joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fa990
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4faa8b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.user32.dll_GetClientRect
push 0
call sub.user32.dll_GetSystemMetrics
lea edx, [ebp - 4]
call fcn.00409600
push 1
call sub.user32.dll_GetSystemMetrics
lea edx, [ebp - 8]
call fcn.00409600
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x11c]
call fcn.00409f88
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 0x14]
call fcn.00409600
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 4]
call fcn.00404d00
jne 0x4faa5e
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x10]
call fcn.00409600
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.00404d00
jne 0x4faa5e
mov edx, dword [ebp - 0xc]
mov eax, 0x4faaa4
call fcn.00404ef8
dec eax
jge 0x4faa5e
mov bl, 1
jmp 0x4faa60
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4faa92
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.00404918
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404918
ret

Function at 0x1004560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
je 0x100460e
cmp dword [ebp + 0xc], esi
je 0x100460e
cmp dword [ebp + 0x10], esi
je 0x100460e
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call fcn.01004797
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10045bf
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x100460a
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100460a
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10045f3
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x1004603
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1004603
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 0x10]
neg esi
sbb esi, esi
and esi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1004613
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4beb5d
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x4beb8b
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x4beb77
pop edi
pop esi
ret

Function at 0x4bec23
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
imul ecx, ecx, 0x28
mov ecx, dword [ecx + eax + 0x24]
test ecx, 0x20000000
je 0x4bec5c
test ecx, 0x40000000
je 0x4bec55
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x4bec6d
mov eax, 0x10
jmp 0x4bec6d
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x4bec7a
add eax, 0x200
ret
Function at 0x4c0738
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x104
test edx, edx
push esi
push edi
je 0x4c0794
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp + edx - 0x105], 0x5c
je 0x4c079b
mov esi, 0x4bb534
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
movsw word es:[edi], word [esi]
jmp 0x4c079b
mov byte [ebp - 0x104], 0
push dword [ebp + 8]
push 0
push 0x4bb538
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x4c07cd
push 0x10
push 0x4bb53c
push dword [ebp + 8]
call fcn.004beaa9
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c07d3
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.004c0e30
push esi
push edi
push 0
call fcn.004c06c3
add esp, 4
mov dword [0x4bb524], eax
cmp eax, 0xffffffff
jne 0x4c0911
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004c0738
add esp, 8
mov esi, eax
test esi, esi
jne 0x4c0899
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x4c0886
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x4c0868
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x4c0868
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x4c084f
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.004c0738
add esp, 8
mov esi, eax
test esi, esi
je 0x4c083c
test esi, esi
jne 0x4c0899
push 0xc
push 0x4bb548
call fcn.004bf2f6
add esp, 8
push 0x1050
lea eax, [ebp - 0x4220]
push eax
push 0x4ba4d4
call fcn.004bea89
add esp, 0xc
test eax, eax
jne 0x4c08c2
push 2
push 0
call fcn.004bf2f6
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x4ba4d0]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.004beafc
add esp, 0xc
push esi
call fcn.004bea9c
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004c06c3
add esp, 4
mov dword [0x4bb524], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x4bb524], 0xffffffff
jne 0x4c0926
push 0xc
push 0x4bb54c
jmp 0x4c09d3
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x4bb524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x4c09cc
cmp dword [ebp - 0x18], 0x328
jne 0x4c09c3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x4bb524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x4c0999
mov eax, dword [ebp - 4]
mov dword [0x4bb528], eax
jmp 0x4c09db
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x76
je 0x4c09b2
cmp eax, 0x77
je 0x4c09b2
push 0xc
push 0x4bb578
jmp 0x4c09d3
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 1
push str.___please_restart_your_system_and_retry
jmp 0x4c09d3
push 0xc
push 0x4bb57c
jmp 0x4c09d3
push 0xc
push 0x4bb580
call fcn.004bf2f6
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4010a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
push ebx
push esi
push edi
call fcn.00401660
test eax, eax
je 0x40127f
push 0
push 2
call dword [0x40b08c]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4012a3
mov ecx, 0x4a
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], 0x128
call dword [0x40b07c]
lea ecx, [esp + 0x20]
push ecx
push esi
mov byte [esp + 0x378], 0
call dword [0x40b084]
test eax, eax
je 0x401140
lea ebx, [ebx]
mov edx, dword [esp + 0x28]
cmp edx, dword [ebp + 8]
jne 0x401130
xor eax, eax
jmp 0x401120
mov cl, byte [esp + eax + 0x44]
mov byte [esp + eax + 0x370], cl
inc eax
test cl, cl
jne 0x401120
lea eax, [esp + 0x20]
push eax
push esi
call dword [0x40b084]
test eax, eax
jne 0x401110
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x370]
test al, al
je 0x40127f
mov ecx, dword [ebp + 8]
push ecx
push 8
call dword [0x40b08c]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4012a3
mov ecx, 0x89
lea edi, [esp + 0x148]
rep stosd dword es:[edi], eax
xor edx, edx
lea eax, [esp + 0x148]
mov ebx, edx
push eax
mov edi, edx
push esi
mov dword [esp + 0x150], 0x224
mov dword [esp + 0x24], edx
call dword [0x40b088]
lea ecx, [esp + 0x370]
push ecx
lea edx, [esp + 0x26c]
push edx
call fcn.004078f6
add esp, 8
test eax, eax
jne 0x4011cb
mov ebx, dword [esp + 0x15c]
mov edi, dword [esp + 0x160]
lea eax, [esp + 0x148]
push eax
push esi
call dword [0x40b080]
test eax, eax
je 0x40121d
mov edi, edi
lea ecx, [esp + 0x370]
push ecx
lea edx, [esp + 0x26c]
push edx
call fcn.004078f6
add esp, 8
test eax, eax
jne 0x40120a
mov ebx, dword [esp + 0x15c]
mov edi, dword [esp + 0x160]
lea eax, [esp + 0x148]
push eax
push esi
call dword [0x40b080]
test eax, eax
jne 0x4011e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40127f
cmp edi, 0x2000
jb 0x401235
mov edi, 0x2000
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40127f
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40127f
mov edx, dword [esp + 0x10]
push 0x40a6e0
push edi
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x401278
cmp word [esi], 0x5a4d
je 0x401288
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
push esi
jne 0x401279
mov edi, dword [eax + esi + 0x28]
add edi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4012b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
sub esp, 0x114
push ebx
mov ebx, dword [esp + 0x120]
mov dword [0x40aad8], 0x10003
mov eax, dword [ebx + 4]
push 0x40aad8
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x4012e3
pop ebx
add esp, 0x114
ret
mov ecx, dword [ebx + 8]
push ebp
push ecx
call fcn.004010a0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40136a
mov edx, dword [esp + 0x120]
push ebp
push edx
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00401000
add esp, 0x10
test eax, eax
je 0x40136a
push 0x110
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x40ada4], eax
je 0x40136a
mov ecx, dword [ebx]
push 0x40a6ec
push 0x40
push 0x110
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, dword [0x40ada4]
mov eax, dword [ebx]
push 0x40a6e0
push 0x110
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x401375
mov ecx, dword [0x40ada4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov eax, dword [ebx]
push 0x40a6e8
push 0x110
lea edx, [esp + 0x14]
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40135d
push esi
push edi
mov ecx, 0xb3
mov esi, 0x40aad8
mov edi, 0x40adb0
rep movsd dword es:[edi], dword [esi]
mov dword [0x40ae68], ebp
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0xa]
mov dword [0x40a9c4], eax
mov dword [0x40a6f0], 0x10003
lea ecx, [ecx]
push 0x32
call esi
mov ecx, dword [ebx + 4]
push 0x40a6f0
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [0x40a7a8]
cmp edx, dword [0x40a9c4]
jne 0x4013d0
mov eax, dword [0x40a7a0]
mov dword [0x40a6e4], eax
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [0x40ada4]
mov eax, dword [ebx]
push 0x40a6e8
push 0x110
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
pop edi
pop esi
je 0x40135d
mov edx, dword [0x40ada4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x40a6ec]
mov edx, dword [0x40ada8]
lea eax, [esp + 8]
push eax
mov eax, dword [ebx]
push ecx
push 0x110
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [0x40ab90], ebp
mov ecx, dword [ebx + 4]
push 0x40aad8
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
neg eax
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x114
ret
Function at 0x401480
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 0x118
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.VirtualAllocEx
push esi
call edi
push str.VirtualFreeEx
push esi
mov ebx, eax
call edi
mov edi, eax
test edi, edi
je 0x4015ed
test ebx, ebx
je 0x4015ed
mov esi, dword [esp + 0x12c]
mov eax, dword [esi]
push 0x40
push 0x1000
push 0x111
push 0
push eax
call ebx
test eax, eax
mov dword [0x40ada8], eax
je 0x401514
mov ecx, dword [esp + 0x128]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
push 0
call fcn.00401000
mov ecx, dword [esi]
add esp, 0x10
test eax, eax
mov eax, dword [0x40ada8]
jne 0x401520
push 0x4000
push 0x111
push eax
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
push 0x40a6e8
push 0x111
lea edx, [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40155d
push 0x4000
push 0x111
mov edx, dword [0x40ada8]
mov eax, dword [esi]
push edx
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
mov eax, dword [0x40ada8]
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push eax
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x4015a0
mov eax, dword [0x40ada8]
mov ecx, dword [esi]
push 0x4000
push 0x111
push eax
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x40a6e4
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
push 0x4000
push 0x111
je 0x401545
mov ecx, dword [0x40ada8]
mov edx, dword [esi]
push ecx
push edx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x40a6e4]
pop edi
xor eax, eax
test ecx, ecx
pop esi
setne al
pop ebx
add esp, 0x118
ret
push 0
push 0
push str.couldnt_import_virtualallocex
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4017e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x190
push 0x186
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esp + 0x194]
mov dl, byte [eax + 1]
mov cl, 0x3a
cmp dl, cl
jne 0x401834
cmp byte [esp + 1], cl
jne 0x401834
movsx ecx, byte [eax]
push esi
push ecx
call fcn.00401eb0
movsx edx, byte [esp + 8]
push edx
mov esi, eax
call fcn.00401eb0
add esp, 8
cmp esi, eax
pop esi
jne 0x401834
mov al, 1
add esp, 0x190
ret
xor al, al
add esp, 0x190
ret
Function at 0x4018b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
push ebx
push esi
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x7c
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SoftwareSierra_OnLineSetupHALFLIFE
push 0x80000002
mov dword [esp + 0x28], 0x190
mov bl, 1
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40194c
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.SoftwareSierra_OnLineSetupCSTRIKE
push 0x80000002
xor bl, bl
call esi
test eax, eax
je 0x40194c
mov eax, dword [esp + 0x10]
push eax
call edi
push 0x40010
push str._OGC__ERROR
push str.GetHLCSPath_____OpenKey_nHL_CS_IS_NOT_INSTALLED_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push esi
push 0
push 0
push str.DIRECTORY
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401994
mov eax, dword [esp + 0x10]
push eax
call edi
push 0x40010
push str._OGC__ERROR
push str.GetHLCSPath_____QueryValue_nCANNOT_FIND_HL_CS_DIRECTORY_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov edi, esi
dec edi
test bl, bl
je 0x4019c0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4019a2
mov edx, dword [str.hl.exe]
mov dword [edi], edx
mov eax, dword [0x408314]
mov dword [edi + 4], eax
jmp 0x4019ea
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4019c0
mov ecx, dword [str.cstrike.exe]
mov dword [edi], ecx
mov edx, dword [0x408304]
mov dword [edi + 4], edx
mov eax, dword [0x408308]
mov dword [edi + 8], eax
mov cl, byte [0x40830c]
mov byte [edi + 0xc], cl
push esi
lea edx, [esp + 0x1c]
push str.HL_CS_EXECUTABLE_WAS_FOUND_IN__n_n_s
push edx
call fcn.00401f85
add esp, 0xc
push 0x24
push str._OGC__REQUEST
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
cmp eax, 6
