joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8b60
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], ecx
lea ecx, [ebp - 0x130]
call fcn.004d7930
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004d8520
movzx ecx, al
test ecx, ecx
je 0x4d8bd6
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x130]
call fcn.004d85c0
movzx eax, al
test eax, eax
jne 0x4d8bd6
mov ecx, dword [ebp + 8]
call fcn.00403030
mov byte [ebp - 0x131], al
lea ecx, [ebp - 0x130]
call fcn.004d78b0
mov al, byte [ebp - 0x131]
jmp 0x4d8cb6
push 0x80
mov ecx, dword [ebp + 0xc]
call fcn.004d7870
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx ecx, byte [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004d7870
push eax
mov ecx, dword [ebp - 0x138]
call fcn.004d2d40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4d8c73
mov ecx, dword [ebp - 0x138]
call fcn.004d2d70
push eax
push 0x4f93a4
mov ecx, dword [ebp + 8]
call fcn.004d3ad0
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, dword [ebp + 0xc]
call fcn.004d7870
push eax
push 0x4f93b4
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, dword [ebp + 8]
call fcn.00403030
mov byte [ebp - 0x132], al
lea ecx, [ebp - 0x130]
call fcn.004d78b0
mov al, byte [ebp - 0x132]
jmp 0x4d8cb6
push 0x80
mov ecx, dword [ebp + 0xc]
call fcn.004d7870
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 0xc]
call fcn.004d7740
mov ecx, dword [ebp + 0xc]
call fcn.004d7950
mov ecx, dword [ebp + 8]
call fcn.00403040
mov byte [ebp - 0x133], al
lea ecx, [ebp - 0x130]
call fcn.004d78b0
mov al, byte [ebp - 0x133]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d8dc0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x400
mov ecx, dword [ebp + 0xc]
call fcn.004d3080
mov dword [ebp - 8], eax
push 0x3ff
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d8e40
mov ecx, dword [ebp + 0xc]
call fcn.004d3400
mov ecx, dword [ebp + 0xc]
call fcn.004d30c0
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f9198
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d8e50
mov ecx, dword [ebp + 0xc]
call fcn.004d3400
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d8ee0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d8f6e
movzx eax, byte [ebp + 0xc]
test eax, eax
jne 0x4d8f23
cmp dword [ebp - 4], 2
jne 0x4d8f23
mov ecx, dword [ebp + 8]
call fcn.00403040
jmp 0x4d8f76
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4f9124
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f9110
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d8f76
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d8f80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d9052
cmp dword [ebp + 0x14], 0
je 0x4d8fc5
mov eax, dword [ebp + 0x14]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4d8ffb
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f90d0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d905a
push 0x4f9108
mov eax, dword [ebp + 0x14]
push eax
push 0x4f9100
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f90e8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d905a
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d9060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d9139
cmp dword [ebp + 0x14], 0
je 0x4d90b2
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx]
test edx, edx
jne 0x4d90eb
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f9078
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d91d3
mov ecx, dword [ebp + 0x14]
push ecx
push 0x4f9098
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f9088
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d91d3
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
je 0x4d91cb
cmp dword [ebp + 0x14], 0
je 0x4d9155
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx]
test edx, edx
jne 0x4d9180
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f909c
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d91d3
mov eax, dword [ebp + 0x14]
push eax
push 0x4f90cc
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004d2d70
push eax
push 0x4f90b4
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d91d3
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4015e5
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x2909ffff
push 0xf3cfffff
call fcn.0040ff4b
pop ecx
mov dword [0x437c10], eax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [0x437be9]
mov dword [0x437c2c], eax
movsx ax, cl
imul ax, word [0x437bf6]
mov word [0x437bf8], ax
movsx eax, ax
push eax
movsx eax, cl
push eax
call fcn.0040fede
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add dword [0x437c18], eax
pop ecx
pop ecx
call edi
add dword [0x437c14], eax
mov al, byte [0x437bf8]
imul byte [0x437bee]
add byte [0x437bed], al
mov eax, dword [esp + 0x14]
mov bl, byte [eax]
movsx eax, word [0x437bf4]
push eax
xor bl, 0xea
movsx eax, word [0x437bfe]
push eax
call fcn.0041004e
add byte [0x437bea], al
push 0x7c9fffff
movsx eax, byte [0x437bed]
push eax
call fcn.0040ff1a
mov esi, dword [esp + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x437c24], eax
add esp, 0x10
mov byte [esi], bl
mov dword [0x437c14], 0xfdddffff
call ebp
test bl, bl
mov dword [0x437c10], eax
je 0x401776
mov ebx, dword [esp + 0x14]
sub ebx, esi
mov dword [esp + 0x14], ebx
jmp 0x4016c9
mov ebx, dword [esp + 0x14]
push dword [0x437c24]
dec al
add byte [0x437bef], al
push dword [0x437c1c]
call fcn.0040fede
add dword [0x437c28], eax
inc esi
movsx eax, word [0x437bf8]
push eax
movsx eax, byte [0x437be9]
push eax
call fcn.0040fede
add dword [0x437c18], eax
add esp, 0x10
call edi
add dword [0x437c14], eax
mov al, byte [0x437bf8]
imul byte [0x437bee]
add byte [0x437bed], al
mov bl, byte [ebx + esi]
movsx eax, word [0x437bf4]
push eax
xor bl, 0xea
movsx eax, word [0x437bfe]
push eax
call fcn.0041004e
add byte [0x437bea], al
push 0x7c9fffff
movsx eax, byte [0x437bed]
push eax
call fcn.0040ff1a
mov dword [0x437c24], eax
add esp, 0x10
mov byte [esi], bl
mov dword [0x437c14], 0xfdddffff
call ebp
test bl, bl
mov dword [0x437c10], eax
jne 0x4016c5
push 0x530bffff
push 0x8ebffff
call fcn.0040ff1a
cmp word [0x437c02], 0
pop ecx
pop ecx
pop edi
setne al
pop esi
mov byte [0x437bee], al
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
ret
Function at 0x40198f
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431590
push 0x42c600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], ebx
xor eax, eax
cmp byte [0x437be8], bl
setne al
add byte [0x437be8], al
mov dword [ebp - 4], ebx
inc word [0x437bf2]
add dword [0x437c2c], 0x51be0000
push 0xb26dffff
push 0xc80fffff
call fcn.00410016
mov dword [0x437c1c], eax
push 0x4d
call fcn.0041448a
add esp, 0xc
call eax
test eax, 0x80000000
je 0x401a53
mov dword [0x437c2c], 0x5cf80000
mov dword [0x437c10], 0xac1c0000
mov eax, dword fs:[0x20]
mov dword [ebp - 0x1c], eax
push 0xe4b3ffff
push 0xe637ffff
call fcn.0040ff4b
pop ecx
pop ecx
add byte [0x437bef], al
xor eax, eax
cmp byte [0x437be9], bl
setne al
add dword [0x437c28], eax
jmp 0x401b1d
push 0x8d69ffff
push dword [0x437c0c]
call fcn.0041004e
pop ecx
pop ecx
add word [0x437bf6], ax
inc byte [0x437bee]
push ecx
push eax
xor ecx, 0x97d7ffff
nop
mov ecx, eax
add ecx, 0x6e3dffff
pop eax
pop ecx
mov ebx, dword fs:[0x30]
push edx
push ecx
push ebx
imul edx, ecx
imul ecx, ebx
and ebx, edx
sub edx, 0x17fdffff
inc edx
pop ebx
pop ecx
pop edx
mov bl, byte [ebx + 2]
push edx
push ecx
push ebx
push eax
or ebx, ecx
add ecx, ecx
nop
sub ecx, eax
or edx, eax
pop eax
pop ebx
pop ecx
pop edx
movzx ebx, bl
push edx
push ecx
push ebx
push eax
and ecx, edx
xor ecx, 0x1867ffff
xor eax, ebx
inc edx
and ecx, eax
inc edx
pop eax
pop ebx
pop ecx
pop edx
mov dword [ebp - 0x1c], ebx
push ecx
push ebx
push eax
add ebx, 0xd83fffff
imul eax, eax
xor ecx, ecx
inc eax
pop eax
pop ebx
pop ecx
sub dword [0x437c0c], 0x2a020002
push 0x2b85ffff
push dword [0x437c10]
call fcn.0040ff1a
pop ecx
pop ecx
add dword [0x437c20], eax
jmp 0x401b1d
or dword [ebp - 4], 0xffffffff
movsx eax, word [0x437bfc]
push eax
push dword [0x437c0c]
call fcn.0040ffc6
mov byte [0x437bed], al
push dword [0x437c28]
movsx eax, al
push eax
call fcn.0040ff1a
add esp, 0x10
add word [0x437bfe], ax
cmp dword [ebp - 0x1c], 0
je 0x401b5c
mov byte [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4067e5
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
push 0x3f
mov dword [ebp - 8], eax
call fcn.0041448a
pop ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x406892
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x406887
push esi
cmp dword [ebp - 0x24], 0x10
jb 0x406871
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x406871
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x406871
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x406871
cmp byte [ebp + 8], 0
push esi
je 0x406860
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x406866
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push 0x37
call fcn.0041448a
pop ecx
call eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x406829
pop esi
push edi
push 0x37
call fcn.0041448a
pop ecx
call eax
pop edi
leave
ret
Function at 0x408a99
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 0xccffffff
push 0xfdf7ffff
call fcn.0041004e
add word [0x437bfe], ax
push dword [0x437c10]
movsx eax, word [0x437c02]
push eax
call fcn.0040ffe3
mov esi, dword [ebp + 8]
add word [0x437bfc], ax
sub dword [0x437c24], 0x20060001
add esp, 0x10
mov al, byte [esi]
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetVersion]
add byte [0x437bed], al
mov eax, dword [0x437c2c]
mov edi, dword [ebp + 0xc]
dec eax
add word [0x437bf4], ax
cmp edi, 1
jbe 0x408b0f
mov al, byte [esi + 1]
mov byte [ebp - 2], al
movsx eax, byte [0x437be8]
imul eax, eax, 0x5d73ffff
add dword [0x437c20], eax
cmp edi, 2
jbe 0x408b2d
mov al, byte [esi + 2]
mov byte [ebp - 3], al
push 0xae8fffff
push 0x732dffff
call fcn.0040ffe3
inc word [0x437c00]
mov dword [0x437c20], eax
lea eax, [ebp - 4]
push eax
call fcn.004088c5
mov esi, dword [ebp + 0x10]
push 0xe1f7ffff
mov byte [esi], al
movsx eax, word [0x437c04]
push eax
call fcn.0040ff78
add byte [0x437beb], al
push 0x8f93ffff
push 0xcbbffff
call fcn.0040ff4b
mov word [0x437bfc], ax
lea eax, [ebp - 4]
push eax
call fcn.004088c5
mov byte [esi + 1], al
push dword [0x437c08]
movsx eax, word [0x437c04]
push eax
call fcn.0040ffc6
add byte [0x437be9], al
mov eax, dword [0x437c28]
push eax
push eax
call fcn.00410092
add byte [0x437beb], al
movsx eax, byte [0x437bef]
push eax
movsx eax, word [0x437bfe]
push eax
call fcn.004100bc
add byte [0x437beb], al
add esp, 0x38
cmp edi, 1
je 0x408be9
lea eax, [ebp - 4]
push eax
call fcn.004088c5
pop ecx
jmp 0x408beb
mov al, 0x3d
mov byte [esi + 2], al
or al, 0xff
sub al, byte [0x437bfe]
add byte [0x437bf1], al
inc word [0x437c04]
cmp edi, 3
jne 0x408c14
lea eax, [ebp - 4]
push eax
call fcn.004088c5
pop ecx
jmp 0x408c16
mov al, 0x3d
mov byte [esi + 3], al
movsx eax, byte [0x437bf1]
push eax
push 0x2bb7ffff
call fcn.0040ff4b
mov dword [0x437c28], eax
push 0xa539ffff
movsx eax, word [0x437c04]
push eax
call fcn.0040ff78
add dword [0x437c18], eax
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
pop edi
mov dword [0x437c18], eax
pop esi
leave
ret 0xc
Function at 0x40a00e
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x42d29a
call fcn.0042c5b0
sub esp, 0x2c
movsx eax, word [0x437c04]
or eax, dword [0x437c0c]
push ebx
push edi
mov edi, ecx
add dword [0x437c20], eax
xor ebx, ebx
movsx ax, byte [0x437bea]
imul eax, dword [0x437c2c]
add word [0x437c02], ax
cmp dword [edi + 0xfc], ebx
jne 0x40a05a
mov eax, dword [ebp + 0xc]
jmp 0x40a1b2
xor eax, eax
cmp byte [0x437bf1], bl
push esi
push 3
setne al
mov dword [0x437c24], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041f32a
movsx eax, byte [0x437bee]
push eax
mov dword [ebp - 4], ebx
movsx eax, byte [0x437bed]
push eax
call fcn.0040ffe3
add esp, 0x10
mov word [0x437bf2], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [0x437c20]
mov dword [0x437c18], eax
push 0xdd49ffff
call fcn.0040ffe3
add dword [0x437c2c], eax
push dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
call fcn.0040b04f
add esp, 0x10
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [ebp - 4], 1
push dword [ecx]
lea ecx, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
xor eax, eax
cmp byte [0x437bee], bl
push dword [0x437c2c]
setne al
mov word [0x437bfa], ax
movsx eax, byte [0x437beb]
push eax
call fcn.0040ff78
mov word [0x437bfc], ax
movsx eax, word [0x437bfe]
push eax
movsx eax, byte [0x437bec]
push eax
call fcn.00410092
add byte [0x437bf1], al
add esp, 0x10
movsx eax, word [0x437bfc]
push 4
pop esi
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_IsWindow]
add byte [0x437bed], al
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x40a15a
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push dword [edi + 0xfc]
push 0x16
call fcn.0041448a
pop ecx
call eax
test eax, eax
jne 0x40a18b
cmp dword [ebp - 0x14], esi
jne 0x40a18b
cmp dword [ebp - 0x10], esi
jne 0x40a18b
mov esi, dword [ebp - 0x18]
jmp 0x40a1a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc dword [0x437c10]
mov esi, dword [ebp + 0xc]
mov word [0x437c00], ax
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40a7bb
Capabilities:
Accept command line arguments

Disassembly:
or al, 0xff
push esi
sub al, byte [0x437bf1]
mov esi, dword [esp + 8]
mov byte [0x437be8], al
mov al, byte [0x437c10]
sub byte [0x437beb], al
cmp esi, 0xb
jge 0x40a84b
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [0x437c14]
mov byte [0x437bf0], al
movsx eax, word [0x437bf6]
push eax
call fcn.0040ff78
mov edi, dword [esp + 0x18]
add dword [0x437c18], 0x69720000
pop ecx
mov byte [0x437bee], al
pop ecx
push edi
push esi
mov ecx, 0x4379e0
call fcn.00409d8e
xor eax, eax
mov ecx, 0x11f1ffff
cmp word [0x437bf4], ax
mov dword [esi*4 + 0x4379e0], edi
pop edi
setne al
add dword [0x437c10], eax
movsx eax, word [0x437bfa]
sub ecx, eax
add dword [0x437c20], ecx
pop esi
ret
Function at 0x41367f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
xor eax, eax
cmp byte [0x437bed], bl
push edi
push 0x69a1ffff
setne al
add byte [0x437bee], al
push 0x1e59ffff
mov word [0x437c04], 0xfffe
mov dword [ebp - 4], ebx
call fcn.0040ffe3
mov byte [0x437be9], al
mov eax, dword [ebp + 8]
pop ecx
mov eax, dword [eax + 4]
pop ecx
cmp eax, ebx
jne 0x4136c9
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
push 0x3a
call fcn.0041448a
pop ecx
call eax
push dword [0x437c10]
mov edi, eax
movsx eax, word [0x437bfe]
push eax
call fcn.00410092
mov byte [0x437bee], al
mov ax, word [0x437bfc]
sub ax, word [0x437c00]
pop ecx
pop ecx
add word [0x437bfe], ax
cmp edi, 0xffffffff
je 0x413863
sub dword [0x437c10], 0x21060001
or al, 0xff
sub al, byte [0x437c1c]
push esi
push 0xab99ffff
push 0x8075ffff
add byte [0x437be8], al
mov ax, word [0x437c0c]
add word [0x437bf2], ax
call fcn.004100bc
add dword [0x437c14], eax
pop ecx
pop ecx
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, dword [ebp + 0xc]
add dword [0x437c1c], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp eax, ebx
jne 0x413774
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [ebp + 8]
push ebx
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ax, word [0x437c04]
inc ax
mov word [0x437bfc], ax
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 8]
pop esi
jne 0x4137c9
push 0x2e4dffff
push 0x6c87ffff
call fcn.004100bc
mov word [0x437bf2], ax
pop ecx
movsx eax, word [0x437bfe]
imul eax, eax, 0xdd7dffff
pop ecx
mov dword [0x437c24], eax
mov dword [ebp - 4], 1
movsx eax, byte [0x437beb]
push 0x9d61ffff
push eax
call fcn.0040ff4b
mov dword [0x437c1c], eax
movsx eax, word [0x437bf2]
push eax
push 0x8b07ffff
call fcn.0040ffc6
add byte [0x437bf1], al
mov al, byte [0x437c18]
add esp, 0x10
dec al
add byte [0x437bee], al
push edi
push 0x37
call fcn.0041448a
pop ecx
call eax
movsx eax, byte [0x437bf1]
push dword [0x437c2c]
push eax
call fcn.0040ff1a
add word [0x437bfe], ax
movsx eax, byte [0x437be8]
push eax
movsx eax, word [0x437c04]
push eax
call fcn.00410092
add esp, 0x10
cmp byte [0x437bea], bl
mov byte [0x437be8], al
jne 0x41385a
cmp dword [0x437c2c], ebx
je 0x41385d
push 1
pop ebx
add byte [0x437bee], bl
movsx eax, byte [0x437beb]
push dword [0x437c28]
push eax
call fcn.0040ffe3
pop ecx
mov word [0x437c04], ax
pop ecx
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharLowerA]
add word [0x437c00], ax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x41d58d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movsx eax, word [0x437bf8]
imul eax, eax, 0x54fffff
mov dword [0x437c0c], eax
push 0x7247ffff
movsx ax, byte [0x437be8]
dec eax
add word [0x437bfc], ax
movsx eax, word [0x437bf4]
push eax
call fcn.004100bc
pop ecx
mov byte [0x437bef], al
pop ecx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp dword [0x437c10], eax
jne 0x41d5ea
cmp dword [0x437c18], eax
je 0x41d5ed
push 1
pop eax
add word [0x437bfa], ax
or al, 0xff
sub al, byte [0x437c0c]
push esi
mov esi, dword [ebp + 8]
xor edx, edx
add byte [0x437be8], al
mov eax, esi
div dword [ebp - 0x24]
push edi
push 0x4a49ffff
push 0xb173ffff
mov edi, edx
call fcn.0040ff1a
push dword [0x437c24]
add byte [0x437bed], al
add byte [0x437beb], 0xfe
push 0x7c7dffff
call fcn.0040ffc6
add word [0x437bfc], ax
add esp, 0x10
lea eax, [ebp - 4]
inc byte [0x437bea]
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push 0x40
sub esi, edi
push eax
push esi
push 0x5e
call fcn.0041448a
pop ecx
call eax
pop edi
pop esi
leave
ret