joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458748
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4588f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4588d4
mov dl, 1
mov eax, dword [0x4127d0]
call fcn.004038c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404684
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4588c3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446664
test al, al
je 0x4588b6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458904
lea eax, [ebp - 0x254]
call fcn.00409590
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4588b6
xor eax, eax
push ebp
push 0x4588af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45893c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458898
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048f4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458898
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4588b6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4587b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004162ac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4588fa
lea eax, [ebp - 0x260]
call fcn.00404684
ret

Function at 0x45923c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45fbdc]
cmp byte [eax + 0xa5], 0
jne 0x4592ad
cmp dword [0x45fbf4], 0
jne 0x45926e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4591f8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45fbf4], eax
cmp dword [0x45fbf0], 0
jne 0x459289
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45fbf0], eax
cmp dword [0x45fbf8], 0
jne 0x4592ad
push esp
push 0
push 0
push 0x45919c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45fbf8], eax
pop edx
ret
Function at 0x459940
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45fbdc]
cmp dword [eax + 0x30], 0
je 0x4599ea
cmp dword [ebx + 0x94], 0
jne 0x4599e4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4598d0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4599e4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4599aa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4599e4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041471c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4599b9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a548
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45a57d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404774
jmp 0x45a58a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046d8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45b69c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b6dd
mov eax, esi
call fcn.00441c90
test al, al
je 0x45b6dd
mov eax, dword [ebx + 0x84]
call fcn.0044198c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b6dd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044198c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4016f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov bx, word [eax]
lea esi, [eax + 2]
test bx, bx
mov dword [ebp + 8], esi
jge 0x40170f
xor eax, eax
jmp 0x4017b4
mov edx, 0x4000
test dx, bx
jne 0x40175d
cmp bx, 0x3fff
jg 0x401766
mov dx, word [esi]
cmp bx, 2
mov dword [ebp + 8], edx
mov dx, word [ebp + 8]
jl 0x401734
xor dx, word [eax + 4]
test dx, dx
jl 0x401766
cmp dx, 0x3fff
jg 0x401766
push dword [ebp + 0x10]
add eax, 4
movsx esi, dx
movsx edx, bx
push edx
push esi
push dword [ebp + 0xc]
push eax
call fcn.00401586
test eax, eax
jge 0x4017b2
jmp 0x401766
xor ebx, edx
cmp bx, 0x3fff
jle 0x40176b
or eax, 0xffffffff
jmp 0x4017b4
push dword [ebp + 0x10]
lea edi, [ecx + 0x113c]
push edi
call fcn.00401000
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov dl, 0x44
mov ecx, esi
movsx esi, bx
test esi, esi
jle 0x4017b2
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], esi
sub eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov bl, byte [ebx + edi]
xor bl, dl
xor bl, byte [ecx]
mov byte [ecx + eax], bl
add dl, byte [ecx]
mov ebx, dword [ebp + 0x10]
inc ecx
inc ebx
and ebx, 0xf
dec dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
jne 0x401793
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x401ae4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
push edi
push dword [0x40a040]
lea eax, [ebp - 0x80]
push eax
call fcn.00404b50
pop ecx
pop ecx
push dword [ebp + 0xc]
call fcn.00404ad0
