joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x48e960
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048ddaa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x48e983
test byte [esp + 8], 2
je 0x48e983
call fcn.0048de1d
mov dword [eax], 0xd
call fcn.0048de26
mov dword [eax], 5
jmp 0x48e95c
xor eax, eax
ret

Function at 0x49f1f3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49f22b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049d280
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049d258
jmp 0x49f237
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a08e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a0926
call fcn.004a6398
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a0926
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a091d
xor eax, eax
jmp 0x4a092e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a0934
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a68c8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a68f6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a6914
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a682e
jmp 0x4a6914
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a6914
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a682e
test edi, edi
mov eax, edi
jne 0x4a68fe
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401640
Capabilities:
Check internet connectivity via wininet
Create http request
Delete file
Move file

Disassembly:
sub esp, 0x148
mov eax, dword [0x435110]
push edi
mov edi, dword [0x4340b8]
mov dword [esp + 0x148], eax
mov eax, 0xffffeb46
push 0
lea ecx, [esp + 8]
sub eax, edi
push ecx
mov dword [str._r_____r____], eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [esp + 4], 0x20
je 0x401692
mov eax, 4
pop edi
mov ecx, dword [esp + 0x144]
call fcn.0040e7cd
add esp, 0x148
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
push eax
lea edx, [esp + 0xc]
push str.Agent_ld
push edx
call fcn.0040e497
mov ecx, dword [0x4340b4]
mov eax, dword [0x4340b0]
sub eax, ecx
mov ecx, dword [str._r_____r____]
add esp, 0xc
lea edx, [eax + ecx + 0xd52]
test byte [esp + 4], 4
push 0
push 0
mov dword [0x4340a8], edx
push 0
jne 0x4016e1
push 4
lea eax, [esp + 0x18]
push eax
jmp 0x4016e8
push 0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, dword [0x4340b4]
push ebx
sub edx, dword [0x4340bc]
push esi
sub edx, dword [0x4340c4]
mov edi, eax
add edx, 0x1e45
test edi, edi
mov dword [0x4340ac], edx
je 0x4017f0
mov ebx, dword [esp + 0x168]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401724
sub eax, edx
lea eax, [eax + ebx - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x58]
push str.C:WindowsSystem32_d_s
push ecx
call fcn.0040e497
mov edx, dword [esp + 0x170]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
push edx
push eax
mov eax, dword [esp + 0x17c]
push ecx
lea edx, [esp + 0x6c]
push edx
push eax
push edi
call fcn.00401130
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x4017b2
push 1
push ebx
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4017d1
push edi
mov esi, 0x63
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [esp + 0x144]
call fcn.0040e7cd
add esp, 0x148
ret
lea edx, [esp + 0x50]
push 0
push edx
call fcn.0040e81d
add esp, 8
cmp eax, 0xffffffff
je 0x4017d1
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [esp + 0x144]
call fcn.0040e7cd
add esp, 0x148
ret
mov ecx, dword [esp + 0x150]
pop esi
pop ebx
mov eax, 4
pop edi
call fcn.0040e7cd
add esp, 0x148
ret
Function at 0x401c90
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x435110]
mov ecx, dword [0x4340b8]
push ebp
mov dword [esp + 0x108], eax
push edi
mov edi, dword [esp + 0x114]
mov eax, 0xffffeb46
sub eax, ecx
push 0
push edi
mov ebp, edi
mov dword [str._r_____r____], eax
call fcn.0040e81d
add esp, 8
cmp eax, 0xffffffff
je 0x401ce6
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x104]
call fcn.0040e7cd
add esp, 0x108
ret
mov eax, edi
lea edx, [eax + 1]
jmp 0x401cf0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401cf0
sub eax, edx
mov dword [esp + 8], eax
je 0x401e15
push 0x5c
push edi
call fcn.0040e0d0
add esp, 8
test eax, eax
je 0x401e15
push 0x3a
push edi
call fcn.0040e0d0
add esp, 8
test eax, eax
je 0x401e15
mov edx, dword [0x4340b4]
mov ecx, dword [0x4340b0]
sub ecx, edx
test edi, edi
mov edx, dword [str._r_____r____]
lea eax, [ecx + edx + 0xd52]
push esi
mov dword [0x4340a8], eax
je 0x401de2
push 0x5c
inc ebp
push ebp
call fcn.0040e0d0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x401d7c
lea edx, [esp + 0x10]
mov eax, edi
sub edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401d70
jmp 0x401d94
mov esi, ebp
sub esi, edi
push esi
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.0040e9a0
add esp, 0xc
mov byte [esp + esi + 0x10], 0
mov eax, dword [0x4340bc]
mov edx, dword [0x4340b4]
mov esi, dword [0x4340c4]
sub edx, eax
sub edx, esi
lea eax, [esp + 0x10]
add edx, 0x1e45
push 0
push eax
mov dword [0x4340ac], edx
call fcn.0040e81d
add esp, 8
cmp eax, 0xffffffff
jne 0x401dda
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401dfa
