joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a5d4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a77f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45a760
mov dl, 1
mov eax, dword [0x412f4c]
call fcn.004036f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404474
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45a74f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00448020
test al, al
je 0x45a742
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45a790
lea eax, [ebp - 0x254]
call fcn.004095b0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45a742
xor eax, eax
push ebp
push 0x45a73b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45a7c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45a724
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004046e4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45a724
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004046e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a742
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45a645
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416a80
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a786
lea eax, [ebp - 0x260]
call fcn.00404474
ret

Function at 0x45b0b4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x492bdc]
cmp byte [eax + 0xa5], 0
jne 0x45b125
cmp dword [0x492bf4], 0
jne 0x45b0e6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45b070
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x492bf4], eax
cmp dword [0x492bf0], 0
jne 0x45b101
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x492bf0], eax
cmp dword [0x492bf8], 0
jne 0x45b125
push esp
push 0
push 0
push 0x45b014
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x492bf8], eax
pop edx
ret
Function at 0x45b21c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45b233
add esp, 0xfffffff0
call fcn.00403a48
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a978
mov eax, dword [0x49146c]
cmp word [eax + 2], 0
jne 0x45b25b
mov eax, dword [0x49146c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c8f4
mov eax, dword [0x491518]
cmp word [eax + 2], 0
jne 0x45b275
mov eax, dword [0x491518]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045caec
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412b30]
call fcn.004036f4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412b30]
call fcn.004036f4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cecc]
call fcn.00424a28
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45b3fc
mov eax, dword [0x491378]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424df8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45d09c
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x491378]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cef4
test eax, eax
je 0x45b36a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f90
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cf1c
test eax, eax
je 0x45b37e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.004046e4
mov eax, dword [0x491244]
cmp byte [eax], 0
jne 0x45b3b2
mov eax, ebx
call fcn.0045b524
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045d278
mov eax, ebx
call fcn.0045dc3c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45b3f2
call fcn.00403aa0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b7a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x492bdc]
cmp dword [eax + 0x30], 0
je 0x45b84e
cmp dword [ebx + 0x94], 0
jne 0x45b848
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45b734
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b848
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45b80e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b848
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414e98
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45b81d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45c3b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45c3e5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404564
jmp 0x45c3f2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044c8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45d454
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d495
mov eax, esi
call fcn.004435c4
test al, al
je 0x45d495
mov eax, dword [ebx + 0x84]
call fcn.004432c0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d495
push 0
mov eax, dword [ebx + 0x84]
call fcn.004432c0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x468b84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x468bde
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.00468be8
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468be5
ret

Function at 0x4706e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004432c0
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0043c9f8
pop ebx
ret
Function at 0x479d78
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x479e32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404ba8
mov eax, dword [0x4912c0]
cmp byte [eax], 0
je 0x479de7
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404f08
mov eax, dword [ebx]
call fcn.00404d34
push eax
mov eax, dword [ebx]
call fcn.00404d24
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404d34
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404f08
jmp 0x479e19
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409140
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404d14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e39
lea eax, [ebp - 0x3f0]
call fcn.00404474
ret

Function at 0x479e40
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409140
add esp, 0x3ec
pop ebx
ret

Function at 0x47b45c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x47b490
cmp eax, dword [esp]
pop edx
pop eax
jae 0x47b4cc
jmp 0x47b494
pop edx
pop eax
jge 0x47b4cc
mov eax, dword [0x4915e0]
mov eax, dword [eax]
mov dword [eax + 0x44], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00476460
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x47b4f1
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x47b4f1
cmp dword [ebx + 0x11c], 0
je 0x47b4f1
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0042bfe4
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x48598c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485afd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x94], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x485ae2
lea eax, [ebp - 0x10d]
push eax
push 0x100
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409140
mov dl, 1
mov eax, dword [0x4622d4]
call fcn.0046232c
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov dl, 1
mov eax, dword [0x41323c]
call fcn.004036f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x90]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.004623a8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x485adf
mov dl, 1
mov eax, dword [0x46344c]
call fcn.004634b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov edx, 0x485b14
call fcn.004626f4
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404780
xor eax, eax
push ebp
push 0x485ad8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004637b4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00485b1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485adf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00403724
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403724
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403724
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485b04
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404498
ret
Function at 0x487774
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x487895
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
mov edx, dword [0x491580]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x491580]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4878ac
call fcn.00409630
mov eax, dword [ebp - 4]
call fcn.0047fe58
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x491380]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [0x49154c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4878c8
call fcn.00409630
mov eax, dword [ebp - 0x10]
call fcn.0047fe58
call sub.kernel32.dll_GetCurrentThreadId_1
mov esi, eax
push esi
push 0
push 0x487358
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4878e8
call fcn.00409630
mov eax, dword [ebp - 0x24]
call fcn.0047fe58
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x487900
call fcn.00409630
mov eax, dword [ebp - 0x28]
call fcn.0047fe58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48789c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 0x10]
call fcn.00404474
lea eax, [ebp - 4]
call fcn.00404474
ret