mov edi, dword [ebp + 8]
pop ecx
mov esi, eax
push 0x20
lea eax, [edi + 0x14]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00404670
add esp, 0xc
lea eax, [ebp - 0x6c]
push 0x20
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00404670
add esp, 0xc
lea eax, [ebp - 0x4c]
push esi
push dword [ebp + 0xc]
push eax
call fcn.00404670
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [ebp + 0x10]
push esi
push eax
call fcn.004017bb
add esp, 0xc
xor ecx, ecx
lea eax, [ebp - 0x4c]
mov dl, byte [eax - 1]
xor byte [ebp + ecx - 0x4c], dl
inc ecx
dec eax
cmp ecx, 0x20
jl 0x401b57
push 0x54
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00404a20
add esp, 0xc
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
leave
ret

Function at 0x4021d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
push edi
mov esi, ecx
je 0x402281
mov dword [ebp + 0x10], ebx
mov edi, dword [esi + 0x38c]
cmp edi, dword [ebp + 0xc]
jl 0x4021fa
mov edi, dword [ebp + 0xc]
push ebx
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.004021d6
sub dword [esi + 0x38c], edi
sub dword [ebp + 0xc], edi
add dword [ebp + 0x10], eax
add dword [ebp + 8], edi
mov ecx, dword [esi + 0x38c]
cmp eax, edi
jne 0x40227c
cmp ecx, ebx
jne 0x402273
add dword [esi + 0x168], 2
mov eax, dword [esi + 0x168]
mov eax, dword [esi + eax*4 + 4]
cmp eax, ebx
mov dword [esi + 0x38c], eax
jne 0x402262
mov ecx, esi
call fcn.00402039
test eax, eax
je 0x40227c
mov eax, dword [esi + 4]
push ebx
push dword [esi]
mov ecx, esi
mov dword [esi + 0x168], ebx
mov dword [esi + 0x38c], eax
call fcn.00401f79
mov eax, dword [esi + 0x168]
push ebx
mov ecx, esi
push dword [esi + eax*4]
call fcn.00401f79
cmp dword [ebp + 0xc], ebx
jne 0x4021ec
mov eax, dword [ebp + 0x10]
jmp 0x40229f
lea eax, [ebp + 0xc]
push ebx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x148]
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x402793
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 0x10c], 0
push esi
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x402802
lea eax, [ebp - 0x10c]
push eax
call fcn.00404ad0
test eax, eax
pop ecx
jbe 0x402802
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push str.Desktop
push eax
push esi
call fcn.0040274a
add esp, 0xc
push dword [ebp + 0xc]
push esi
push esi
call fcn.0040274a
add esp, 0xc
push str..LNK
push esi
call fcn.00404b60
pop ecx
pop ecx
push 1
pop eax
jmp 0x402804
xor eax, eax
pop esi
leave
ret
Function at 0x4028ea
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x402903
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop ebp
ret
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40292e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret

Function at 0x402990
Capabilities:
Create process on windows
Get file attributes
Set file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
cmp byte [esi], 0x21
mov dword [esp + 0x10], ebx
jne 0x4029ad
inc esi
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x1c]
cmp ebp, ebx
jne 0x4029da
cmp byte [esi], bl
mov edi, esi
je 0x4029da
push 5
push str..EXE
push edi
call fcn.004083a0
add esp, 0xc
test eax, eax
jne 0x4029d5
mov byte [edi + 4], bl
lea ebp, [edi + 5]
inc edi
cmp byte [edi], bl
jne 0x4029bb
push 1
push ebx
push ebp
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x10], ebx
je 0x402a35
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push pe_nt_image_headers32
push esi
call edi
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x402a00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x402c74
Capabilities:
Delete file

Disassembly:
sub esp, 0x154
push ebx
push ebp
push esi
push edi
push 2
call fcn.00402c2e
xor ebx, ebx
pop ecx
cmp eax, ebx
mov edi, 0x40cc58
je 0x402ca0
push eax
mov ecx, edi
call fcn.00401d01
push eax
call fcn.00402898
pop ecx
push 5
call fcn.00402c2e
mov ebp, eax
pop ecx
cmp ebp, ebx
je 0x402ce4
push ebp
mov ecx, edi
call fcn.00401d01
mov esi, eax
push esi
call fcn.00402c13
test eax, eax
pop ecx
jne 0x402ce4
cmp byte [esi], bl
je 0x402ce1
push 0x2c
push esi
call fcn.004051d0
pop ecx
cmp eax, ebx
pop ecx
je 0x402cd8
mov byte [eax], bl
inc eax
push eax
push esi
call fcn.004028ea
pop ecx
pop ecx
inc ebp
jmp 0x402cae
push 3
call fcn.00402c2e
cmp eax, ebx
pop ecx
je 0x402d34
push eax
mov ecx, edi
call fcn.00401d01
cmp byte [eax], bl
je 0x402d34
push 0x2c
push eax
call fcn.00401da1
pop ecx
cmp eax, ebx
pop ecx
je 0x402d34
mov byte [eax], bl
inc eax
push eax
call fcn.00401d1a
cmp byte [eax], bl
pop ecx
je 0x402d34
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00402793
pop ecx
test eax, eax
pop ecx
je 0x402d34
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x154
ret
Function at 0x4030bc
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
push edi
push 8
call fcn.00402c2e
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x403177
push 0x40cb38
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 4]
mov ecx, 0x40cc58
call fcn.00401d01
mov esi, eax
push esi
call fcn.00402c13
test eax, eax
pop ecx
jne 0x403177
cmp byte [esi], al
je 0x40316f
push 0x40cb38
lea ebx, [ebp - 0x808]
call fcn.00404ad0
pop ecx
mov dword [ebp - 8], eax
push 0x40a1b4
push esi
call fcn.00405340
pop ecx
test eax, eax
pop ecx
je 0x403156
sub eax, esi
mov edi, eax
je 0x40313c
push edi
push esi
push ebx
call fcn.00404670
add esp, 0xc
add ebx, edi
push dword [ebp - 8]
lea esi, [esi + edi + 2]
push 0x40cb38
push ebx
call fcn.00404670
add esp, 0xc
add ebx, dword [ebp - 8]
jmp 0x403118
push esi
push ebx
call fcn.00404b50
pop ecx
lea eax, [ebp - 0x808]
pop ecx
push 0
push eax
call fcn.00402990
pop ecx
pop ecx
inc dword [ebp - 4]
jmp 0x4030e6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40317c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x40cb30]
push esi
lea esi, [eax - 1]
test esi, esi
jl 0x4031ed
push edi
push ebx
mov edi, 0x40d018
push esi
mov ecx, edi
call fcn.00401d01
mov ebx, eax
push 0
lea eax, [ebp - 0x12c]
push esi
push eax
mov ecx, edi
call fcn.00401c65
test byte [ebx + 8], 0x10
je 0x4031c9
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4031e8
lea eax, [ebp - 0x12c]
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
dec esi
jns 0x403199
pop ebx
pop edi
pop esi
leave
ret
Function at 0x404316
Capabilities:
Copy file
Delete file
Get graphical window text

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [0x40d144], ebx
push ebp
push esi
push edi
mov ebp, 0x40c8a0
mov esi, 0x40cb38
jne 0x40449c
cmp dword [0x40d148], ebx
je 0x40435a
push ebp
push esi
call fcn.00404b50
pop ecx
pop ecx
push str.Exec_Temp_Dir
push esi
call fcn.00404b60
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404378
push 0x104
push esi
push 0x3e9
push dword [0x40d13c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
call fcn.00401d1a
pop ecx
mov ebx, eax
push ebx
call fcn.00404ad0
mov edi, eax
pop ecx
cmp edi, 4
jge 0x404396
xor eax, eax
jmp 0x404496
cmp ebx, esi
je 0x4043a8
lea eax, [edi + 1]
push eax
push ebx
push esi
call fcn.00404670
add esp, 0xc
cmp byte [edi + 0x40cb37], 0x5c
lea eax, [edi + 0x40cb37]
jne 0x4043bb
and byte [eax], 0
dec edi
xor ebx, ebx
cmp dword [0x40ca24], ebx
jne 0x4043d2
call fcn.00403e03
test eax, eax
je 0x40448e
push ebx
call fcn.00403c67
pop ecx
call fcn.00403753
cmp eax, 0xfffffffd
mov dword [esp + 0x10], eax
jne 0x4043ec
call fcn.00402b7e
cmp dword [esp + 0x10], ebx
jne 0x40448e
cmp dword [0x40d144], ebx
jne 0x40442d
push ebx
mov ecx, 0x40d018
call fcn.00401d01
mov ebx, eax
push dword [ebx]
call fcn.00404660
pop ecx
inc edi
push edi
call fcn.00404a10
pop ecx
mov dword [ebx], eax
push esi
push eax
call fcn.00404b50
pop ecx
pop ecx
call fcn.00403ee4
jmp 0x40448e
call fcn.00402c74
call fcn.0040317c
cmp byte [0x40c8a0], 0
je 0x40448e
mov ecx, 0x40cc68
call fcn.004021c9
mov esi, 0x40ca28
push 0x5c
push esi
call fcn.00401d6e
pop ecx
cmp eax, ebx
pop ecx
je 0x404460
inc eax
jmp 0x404462
mov eax, esi
push eax
push ebp
push ebp
call fcn.0040274a
add esp, 0xc
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push ebp
call fcn.00402990
pop ecx
pop ecx
push ebx
push dword [0x40d13c]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x404493
call fcn.004042fe
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x10]
jmp 0x4043bd
Function at 0x4053f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x407248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x40d184], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x40d180], ecx
shl ecx, 8
add ecx, edx
mov dword [0x40d17c], ecx
shr eax, 0x10
mov dword [0x40d178], eax
call fcn.00407200
test eax, eax
jne 0x40545a
push 0x1c
call fcn.00405590
add esp, 4
mov dword [ebp - 4], 0
call fcn.00407000
call fcn.00406ff0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40d570], eax
call fcn.00406bc0
mov dword [0x40d150], eax
test eax, eax
je 0x40548d
mov eax, dword [0x40d570]
test eax, eax
jne 0x405497
push 0xffffffffffffffff
call fcn.004064a0
add esp, 4
call fcn.00406910
call fcn.00406820
call fcn.00406470
mov esi, dword [0x40d570]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x405576
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x4054de
test al, al
je 0x4054de
and eax, 0xff
push eax
call fcn.004067c0
add esp, 4
test eax, eax
je 0x4054b8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4054b8
cmp byte [esi], 0x22
jne 0x4054e7
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x4054f7
cmp al, 0x20
ja 0x4054f7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4054e7
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x405518
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40551d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004064a0
jmp 0x40555b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4054e7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x405576

Function at 0x4064e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40d1b4]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x4064ff
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x40d1b0], 1
mov byte [0x40d1ac], bl
jne 0x406559
mov ecx, dword [0x40d568]
test ecx, ecx
je 0x406547
mov esi, dword [0x40d564]
sub esi, 4
cmp esi, ecx
jb 0x406547
mov eax, dword [esi]
test eax, eax
je 0x406540
call eax
mov ecx, dword [0x40d568]
sub esi, 4
cmp esi, ecx
jae 0x406532
push 0x40a028
push 0x40a024
call fcn.00406590
add esp, 8
push 0x40a034
push 0x40a02c
call fcn.00406590
add esp, 8
test ebx, ebx
jne 0x406580
push ebp
mov dword [0x40d1b4], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x406bc0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x40d2c8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x406c02
call edi
mov esi, eax
test esi, esi
je 0x406bec
mov eax, 1
jmp 0x406bfd
call ebp
mov ebx, eax
test ebx, ebx
je 0x406d0f
mov eax, 2
mov dword [0x40d2c8], eax
cmp eax, 1
jne 0x406ca2
test esi, esi
jne 0x406c1b
call edi
mov esi, eax
test esi, esi
je 0x406d0f
cmp word [esi], 0
mov eax, esi
je 0x406c35
add eax, 2
cmp word [eax], 0
jne 0x406c23
add eax, 2
cmp word [eax], 0
jne 0x406c23
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x406c94
push edi
call fcn.00405610
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x406c94
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x406c86
push ebx
call fcn.004055c0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x406d0f
test ebx, ebx
jne 0x406cb3
call ebp
mov ebx, eax
test ebx, ebx
je 0x406d0f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x406ccb
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406cbb
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406cbb
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00405610
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x406ced
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x407360
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x40a7d0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x407384
add eax, 8
inc ebp
cmp eax, 0x40a860
jb 0x407375
cmp ecx, dword [ebp*8 + 0x40a7d0]
jne 0x40752b
mov eax, dword [0x40d158]
cmp eax, 1
je 0x4074ed
test eax, eax
jne 0x4073b0
cmp dword [0x40a404], 1
je 0x4074ed
cmp ecx, 0xfc
je 0x40752b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4073eb
mov ecx, 5
mov esi, 0x409360
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x407434
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x40935c
add ebx, ecx
push ebx
call fcn.00408020
add esp, 0xc
mov ecx, 6
mov esi, 0x409340
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40933c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x409314
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x40a7d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00407f90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x40d460]
test eax, eax
je 0x4074fe
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x407508
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x40a7d4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret