joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4556f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
lea edi, [esi + 0x38]
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
call fcn.00413510
push 4
mov dword [esp + 0x20], ebx
lea edi, [esi + 0xdc]
call fcn.00430c2e
add esp, 4
cmp eax, ebx
je 0x41275e
mov dword [eax], edi
jmp 0x412760
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov edi, dword [0x457144]
push esi
call edi
lea eax, [esi + 0x18]
push eax
call edi
push ebx
push 1
push 2
call dword [0x457434]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x30], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4

Function at 0x412830
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x454c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x38], 0
mov esi, dword [0x45714c]
push edi
call esi
lea ebp, [edi + 0x18]
push ebp
call esi
mov edx, dword [edi + 0x30]
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0xc
lea ecx, [esp + 0x2c]
push ecx
push 0x98000004
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0x7530
mov dword [esp + 0x40], 0x3e8
call dword [0x457454]
mov eax, 2
push ecx
mov ecx, dword [esp + 0x44]
mov word [esp + 0x24], ax
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], esp
test eax, eax
je 0x4128c9
add eax, 8
push eax
call dword [0x457130]
call fcn.00412a90
mov edx, dword [esp + 0x44]
push edx
mov dword [esp + 0x28], eax
call dword [0x457430]
mov ecx, dword [edi + 0x30]
mov word [esp + 0x22], ax
push 0x10
lea eax, [esp + 0x24]
push eax
push ecx
call dword [0x45742c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41290f
lea esi, [edi + 0x38]
mov byte [edi + 0x34], 1
call fcn.004135d0
mov edx, dword [edi + 0x30]
mov dword [edi + 0xf4], edx
mov esi, dword [0x457150]
push ebp
call esi
push edi
call esi
cmp ebx, 0xffffffff
jne 0x41292a
call dword [0x457468]
mov edi, eax
jmp 0x41292c
xor edi, edi
mov esi, dword [esp + 0x40]
test esi, esi
je 0x41296c
lea eax, [esi + 8]
push eax
call dword [0x457108]
test eax, eax
jne 0x41296c
test esi, esi
je 0x41296c
mov eax, dword [esi]
test eax, eax
je 0x412953
push eax
call dword [0x457268]
mov eax, dword [esi + 4]
test eax, eax
je 0x412963
push eax
call fcn.00430981
add esp, 4
push esi
call fcn.00430981
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8
Function at 0x413660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x455738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push ebp
mov ebp, dword [esp + 0x30]
push edi
mov dword [esp + 0x34], 0
jne 0x4136a9
push ebp
call fcn.0040bfe0
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop ebp
add esp, 0x28
ret 4
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
lea edi, [edx + ecx + 0xc]
lea ecx, [esp + 8]
push ecx
call fcn.0040c030
xor edi, edi
mov dword [esp + 0x2c], edi
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
jne 0x4136da
call fcn.00430e4d
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x14]
mov edx, eax
sub edx, ecx
jne 0x413703
call fcn.00430e4d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 2
sub eax, ecx
push ebx
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], eax
call fcn.00443e70
mov eax, dword [esp + 0x18]
sub eax, dword [ebx + 0x10]
sub eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0xc]
call fcn.004130c0
push ebp
lea ecx, [esp + 0xc]
call fcn.00412420
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x413743
push eax
call fcn.00430981
add esp, 4
mov ecx, dword [esp + 8]
push ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.00430981
mov ecx, dword [esp + 0x28]
add esp, 4
pop edi
mov eax, ebp
mov dword fs:[0], ecx
pop ebp
add esp, 0x28
ret 4
Function at 0x415730
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x455650
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov ebx, ecx
push ebp
push edi
cmp ebx, 0x3e
jne 0x415893
push esi
call fcn.00414cc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
xor ebp, ebp
mov dword [ecx + 0x18], 3
mov dword [ecx + 0x14], ebp
lea eax, [esi + 0x10]
mov dword [ecx + 4], ebp
call fcn.00406c70
lea eax, [esp + 0x30]
push eax
call fcn.00405b80
add esp, 0x20
mov dword [esp + 0x38], ebp
cmp dword [eax + 0x18], 8
jb 0x415798
mov eax, dword [eax + 4]
jmp 0x41579b
add eax, 4
lea ecx, [esp + 0x10]
push ecx
mov edi, eax
call fcn.00409200
mov byte [esp + 0x38], 1
mov ebx, dword [esi]
mov ecx, eax
call fcn.0040cb40
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4157fb
mov edi, eax
add eax, 8
push eax
call dword [0x457108]
cmp eax, ebp
jne 0x4157f7
cmp edi, ebp
je 0x4157f7
mov eax, dword [edi]
cmp eax, ebp
je 0x4157de
push eax
call dword [0x457268]
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x4157ee
push eax
call fcn.00430981
add esp, 4
push edi
call fcn.00430981
add esp, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x415817
mov edx, dword [esp + 0x18]
push edx
call fcn.00430981
add esp, 4
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], ax
call fcn.004162d0
mov ecx, dword [esi + 0x64]
mov edx, dword [ecx + 4]
lea edi, [esi + 0x4c]
push edx
mov ecx, edi
call fcn.00416d40
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], ebp
mov dword [eax], eax
mov edi, dword [edi + 0x18]
mov dword [edi + 8], edi
lea edi, [esi + 0x6c]
call fcn.004162d0
lea edi, [esi + 0x88]
call fcn.004162d0
lea edi, [esi + 0xa4]
call fcn.004162d0
mov dword [esi + 0xc], ebp
mov dword [esi + 8], 3
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
cmp ebx, 0x2f
je 0x4158d0
cmp ebx, 0x20
je 0x4158d0
cmp ebx, 9
je 0x4158d0
cmp ebx, 0xa
je 0x4158d0
cmp ebx, 0xd
je 0x4158d0
lea edi, [esi + 0x88]
call fcn.004162d0
lea edi, [esi + 0xa4]
call fcn.004162d0
push ebx
push esi
mov dword [esi + 0xc], 3
call fcn.004158f0
mov ecx, dword [esp + 0x30]
pop edi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret
Function at 0x42e050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x454afb
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
call fcn.00430440
push esi
lea eax, [esi + 0x58]
xor ebx, ebx
mov dword [esp + 0x18], ebx
push eax
mov dword [esi], 0x46b034
mov dword [esi + 0x10], 0x46b15c
mov dword [esi + 0x14], 0x46b1a8
mov dword [esi + 0x18], 0x46b1c0
mov dword [esi + 0x1c], 0x46b1f0
call fcn.00429450
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov eax, 7
xor ecx, ecx
mov dword [esi + 0xc0], eax
mov dword [esi + 0xbc], ebx
mov word [esi + 0xac], cx
xor edx, edx
mov dword [esi + 0xdc], eax
mov dword [esi + 0xd8], ebx
mov word [esi + 0xc8], dx
lea eax, [esi + 0xe0]
push eax
call dword [0x457258]
lea eax, [esi + 0x100]
push eax
mov edi, esi
mov byte [esp + 0x18], 0xd
call fcn.0042abc0
mov dword [esi + 0x13c], ebx
push ebx
mov dword [esi + 0x20], 0x30
mov dword [esi + 0x24], 8
mov dword [esi + 0x28], 0x42ea70
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call dword [0x457190]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xf
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], str.Pandion_Window
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x80], 0xffffffff
mov byte [esi + 0x10c], 1
mov dword [esi + 0xf4], 0xa0
mov ecx, dword [esp + 0xc]
mov byte [esi + 0xf0], bl
pop edi
mov dword [esi + 0xf8], 0xc8
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x44f863
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x44f888
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x44f8a0
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x44f8cf
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x44f90e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x44f9e2
sub edx, 0x10000
js 0x44f9e2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x44f8f4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x44f8f4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x44f965
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x44f962
add edx, 8
jne 0x44f949
jmp 0x44f9d3
add edx, 4
test eax, 0xffff
jne 0x44f972
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x44f9d3
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x44f9a6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x44f8f4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x44f9e2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x44f8f4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x44f9f3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406ba0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x406bad
xor eax, eax
pop esi
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jne 0x406bbf
pop esi
ret
cmp ecx, 1
jne 0x406bcd
cmp byte [esi], 0x5c
jne 0x406bcd
xor eax, eax
pop esi
ret
push esi
call fcn.00406950
add esp, 4
test eax, eax
je 0x406be1
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58784888
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6ce946ef
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
call fcn.0040142a
push 0x7eff
push 0
call fcn.00401451
call dword [0x40652a]
adc eax, 0x40652a
mov dword [0x403071], eax
mov ebx, 0x7f00
push ebx
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov ebx, 0x403059
mov dword [0x403069], 0x400000
mov dword [0x40306d], 0
push ebx
call dword [sym.imp.user32.dll_RegisterClassA]
call fcn.0040100f
push edi
sbb byte [eax], al
xor bh, byte [ecx - 0x19]
xchg esi, eax
push es
add byte [ebp + ebp + 0x7d9e3], cl
mov eax, 0xd29a9e8
add bh, dl
and cl, byte [eax]
daa
adc dword [eax], eax
in al, dx
dec edx
or eax, 0x9f00120d
jno 0x40201e
or dword [edi], ecx
add byte [edx + 0x50], ch
stosd dword es:[edi], eax
push cs
verw word [esi + 0x1040c48c]
add byte [ebx], ah
hlt
Function at 0x57f8e0
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc61e
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x6c9db0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x775757], 0
je 0x57f95c
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.005b0aaa
add eax, 0x20
push eax
push 0x674a2c
push str.CONOUT_
call fcn.005b09ea
call fcn.005b0aaa
push eax
push 0x674e20
push str.CONIN_
call fcn.005b09ea
add esp, 0x18
mov dword [0x6d0270], 1
jmp 0x57facd
mov ecx, 0x7762c0
call fcn.0057cb90
push 5
push dword [0x6d196c]
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push dword [0x6d1970]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x800000
push 0
push dword [0x6d1970]
call fcn.0058a4a0
push 0xc00000
push 0
push dword [0x6d1970]
call fcn.0058a4a0
add esp, 0x18
push 0x57f760
push 0xfffffffffffffffc
push dword [0x6d1970]
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.00593e80
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateICA]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push ebx
call esi
push 0xa
push ebx
mov edi, eax
call esi
mov ecx, eax
lea eax, [edi - 0x311]
cdq
sub eax, edx
mov esi, eax
push 0
lea eax, [ecx - 0x28a]
sar esi, 1
push 0x28a
cdq
push 0x311
sub eax, edx
sar eax, 1
push eax
push esi
push 0
push dword [0x6d1970]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x102650
call fcn.0058bdd0
add esp, 4
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x57fa49
mov ecx, eax
call fcn.0058c0e0
jmp 0x57fa4b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push dword [0x6d1970]
mov dword [0x6d0324], eax
call fcn.0058e660
call fcn.0057ec80
push str.Jan_20_2024_12:07:41
push str.1.0.9
lea eax, [ebp - 0x210]
push str.WarZSiam_Launcher__s___s_
push eax
call fcn.00582710
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push dword [0x6d1970]
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.0057f110
push 5
push dword [0x6d1970]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [0x6d030c]
call fcn.00597430
mov ecx, dword [0x6d0308]
call fcn.00597480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aede3
mov esp, ebp
pop ebp
ret
Function at 0x403900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp byte [esi + 0x1110], bl
je 0x40391c
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push edi
mov eax, dword [ecx + 4]
mov dword [esi + 0x1104], eax
lea eax, [esi + 7]
mov edi, dword [ecx]
mov ecx, 0x10
mov word [esi], 0x9090
nop dword [eax + eax]
mov byte [eax - 5], 0x90
lea eax, [eax + 0xb]
mov dword [eax - 0xf], 0x90909090
mov word [eax - 0xb], 0x9090
mov dword [eax - 9], 0x90909090
sub ecx, 1
jne 0x403940
push 0x1040
push ecx
lea eax, [esi + 0xb8]
mov word [esi + 0xb2], 0x25ff
push eax
mov dword [esi + 0xb4], ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esi + 0x10f8], 0
push dword [eax + 8]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x10fc], eax
test eax, eax
je 0x403acf
push 0x40
push 0x1000
push 0x10fc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esi + 0x1100], eax
test eax, eax
je 0x403ab7
push eax
push str.remote_memory___08X
mov dword [ebp + 0xc], 0
call fcn.00401210
add esp, 8
lea ecx, [ebp + 0xc]
lea eax, [edi + 1]
push ecx
push 4
lea ecx, [ebp + 8]
push ecx
push eax
push dword [esi + 0x10fc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x403a9f
cmp dword [ebp + 0xc], 4
jne 0x403a9f
mov eax, dword [ebp + 8]
add eax, 5
add eax, edi
push eax
push str.old_winmain___08X
mov dword [ebp + 8], eax
call fcn.00401210
mov ecx, dword [esi + 0x1100]
add esp, 8
mov eax, dword [ebp + 8]
mov dword [esi + 0x10f8], eax
lea eax, [ecx + 0x10f8]
sub ecx, edi
mov dword [esi + 0xb4], eax
sub ecx, 5
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ecx
push eax
push 4
lea eax, [ebp - 4]
push eax
lea eax, [edi + 1]
push eax
push dword [esi + 0x10fc]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x403a87
cmp dword [ebp + 0xc], 4
jne 0x403a87
pop edi
mov bl, 1
mov byte [esi + 0x1110], 1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_write_memory__update_winmain_
call fcn.00403af0
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_read_memory__update_winmain_
call fcn.00403af0
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_allocate_memory_in_remote_process
call fcn.00403af0
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.couldnt_open_process
call fcn.00403af0
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405c10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x405c2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
je 0x405c7c
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
setne al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x405c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x405cf0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0xc]
jl 0x405d12
jg 0x405d09
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 8]
jbe 0x405d12
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov ecx, 0
add eax, dword [esi + 0x10]
mov dword [esi + 0x10], eax
adc ecx, dword [esi + 0x14]
mov dword [esi + 0x14], ecx
cmp dword [esi + 0xc], ecx
jg 0x405d4d
jl 0x405d47
cmp dword [esi + 8], eax
jae 0x405d4d
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1003c86
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x100eb54]
push ebx
push esi
push edi
push 0x45
mov dword [ebp - 4], eax
mov ebx, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x19c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x19c]
push eax
mov dword [ebp - 0x19c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x18c], 1
push 0
sete al
or dword [ebx + 8], 0xffffffff
mov dword [ebx + 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [ebx + 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x14
lea eax, [ebp - 0x2c]
push eax
push 0x1004
push dword [0x100eb74]
call esi
test eax, eax
push 0xa
pop edi
je 0x1003d29
push edi
lea eax, [ebp - 0x2c]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov byte [ebx + 0x10], al
jmp 0x1003d2d
mov byte [ebx + 0x10], 0
push 0x17
pop ecx
xor eax, eax
mov dword [ebp - 0x1b4], edi
lea edi, [ebp - 0x88]
rep stosd dword es:[edi], eax
mov al, byte [ebx + 0x10]
push 0x20
mov byte [ebp - 0x71], al
lea eax, [ebp - 0x6c]
push eax
push 0xfa6
push dword [0x100eb74]
mov dword [ebp - 0x1b8], 8
mov dword [ebp - 0x1b0], 0xc
mov dword [ebp - 0x1ac], 0xe
mov dword [ebp - 0x1a8], 0x12
mov dword [ebp - 0x1a4], 0x18
call esi
and dword [ebp - 0x1a0], 0
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea esi, [ebx + 0x494c]
mov eax, dword [ebp - 0x1a0]
fild dword [ebp + eax*4 - 0x1b8]
fimul dword [ebx + 4]
fmul dword [0x100185c]
fadd dword [0x1001858]
call sub.msvcrt.dll__ftol
neg eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push eax
call edi
mov dword [esi - 0x18], eax
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 0x73], 1
call edi
inc dword [ebp - 0x1a0]
mov dword [esi], eax
add esi, 4
cmp dword [ebp - 0x1a0], 6
mov byte [ebp - 0x73], 0
jl 0x1003d9e
lea eax, [ebx + 0x48d8]
push eax
lea eax, [ebx + 0x46e4]
push eax
call fcn.01006bf1
lea esi, [ebx + 0x11c8]
mov ecx, esi
call fcn.0100b09d
mov eax, 0x46d
mov ecx, eax
lea edi, [ebx + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea esi, [ebx + 0x11c8]
lea edi, [ebx + 0x237c]
rep movsd dword es:[edi], dword [esi]
and dword [ebx], 0
lea ecx, [ebx + 0x3530]
call fcn.01003a46
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100bd20
leave
ret