joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404960
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x409610], edx
push ebx
push esi
push edi
push ebp
jbe 0x404b67
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x409510
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x404b67
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x4049c9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x4049da
push 2
push 0
push edx
call fcn.004052b0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x404a76
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x404aaf
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x404a3d
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x404a2b
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x404a12
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404aa5
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x4049fd
jmp 0x404aaf
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404aa5
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x404aaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x404b56
cmp dword [esp + 0x10], 0
je 0x404b08
cmp dword [esp + 0x10], 5
jne 0x404aeb
mov dword [0x4071a0], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x4071a4], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00404630
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x404b32
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x404b32
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4071a0], 0x1c
mov dword [0x4071a4], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4071a0], 9
mov dword [0x4071a4], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x4053c0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.00405820
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0x409610], esi
jbe 0x40550d
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0x409510]
test byte [edx + ecx*8 + 4], 1
je 0x40550d
push 1
push ebx
push esi
call fcn.004052b0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x4054fd
push 2
push ebx
push esi
call fcn.004052b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4054fd
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x4054a3
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.004057a0
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x405466
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00404960
add esp, 0xc
cmp eax, 0xffffffff
je 0x405482
sub ebp, eax
test ebp, ebp
jg 0x40545b
jmp 0x405497
cmp dword [0x4071a4], 5
jne 0x405495
mov dword [0x4071a0], 0xd
mov ebx, eax
push edi
push esi
call fcn.004057a0
add esp, 8
jmp 0x4054e0
jge 0x4054e0
push 0
push ecx
push esi
call fcn.004052b0
add esp, 0xc
push esi
call fcn.004048a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x4054e0
mov dword [0x4071a0], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4071a4], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.004052b0
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4071a0], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x401510
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40
push 0x3000
push edi
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x40158d
push eax
pop esi
mov eax, dword [esp + 0x14]
mov dword [esp], 0
push esp
pop ecx
push ecx
push edi
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edi, edi
or eax, eax
je 0x40158f
mov ebx, dword [esp + 0x1c]
push 0
push 0
push esi
push 0x401500
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebx], eax
test eax, eax
je 0x40158f
cmp dword [esp + 0x20], 0
je 0x401589
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, esi
jmp 0x40158f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x4018b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402600
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402600
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401910
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x17f0050]
or esi, esi
jle 0x401a30
mov eax, dword [0x17f0054]
sub ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401944
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4019c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401930
mov dword [esp], ebx
call fcn.004022a0
push eax
pop edi
test eax, eax
je 0x401a57
mov eax, dword [0x17f0054]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004023b0
mov edx, dword [0x17f0054]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
or eax, eax
je 0x401a37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019c0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4019d0
add dword [0x17f0050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
nop
nop
push 0x40
pop edx
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x17f0054]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004018b0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40194e
mov eax, dword [0x17f0054]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004018b0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004018b0
lea esi, [esi]
nop

Function at 0x401f10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x17f006c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x17f0064]
sub esp, 4
or ebx, ebx
je 0x401f65
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
or eax, eax
jne 0x401f5e
or esi, esi
je 0x401f5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f40
mov dword [esp], 0x17f006c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x438c9c
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
and ebx, ebx
add ebx, edx
call fcn.00438ccf
mov edx, 0xdc8f4be5
add ebx, ebx
or ebx, edx
xor dword [esi], edi
push edx
pop edx
inc esi
mov edx, edx
dec edx
and ebx, edx
cmp esi, eax
jne fcn.00438c9c
mov ebx, ebx
or ebx, ebx
or edx, edx
ret
Function at 0x2dd27
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
call fcn.0002e759
nop
aam 0xea
fcmovnbe st(0), st(5)
push eax
test dword [edi + edi*8 - 0x48], edx
push 0x7e
movsb byte es:[edi], byte [esi]
enter 0xffffffffffffe77c, 0x5d
int3
call fcn.0002f4f0
bt cx, cx
push ebp
btr eax, eax
daa
ror bp, cl
mov ebp, esp
inc al
sub esp, 0x18
das
push esi
jmp 0x2f235
test bl, 0xb5
mov ecx, dword [esi + 0x7c]
cmp ch, dl
add ecx, edx
cmp dl, 0x99
test cl, 0x1e
mov dword [ebp - 0x10], ecx
rol cl, cl
xor cl, al
cmc
adc cl, cl
mov ecx, dword [ebp + 0xc]
stc
jmp 0x2e255
je fcn.00030013
rcl ch, 1
btc ecx, 0x16
add edx, eax
neg cx
jmp 0x2dfdc
pushfd
cmp ecx, 0xffff
mov word [esp], di
mov byte [esp], ah
mov byte [esp], ch
lea esp, [esp + 4]
jbe 0x314b5
jmp 0x2f9a3
clc
neg al
aam 0xe7
push edi
dec al
neg ah
push ebx
aad 0x40
push edx
movzx ax, al
cwde
not eax
daa
mov eax, dword [ebp + 8]
pushal
test eax, eax
mov byte [esp + 8], 1
lea esp, [esp + 0x20]
je fcn.00030013
btr si, 2
shrd si, sp, cl
push eax
mov esi, dword [eax + 0x3c]
push 0x7b26573e
sar dl, 6
add esi, eax
and dx, cx
mov edx, dword [esi + 0x78]
clc
stc
mov word [esp], 0xa2ad
test edx, edx
lea esp, [esp + 8]
jnp 0x2dd22
jmp 0x2e1e4
stc
sal di, 4
mov edi, dword [edx + 0x24]
test dl, 0x33
adc bx, si
add edi, eax
bswap cx
mov ebx, dword [edx + 0x20]
btr ecx, 0xa
clc
ror cx, cl
add ebx, eax
dec cl
bts cx, bp
mov dword [ebp - 8], 0
btr cx, 1
mov ecx, dword [edx + 0x18]
call fcn.000314aa
and dword [edx + 0x270b0166], 0xffffff8f
sub eax, 0x87b2b279
fcom dword [edi + 1]
sbb byte [esi - 0x33eb62ad], ah
mov ebx, 0x9b5cc8d5
jne 0x2fa45
mov bl, 0x2d
pop eax
pushal
out dx, eax
dec ecx
sub al, 0x54
pop ss
or al, 0x9a
mov edi, 0xd4f4cf4f
lodsb al, byte [esi]
jmp 0x2fa2c
imul dword [edx + 0x2f]
and esi, dword [eax + 0x28bbd0b3]
push edi
cmp al, byte [ecx + edx - 0x21464553]
in eax, dx
fisubr dword [edx]
mov al, 0x3b
fldenv [esp + ebp*4 - 0x6b78abc]
inc esp
jne 0x2fa90
stc
mov bl, 0x96
and eax, dword [eax]
int1
insd dword es:[edi], dx
mov ebx, 0xd8bb0c6a
sti
invalid
imul esp, ebp, 0xffffffff
dec dword [ebp + 0xf042464]
test byte [ecx + 0x12], dl
add byte [eax], al
jmp 0x30942
push 0xe967b80a
mov edi, dword [ebp + 8]
pushal
lea esi, [0x2b899]
pushfd
call fcn.0002d63b
or di, ax
push edi
add di, 0x43
shld edi, edx, cl
mov edi, dword [edx + 0x1c]
cmc
bt esi, 0x14
cmc
add edi, eax
bt dx, cx
cmc
cmp si, dx
mov edi, dword [edi + ecx*4]
stc
pushal
cmp cl, ch
bt sp, bp
test edi, edi
mov dword [esp + 4], 0x37fd5e2f
lea esp, [esp + 0x24]
je fcn.00030013
cmc
pushal
push dword [esp]
stc
add eax, edi
clc
jmp 0x2c06e
bt di, 0xc
sub ecx, dword [edx + 0x10]
push eax
cmp ecx, dword [edx + 0x14]
mov byte [esp], bh
pushfd
lea esp, [esp + 8]
jae fcn.00030013
push 0x5501b92f
mov dword [esp], 0x1dbf4348
lea esp, [esp + 4]
jmp 0x30a02
Function at 0x4011c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4011ed
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40120e
cmp esi, eax
jae 0x4011e7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401200
cmp esi, eax
jae 0x4011e7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4012a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4020b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4020d6
call fcn.00402090
ret 0xc
xor eax, eax
ret 0xc

Function at 0x402180
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x4021a5
call fcn.00402090
test eax, eax
jl 0x4021b4
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
add esp, 8
ret 4
Function at 0x4021e0
Capabilities:
Accept command line arguments
Create process on windows
Hide graphical window

Disassembly:
sub esp, 0x54
push ebx
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40ec90]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push ecx
xor bl, bl
mov dword [esp + 0x1c], 0x44
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40222c
mov edx, dword [0x40ec90]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [esp + 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40226a
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
mov bl, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40227c
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402287
push eax
call esi
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x4022a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
mov al, bl
pop ebx
add esp, 0x54
ret
Function at 0x4025e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40a630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, dword [0x40e0d0]
push ebx
push ebp
push esi
mov dword [esp + 0x48], eax
push edi
xor esi, esi
mov dword [esp + 0x58], esi
mov ebx, 3
mov dword [esp + 0x18], esi
mov ebp, dword [esp + 0x60]
push esi
push 0x80
push ebx
xor eax, eax
push esi
mov ecx, 0xb
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
push 1
push 0x80000000
push ebp
mov byte [esp + 0x74], 1
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4026e9
call fcn.00402090
test eax, eax
jne 0x40271d
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
mov edi, 0x2e
jne 0x40267f
call fcn.00402090
test eax, eax
jl 0x4026ad
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
sub eax, edi
lea edx, [esp + 0x18]
push edx
push eax
sbb ecx, 0
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4026ad
call fcn.00402090
test eax, eax
jl 0x4026fd
push 0
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4026ce
call fcn.00402090
test eax, eax
jne 0x4026f4
cmp dword [esp + 0x10], edi
jne 0x4026f4
cmp word [esp + 0x24], di
jne 0x4026f4
cmp dword [esp + 0x26], 0x45505254
jne 0x4026f4
xor ebx, ebx
jmp 0x402710
mov esi, eax
mov dword [esp + 0x18], esi
jmp 0x402658
push 0x14f
push 3
jmp 0x402708
mov ebx, 1
push 0x156
push ebx
call fcn.00402510
add esp, 8
test esi, esi
je 0x402730
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402730
mov ebx, 1
push 0x161
push ebx
call fcn.00402510
add esp, 8
lea eax, [ebp - 0x10]
mov dword [esp + 0x58], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402752
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x40]
mov eax, ebx
pop ebx
call fcn.0040360e
add esp, 0x4c
ret
Function at 0x402de0
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x1c
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 0x24]
push str.MAINICON
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0x10
push 0x10
push 1
push str.MAINICON
push esi
mov dword [0x40ec88], eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x40ec84], eax
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.00402d90
add esp, 8
test eax, eax
jne 0x402e31
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
call esi
test eax, eax
je 0x402e93
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsDialogMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ecx]
mov eax, dword [0x40ec90]
lea edx, [esp + 0x10]
push edx
push eax
call ebp
test eax, eax
jne 0x402e7f
lea ecx, [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x402e60
pop edi
pop ebp
pop ebx
mov ecx, dword [0x40ec88]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x1c
ret 0x10

Function at 0x4032bd
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004035a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x403358
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40ed00]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x403358
cmp eax, 1
je 0x403379
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x403358
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x403325
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x403354
xor eax, eax
inc eax
jmp 0x403398
cmp edi, eax
jae 0x40335c
xor eax, eax
jmp 0x403398
cmp eax, esi
jae 0x403363
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40ed00]
jmp 0x40337c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40401a
Capabilities:
Terminate process

Disassembly:
push 8
push 0x40b500
call fcn.004043a0
push 8
call fcn.004046ec
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x40ed40], esi
jne 0x40404e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x40ed3c], esi
mov al, byte [ebp + 0x10]
mov byte [0x40ed38], al
cmp dword [ebp + 0xc], edi
jne 0x404098
cmp dword [0x410550], edi
je 0x404088
mov eax, dword [0x41054c]
sub eax, 4
mov dword [0x41054c], eax
cmp eax, dword [0x410550]
jb 0x404088
mov eax, dword [eax]
cmp eax, edi
je 0x404069
call eax
jmp 0x404069
push 0x40e038
mov eax, 0x40e030
call fcn.00403f98
pop ecx
push 0x40e044
mov eax, 0x40e03c
call fcn.00403f98
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.004040c9
cmp dword [ebp + 0x10], edi
jne 0x4040d7
mov dword [0x40ed40], esi
push dword [ebp + 8]
call fcn.00403f56
xor edi, edi
xor esi, esi
inc esi
call fcn.004043db
ret
Function at 0x404166
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40b510
call fcn.004043a0
mov edi, 0x94
mov eax, edi
call fcn.004035a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40ed00], ecx
mov eax, dword [esi + 4]
mov dword [0x40ed0c], eax
mov edx, dword [esi + 8]
mov dword [0x40ed10], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40ed04], esi
cmp ecx, 2
je 0x4041c6
or esi, 0x8000
mov dword [0x40ed04], esi
shl eax, 8
add eax, edx
mov dword [0x40ed08], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x404201
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404201
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x404219
cmp eax, 0x20b
je 0x404206
mov dword [ebp - 0x1c], esi
jmp 0x40422d
cmp dword [ecx + 0x84], 0xe
jbe 0x404201
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x404227
cmp dword [ecx + 0x74], 0xe
jbe 0x404201
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00404737
pop ecx
test eax, eax
jne 0x404241
push 0x1c
call fcn.00404142
pop ecx
call fcn.0040621e
test eax, eax
jne 0x404252
push 0x10
call fcn.00404142
pop ecx
call fcn.00406dd3
mov dword [ebp - 4], esi
call fcn.004075c3
test eax, eax
jge 0x40426b
push 0x1b
call fcn.0040411d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x410544], eax
call fcn.004074a1
mov dword [0x40ed44], eax
call fcn.004073ff
test eax, eax
jge 0x404291
push 8
call fcn.0040411d
pop ecx
call fcn.004071cc
test eax, eax
jge 0x4042a2
push 9
call fcn.0040411d
pop ecx
push 1
call fcn.00403fb0
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4042b8
push eax
call fcn.0040411d
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040716f
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4042d9
movzx eax, word [ebp - 0x40]
jmp 0x4042dc
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00402de0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4042fa
push edi
call fcn.004040dd
call fcn.004040ff
jmp 0x40432c
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004043db
ret