Function at 0x48b23c
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x499ce4], 0
jne 0x48b262
push 0
mov eax, dword [0x492664]
push eax
mov eax, 0x48b13c
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x499ce4], eax
mov al, 1
ret
xor eax, eax
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x21e246d5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x69f9701d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x35966e8f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x318f7cfa
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4016e0
Capabilities:
Terminate process

Disassembly:
mov dword [0x4060dc], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x4060d8], bl
jne 0x40173c
cmp dword [0x40806c], 0
je 0x40172a
mov esi, dword [0x408064]
sub esi, 4
cmp esi, dword [0x40806c]
jb 0x40172a
mov eax, dword [esi]
test eax, eax
je 0x40171f
call eax
sub esi, 4
cmp esi, dword [0x40806c]
jae 0x401717
push 0x40601c
push 0x406014
call fcn.00401760
add esp, 8
push 0x406024
push 0x406020
call fcn.00401760
add esp, 8
test ebx, ebx
jne 0x40175d
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret

Function at 0x401780
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x402ad0
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4060a4], eax
xor eax, eax
mov al, byte [0x4060a5]
mov dword [0x4060b0], eax
mov eax, dword [0x4060a4]
shr dword [0x4060a4], 0x10
and eax, 0xff
mov dword [0x4060ac], eax
shl eax, 8
add eax, dword [0x4060b0]
mov dword [0x4060a8], eax
call fcn.00402ab0
mov dword [ebp - 4], 0
call fcn.004028d0
call fcn.00401c00
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x408060], eax
call fcn.00402730
mov dword [0x4060e0], eax
test eax, eax
je 0x401819
cmp dword [0x408060], 0
jne 0x401823
push 0xffffffffffffffff
call fcn.004016a0
add esp, 4
call fcn.004024b0
call fcn.004023d0
call fcn.00401670
mov esi, dword [0x408060]
mov al, byte [esi]
cmp al, 0x22
je 0x40184a
cmp al, 0x20
jbe 0x401877
inc esi
cmp byte [esi], 0x20
ja 0x401842
jmp 0x401877
inc esi
cmp byte [esi], 0x22
je 0x401876
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x401871
xor eax, eax
mov al, bl
push eax
call fcn.004013b0
add esp, 4
test eax, eax
je 0x40186b
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x401853
cmp byte [esi], 0x22
jne 0x401877
inc esi
cmp byte [esi], 0
je 0x401887
cmp byte [esi], 0x20
ja 0x401887
inc esi
cmp byte [esi], 0
jne 0x40187c
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4018ab
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.004016a0
jmp 0x4018ec
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402730
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x406850], 0
push ebx
push esi
push edi
push ebp
jne 0x402780
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call esi
mov edi, eax
test edi, edi
je 0x40275e
mov dword [0x406850], 1
mov ebx, dword [esp + 0x10]
jmp 0x40278e
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x402776
mov dword [0x406850], 2
jmp 0x40278e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x406850], 1
jne 0x40283d
test edi, edi
jne 0x4027b1
call esi
mov edi, eax
test edi, edi
jne 0x4027b1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x4027cb
add esi, 2
cmp word [esi], 0
jne 0x4027b9
add esi, 2
cmp word [esi], 0
jne 0x4027b9
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x40282c
push ebp
call fcn.00402de0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40282c
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40281b
push ebx
call fcn.00403420
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x406850], 2
jne 0x4028c1
test ebx, ebx
jne 0x402860
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x402860
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x402875
inc ebp
cmp byte [ebp], 0
jne 0x402867
inc ebp
cmp byte [ebp], 0
jne 0x402867
sub ebp, ebx
inc ebp
push ebp
call fcn.00402de0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40289a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret