joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416608
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.004299a0
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [edi + 0x1010]
mov dword [ebp - 0xc], ebx
push dword [edi + 0x1000]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41663b
xor al, al
jmp 0x4166eb
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1000]
call esi
cmp dword [ebp - 4], 4
je 0x416662
xor al, al
jmp 0x4166ea
push ebx
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x1000]
call esi
cmp dword [ebp - 4], 4
jne 0x41665b
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x2010]
push eax
push dword [edi + 0x1000]
call esi
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x41665b
mov esi, dword [edi + 0x101c]
push 0x1000
push eax
lea eax, [ebp - 0x2010]
push eax
push edi
call fcn.004163f4
mov eax, dword [ebp - 8]
add eax, 8
add dword [edi + 0x1010], eax
cmp byte [edi + 0x1020], bl
mov dword [edi + 0x100c], ebx
je 0x4166e8
mov eax, dword [ebp - 0xc]
add eax, dword [edi + ebx*4]
inc ebx
cmp ebx, 0x400
jl 0x4166d0
xor ecx, ecx
cmp eax, dword [ebp - 0x10]
sete cl
mov al, cl
jmp 0x4166ea
mov al, 1
pop esi
pop ebx
leave
ret

Function at 0x4166ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004299a0
push ebx
push esi
mov esi, dword [edi + 0x101c]
push 0x1000
push edi
lea eax, [ebp - 0x200c]
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call fcn.00416237
mov dword [ebp - 0xc], eax
xor eax, eax
mov ecx, dword [edi + eax*4]
add dword [ebp - 8], ecx
inc eax
cmp eax, 0x400
jl 0x41671f
mov eax, dword [edi + 0x1004]
mov ecx, dword [eax + 0x7c]
add ecx, dword [eax + 0x74]
push ebx
push ebx
push ecx
push dword [edi + 0x1000]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4167a4
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x1000]
call esi
cmp dword [ebp - 4], 4
jne 0x4167a4
push ebx
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1000]
call esi
cmp dword [ebp - 4], 4
jne 0x4167a4
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x200c]
push eax
push dword [edi + 0x1000]
call esi
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 4], ecx
je 0x4167a8
xor al, al
jmp 0x4167cb
mov eax, dword [edi + 0x1004]
push 0x1000
add ecx, 8
add dword [eax + 0x7c], ecx
push ebx
push edi
call fcn.00426270
add esp, 0xc
mov dword [edi + 0x100c], ebx
mov al, 1
pop esi
pop ebx
leave
ret
Function at 0x4167e3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp byte [edi + 0x1018], 0
mov ebx, eax
mov dword [ebp - 4], esi
jne 0x41683f
mov eax, dword [edi + 0x1004]
cmp dword [eax + 0x70], 1
jne 0x416858
mov eax, dword [eax + 0x74]
add eax, dword [edi + 0x1014]
push esi
push esi
push eax
push dword [edi + 0x1000]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41683f
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [edi + 0x1000]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x416847
or eax, 0xffffffff
jmp 0x41690a
mov eax, dword [edi + 0x1004]
mov ecx, dword [ebp - 4]
add dword [eax + 0x7c], ecx
jmp 0x4168f5
mov eax, dword [edi + 0x100c]
lea ecx, [eax + ebx]
mov esi, 0x1000
cmp ecx, esi
ja 0x41688c
push ebx
push dword [ebp + 8]
add eax, edi
push eax
call fcn.00425f30
mov eax, dword [edi + 0x1004]
add dword [eax + 0x78], ebx
add esp, 0xc
add dword [edi + 0x100c], ebx
mov eax, ebx
jmp 0x41690a
mov ecx, esi
sub ecx, eax
push ecx
push dword [ebp + 8]
add eax, edi
push eax
mov dword [ebp - 8], ecx
call fcn.00425f30
add esp, 0xc
call fcn.004166ee
test al, al
je 0x416911
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], eax
sub ebx, eax
add eax, ecx
mov dword [ebp + 8], eax
jmp 0x4168db
push esi
push dword [ebp + 8]
push edi
call fcn.00425f30
add esp, 0xc
call fcn.004166ee
test al, al
je 0x416911
add dword [ebp + 8], esi
sub ebx, esi
add dword [ebp - 4], esi
cmp ebx, esi
ja 0x4168bd
push ebx
push dword [ebp + 8]
push edi
call fcn.00425f30
add esp, 0xc
add dword [ebp - 4], ebx
mov dword [edi + 0x100c], ebx
mov eax, dword [edi + 0x1004]
mov ecx, dword [ebp - 4]
add dword [eax + 0x78], ecx
mov eax, dword [ebp - 4]
add dword [edi + 0x1014], eax
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
jmp 0x41690a
Function at 0x416c8f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40010
call fcn.004299a0
push edi
mov edi, ecx
cmp dword [edi + 0x1040], 0xffffffff
je 0x416ed1
cmp byte [edi + 0x1044], 1
je 0x416ed1
cmp byte [edi + 0x1045], 0
push ebx
push esi
jne 0x416e94
cmp byte [edi + 0x10730], 0
jne 0x416cd7
and dword [edi + 0xc], 0
jmp 0x416cdf
call fcn.00416ed6
mov dword [edi + 0xc], eax
xor ebx, ebx
push ebx
push ebx
push dword [edi + 0x10]
push dword [edi + 0x1040]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x416eb6
push 0x40
push edi
lea eax, [ebp - 0x40010]
lea esi, [edi + 0x1048]
push eax
call fcn.00416237
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
cmp dword [ebp - 4], 4
jne 0x416eb6
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x40010]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x416eb6
and dword [ebp - 0xc], 0
test dword [edi + 8], 0xfffffc00
jbe 0x416e02
lea eax, [edi + 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push 0x20000
push dword [eax]
lea eax, [ebp - 0x40010]
push eax
call fcn.00416237
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
cmp dword [ebp - 4], 4
jne 0x416eb6
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x40010]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x416eb6
mov eax, dword [edi + 8]
inc dword [ebp - 0xc]
add dword [ebp - 0x10], 4
shr eax, 0xa
cmp dword [ebp - 0xc], eax
jb 0x416d83
test word [edi + 8], 0x3ff
je 0x416e69
mov eax, dword [ebp - 0xc]
push 0x20000
push dword [edi + eax*4 + 0x40]
lea eax, [ebp - 0x40010]
push eax
call fcn.00416237
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
cmp dword [ebp - 4], 4
jne 0x416eb6
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x40010]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x416eb6
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [edi + 0x10]
push eax
push dword [edi + 0x1040]
call ebx
cmp eax, 1
jne 0x416eb6
cmp dword [ebp - 4], 4
jne 0x416eb6
push dword [edi + 0x1040]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea esi, [edi + 0x40]
mov ebx, 0x400
mov eax, dword [esi]
test eax, eax
je 0x416ea9
push eax
call fcn.00438cde
pop ecx
and dword [esi], 0
add esi, 4
dec ebx
jne 0x416e9c
mov bl, 1
jmp 0x416eb8
xor bl, bl
push dword [edi + 0x1040]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x1040], 0xffffffff
pop esi
mov al, bl
pop ebx
jmp 0x416ed3
mov al, 1
pop edi
leave
ret
Function at 0x416ed6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004299a0
cmp byte [edi + 0x1044], 0
jne 0x416fa4
mov ecx, dword [edi + 0x1040]
cmp ecx, 0xffffffff
je 0x416fa4
xor eax, eax
cmp byte [edi + 0x10730], al
je 0x416fa6
push ebx
push esi
mov esi, dword [edi + 0x10]
push eax
push eax
push eax
push ecx
shr esi, 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, esi
shr eax, 0xa
je 0x416f65
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
push dword [edi + 0x1040]
call ebx
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x100c]
add dword [ebp - 4], ecx
inc eax
cmp eax, 0x400
jl 0x416f4e
dec dword [ebp - 8]
jne 0x416f32
and esi, 0x3ff
je 0x416f9d
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
shl eax, 2
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [edi + 0x1040]
call ebx
xor eax, eax
test esi, esi
jbe 0x416f9d
mov ecx, dword [ebp + eax*4 - 0x100c]
add dword [ebp - 4], ecx
inc eax
cmp eax, esi
jb 0x416f8e
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
xor eax, eax
leave
ret
Function at 0x4172b6
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004299a0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x1044], bl
push edi
jne 0x41744e
cmp byte [esi + 0x1045], bl
jne 0x41744e
mov edi, esi
call fcn.00416fa8
mov ecx, dword [esi + 0x10]
mov edx, eax
mov eax, ecx
sub eax, edx
imul eax, eax, 0x64
xor edx, edx
div ecx
cmp dword [ebp + 8], eax
jae 0x41744a
push ebx
mov dword [ebp + 8], ebx
call fcn.00417277
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x417444
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x417321
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x74], ecx
jne 0x417331
add ecx, dword [eax + 0x7c]
jmp 0x417430
mov edx, dword [eax + 0x7c]
mov dword [ebp - 0x14], edx
xor ecx, ecx
shr edx, 0xc
je 0x4173b7
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax + 0x74]
add eax, dword [ebp - 0xc]
push ebx
push ebx
push eax
push dword [esi + 0x1040]
call edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x1000
lea eax, [ebp - 0x101c]
push eax
push dword [esi + 0x1040]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
push ebx
push ebx
add eax, ecx
push eax
push dword [esi + 0x1040]
call edi
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x1000
lea eax, [ebp - 0x101c]
push eax
