joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4139e7
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1fb4]
mov eax, 0x2034
call fcn.0041bd40
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x1fb0], eax
push esi
push edi
mov edi, 0x206
xor esi, esi
push edi
lea eax, [ebp + 0x1ba2]
push esi
push eax
mov word [ebp + 0x1ba0], si
call fcn.0041bd70
lea eax, [ebp + 0x1ba0]
push str.C:log_
push eax
call fcn.0041c0a1
push edi
lea eax, [ebp + 0x1792]
push esi
push eax
mov word [ebp + 0x1790], si
call fcn.0041bd70
push edi
lea eax, [ebp + 0x1daa]
push esi
push eax
mov word [ebp + 0x1da8], si
call fcn.0041bd70
add esp, 0x2c
push 0x104
lea eax, [ebp + 0x1da8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1da8]
push 0x5c
push eax
call fcn.0041c425
pop ecx
mov word [eax], si
cmp dword [0x55e408], esi
pop ecx
je 0x413aab
lea eax, [ebp + 0x1da8]
push eax
lea eax, [ebp + 0x1ba0]
push str._slog_
push eax
call fcn.0041bfe1
add esp, 0xc
push 0x7fe
lea eax, [ebp + 0xf92]
push esi
push eax
mov word [ebp + 0xf90], si
call fcn.0041bd70
lea eax, [ebp + 0x1ba0]
push eax
lea eax, [ebp + 0x1998]
push str._sgswb.log
push eax
call fcn.0041bfe1
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x18
lea eax, [ebp + 0x1998]
push eax
call edi
test eax, eax
je 0x413c35
lea eax, [ebp + 0x1da8]
push ebx
push eax
call fcn.0041b494
lea eax, [ebp + eax*2 + 0x1daa]
push eax
lea eax, [ebp + 0x1790]
push eax
call fcn.0041c0a1
lea eax, [ebp + 0x1790]
push eax
lea eax, [ebp + 0x1ba0]
push eax
lea eax, [ebp + 0x1998]
push str._s_s.txt
push eax
call fcn.0041bfe1
lea eax, [ebp + 0x1fc0]
push eax
push dword [ebp + 0x1fbc]
lea eax, [ebp + 0xf90]
push 0x3ff
push eax
call fcn.00420cbb
push esi
call fcn.00420446
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], edx
call fcn.00420422
lea ecx, [ebp + 0xf90]
push ecx
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x70]
push str.__d__d__d__d__d__d_:_s
push eax
call fcn.0041bfe1
add esp, 0x58
lea eax, [ebp + 0x1998]
push eax
mov word [ebp + 0x178e], si
mov dword [ebp - 0x74], esi
call edi
xor ebx, ebx
inc ebx
test eax, eax
je 0x413bb7
mov dword [ebp - 0x74], ebx
lea eax, [ebp + 0x1998]
push 0x50a998
push eax
call fcn.00420bd6
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x413c34
cmp dword [ebp - 0x74], esi
jne 0x413bec
push edi
push 2
lea eax, [ebp - 0x78]
push ebx
push eax
mov dword [ebp - 0x78], 0xfeff
call fcn.00420a8e
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
call fcn.0041b494
push edi
add eax, eax
push eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00420a8e
push edi
push 2
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x74], 0xd
call fcn.00420a8e
push edi
push 2
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x74], 0xa
call fcn.00420a8e
push edi
call fcn.004208b3
add esp, 0x38
pop ebx
mov ecx, dword [ebp + 0x1fb0]
pop edi
xor ecx, ebp
pop esi
call fcn.0041bab8
add ebp, 0x1fb4
leave
ret
Function at 0x415399
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
cmp dword [0x55e440], edi
mov esi, ecx
je 0x4154df
cmp dword [esi + 0x20], 8
jb 0x4153bc
mov eax, dword [esi + 0xc]
jmp 0x4153bf
lea eax, [esi + 0xc]
push ebx
push 0x50ac20
push eax
push dword [0x5524f4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
je 0x4154de
push ebx
push dword [0x5524f4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push dword [0x5524f4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0x42
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 4]
push dword [ebp - 8]
push eax
call fcn.0041c0c0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0xc]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push edi
push dword [ebp - 0xc]
call fcn.00413cd6
cmp eax, edi
pop ecx
pop ecx
je 0x4154de
mov dword [esi + 4], eax
lea eax, [ebp + 8]
push eax
mov ecx, 0x55e444
call fcn.00415159
mov ebx, dword [ebp + 8]
push edi
mov dword [eax], esi
push dword [0x5524f4]
push edi
push ebx
push edi
push edi
push edi
push closesocket
push 0x80c80000
push edi
push dword [0x5524f0]
push 0x80020
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push ebx
mov dword [esi + 0x24], eax
call edi
test eax, 0x10000000
jne 0x4154a4
mov byte [esi + 0x2c], 1
jmp 0x4154c8
test eax, 0x21000000
je 0x4154b1
mov byte [esi + 0x2c], 5
jmp 0x4154c8
push 8
push dword [esi + 0x24]
mov byte [esi + 0x2c], 7
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov ecx, esi
call fcn.00414775
push 0xfffffffffffffffc
push ebx
call edi
push 0x4151ce
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x28], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x4162a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
mov dword [ebp - 0x10], ecx
jle 0x416338
lea ecx, [eax + 0x80]
add eax, 0x100
push ebx
dec edi
shr edi, 3
push 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
inc edi
pop ebx
mov ecx, dword [ebp - 0x10]
mov eax, esi
sub ecx, esi
mov dword [ebp - 0x18], ebx
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec dword [ebp - 0x18]
jne 0x4162e9
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.0041c0c0
mov ecx, dword [ebp - 0x1c]
push esi
mov eax, esi
call fcn.00415920
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + eax]
xor byte [esi + eax], cl
inc eax
cmp eax, ebx
jl 0x416311
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
call fcn.0041c0c0
add dword [ebp - 0x10], ebx
add esp, 0xc
add esi, ebx
dec edi
jne 0x4162df
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041bab8
leave
ret
Function at 0x417cfc
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xd0
mov eax, 0x507712
call fcn.0041bb30
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xbc], esi
mov edi, 0x54b284
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00401590
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.0040559a
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x417d48
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417e7e
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x417d63
lea eax, [ebp + 0x10]
push esi
push 0x80
push 4
push esi
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xbc], eax
jne 0x417d92
push edi
mov ecx, ebx
call fcn.00401590
jmp 0x417e89
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.0041a944
mov edi, eax
cmp edi, esi
pop ecx
jne 0x417ddd
mov ecx, dword [ebp - 0xb8]
push 0x54b284
call fcn.00401590
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401790
push esi
push 1
lea ecx, [ebp + 0xc]
call fcn.00401790
mov eax, dword [ebp - 0xb8]
jmp 0x417ea1
lea eax, [ebx + 1]
push eax
push esi
push edi
call fcn.0041bd70
add esp, 0xc
push esi
lea eax, [ebp - 0xc0]
push eax
push ebx
push edi
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
lea ecx, [ebp - 0xb4]
call fcn.00405e21
push edi
call fcn.0041c846
pop ecx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00405f77
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.004115c8
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00401710
cmp dword [ebp - 0x34], esi
jbe 0x417e69
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401d00
push esi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00401790
mov ebx, dword [ebp - 0xb8]
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.004034b0
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401790
push esi
push 1
lea ecx, [ebp + 0xc]
call fcn.00401790
mov eax, ebx
call fcn.0041bbb3
ret 0x20
Function at 0x418162
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x34
mov eax, 0x5077b9
call fcn.0041bac7
mov eax, dword [ebp + 0x810]
mov esi, dword [ebp + 0x80c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x814]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x818]
xor ebx, ebx
push 0x7fe
mov dword [ebp - 0x10], eax
lea eax, [ebp + 2]
mov edi, ecx
push ebx
mov dword [ebp - 0x1c], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov word [ebp], bx
call fcn.0041bd70
add esp, 0xc
cmp dword [edi + 0x1c], 8
jb 0x4181d8
mov edi, dword [edi + 8]
jmp 0x4181db
add edi, 8
push edi
push 0x400
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00401590
xor edi, edi
inc edi
cmp dword [esi + 0x18], 8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], edi
jb 0x418213
mov eax, dword [esi + 4]
jmp 0x418216
lea eax, [esi + 4]
push dword [ebp - 0x10]
push eax
call fcn.0041d1a8
test eax, eax
pop ecx
pop ecx
jne 0x418264
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp byte [ecx], bl
push dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push dword [ebp - 0x18]
push eax
je 0x418243
call fcn.00417ea9
mov dword [ebp - 4], edi
jmp 0x41824f
call fcn.00416c91
mov dword [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00401d00
push ebx
push edi
lea ecx, [ebp - 0x40]
call fcn.00401790
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0041bab8
add ebp, 0x804
leave
ret 0x10

Function at 0x4191a5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
and dword [ebp - 4], 0
cmp word [eax + 6], 0
mov dword [ebp - 8], ecx
movzx ecx, word [eax + 0x14]
push esi
lea esi, [ecx + eax + 0x18]
jbe 0x419248
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, 0x10
mov ebx, 0x1000
mov eax, dword [esi]
test eax, eax
jne 0x41920a
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x419232
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call fcn.0041bd70
jmp 0x41922f
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call fcn.0041c0c0
mov eax, dword [ebp - 0xc]
mov dword [esi - 8], eax
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
add esi, 0x28
cmp dword [ebp - 4], eax
jl 0x4191da
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41958b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x41959e
xor eax, eax
leave
ret
push esi
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
je 0x4195b3
xor eax, eax
jmp 0x4196a4
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
mov ebx, 0x2000
push ebx
push dword [esi + 0x50]
push dword [esi + 0x34]
call edi
test eax, eax
mov dword [ebp - 4], eax
jne 0x4195e6
push 4
push ebx
push dword [esi + 0x50]
push eax
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x419699
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [ebp - 4]
push 4
xor ecx, ecx
push 0x1000
mov dword [ebx + 4], eax
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0x10], ecx
push dword [esi + 0x50]
push eax
call edi
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call edi
mov ecx, dword [esi + 0x54]
mov edi, dword [ebp + 8]
add ecx, dword [edi + 0x3c]
mov dword [ebp - 8], eax
push ecx
push edi
push eax
call fcn.0041c0c0
mov eax, dword [edi + 0x3c]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
push ebx
push esi
mov dword [ebx], eax
push edi
mov dword [eax + 0x34], ecx
call fcn.004191a5
mov edi, dword [ebp - 4]
mov eax, edi
add esp, 0x18
sub eax, dword [esi + 0x34]
je 0x419668
push eax
mov eax, ebx
call fcn.00419309
pop ecx
call fcn.00419382
test eax, eax
je 0x419692
push ebx
call fcn.0041924b
mov eax, dword [ebx]
mov eax, dword [eax + 0x28]
test eax, eax
pop ecx
je 0x4196a0
add eax, edi
je 0x419692
push 0
xor esi, esi
inc esi
push esi
push edi
call eax
test eax, eax
jne 0x41969d
push ebx
call fcn.00419512
pop ecx
xor eax, eax
jmp 0x4196a2
mov dword [ebx + 0x10], esi
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41a070
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x41a034
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
pop esi
je 0x41a09f
cmp eax, 0xffffffff
je 0x41a09f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x41a60f
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x25c
lea ebp, [esp - 4]
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x25c], eax
push 0xc
mov eax, 0x507ba0
call fcn.0041bac7
mov esi, dword [ebp + 0x268]
mov eax, dword [ebp + 0x26c]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
jne 0x41a672
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x25c]
xor ecx, ebp
call fcn.0041bab8
add ebp, 0x260
leave
ret 8
call fcn.0041a1c7
push 0x206
mov edi, eax
lea eax, [ebp + 0x56]
push ebx
push eax
mov word [ebp + 0x54], bx
call fcn.0041bd70
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push esi
lea eax, [ebp + 0x38]
push eax
call fcn.0041a3aa
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 4], ebx
jae 0x41a6ab
lea eax, [ebp + 0x3c]
push edi
push 0x104
lea ecx, [ebp + 0x54]
push ecx
mov esi, 0x54b284
push esi
push eax
mov edi, 0x50ba8c
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x54]
push esi
push eax
call fcn.0041d1a8
test eax, eax
pop ecx
pop ecx
jne 0x41a751
push ebx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], 7
call fcn.00401b10
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
mov byte [ebp - 4], 1
jae 0x41a6f8
lea eax, [ebp + 0x3c]
lea ecx, [ebp + 0x1c]
push ecx
mov ecx, dword [ebp - 0x14]
push eax
push edi
call fcn.0041a28f
test al, al
jne 0x41a72b
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401790
mov byte [ebp - 0xd], bl
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.00401790
mov al, byte [ebp - 0xd]
jmp 0x41a64d
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x41a737
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.0041c0a1
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], bl
call fcn.00401790
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp]
push eax
call fcn.0041a4e6
mov ecx, dword [ebp - 0x18]
push 0xffffffffffffffff
push ebx
lea eax, [ebp]
push eax
mov byte [ebp - 4], 2
call fcn.00401d00
push ebx
push 1
lea ecx, [ebp]
call fcn.00401790
mov byte [ebp - 0xd], 1
jmp 0x41a718

Function at 0x41bab8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x552994]
jne 0x41bac2
repz ret
jmp fcn.0042597c
Function at 0x4273fa
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x552c88]
je 0x427415
inc edi
cmp edi, 0x17
jb 0x427406
cmp edi, 0x17
jae 0x427595
push ebp
push 3
call fcn.00432d3f
cmp eax, 1
pop ecx
je 0x427561
push 3
call fcn.00432d3f
test eax, eax
pop ecx
jne 0x427449
cmp dword [0x552ab4], 1
je 0x427561
cmp ebx, 0xfc
je 0x427594
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x55ed90
push ebp
call fcn.0042445b
add esp, 0xc
test eax, eax
je 0x42747f
push esi
push esi
push esi
push esi
push esi
call fcn.0041c45f
add esp, 0x14
push 0x104
mov esi, 0x55eda9
push esi
push 0
mov byte [0x55eead], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4274c3
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0042445b
add esp, 0xc
test eax, eax
je 0x4274c3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041c45f
add esp, 0x14
push esi
call fcn.0041b4b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x427508
push esi
call fcn.0041b4b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x55f0a4
push 0x50cbac
sub ecx, eax
push ecx
push eax
call fcn.0042f366
add esp, 0x14
test eax, eax
je 0x427508
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041c45f
add esp, 0x14
jmp 0x42750a
xor esi, esi
push 0x50cba8
push ebx
push ebp
call fcn.0042f2af
add esp, 0xc
test eax, eax
je 0x42752a
push esi
push esi
push esi
push esi
push esi
call fcn.0041c45f
add esp, 0x14
push dword [edi*8 + 0x552c8c]
push ebx
push ebp
call fcn.0042f2af
add esp, 0xc
test eax, eax
je 0x42754c
push esi
push esi
push esi
push esi
push esi
call fcn.0041c45f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00432b82
add esp, 0xc
jmp 0x427594
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x427594
cmp ebp, 0xffffffff
je 0x427594
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x552c8c]
push dword [esi]
call fcn.0041b4b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x432b82
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042531c
xor ebx, ebx
cmp dword [0x55f588], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x432c58
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x432d38
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x50de0c
push edi
call esi
cmp eax, ebx
je 0x432d38
push eax
call fcn.004252ae
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x55f588], eax
call esi
push eax
call fcn.004252ae
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x55f58c], eax
call esi
push eax
call fcn.004252ae
mov dword [0x55f590], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00424021
test eax, eax
pop ecx
pop ecx
je 0x432c26
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041c45f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x432c58
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004252ae
cmp eax, ebx
pop ecx
mov dword [0x55f598], eax
je 0x432c58
push 0x50ddb4
push edi
call esi
push eax
call fcn.004252ae
pop ecx
mov dword [0x55f594], eax
mov eax, dword [0x55f594]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x432cdd
cmp dword [0x55f598], ecx
je 0x432cdd
push eax
call fcn.00425325
push dword [0x55f598]
mov esi, eax
call fcn.00425325
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x432cdd
cmp edi, ebx
je 0x432cdd
call esi
cmp eax, ebx
je 0x432caa
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x432caa
test byte [ebp - 0x18], 1
jne 0x432cdd
lea eax, [ebp - 0x10]
push eax
call fcn.00424058
test eax, eax
pop ecx
je 0x432cc5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041c45f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x432cd4
or dword [ebp + 0x10], 0x200000
jmp 0x432d18
or dword [ebp + 0x10], 0x40000
jmp 0x432d18
mov eax, dword [0x55f58c]
cmp eax, dword [ebp - 8]
je 0x432d18
push eax
call fcn.00425325
cmp eax, ebx
pop ecx
je 0x432d18
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x432d18
mov eax, dword [0x55f590]
cmp eax, dword [ebp - 8]
je 0x432d18
push eax
call fcn.00425325
cmp eax, ebx
pop ecx
je 0x432d18
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x55f588]
call fcn.00425325
cmp eax, ebx
pop ecx
je 0x432d38
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x432d3a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43788e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00437823
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041bd70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4378dd
cmp dword [ebp - 0x1c], 5
jb 0x4378f5
jmp 0x4378f1
cmp dword [ebp - 0x10], 1
jne 0x4378f5
cmp dword [ebp - 0x1c], 4
ja 0x4378f1
jne 0x4378f5
cmp dword [ebp - 0x18], 0
jbe 0x4378f5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x50de64
call fcn.004084f9
test eax, eax
jge 0x437916
mov byte [0x5619a8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041bab8
add ebp, 0x78
leave
ret

Function at 0x437960
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x552994]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4379b2
mov eax, dword [esp]
cmp al, 2
jne 0x4379ac
shr eax, 8
cmp al, 2
jne 0x4379ac
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0041bab8
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.0041bab8
add esp, 0x194
ret

Function at 0x438db0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x438dd2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x438dc6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x438e02
cmp dword [esi + 8], 0
jne 0x438df5
mov ecx, dword [eax + 8]
push 0x50de88
push ecx
call fcn.00423f65
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x438df5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.004ee3ae
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x438e24
mov eax, dword [esi + 8]
test eax, eax
je 0x438e1e
push eax
call fcn.004208b3
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret