e8]
add eax, 4
xor ecx, edx
cmp eax, esi
jge 0x10001d13
mov eax, ecx
add edi, 4
or eax, 0x3652
cmp edi, eax
jne 0x10001d00
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10004740
Capabilities:
Create pipe

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
add edx, 0xffffc99c
push ebp
mov ebp, ebx
mov dword [esp + 0x1c], edx
xor ebp, 0xd
xor ebx, 0x3652
push esi
push edi
mov edi, dword [esp + 0x1c]
xor edi, 0x366a
lea eax, [ebp + 0xe]
cmp edi, eax
je 0x10004816
mov eax, dword [esp + 0x2c]
xor edi, 0x3665
mov edx, dword [esp + 0x20]
add eax, 0xfffffff5
cmp eax, edi
je 0x100047c5
mov eax, dword [0x10165034]
sub eax, dword [edx + 0x11c]
xor eax, 0x2718f3
add dword [edx + 0x100], eax
mov eax, dword [0x101650f0]
mov eax, dword [eax + 0x60]
cmp eax, dword [0x1016509c]
jb 0x100047bb
imul eax, dword [edx + 0x40], 0x1a77d4
mov dword [edx + 0x40], eax
sub dword [0x101650a8], 0xcd5
mov esi, dword [edx + 0x50]
cmp esi, 0x8287
jbe 0x100047d9
or dword [edx + 0x7c], 0x25c4f
jmp 0x100047f2
mov eax, dword [edx + 0x104]
mov ecx, dword [0x101650f0]
sub eax, esi
xor eax, 0x15c443
sub dword [ecx + 0xfc], eax
mov ecx, dword [0x101650f0]
pop edi
pop esi
pop ebp
mov eax, dword [ecx + 0x12c]
sub eax, dword [0x10164fb0]
xor eax, 0xffe80aa3
mov dword [ecx], eax
lea eax, [ebx + 0x3657]
pop ebx
ret
mov esi, dword [esp + 0x20]
mov ecx, ebx
mov eax, dword [0x10165000]
sub ecx, ebp
sub eax, dword [esi + 0x94]
sub eax, 0x3659
push eax
lea eax, [ecx - 0x3667]
push eax
mov eax, dword [esi + 0x128]
or eax, dword [esi + 4]
or eax, 0x366a
push ecx
mov ecx, dword [0x1016507c]
push eax
mov eax, ecx
sub eax, dword [0x10164fc0]
push eax
mov eax, dword [0x10165030]
or eax, 0x365f
push eax
mov eax, dword [esi + 0x60]
or eax, 0x365c
xor eax, dword [0x10164fc8]
push eax
lea eax, [ecx + ebp]
imul eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [0x10164fe0]
mov ecx, dword [0x101650f0]
add eax, 0xffffc9a4
push eax
mov eax, dword [esi + 0xf4]
or eax, edi
add eax, dword [esi + 0x13c]
push esi
push eax
mov eax, dword [ecx + 0x144]
add eax, ebx
add eax, ebp
xor ebp, 0x3667
push eax
mov eax, dword [0x101650d4]
add eax, 0xffff934e
push eax
mov eax, dword [ecx + 0x74]
and eax, dword [esi + 0xc]
imul eax, dword [esp + 0x38]
push eax
push ebp
call fcn.100014e0
mov ecx, dword [esi + 0x11c]
add esp, 0x1c
mov eax, dword [0x101650f0]
and ecx, dword [0x1016504c]
pop edi
xor ecx, dword [eax + 0xf0]
lea eax, [ebx + 0x3657]
or dword [0x10164fc8], ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x10004c50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
xor edx, 0x366a
push esi
mov esi, dword [esp + 0x10]
xor ebp, 0x35
push edi
mov edi, dword [esp + 0x28]
lea eax, [edx + 0x3643]
xor esi, 0x37
add edi, 0xffffc9a4
cmp dword [esp + 0x14], eax
je 0x10004cdc
mov eax, edi
xor edx, 0x3656
xor eax, 0x365f
push eax
push edx
lea eax, [edi + 0x3652]
xor edi, 0x365c
push eax
push dword [0x101650f0]
mov eax, dword [esp + 0x34]
xor eax, 5
push eax
push edi
call fcn.10004b80
add esp, 0x18
cmp dword [0x101650a4], 0x815b
je 0x10004d38
mov ecx, dword [esp + 0x10]
pop edi
mov eax, dword [ecx + 0x20]
add eax, 0x1a861c
imul eax, dword [ecx + 0x58]
xor esi, 0x34
mov dword [ecx + 0x58], eax
mov eax, esi
pop esi
pop ebp
ret
mov edi, esi
cmp esi, 0xffffc9ae
jl 0x10004d38
push ebx
mov ebx, dword [esp + 0x14]
nop dword [eax + eax]
mov ecx, dword [0x101650f0]
mov eax, dword [0x10165008]
mov edx, dword [ebx + 0xac]
or eax, ebp
push ebx
xor eax, dword [ecx + 0x90]
push eax
mov eax, dword [ecx + 0x80]
and eax, edx
push eax
mov eax, dword [ecx + 0xc]
imul eax, edx
push eax
mov eax, dword [ebx + 0x60]
sub eax, 0x365c
push eax
call fcn.10002780
add edi, 3
add esp, 0x14
cmp edi, 0xffffc9ae
jge 0x10004cf0
pop ebx
xor esi, 0x34
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x403b80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4187b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x425538]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x14]
push ecx
mov ecx, dword [esi + 0x30]
push edx
push eax
push ecx
call dword [0x4193b4]
lea edx, [esp + 0x14]
push edx
push 0x41948c
mov dword [esp + 0x1c], 0
call dword [0x4193f8]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [0x4193ac]
mov edx, dword [0x4269bc]
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x28]
push 0
push edx
mov edx, dword [esp + 0x2c]
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x30]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x30]
sub edx, ecx
push edx
push eax
push ecx
push 0x56000000
push 0
push 0x41eb5c
push 0
lea ebx, [esi + 0x60]
call dword [0x41938c]
mov edi, dword [esp + 0x14]
mov ecx, ebx
mov dword [ebx], eax
call fcn.00404090
mov eax, dword [esp + 0x14]
push eax
call dword [0x4193fc]
lea edi, [esi + 0x64]
push ebx
mov ebx, edi
call fcn.00404780
mov cl, byte [esi + 0x68]
and cl, 1
je 0x403c99
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], ebx
mov eax, dword [edi]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x18]
push ecx
push 0x4194cc
push eax
call edx
cmp eax, ebx
jl 0x403c81
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push eax
call edx
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x403c99
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x68]
shr eax, 2
test al, 1
je 0x403cb0
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x60]
push eax
call fcn.00404000
mov ecx, dword [esi + 0x68]
shr ecx, 3
test cl, 1
je 0x403ce2
mov eax, dword [edi]
add esi, 0x34
cmp dword [esi + 0x28], 0xfefefefe
lea ecx, [esi + 0x28]
je 0x403cd6
push 0x80004005
call fcn.00402290
push ecx
push 0x41947c
push esi
call fcn.00406a50
mov edi, dword [edi]
mov edx, dword [edi]
mov eax, dword [edx + 0x100]
push 0
push edi
call eax
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x409fc0
Capabilities:
Encode data using xor

Disassembly:
or cl, byte [edx + 0x70]
and al, 0xab
dec edx
jo 0x409fe1
stosd dword es:[edi], eax
cdq
jae 0x409fb9
clc
clc
stosb byte es:[edi], al
mov byte [esi - 0x21], bl
push edi
aad 0x6f
daa
imul edi, dword [edx - 0x6218ba90], 0xffffffa7
loop 0x409fba
aas
push cs
invalid
out dx, al
mov edx, dword gs:[ebx - 0x5c]
and eax, 0xdd4f23ab
cmp bl, cl
mov bl, 0xb9
dec esi
inc ebp
invalid
Function at 0x408850
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x44a648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x45ccd4]
mov eax, 0x98dd629f
imul ecx
add edx, ecx
push ebx
push esi
mov esi, dword [0x45cce8]
sar edx, 0xf
imul esi, esi, 0xdaea
add esi, edx
push edi
mov edi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45cccc]
mov eax, esi
imul eax, eax, 0xd3c7
add edi, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x61494a93
imul esi
sub edi, ecx
sar edx, 0xf
mov ecx, edx
add edi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xd082
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov eax, 0x5cb3b92f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x57304c]
sub ecx, eax
mov dword [str._r_____r____], ecx
mov ecx, 0x57304c
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [0x45ccd8]
mov eax, 0x5134ce4f
imul ecx
imul ecx, ecx, 0x150d2
mov eax, dword [0x45cce8]
imul eax, eax, 0xdaea
sar edx, 0xd
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, eax
add esi, ecx
mov ecx, dword [0x45ccdc]
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xd082
sub esi, ecx
mov ecx, dword [0x45ccd0]
add esi, edx
mov eax, 0x79b0bfed
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], 0
sub esi, eax
mov eax, dword [0x45cce4]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
sub esi, eax
push ecx
sub esi, 0x64e1
push edx
lea ecx, [esp + 0x14]
mov dword [0x45ccd0], esi
call fcn.004085c0
mov esi, dword [0x45cccc]
mov eax, dword [0x45ccd0]
mov ecx, dword [0x45ccdc]
lea edi, [eax + esi]
imul ecx, ecx, 0x64e1
imul edi, edi, 0xb0bd
add edi, ecx
mov ecx, dword [0x45cce4]
mov eax, 0x98dd629f
imul ecx
add edx, ecx
sar edx, 0xf
mov ebx, edx
add edi, edx
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
shr ebx, 0x1f
mov ecx, edx
add ebx, edi
add ebx, edx
mov eax, 0x4e93cfed
imul esi
mov esi, dword [esp + 0xc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x10171
shr ecx, 0x1f
add ecx, ebx
sub ecx, eax
add ecx, edx
push esi
mov dword [0x45ccdc], ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebx
jg 0x408a43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41b640
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x45e640]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41b762
lea ecx, [esp + 8]
call fcn.0041b520
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x41b766
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x41b710
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.0041b640
mov edi, eax
test edi, edi
jne 0x41b78a
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x41b6d2
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41b729
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b748
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.0042fdb1
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x41b771
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.0042fdb1
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b799
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.0042fdb1
add esp, 0x118
ret 4
Function at 0x41bc70
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x41bc82
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x426f8e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x426fe1
call fcn.00447b05
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x426fe1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x426fd7
xor eax, eax
jmp 0x4270fa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x427011
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x427011
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4270f7
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x42703e
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00426203
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4270f7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x427087
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x427087
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x427081
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00426203
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4270e7
and dword [ebp + 0xc], 0
jmp 0x4270e7
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4270e7
push 0xc
call fcn.00441a07
mov esi, eax
test esi, esi
pop ecx
je 0x4270c9
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4270cb
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4270e2
push dword [ebp - 8]
call fcn.0043d45a
jmp 0x4270e7
call fcn.0043d431
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x42704c
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43031d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43033d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043257c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x430360
test byte [esp + 8], 2
je 0x430360
call fcn.0043256a
mov dword [eax], 0xd
call fcn.00432573
mov dword [eax], 5
jmp 0x430339
xor eax, eax
ret
Function at 0x430427
Capabilities:
Terminate process

Disassembly:
push 8
push 0x450738
call fcn.004323e8
push 8
call fcn.00434621
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x572b3c], esi
jne 0x43045b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x572b38], esi
mov al, byte [ebp + 0x10]
mov byte [0x572b34], al
cmp dword [ebp + 0xc], edi
jne 0x4304a5
cmp dword [0x57442c], edi
je 0x430495
mov eax, dword [0x574428]
sub eax, 4
mov dword [0x574428], eax
cmp eax, dword [0x57442c]
jb 0x430495
mov eax, dword [eax]
cmp eax, edi
je 0x430476
call eax
jmp 0x430476
push 0x4590cc
mov eax, 0x4590c4
call fcn.004303a5
pop ecx
push 0x4590d8
mov eax, 0x4590d0
call fcn.004303a5
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4304d6
cmp dword [ebp + 0x10], edi
jne 0x4304e4
mov dword [0x572b3c], esi
push dword [ebp + 8]
call fcn.00430363
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4304e3
push 8
call fcn.0043456c
pop ecx
ret
call fcn.00432423
ret

Function at 0x430757
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004305f0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4307f2
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x572afc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4307f2
cmp eax, 1
je 0x430813
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4307f2
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4307bf
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4307ee
xor eax, eax
inc eax
jmp 0x430832
cmp edi, eax
jae 0x4307f6
xor eax, eax
jmp 0x430832
cmp eax, esi
jae 0x4307fd
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x572afc]
jmp 0x430816
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4311a2
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4507f0
call fcn.004323e8
mov edi, 0x94
mov eax, edi
call fcn.004305f0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x572afc], ecx
mov eax, dword [esi + 4]
mov dword [0x572b08], eax
mov edx, dword [esi + 8]
mov dword [0x572b0c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x572b00], esi
cmp ecx, 2
je 0x431202
or esi, 0x8000
mov dword [0x572b00], esi
shl eax, 8
add eax, edx
mov dword [0x572b04], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x43123d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43123d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x431255
cmp eax, 0x20b
je 0x431242
mov dword [ebp - 0x1c], esi
jmp 0x431269
cmp dword [ecx + 0x84], 0xe
jbe 0x43123d
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x431263
cmp dword [ecx + 0x74], 0xe
jbe 0x43123d
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00434762
pop ecx
test eax, eax
jne 0x43127d
push 0x1c
call fcn.0043117e
pop ecx
call fcn.0043359d
test eax, eax
jne 0x43128e
push 0x10
call fcn.0043117e
pop ecx
call fcn.00434652
mov dword [ebp - 4], esi
call fcn.0043732f
test eax, eax
jge 0x4312a7
push 0x1b
call fcn.00431159
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x574420], eax
call fcn.0043720d
mov dword [0x572b48], eax
call fcn.0043716b
test eax, eax
jge 0x4312cd
push 8
call fcn.00431159
pop ecx
call fcn.00436f38
test eax, eax
jge 0x4312de
push 9
call fcn.00431159
pop ecx
push 1
call fcn.004303bd
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4312f4
push eax
call fcn.00431159
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00436edb
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x431315
movzx eax, word [ebp - 0x40]
jmp 0x431318
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0043cafe
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x431336
push edi
call fcn.004304ea
call fcn.0043050c
jmp 0x431368
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00432423
ret