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4021a7
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x408548
call fcn.00404324
mov edi, 0x94
mov eax, edi
call fcn.00404370
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40b140], ecx
mov eax, dword [esi + 4]
mov dword [0x40b14c], eax
mov edx, dword [esi + 8]
mov dword [0x40b150], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40b144], esi
cmp ecx, 2
je 0x402207
or esi, 0x8000
mov dword [0x40b144], esi
shl eax, 8
add eax, edx
mov dword [0x40b148], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x402242
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402242
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40225a
cmp eax, 0x20b
je 0x402247
mov dword [ebp - 0x1c], esi
jmp 0x40226e
cmp dword [ecx + 0x84], 0xe
jbe 0x402242
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x402268
cmp dword [ecx + 0x74], 0xe
jbe 0x402242
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.004042d3
pop ecx
test eax, eax
jne 0x40229a
cmp dword [0x40b104], 1
jne 0x402287
call fcn.00403a7c
push 0x1c
call fcn.00403905
push 0xff
call fcn.004036fc
pop ecx
pop ecx
call fcn.00404231
mov dword [ebp - 4], esi
call fcn.00404086
test eax, eax
jge 0x4022b3
push 0x1b
call fcn.00402182
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40c654], eax
call fcn.00403f64
mov dword [0x40b0fc], eax
call fcn.00403ec2
test eax, eax
jge 0x4022d9
push 8
call fcn.00402182
pop ecx
call fcn.00403c8f
test eax, eax
jge 0x4022ea
push 9
call fcn.00402182
pop ecx
call fcn.0040372c
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x4022fd
push eax
call fcn.00402182
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403c26
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x40231e
movzx eax, word [ebp - 0x34]
jmp 0x402321
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00401a20
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40233f
push edi
call fcn.00403853
call fcn.00403875
jmp 0x402371
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040435f
ret
Function at 0x403791
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40b180], esi
push edi
jne 0x4037b1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40b17c], esi
mov byte [0x40b178], al
jne 0x403817
mov ecx, dword [0x40c648]
test ecx, ecx
je 0x4037f8
mov eax, dword [0x40c644]
sub eax, 4
cmp eax, ecx
jmp 0x4037f1
mov eax, dword [eax]
test eax, eax
je 0x4037e3
call eax
mov eax, dword [0x40c644]
sub eax, 4
cmp eax, dword [0x40c648]
mov dword [0x40c644], eax
jae 0x4037db
mov eax, 0x40a020
mov esi, 0x40a028
cmp eax, esi
mov edi, eax
jae 0x403817
mov eax, dword [edi]
test eax, eax
je 0x403810
call eax
add edi, 4
cmp edi, esi
jb 0x403808
mov eax, 0x40a02c
mov esi, 0x40a030
cmp eax, esi
mov edi, eax
jae 0x403836
mov eax, dword [edi]
test eax, eax
je 0x40382f
call eax
add edi, 4
cmp edi, esi
jb 0x403827
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x403851
push dword [ebp + 8]
mov dword [0x40b180], 1
call fcn.004036fc
pop ecx
pop ebp
ret

Function at 0x403905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40a448]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40a080]
je 0x403932
inc eax
cmp eax, 0x12
jb 0x403923
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40a080]
jne 0x403a66
mov eax, dword [0x40b104]
cmp eax, 1
je 0x403a41
cmp eax, edx
jne 0x403962
cmp dword [0x40a054], 1
je 0x403a41
cmp ecx, 0xfc
je 0x403a66
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40399b
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.00406270
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.00404ca0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4039dd
lea eax, [ebp - 0x10c]
push eax
call fcn.00404ca0
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x408d68
push edi
call fcn.00406370
add esp, 0x10
push edi
call fcn.00404ca0
push dword [esi + 0x40a084]
mov ebx, eax
call fcn.00404ca0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00404370
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00406270
push edi
push ebx
call fcn.00406280
push 0x408d48
push ebx
call fcn.00406280
push dword [esi + 0x40a084]
push ebx
call fcn.00406280
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00406174
add esp, 0x2c
jmp 0x403a66
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x40a084]
push dword [esi]
call fcn.00404ca0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00404dc2
pop edi
pop esi
pop ebx
leave
ret