joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4368a2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x4369d8
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x4369b3
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x436901
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x4368dd
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x43e5dc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x43e723
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x43e682
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x43e62c
cmp ecx, 0x40010001
je 0x43e62c
cmp ecx, 0x40020001
je 0x43e62c
cmp ecx, 0x40030001
jne 0x43e637
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x43e649
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x43e67c
dec ecx
je 0x43e676
dec ecx
je 0x43e670
dec ecx
je 0x43e66a
dec ecx
je 0x43e664
dec ecx
jne 0x43e68f
or dword [ebp - 4], 0xe
jmp 0x43e68f
or dword [ebp - 4], 0xc
jmp 0x43e68f
or dword [ebp - 4], 0xa
jmp 0x43e68f
or dword [ebp - 4], 8
jmp 0x43e68f
or dword [ebp - 4], 6
jmp 0x43e68f
or dword [ebp - 4], 2
jmp 0x43e68f
cmp ecx, 0x40030000
jne 0x43e68f
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x43e69f
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x43e6ad
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x43e6bb
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x43e6c9
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x43e6de
push 3
jmp 0x43e709
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x43e70f
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x43e6fb
xor edx, edx
inc edx
jmp 0x43e70a
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x43e71b
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x43e6cc
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x43e730
mov eax, 0x8876086c
jmp 0x43e73a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8
Function at 0x45c553
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x45c561
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x45c635
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x491858]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x491858]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x491858]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x491858]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x491858]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x491858]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x491858]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x491858]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x45c57e
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x45c655
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x491858]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x45c63b
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x475410
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4754b0
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x475462
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4b0b64]
xor eax, edx
inc esi
cmp esi, edi
jl 0x475443
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x47548b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4b0b64]
xor eax, edx
inc esi
cmp esi, edi
jl 0x47546e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret

Function at 0x4790bb
Capabilities:
Encode data using xor

Disassembly:
aaa
fnstsw word [eax + 0x53ef3981]
cwde
cmp ch, dh
push esi
aaa
xchg ebp, eax
imul esi, dword [edx + eax*2 - 0x60], 5
lea ebx, [ebp + 0x60c43217]
xor al, ah
pushal
cmp al, 0xc9
xor byte [eax - 0x1429a4c0], cl
and ebx, eax
pushal
cmpsd dword [esi], dword es:[edi]
jp 0x4790d0
invalid

Function at 0x47b6f0
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x33782c9a
out 0x51, al
jl 0x47b711
mov fs, word [edx + 0x7b3fe280]
aam 0xd0
sbb dword [edx - 0x2ca4b0e3], edi
and al, byte [ecx + ebp*4]
cli
test al, 0x98
lahf
invalid
out 0xd6, eax
pop ebp
dec edx
ret 0x2b34
Function at 0x2a30195d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2a357578]
jne 0x2a301967
repz ret
jmp fcn.2a341dce

Function at 0x2a309f40
Capabilities:
Terminate thread

Disassembly:
push 0x10
mov eax, 0x2a342707
call fcn.2a30229e
mov esi, ecx
xor edi, edi
cmp dword [esi], 0xb
mov dword [ebp - 0x14], edi
jne 0x2a30a02b
mov edi, dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0xea60
push dword [esi + 0x2e0]
call edi
or dword [esi + 0x1ac], 0xffffffff
push 1
push dword [esi + 0x2dc]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
call ebx
shr eax, 4
add eax, 0x12c
mov dword [ebp - 0x10], eax
jmp 0x2a309fdb
push 0xea60
push dword [esi + 0x2e0]
call edi
push dword [esi + 0x2e0]
xor eax, eax
cmp dword [esi], 0xb
setne al
movzx eax, ax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp word [ebp - 0x1c], 0
jne 0x2a309fe5
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call ebx
shr eax, 4
cmp eax, dword [ebp - 0x10]
jb 0x2a309fa5
push 0xea60
push dword [esi + 0x2e0]
call edi
cmp dword [esi], 0xb
jne 0x2a30a00a
xor edi, edi
inc edi
push edi
push dword [esi + 0x2dc]
call dword [sym.imp.kernel32.dll_TerminateThread]
mov dword [ebp - 0x14], edi
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_CloseHandle]
and dword [esi + 0x2e0], 0
xor edi, edi
mov eax, dword [esi + 0x1c]
lea ebx, [esi + 0x1ac]
mov dword [ebx], edi
cmp eax, edi
je 0x2a30a05c
cmp word [ebp - 0x14], di
jne 0x2a30a059
push ebx
push eax
call fcn.2a3397c8
cmp dword [ebx], edi
jne 0x2a30a05c
push ebx
push dword [esi + 0x18]
mov dword [esi + 0x1c], edi
call fcn.2a3397c8
jmp 0x2a30a05c
mov dword [esi + 0x1c], edi
cmp word [esi + 0x14c], di
je 0x2a30a0c8
push edi
push edi
lea ecx, [ebp - 0x18]
call fcn.2a3397c8
mov ebx, dword [0x2a358a70]
push edi
lea eax, [esi + 0x48]
push eax
mov eax, dword [0x2a358a74]
push str.Cstring
mov dword [ebp - 4], edi
call dword [eax + 0x14]
movzx eax, ax
pop ecx
push eax
push edi
call dword [ebx + 0xd0]
add esp, 0x10
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.2a3397c8
cmp dword [ebp - 0x14], edi
je 0x2a30a0bc
lea ecx, [ebp - 0x18]
call fcn.2a3397c8
test al, al
je 0x2a30a0bc
lea ecx, [ebp - 0x18]
call fcn.2a330802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a3032b3
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x2a30a0df
push eax
mov eax, dword [0x2a358780]
call dword [eax + 0x284]
pop ecx
mov dword [esi + 0x3c], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x2a30a107
push eax
mov eax, dword [0x2a358a90]
cmp word [esi + 0x1a2], di
je 0x2a30a0fd
call dword [eax + 0x124]
jmp 0x2a30a103
call dword [eax + 0x11c]
pop ecx
mov dword [esi + 0x24], edi
mov dword [esi], 2
call fcn.2a3026e6
ret
Function at 0x2a323cd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x2a3442a0
call fcn.2a30372f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x2a323d84
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2a3397c8
add esp, 0xc
test eax, eax
js 0x2a323d84
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x2a323d6a
push edi
call fcn.2a3203ae
pop ecx
test al, al
je 0x2a323d6a
mov eax, edi
call fcn.2a341a00
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a323d76
push edi
lea ecx, [ebp - 0x428]
call fcn.2a3397c8
push 3
push edi
push esi
push eax
call fcn.2a3397c8
cmp eax, ebx
jne 0x2a323dc1
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a323d9d
lea ecx, [ebp - 0x418]
call fcn.2a31ffe1
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2a31fe2e
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.2a303768
ret 0x10
push 2
push ebx
push eax
call fcn.2a3212fd
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x2a323de2
call fcn.2a31f619
mov esi, eax
jmp 0x2a323eac
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x2a323e05
call fcn.2a31f619
jmp 0x2a323e9e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x2a323dfb
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x2a323e35
mov esi, 0x8007000e
jmp 0x2a323ea0
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3397c8
mov dword [ebp - 4], 1
jmp 0x2a323e63
cmp dword [ebp - 0x418], ebx
je 0x2a323e2e
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2a3397c8
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2a3397c8
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a323da2
lea ecx, [ebp - 0x418]
call fcn.2a31ffe1
jmp 0x2a323da2
Function at 0x2a3397c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x2a3397d7
