joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d42ca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4d4259
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4d4263
cmp eax, 0
jne 0x4d4263
mov eax, dword [ebp - 8]
call fcn.00404f74
jmp 0x4d42b4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4d4292
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4d427a
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0047c25c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040810c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d42d1
lea eax, [ebp - 0xc]
call fcn.00404f74
ret

Function at 0x4d43ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bac
xor eax, eax
push ebp
push 0x4d44a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00405df0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.0047130c
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.004073f0
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4d441e
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4d4406
mov eax, dword [ebp - 8]
call fcn.004073f0
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 0xfde9
call fcn.00405818
lea eax, [ebp - 0xc]
call fcn.004057ac
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.004073f0
mov edx, ebx
mov ecx, dword [ebp - 8]
xchg ecx, eax
call fcn.004031a0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00408210
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00405bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d44ab
lea eax, [ebp - 0x18]
call fcn.00404f74
lea eax, [ebp - 0x10]
call fcn.00405bb4
lea eax, [ebp - 0xc]
call fcn.00404f74
lea eax, [ebp - 8]
mov edx, dword [0x40a230]
call fcn.004075c4
lea eax, [ebp - 4]
call fcn.00405bb4
ret
Function at 0x4e27f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e2918
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004e26dc
mov eax, dword [esi]
call fcn.004073f0
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40a230]
call fcn.004075b8
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004031a0
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004031a0
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004073f0
mov dword [ebp - 0xc], eax
mov eax, dword [0x502bf4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004d4af0
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403638
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004073f0
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004d4998
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004d4994
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004d4ae8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e291f
lea eax, [ebp - 4]
mov edx, dword [0x40a230]
call fcn.004075c4
ret
Function at 0x4e4ff4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e4ffc
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bac
xor eax, eax
push ebp
push 0x4e5354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405bc4
xor eax, eax
push ebp
push 0x4e506a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5370
call fcn.00406080
mov eax, dword [ebp - 0x14]
mov ecx, 0x4e53ac
mov edx, 6
call fcn.004c6ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e50a6
cmp dword [ebp - 8], 0
je 0x4e511b
mov edx, dword [ebp - 8]
mov eax, dword [0x4c8510]
call fcn.004c9c14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e511b
xor eax, eax
push ebp
push 0x4e5114
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4e5458
mov eax, dword [ebp - 0x10]
call fcn.004c8eb8
test eax, eax
jl 0x4e50fe
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4e5458
mov eax, dword [ebp - 0x10]
call fcn.004c9398
call fcn.00404840
jmp 0x4e532c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e511b
mov eax, dword [ebp - 0x10]
call fcn.00403d70
ret
xor eax, eax
push ebp
push 0x4e515c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x4e547c
call fcn.00406080
mov eax, dword [ebp - 0x1c]
mov ecx, 0x4e53ac
mov edx, 6
call fcn.004c6ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e51e0
cmp dword [ebp - 8], 0
je 0x4e5255
mov edx, dword [ebp - 8]
mov eax, dword [0x4c8510]
call fcn.004c9c14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e5255
xor eax, eax
push ebp
push 0x4e524e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4e5558
mov eax, dword [ebp - 0x10]
call fcn.004c8eb8
test eax, eax
jl 0x4e5238
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4e5558
mov eax, dword [ebp - 0x10]
call fcn.004c9398
call fcn.00404840
jmp 0x4e532c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5255
mov eax, dword [ebp - 0x10]
call fcn.00403d70
ret
cmp dword [ebp - 4], 0
jne 0x4e532c
xor eax, eax
push ebp
push 0x4e528f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x4e53ac
mov edx, 6
mov eax, 0x4e5574
call fcn.004c6ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e52cb
cmp dword [ebp - 8], 0
je 0x4e532c
mov edx, dword [ebp - 8]
mov eax, dword [0x4c8510]
call fcn.004c9c14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e532c
xor eax, eax
push ebp
push 0x4e5325
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4e5674
mov eax, dword [ebp - 0x10]
call fcn.004c9398
call fcn.00404840
jmp 0x4e532c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e535b
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00405bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405bbc
ret
Function at 0x4e7b84
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4e7c9f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x4e7c84
mov eax, esi
and eax, 1
dec eax
jne 0x4e7c09
call sub.kernel32.dll_GetSystemDefaultLangID
mov edi, eax
call sub.kernel32.dll_GetUserDefaultLangID
mov word [ebp - 2], ax
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp di, 0x419
je 0x4e7c07
cmp word [ebp - 2], 0x419
je 0x4e7c07
cmp ax, 0x419
je 0x4e7c07
cmp di, 0x423
je 0x4e7c07
cmp word [ebp - 2], 0x423
je 0x4e7c07
cmp ax, 0x423
je 0x4e7c07
cmp di, 0x422
je 0x4e7c07
cmp word [ebp - 2], 0x422
je 0x4e7c07
cmp ax, 0x422
jne 0x4e7c09
mov bl, 1
test bl, bl
jne 0x4e7c84
and esi, 2
cmp esi, 2
jne 0x4e7c84
lea ecx, [ebp - 8]
mov dl, 1
xor eax, eax
call fcn.004e5ca0
mov edx, dword [ebp - 8]
mov eax, 0x502300
call fcn.00405bc4
lea edx, [ebp - 0xc]
mov eax, dword [0x502300]
call fcn.0040b910
mov eax, dword [ebp - 0xc]
mov edx, 0x4e7cbc
call fcn.00406350
je 0x4e7c82
lea edx, [ebp - 0x10]
mov eax, dword [0x502300]
call fcn.0040b910
mov eax, dword [ebp - 0x10]
mov edx, 0x4e7cd0
call fcn.00406350
je 0x4e7c82
lea edx, [ebp - 0x14]
mov eax, dword [0x502300]
call fcn.0040b910
mov eax, dword [ebp - 0x14]
mov edx, 0x4e7ce4
call fcn.00406350
jne 0x4e7c84
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7ca6
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405bbc
ret

Function at 0x4e8e48
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0042a680
test bl, bl
je 0x4e8e6e
push 0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, esi
call fcn.00403d70
pop esi
pop ebx
ret
mov byte [esi + 0x44], 1
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop esi
pop ebx
ret
Function at 0x4e956c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bac
mov eax, dword [ebp - 8]
call fcn.00405bac
mov eax, dword [ebp - 0xc]
call fcn.00405bac
xor eax, eax
push ebp
push 0x4e96be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.004cc3ac
xor edx, edx
push ebp
push 0x4e969c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4e95c7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4e95ce
mov dword [ebp - 0x10], 1
xor edx, edx
push ebp
push 0x4e962f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405c50
mov edi, eax
push edi
mov eax, dword [ebp - 8]
call fcn.00405c50
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405c50
mov ebx, eax
push ebx
push 0x4e96d0
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4e9625
mov eax, dword [ebp - 0x10]
push eax
push edi
push esi
push ebx
push 0x4e96d0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e9686
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e96a3
mov eax, dword [ebp - 0x14]
call fcn.004cc3dc
ret

Function at 0x4eb70c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eb797
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403638
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0041500c
lea eax, [ebp - 0x24]
mov edx, 0x4eb7b4
call fcn.00405fc0
mov eax, dword [ebp - 0x24]
call fcn.00405c50
mov dword [ebp - 0x16], eax
mov eax, 0x4eb7b8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb79e
lea eax, [ebp - 0x24]
call fcn.00405bb4
ret
Function at 0x4eeb8c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4eec82
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx esi, ax
lea eax, [ebp - 4]
push eax
mov ecx, 0x4eec9c
mov edx, 0x59
mov eax, esi
call fcn.00412f58
push dword [ebp - 4]
push 0x4eecb0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4eecc0
mov edx, 0x5a
mov eax, esi
call fcn.00412f58
push dword [ebp - 8]
lea eax, [ebx + 0x18]
mov edx, 3
call fcn.00406164
call fcn.00474ed8
test al, al
je 0x4eec0a
lea eax, [ebx + 0x1c]
mov edx, 0x4eecd4
call fcn.00405bc4
jmp 0x4eec31
mov eax, dword [0x502654]
mov eax, dword [eax]
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [0x502a8c]
add eax, dword [edx]
lea edx, [ebp - 0xc]
call fcn.0040c428
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x1c]
call fcn.00405bc4
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, dword [ebx + 0xc]
call fcn.004eb604
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
call fcn.00405bc4
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebx + 0xc]
call fcn.004eb604
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x3c]
call fcn.00405bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eec89
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405bbc
ret
Function at 0x4ef2d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ef41c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4ef3fa
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405bc4
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.00405c50
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4ef3f0
mov eax, dword [ebp - 0xc]
call fcn.00402fd0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4ef3e9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4ef3d1
cmp dword [ebp - 8], 0
je 0x4ef3d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4ef42c
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov ebx, eax
shr ebx, 0x10
mov esi, eax
and esi, 0xffff
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edi, eax
shr edi, 0x10
and eax, 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x4ef43c
call fcn.0040dc1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef3f0
mov eax, dword [ebp - 8]
push eax
call fcn.00407ec0
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ef40e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef423
ret
Function at 0x4f34a8
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov eax, 0x4f13f0
call fcn.00408580
xor eax, eax
push ebp
push 0x4f36a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4f36c4
call fcn.00415e24
test al, al
je 0x4f3578
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 1
mov eax, 0x4f36c4
call fcn.0046f1d0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0040b9d8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00471f74
mov edx, dword [ebp - 0x14]
mov eax, 0x509530
call fcn.00405bc4
mov eax, 0x509530
mov ecx, dword [0x509530]
mov edx, 0x4f36e8
call fcn.00406080
mov eax, dword [0x509530]
call fcn.00405c50
push eax
push 0xffffffffffffffff
push 0
call fcn.00408a4c
test eax, eax
je 0x4f355c
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4f356e
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x4f368b
call fcn.004f13b4
jmp 0x4f368b
xor edi, edi
xor ebx, ebx
lea edx, [ebp - 0x20]
mov eax, edi
call fcn.0040c428
mov ecx, dword [ebp - 0x20]
push 0x509530
mov edx, 0x4f36e8
pop eax
call fcn.00406080
mov eax, dword [0x509530]
call fcn.00405c50
push eax
push 0
push 0x20000
call sub.kernel32.dll_OpenMutexW
mov esi, eax
test esi, esi
je 0x4f35bf
push esi
call sub.kernel32.dll_CloseHandle_1
inc edi
jmp 0x4f35ea
mov eax, dword [0x509530]
call fcn.00405c50
push eax
push 0xffffffffffffffff
push 0
call fcn.00408a4c
test eax, eax
je 0x4f35e3
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4f35e6
inc edi
jmp 0x4f35ea
mov bl, 1
jmp 0x4f35ef
cmp edi, 0x14
jl 0x4f357c
test bl, bl
jne 0x4f3605
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x4f368b
mov eax, 0x4f3778
call fcn.00415e24
test al, al
je 0x4f361a
call fcn.004f00c0
jmp 0x4f368b
mov eax, 0x4f3798
call fcn.00415e24
test al, al
je 0x4f362f
call fcn.004f01a8
jmp 0x4f368b
mov eax, 0x4f37bc
call fcn.00415e24
test al, al
je 0x4f3653
call fcn.004f02a0
test al, al
je 0x4f368b
mov eax, dword [0x50236c]
mov dword [eax], 0x64
jmp 0x4f368b
mov eax, 0x4f37e0
call fcn.00415e24
test al, al
je 0x4f3670
call fcn.004effa0
mov edx, dword [0x50236c]
mov dword [edx], eax
jmp 0x4f368b
mov eax, 0x4f37fc
call fcn.00415e24
test al, al
je 0x4f368b
call fcn.004efd3c
mov edx, dword [0x50236c]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f36ad
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405bbc
ret
Function at 0x404041
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407320
cmp edx, dword [eax]
je 0x404063
add eax, 8
inc ecx
cmp eax, 0x4073b0
jl 0x404054
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407320]
jne 0x404191
mov eax, dword [0x4075f0]
cmp eax, 1
je 0x40416b
test eax, eax
jne 0x404094
cmp dword [0x407164], 1
je 0x40416b
cmp edx, 0xfc
je 0x404191
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4040cb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004056f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402c10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40410e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402c10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x406494
push edi
call fcn.00405ba0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004056f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405700
lea eax, [ebp - 0xa0]
push 0x406474
push eax
call fcn.00405700
push dword [esi + 0x407324]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405700
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405b15
add esp, 0x2c
pop edi
jmp 0x404191
lea eax, [ebp + 8]
lea esi, [esi + 0x407324]
push 0
push eax
push dword [esi]
call fcn.00402c10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x431860]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x154]
push 0
push eax
mov dword [ebp - 0x158], 0x44
call fcn.00411ca0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ebp - 0x12c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
call fcn.00408910
int3

Function at 0x4089c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x431860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x103
lea eax, [ebp - 0x12f]
push 0
push eax
mov bl, dl
mov esi, ecx
mov byte [ebp - 0x130], 0
call fcn.00411ca0
mov al, byte [0x42cf9c]
movq xmm0, qword [str.pgH0BwW]
add esp, 0xc
mov byte [ebp - 0x1c], al
xor eax, eax
push str.X:.Trash_100
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
movq qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x130]
xorps xmm0, xmm0
push 0x104
push eax
movq qword [ebp - 0x13], xmm0
call fcn.0040e3a9
add esp, 0xc
lea eax, [ebp - 0x130]
push str.ctfmon.exe
push 0x104
push eax
call fcn.0040e681
lea edx, [ebp - 0x24]
add esp, 0xc
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x408a64
lea eax, [ebp - 0x14]
sub edx, ecx
push 0x10
push eax
lea ecx, [ebp - 0x24]
call fcn.004056c0
push 0x432f68
push esi
call fcn.0040e880
add esp, 0x10
cmp eax, esi
jne 0x408a95
test bl, bl
jne 0x408b24
push 0x42cd74
push esi
call fcn.0040e880
add esp, 8
lea ecx, [eax + 1]
lea edx, [ebp - 0x130]
call fcn.0040ab40
test al, al
je 0x408b24
push ecx
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x130]
call fcn.0040bb90
add esp, 4
test eax, eax
jne 0x408b34
push 0x40
push eax
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x178], 0x44
call fcn.00411ca0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x148], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x178]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
push 0
mov dword [ebp - 0x14c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408b44
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d0ff
mov esp, ebp
pop ebp
ret
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00408930
call fcn.00408910
int3