test ebp, ebp
jne 0x401d52
pop esi
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x104]
call fcn.0040e7cd
add esp, 0x108
ret
pop esi
pop edi
mov eax, 0xfffffffe
pop ebp
mov ecx, dword [esp + 0x104]
call fcn.0040e7cd
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop edi
or eax, 0xffffffff
pop ebp
call fcn.0040e7cd
add esp, 0x108
ret
Function at 0x4021f0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [0x4340b8]
lea ecx, [esp + 0x10]
mov eax, 0xffffeb46
push ecx
sub eax, esi
xor ebp, ebp
push ebx
mov dword [esp + 0x18], ebp
mov dword [str._r_____r____], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
je 0x4022d2
mov eax, dword [0x4340b4]
mov edx, dword [0x4340b0]
sub edx, eax
mov eax, dword [str._r_____r____]
push edi
lea ecx, [edx + eax + 0xd52]
push esi
mov dword [0x4340a8], ecx
call fcn.0041cbe6
add esp, 4
mov edi, eax
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4022c8
mov eax, dword [0x4340bc]
mov edx, dword [0x4340b4]
mov ebx, dword [0x4340c4]
sub edx, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
sub edx, ebx
push 0x429b3c
add edx, 0x1e45
push edi
mov dword [0x4340ac], edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4022a9
mov edx, dword [esp + 0x10]
mov bp, word [edx + 0x14]
mov eax, dword [0x4340ac]
mov esi, dword [0x4340c0]
mov edx, dword [str._r_____r____]
sub eax, esi
sub eax, edx
add eax, 0x19b8
mov dword [0x4340b0], eax
push edi
call fcn.0041cbeb
add esp, 4
pop edi
pop esi
mov ax, bp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4022e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x9b0
mov eax, dword [0x435110]
push ebx
push 0
push 2
mov dword [esp + 0x9b8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x88]
push ecx
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x90], 0x128
xor ebx, ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402336
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x9ac]
call fcn.0040e7cd
add esp, 0x9b0
ret
xor eax, eax
jmp 0x402340
mov cl, byte [esp + eax + 0xac]
mov byte [esp + eax + 0x1b0], cl
inc eax
test cl, cl
jne 0x402340
push esi
mov esi, dword [esp + 0x9bc]
lea eax, [esp + 0x1b4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402386
test cl, cl
je 0x402382
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402386
add eax, 2
add esi, 2
test cl, cl
jne 0x402362
xor eax, eax
jmp 0x40238b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402394
mov ebx, 1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x8c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402447
mov eax, ebx
shl eax, 6
push ebp
lea edx, [esp + 0xb4]
lea ebp, [esp + eax + 0x1b8]
sub eax, edx
push edi
lea edi, [esp + eax + 0x1bc]
lea esp, [esp]
lea eax, [esp + 0xb8]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x4023d7
mov esi, dword [esp + 0x9c4]
mov eax, ebp
lea ebx, [ebx]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402414
test cl, cl
je 0x402410
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402414
add eax, 2
add esi, 2
test cl, cl
jne 0x4023f0
xor eax, eax
jmp 0x402419
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40242f
mov eax, dword [esp + 0x9c]
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
add ebp, 0x40
add edi, 0x40
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x94]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4023d0
pop edi
pop ebp
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9b4]
pop esi
mov eax, ebx
pop ebx
call fcn.0040e7cd
add esp, 0x9b0
ret
Function at 0x402470
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x435110]
push ebx
push esi
push edi
mov dword [esp + 0x244], eax
xor eax, eax
mov byte [esp + 0x138], 0
mov ecx, 0x40
lea edi, [esp + 0x139]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push 0x429b88
lea ecx, [esp + 0x140]
push 0x104
push ecx
call fcn.0040e8f7
add esp, 0x10
push 0
push 2
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4024fe
push str.CreateToolhelp32Snapshot__of_processes_
call fcn.0040eafd
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x244]
call fcn.0040e7cd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
push ebx
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402531
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x244]
call fcn.0040e7cd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x402540
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.0040e863
add esp, 8
test eax, eax
je 0x402601
mov edx, dword [esp + 0x18]
push edx
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
jne 0x402580
push 0x429b54
call fcn.0040eafd
add esp, 4
jmp 0x40259f
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test eax, eax
jne 0x402598
push 0x429b40
call fcn.0040eafd
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402540
mov esi, dword [esp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4024e9
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x4024e9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x244]
mov eax, 1
call fcn.0040e7cd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x18]
jmp 0x4025b2

Function at 0x403950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403969
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40397d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40399e
cmp esi, eax
jae 0x403977
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403990
cmp esi, eax
jae 0x403977
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404864
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4048b7
call fcn.00425569
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4048b7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4048ad
xor eax, eax
jmp 0x4049d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4048e7
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4048e7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4049cd
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x404914
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00405e39
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4049cd
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40495d
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x40495d
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x404957
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00405e39
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4049bd
and dword [ebp + 0xc], 0
jmp 0x4049bd
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4049bd
push 0xc
call fcn.0041cbbb
mov esi, eax
test esi, esi
pop ecx
je 0x40499f
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4049a1
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4049b8
push dword [ebp - 8]
call fcn.0041b027
jmp 0x4049bd
call fcn.0041affe
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x404922
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40e81d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40e83d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410c3c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40e860
test byte [esp + 8], 2
je 0x40e860
call fcn.00410c2a
mov dword [eax], 0xd
call fcn.00410c33
mov dword [eax], 5
jmp 0x40e839
xor eax, eax
ret
Function at 0x40ee6e
Capabilities:
Terminate process

Disassembly:
push 8
push 0x42ca78
call fcn.004106cc
push 8
call fcn.00412771
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4380a4], esi
jne 0x40eea2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4380a0], esi
mov al, byte [ebp + 0x10]
mov byte [0x43809c], al
cmp dword [ebp + 0xc], edi
jne 0x40eeec
cmp dword [0x43996c], edi
je 0x40eedc
mov eax, dword [0x439968]
sub eax, 4
mov dword [0x439968], eax
cmp eax, dword [0x43996c]
jb 0x40eedc
mov eax, dword [eax]
cmp eax, edi
je 0x40eebd
call eax
jmp 0x40eebd
push 0x434090
mov eax, 0x434088
call fcn.0040edec
pop ecx
push 0x43409c
mov eax, 0x434094
call fcn.0040edec
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x40ef1d
cmp dword [ebp + 0x10], edi
jne 0x40ef2b
mov dword [0x4380a4], esi
push dword [ebp + 8]
call fcn.0040edaa
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x40ef2a
push 8
call fcn.004126bc
pop ecx
ret
call fcn.00410707
ret

Function at 0x40f09b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040e7e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f136
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x438064]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40f136
cmp eax, 1
je 0x40f157
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f136
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40f103
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40f132
xor eax, eax
inc eax
jmp 0x40f176
cmp edi, eax
jae 0x40f13a
xor eax, eax
jmp 0x40f176
cmp eax, esi
jae 0x40f141
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x438064]
jmp 0x40f15a
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f2ee
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x42caa8
call fcn.004106cc
mov edi, 0x94
mov eax, edi
call fcn.0040e7e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x438064], ecx
mov eax, dword [esi + 4]
mov dword [0x438070], eax
mov edx, dword [esi + 8]
mov dword [0x438074], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x438068], esi
cmp ecx, 2
je 0x40f34e
or esi, 0x8000
mov dword [0x438068], esi
shl eax, 8
add eax, edx
mov dword [0x43806c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40f389
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f389
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40f3a1
cmp eax, 0x20b
je 0x40f38e
mov dword [ebp - 0x1c], esi
jmp 0x40f3b5
cmp dword [ecx + 0x84], 0xe
jbe 0x40f389
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40f3af
cmp dword [ecx + 0x74], 0xe
jbe 0x40f389
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004143c4
pop ecx
test eax, eax
jne 0x40f3c9
push 0x1c
call fcn.0040f2ca
pop ecx
call fcn.00411c5d
test eax, eax
jne 0x40f3da
push 0x10
call fcn.0040f2ca
pop ecx
call fcn.00414322
mov dword [ebp - 4], esi
call fcn.004158e4
test eax, eax
jge 0x40f3f3
push 0x1b
call fcn.0040f2a5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x439960], eax
call fcn.004157c2
mov dword [0x4380a8], eax
call fcn.00415720
test eax, eax
jge 0x40f419
push 8
call fcn.0040f2a5
pop ecx
call fcn.004154ed
test eax, eax
jge 0x40f42a
push 9
call fcn.0040f2a5
pop ecx
push 1
call fcn.0040ee04
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40f440
push eax
call fcn.0040f2a5
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00415490
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40f461
movzx eax, word [ebp - 0x40]
jmp 0x40f464
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041abb4
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40f482
push edi
call fcn.0040ef31
call fcn.0040ef53
jmp 0x40f4b4
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00410707
ret
Function at 0x4122e9
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x435110]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x41231a
xor eax, eax
jmp 0x4124a3
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x4385e0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x412356
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00417afe
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x412431
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x41246f
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x4123ba
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4123ab
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x41238b
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4123fa
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x412403
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x41237c
jmp 0x412405
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x41249e
cmp dword [ebp - 0x6c], edi
je 0x41246f
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x412464
call fcn.00410c2a
mov dword [eax], 9
call fcn.00410c33
mov dword [eax], esi
jmp 0x412499
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412459
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x412405
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x412405
push dword [ebp - 0x6c]
call fcn.00410c3c
pop ecx
jmp 0x412499
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x412487
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x412487
xor eax, eax
jmp 0x4124a1
call fcn.00410c2a
mov dword [eax], 0x1c
call fcn.00410c33
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x4124a1
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040e7cd
add ebp, 0x3a0
leave
ret