pop dword [ebp - 0x30]
mov eax, 0x7d6ddf2c
add eax, 0xacc5b8ab
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x2178e6f3
sub dword [ebp - 0x40], 0xd326a1a8
mov dword [ebp - 0x3c], 0x5d8b5608
add dword [ebp - 0x3c], 0xd4a7f63d
mov dword [ebp - 0x38], 0xa10754f0
add dword [ebp - 0x38], 0xab44ef3e
mov dword [ebp - 0x34], 0x235c327f
add dword [ebp - 0x34], 0xdca3cd81
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xdea7f0d
sub dword [ebp - 0x40], 0x997815b7
mov dword [ebp - 0x3c], 0x4a1eb09f
add dword [ebp - 0x3c], 0xf74db0d6
mov dword [ebp - 0x38], 0xe86644f7
add dword [ebp - 0x38], 0x7b092775
mov dword [ebp - 0x34], 0x4a8a9271
sub dword [ebp - 0x34], 0x4a8a9271
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x4485df2d
add eax, 0xe5ae9127
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x45c3f
push 0
call eax
mov ecx, 0x4a4b
xor esi, esi
add esi, eax
mov edx, 0x4cdc72e7
sub edx, 0x22a5b8e7
add edx, dword [ebp - 0x30]
mov ebx, 0x929204e4
add ebx, 0x88bd34b2
add dword [ebp - 0x14], 0xcf6d1724
mov edi, dword [edx]
xor dword [ebp - 8], 0x5955f8e4
xor edi, ebx
add dword [ebp - 0x2c], 0x124e1121
mov dword [esi], edi
sub dword [ebp - 8], ebx
add esi, 0x68f53ab7
sub esi, 0x68f53ab3
add edx, 0xca215dbf
add edx, 0x35dea245
loop 0x2a3398f0
add eax, 0x11bff
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfd6436ce
sub ecx, 0xd33436ce
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x402bc3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
imul eax, ebx
imul eax, eax, 0x26
mov esi, dword [ebp + 0xc]
cmp eax, 0x1d
jb 0x402c13
cmp eax, 0xcc419d58
jne 0x402c13
lea eax, [esi + 0x9a2c]
xor edx, edx
xor eax, ebx
mov ecx, 0x31e
sub eax, 0x15f5d
push eax
mov al, byte [ebp + 0x14]
add al, 0xe
movzx eax, al
or al, 0x58
div ecx
sub eax, dword [ebp + 0x10]
add eax, 0x13582
push eax
call fcn.00401b18
pop ecx
pop ecx
mov eax, 0x106
xor edx, edx
div ebx
imul bl
xor al, 0xd5
cmp ebx, 0x52
jae 0x402c3b
mov eax, esi
xor edx, edx
div dword [ebp + 0x10]
imul eax, eax, 0x155
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x402c83
cmp ebx, 0x36
jbe 0x402c83
cmp ebx, 0x61
jb 0x402c83
cmp ebx, 0xf4fa
jne 0x402c78
cmp al, 0xd5
jne 0x402c83
mov eax, dword [ebp + 0x14]
xor eax, 0x22f98
or eax, esi
sub eax, 0x24847
push eax
mov eax, 0x111d3
sub eax, esi
push eax
push 0xc924
call fcn.00403440
add esp, 0xc
jmp 0x402c83
cmp ebx, 0x45
jae 0x402c83
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov al, byte [ebp + 0x10]
pop esi
pop ebx
pop ebp
ret
Function at 0x4039a5
Capabilities:
Accept command line arguments
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov dword [ebp - 8], 0x36f
mov eax, 0x27e
xor edx, edx
div dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
movzx eax, word [ebp - 4]
sub eax, 0x20e
xor eax, 0x335
mov ecx, dword [ebp - 8]
sub eax, ecx
xor eax, 0x2b9
or al, 0x42
mov dword [ebp - 4], eax
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 4]
xor edx, edx
mov edi, 0x186a0
div ecx
mov esi, edx
sub esi, 0x256
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
dec edi
jne 0x403a05
pminsw mm0, mm1
mov al, byte [ebp - 4]
imul byte [ebp - 4]
mov cl, 0xec
imul cl
mov bl, al
mov eax, dword [ebp - 8]
and eax, 0x5b
mov edi, 0x25e
xor eax, edi
mov dword [ebp - 4], eax
cmp word [ebp - 4], 0x40
jne 0x403a66
movzx eax, word [ebp - 4]
xor eax, 0x1e2
push eax
push esi
movzx eax, word [ebp - 4]
lea eax, [eax + esi - 0x1f5]
push eax
movzx eax, word [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
jmp 0x403ab5
cmp word [ebp - 4], 0x18
ja 0x403a75
mov ebx, dword [ebp - 8]
add bl, 0x1b
jmp 0x403ab5
cmp word [ebp - 4], 0x52
jne 0x403a8d
mov eax, 0xae
movzx ecx, bl
sub eax, esi
and eax, ecx
mov dword [ebp - 4], eax
jmp 0x403ab5
cmp word [ebp - 4], 8
jae 0x403aa7
mov eax, dword [ebp - 8]
sub eax, 0x144
and ax, 0x215
mov ecx, dword [ebp - 4]
xor eax, ecx
jmp 0x403a88
cmp word [ebp - 4], di
jne 0x403ab5
call fcn.0040268b
movzx esi, al
add esi, 0x146
cmp word [ebp - 4], 0xc
jae 0x403ad8
movzx eax, word [ebp - 4]
xor edx, edx
mov ecx, 0x32d
div ecx
mov esi, eax
movzx eax, bl
and esi, eax
jmp 0x403b47
cmp word [ebp - 4], di
jne 0x403b28