push dword [esi + 0x1040]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [ebp - 0xc], 0x1000
dec dword [ebp - 8]
mov eax, dword [ebp - 4]
jne 0x417347
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
and edx, 0xfff
mov dword [ebp - 8], edx
je 0x417427
mov eax, dword [eax + 0x74]
push ebx
shl ecx, 0xc
push ebx
add eax, ecx
push eax
push dword [esi + 0x1040]
mov dword [ebp - 0x10], ecx
call edi
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x101c]
push eax
push dword [esi + 0x1040]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push ebx
push ebx
add eax, ecx
push eax
push dword [esi + 0x1040]
call edi
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x101c]
push eax
push dword [esi + 0x1040]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x74], ecx
add ecx, dword [ebp - 0x14]
push ecx
mov dword [ebp + 8], ecx
call fcn.00417277
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x41731e
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov al, 1
jmp 0x417450
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41820f
Capabilities:
Delete file
Get file size
Set file attributes

Disassembly:
mov eax, 0x447032
call fcn.00429ea8
sub esp, 0x5c
push ebx
push esi
push edi
mov esi, 0x80
push esi
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x41823e
push dword [ebp + 8]
push str.CAutoFetch::CheckFetchFile__s__SetFileAttributes_Failed_n
jmp 0x418260
xor ebx, ebx
push ebx
push esi
mov esi, dword [ebp + 8]
push 3
push ebx
push 3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x41826c
push esi
push str.CAutoFetch::CheckFetchFile__s__CreateFile_Failed_n
call fcn.004101cb
pop ecx
pop ecx
jmp 0x41830c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
jle 0x41828a
push edi
push eax
push esi
push str.CAutoFetch::CheckFetchFile__s__File_Size_differ__d:_d_n
call fcn.004101cb
add esp, 0x10
jmp 0x418303
jne 0x418332
lea edi, [ebp - 0x68]
call fcn.00417772
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], ebx
mov edx, dword [ebp - 0x28]
push edi
push eax
mov ecx, eax
mov byte [ebp - 0x16], 1
call fcn.004178b3
test al, al
jne 0x4182c1
push edi
push str.CAutoFetch::CheckFetchFile__s__xfm.Init_Failed_n
jmp 0x4182ef
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x64], eax
je 0x4182dd
push eax
push dword [ebp - 0x64]
push edi
push str.CAutoFetch::CheckFetchFile__s__xfm.GetVersion_differ__d:_d_n
call fcn.004101cb
add esp, 0x10
jmp 0x4182f6
lea edx, [ebp - 0x68]
call fcn.00417cbf
test al, al
jne 0x418317
push edi
push str.CAutoFetch::CheckFetchFile__s__Uninit_Failed_n
call fcn.004101cb
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.00417799
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x41834b
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.00417799
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x41834d
push edi
push eax
push esi
push str.CAutoFetch::CheckFetchFile__s__FAIL_WITH_RESUME__d:_d_n
call fcn.004101cb
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41be77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41bec3
cmp dword [ebp + 0xc], 1
je 0x41beac
cmp dword [ebp + 0xc], 2
jne 0x41beba
test edi, edi
mov eax, dword [ebp - 4]
je 0x41bebf
cmp byte [eax + edi - 1], 0
je 0x41bebf
push 0xd
pop eax
jmp 0x41bec3
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x41cabd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x41cb10
call fcn.00442855
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41cb10
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x41cb06
xor eax, eax
jmp 0x41cc29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x41cb40
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x41cb40
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x41cc26
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x41cb6d
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0041e7cd
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x41cc26
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41cbb6
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x41cbb6
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x41cbb0
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0041e7cd
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x41cc16
and dword [ebp + 0xc], 0
jmp 0x41cc16
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x41cc16
push 0xc
call fcn.00438cb3
mov esi, eax
test esi, esi
pop ecx
je 0x41cbf8
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x41cbfa
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x41cc11
push dword [ebp - 8]
call fcn.004380f6
jmp 0x41cc16
call fcn.004380cd
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x41cb7b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x425d50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004299a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x425deb
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4657fc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x425deb
cmp eax, 1
je 0x425e0c
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x425deb
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x425db8
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x425de7
xor eax, eax
inc eax
jmp 0x425e2b
cmp edi, eax
jae 0x425def
xor eax, eax
jmp 0x425e2b
cmp eax, esi
jae 0x425df6
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4657fc]
jmp 0x425e0f
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4289de
Capabilities:
Terminate process

Disassembly:
push 8
push 0x44b468
call fcn.0042a294
push 8
call fcn.0042b5eb
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x46583c], esi
jne 0x428a12
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x465838], esi
mov al, byte [ebp + 0x10]
mov byte [0x465834], al
cmp dword [ebp + 0xc], edi
jne 0x428a5c
cmp dword [0x46630c], edi
je 0x428a4c
mov eax, dword [0x466308]
sub eax, 4
mov dword [0x466308], eax
cmp eax, dword [0x46630c]
jb 0x428a4c
mov eax, dword [eax]
cmp eax, edi
je 0x428a2d
call eax
jmp 0x428a2d
push 0x4610b8
mov eax, 0x4610b0
call fcn.0042895c
pop ecx
push 0x4610c4
mov eax, 0x4610bc
call fcn.0042895c
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.00428a8d
cmp dword [ebp + 0x10], edi
jne 0x428a9b
mov dword [0x46583c], esi
push dword [ebp + 8]
call fcn.0042891a
xor edi, edi
xor esi, esi
inc esi
call fcn.0042a2cf
ret
Function at 0x42955e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x42957b
call fcn.0042850d
mov dword [eax], 0x16
xor eax, eax
jmp 0x4295e5
push esi
push 0x8c
push 1
call fcn.0042b3dd
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4295d0
push esi
call fcn.0042cea7
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4295ae
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4294c9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4295e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00426389
test ebx, ebx
pop ecx
je 0x4295e2
push ebx
call fcn.0042851f
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42977d
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x44b5d0
call fcn.0042a294
mov edi, 0x94
mov eax, edi
call fcn.004299a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4657fc], ecx
mov eax, dword [esi + 4]
mov dword [0x465808], eax
mov edx, dword [esi + 8]
mov dword [0x46580c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x465800], esi
cmp ecx, 2
je 0x4297dd
or esi, 0x8000
mov dword [0x465800], esi
shl eax, 8
add eax, edx
mov dword [0x465804], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x429818
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x429818
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x429830
cmp eax, 0x20b
je 0x42981d
mov dword [ebp - 0x1c], esi
jmp 0x429844
cmp dword [ecx + 0x84], 0xe
jbe 0x429818
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x42983e
cmp dword [ecx + 0x74], 0xe
jbe 0x429818
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0042b636
pop ecx
test eax, eax
jne 0x429858
push 0x1c
call fcn.00429759
pop ecx
call fcn.0042d0a1
test eax, eax
jne 0x429869
push 0x10
call fcn.00429759
pop ecx
call fcn.0043055e
mov dword [ebp - 4], esi
call fcn.0042ff4b
test eax, eax
jge 0x429882
push 0x1b
call fcn.00429734
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x466300], eax
call fcn.0043115a
mov dword [0x465840], eax
call fcn.004310b8
test eax, eax
jge 0x4298a8
push 8
call fcn.00429734
pop ecx
call fcn.00430e85
test eax, eax
jge 0x4298b9
push 9
call fcn.00429734
pop ecx
push 1
call fcn.00428974
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4298cf
push eax
call fcn.00429734
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00430e28
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4298f0
movzx eax, word [ebp - 0x40]
jmp 0x4298f3
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00437a31
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x429911
push edi
call fcn.00428aa1
call fcn.00428ac3
jmp 0x429943
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0042a2cf
ret