movzx ecx, bl
mov eax, dword [ebp - 8]
imul eax, eax, 0x3b6
xor edx, edx
div ecx
or cx, 0x1c9
add ecx, 0x38d0
add edx, 0x3af3
push edx
push ecx
movzx eax, word [ebp - 4]
or al, 0x67
xor edx, edx
add eax, 0xc95f
mov ecx, 0x181
push eax
mov eax, esi
div ecx
add eax, 0xf4f9
push eax
call fcn.00402bc3
add esp, 0x10
jmp 0x403b47
cmp word [ebp - 4], 0x15
jae 0x403b37
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x403b47
cmp word [ebp - 4], 0x1e
jae 0x403b43
mov eax, dword [ebp - 8]
jmp 0x403b49
mov ax, word [ebp - 4]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4430f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x446ef8
cmp edx, dword [eax]
je 0x443113
add eax, 8
inc ecx
cmp eax, 0x446f88
jl 0x443104
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x446ef8]
jne 0x443241
mov eax, dword [0x4474dc]
cmp eax, 1
je 0x44321b
test eax, eax
jne 0x443144
cmp dword [0x446e48], 1
je 0x44321b
cmp edx, 0xfc
je 0x443241
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44317b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00442510
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00442410
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4431be
lea eax, [ebp - 0x1a4]
push eax
call fcn.00442410
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4453b0
push edi
call fcn.004422d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00442510
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00442520
lea eax, [ebp - 0xa0]
push 0x445390
push eax
call fcn.00442520
push dword [esi + 0x446efc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00442520
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0044415f
add esp, 0x2c
pop edi
jmp 0x443241
lea eax, [ebp + 8]
lea esi, [esi + 0x446efc]
push 0
push eax
push dword [esi]
call fcn.00442410
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437030]
jne 0x401116
repz ret
jmp fcn.00401d41

Function at 0x40a6cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406ace
and dword [ebp - 4], 0
cmp dword [0x439894], 0
mov ebx, eax
jne 0x40a77d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a82e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a82e
push eax
call fcn.00406a5c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439894], eax
call esi
push eax
call fcn.00406a5c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439898], eax
call esi
push eax
call fcn.00406a5c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43989c], eax
call esi
push eax
call fcn.00406a5c
pop ecx
mov dword [0x4398a4], eax
test eax, eax
je 0x40a77d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a5c
pop ecx
mov dword [0x4398a0], eax
mov eax, dword [0x4398a0]
cmp eax, ebx
je 0x40a7d5
cmp dword [0x4398a4], ebx
je 0x40a7d5
push eax
call fcn.00406ad7
push dword [0x4398a4]
mov esi, eax
call fcn.00406ad7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a7d5
test edi, edi
je 0x40a7d5
call esi
test eax, eax
je 0x40a7cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a7cc
test byte [ebp - 0xc], 1
jne 0x40a7d5
or dword [ebp + 0x10], 0x200000
jmp 0x40a80e
mov eax, dword [0x439898]
cmp eax, ebx
je 0x40a80e
push eax
call fcn.00406ad7
pop ecx
test eax, eax
je 0x40a80e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a80e
mov eax, dword [0x43989c]
cmp eax, ebx
je 0x40a80e
push eax
call fcn.00406ad7
pop ecx
test eax, eax
je 0x40a80e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439894]
call fcn.00406ad7
pop ecx
test eax, eax
je 0x40a82e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a830
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cb60
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x437030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2af21a4]
push ebx
mov ebx, dword [0x2af1ff0]
push esi
mov esi, dword [0x438060]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cba1
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2af21a4]
mov dword [0x4399fc], esi
cmp eax, 0x114e
jne 0x40cbcb
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2af21a4]
cmp eax, 0x2f
jne 0x40cbed
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cad0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret