joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov eax, ecx
push ebx
and ecx, 0xf
push ebp
shr eax, 4
mov dword [esp + 0x14], ecx
mov cx, word [0x43a2ac]
push esi
inc eax
xor ebp, ebp
test cx, cx
push edi
ja 0x402811
xor ecx, ecx
mov cx, 1
mov word [0x43a2ac], cx
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceExA]
movzx esi, ax
push ecx
push esi
push 6
push edi
call ebx
test eax, eax
jne 0x402847
push 0x809
push esi
push 6
push edi
call ebx
test eax, eax
jne 0x402847
push 0x1009
push esi
push 6
push edi
call ebx
test eax, eax
je 0x4028c4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4028c4
mov ecx, 1
mov edx, eax
mov dword [esp + 0x10], ecx
xor eax, eax
mov si, word [edx]
add edx, 2
test si, si
je 0x402877
cmp eax, dword [esp + 0x1c]
je 0x402886
movsx esi, si
lea edx, [edx + esi*2]
inc eax
cmp eax, 0x10
jl 0x402860
pop edi
pop esi
pop ebp
mov ax, cx
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ecx, ebx
mov ebp, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
push 0
push 0
mov ecx, ebp
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
push eax
movsx ecx, si
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ax, word [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
mov ax, bp
pop ebp
pop ebx
pop ecx
ret
Function at 0x4038b0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x429afb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x508
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.00407c20
xor eax, eax
mov al, byte [esi + 0x2710]
lea ecx, [esp + 0xc]
mov dword [esp + 0x51c], 0
push eax
call fcn.004072d0
lea ebp, [esi + 0x1800]
mov edi, 0x42bdd2
mov esi, ebp
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4039ae
push ebp
lea eax, [esp + 0x118]
push str._s.
push eax
call fcn.0040d398
add esp, 0xc
push 0
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x14]
call fcn.00407940
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403940
sub eax, edx
lea esi, [eax - 2]
test esi, esi
jle 0x403980
cmp byte [esi + ebp], 0x5c
je 0x40395d
dec esi
test esi, esi
jg 0x403950
jmp 0x403980
test esi, esi
jle 0x403980
push esi
lea edx, [esp + 0x14]
push ebp
push edx
call fcn.0040ea40
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov byte [esp + esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0xc]
mov dword [esp + 0x51c], 0xffffffff
call fcn.004029f0
pop edi
pop esi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x508]
mov dword fs:[0], ecx
add esp, 0x514
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x51c], 0xffffffff
call fcn.004029f0
mov ecx, dword [esp + 0x514]
pop edi
pop esi
xor al, al
pop ebp
mov dword fs:[0], ecx
add esp, 0x514
ret

Function at 0x4039e0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x429b26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00406d60
lea ecx, [esp + 4]
mov dword [esp + 0x61c], 0
call fcn.00406350
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x620], 1
call fcn.00406870
add esi, 0x1c00
push esi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x21c]
push str._s_s.lnk
push edx
call fcn.0040d398
add esp, 0x10
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0xc]
call fcn.00406360
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
mov byte [esp + 0x61c], 0
call fcn.004029f0
lea ecx, [esp + 8]
mov dword [esp + 0x61c], 0xffffffff
call fcn.004029f0
mov ecx, dword [esp + 0x614]
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x61c
ret
Function at 0x404f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404f29
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x404f3d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404f5e
cmp esi, eax
jae 0x404f37
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404f50
cmp esi, eax
jae 0x404f37
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x406000
Capabilities:
Identify system language via api

Disassembly:
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00406d60
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
call fcn.00402200
add esp, 4
cmp eax, 1
jge 0x406033
mov al, byte [0x43e8bc]
neg al
sbb eax, eax
and eax, 0xffffffee
add eax, 0x13
mov byte [eax + esi + 0x3674], 1
push eax
mov ecx, esi
mov dword [esi + 0x2bfc], eax
call fcn.00405020
lea ecx, [esp + 4]
call fcn.004029f0
pop esi
pop ecx
ret

Function at 0x406001
Capabilities:
Identify system language via api

Disassembly:
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00406d60
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
call fcn.00402200
add esp, 4
cmp eax, 1
jge 0x406033
mov al, byte [0x43e8bc]
neg al
sbb eax, eax
and eax, 0xffffffee
add eax, 0x13
mov byte [eax + esi + 0x3674], 1
push eax
mov ecx, esi
mov dword [esi + 0x2bfc], eax
call fcn.00405020
lea ecx, [esp + 4]
call fcn.004029f0
pop esi
pop ecx
ret

Function at 0x406670
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push 1
push eax
push ecx
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x4067e0
ja 0x4067ca
movzx edx, byte [eax + 0x406820]
jmp dword [edx*4 + 0x4067e8]
push 0
push esi
push 0x42c548
push 0
call dword [0x43a2bc]
xor al, al
pop esi
ret 0xc
mov al, 1
pop esi
ret 0xc
Function at 0x4068b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x42c548]
mov ecx, dword [0x42c54c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov dword [0x43e18c], ecx
mov dword [0x43e188], eax
xor eax, eax
lea edx, [esp + 8]
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0xc], 0x9c
call esi
test eax, eax
jne 0x406911
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call esi
test eax, eax
je 0x406ae5
mov eax, dword [esp + 0x18]
sub eax, 0
mov byte [0x43eacc], 0
je 0x406aad
dec eax
je 0x4069f0
dec eax
jne 0x406ae5
mov eax, dword [esp + 0xc]
cmp eax, 4
mov ecx, 1
mov byte [0x43eacc], cl
ja 0x406979
mov edx, dword [str.Windows_NT]
mov dword [0x43e188], edx
mov edx, dword [0x42c8d8]
mov dword [0x43e18c], edx
mov dx, word [0x42c8dc]
mov word [0x43e190], dx
mov dl, byte [0x42c8de]
mov byte [0x43e192], dl
cmp eax, 5
jb 0x406ae5
cmp dword [esp + 0x10], ecx
jb 0x4069bc
mov eax, dword [str.Windows_XP]
mov ecx, dword [0x42c8cc]
mov dx, word [0x42c8d0]
mov dword [0x43e188], eax
mov al, byte [0x42c8d2]
mov dword [0x43e18c], ecx
mov word [0x43e190], dx
mov byte [0x43e192], al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [str.Windows_2000]
mov edx, dword [0x42c8bc]
mov eax, dword [0x42c8c0]
mov dword [0x43e188], ecx
mov cl, byte [0x42c8c4]
mov dword [0x43e18c], edx
mov dword [0x43e190], eax
mov byte [0x43e194], cl
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
cmp eax, 4
mov ecx, dword [esp + 0x10]
jb 0x406a43
cmp ecx, 0x5a
jb 0x406a38
mov edx, dword [str.Windows_ME]
mov eax, dword [0x42c8b0]
mov cx, word [0x42c8b4]
mov dword [0x43e188], edx
mov dl, byte [0x42c8b6]
mov dword [0x43e18c], eax
mov word [0x43e190], cx
mov byte [0x43e192], dl
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 4
ja 0x406a77
jne 0x406a43
test ecx, ecx
ja 0x406a77
mov eax, dword [str.Windows_95]
mov ecx, dword [0x42c4dc]
mov dx, word [0x42c4e0]
mov dword [0x43e188], eax
mov al, byte [0x42c4e2]
mov dword [0x43e18c], ecx
mov word [0x43e190], dx
mov byte [0x43e192], al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [str.Windows_98]
mov edx, dword [0x42c8a4]
mov ax, word [0x42c8a8]
mov dword [0x43e188], ecx
mov cl, byte [0x42c8aa]
mov dword [0x43e18c], edx
mov word [0x43e190], ax
mov byte [0x43e192], cl
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [str.Microsoft_Win32s]
mov eax, dword [0x42c890]
mov ecx, dword [0x42c894]
mov dword [0x43e188], edx
mov edx, dword [0x42c898]
mov dword [0x43e18c], eax
mov al, byte [0x42c89c]
mov dword [0x43e190], ecx
mov dword [0x43e194], edx
mov byte [0x43e198], al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407700
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x84c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x85c]
lea eax, [esp + 0x318]
push eax
push esi
mov ebp, ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x407920
test byte [esp + 0x318], 0x10
jne 0x407738
mov bl, 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test bl, bl
je 0x407920
lea edx, [esp + 0x214]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407752
push edi
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0x320]
push edx
mov ecx, ebp
call fcn.00407330
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x118]
push ecx
mov ecx, ebp
call fcn.004072e0
lea edx, [esp + 0x114]
push edx
call fcn.0041bcd4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
mov edi, 0x42ca90
lea esi, [esp + 0x114]
mov ecx, 4
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4077d3
mov edi, 0x42ca8c
lea esi, [esp + 0x114]
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x407857
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x42c4d0
push ecx
call fcn.0040d398
push 0
lea edx, [esp + 0x20]
push edx
push str._u__s
push 0x43eb28
push 0x43eb28
push 0
call fcn.0040f4ca
mov al, byte [ebp]
add esp, 0x24
test al, al
je 0x407846
lea eax, [esp + 0x10]
push eax
push 0x43eb28
lea ecx, [esp + 0x464]
push str.exec:__s__u__s__s
push ecx
call fcn.0040d398
add esp, 0x10
push 0
push str.Remove
lea edx, [esp + 0x464]
push edx
push 0
call fcn.00401fe0
push 0
call fcn.0040d8bd
add esp, 4
push 0x3e8
call ebx
mov edi, 0x42ca64
lea esi, [esp + 0x114]
mov ecx, 4
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x4078f7
lea ecx, [esp + 0x214]
push ecx
lea edx, [esp + 0x10]
push 0x42c4d0
push edx
call fcn.0040d398
push 0
lea eax, [esp + 0x1c]
push eax
push str._s__UnregServer
push 0x43eb28
push 0x43eb28
push 0
call fcn.0040f4ca
mov al, byte [ebp]
add esp, 0x24
test al, al
je 0x4078e6
lea ecx, [esp + 0xc]
push ecx
push 0x43eb28
lea edx, [esp + 0x460]
push str.exec:__s__s__UnregServer__s
push edx
call fcn.0040d398
add esp, 0x10
push 0
push str.Remove
lea eax, [esp + 0x460]
push eax
push 0
call fcn.00401fe0
push 0
call fcn.0040d8bd
add esp, 4
push 0x3e8
call ebx
mov esi, dword [esp + 0x85c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407919
test al, 1
je 0x407919
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x84c
ret 4
Function at 0x408910
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
push esi
push edi
mov edi, dword [esp + 0x120]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push edi
push 0x80000002
mov esi, 0x91
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408984
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push eax
push eax
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x408979
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 0x114
ret 4

Function at 0x4089a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [ecx]
or eax, 0xffffffff
test ecx, ecx
je 0x4089c3
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
ret 0xc

Function at 0x4089d0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [ecx]
or eax, 0xffffffff
test ecx, ecx
je 0x4089f0
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x408a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [ecx]
or eax, 0xffffffff
test ecx, ecx
je 0x408a2b
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
mov eax, dword [esp + 0xc]
push edx
push 0
push 0
push eax
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
ret 8
Function at 0x408ad0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x429c8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd20
push ebx
push ebp
mov ebp, dword [esp + 0xd38]
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0x1c], ebx
mov edi, edi
lea eax, [esp + 0x24]
push eax
mov eax, dword [edi]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x40]
push edx
push ebx
push eax
mov dword [esp + 0x40], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, ebx
je 0x408b36
cmp esi, 0xea
jne 0x408be9
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x2c]
push ecx
push ebp
lea edx, [esp + 0x538]
push str._s_s
push edx
mov dword [esp + 0xd48], ebx
call fcn.0040d398
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp eax, ebx
je 0x408b6f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x53c]
push ecx
push 0x80000002
mov dword [esp + 0x28], VariantCopy
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x530]
push edx
lea ecx, [esp + 0x14]
call fcn.00408ad0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x408bb9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
mov ecx, dword [edi]
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0xd38], 0xffffffff
je 0x408be9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
cmp esi, 0x103
jne 0x408b00
mov eax, ebp
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408c00
sub eax, edx
lea esi, [eax - 1]
cmp esi, ebx
jle 0x408c1b
cmp byte [esi + ebp], 0x5c
je 0x408c3a
dec esi
cmp esi, ebx
jg 0x408c10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xd30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd2c
ret 4
push esi
lea edx, [esp + 0x134]
push ebp
push edx
mov dword [esp + 0x1c], ebx
call fcn.0040ea40
lea eax, [esi + ebp + 1]
lea edx, [esp + 0x93c]
add esp, 0xc
mov byte [esp + esi + 0x130], bl
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x408c64
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x408c81
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x13c]
push ecx
push 0x80000002
mov dword [esp + 0x28], VariantCopy
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x930]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x408ccb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x408c1f
Function at 0x40c922
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040cc10
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40c9bd
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x460fdc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40c9bd
cmp eax, 1
je 0x40c9de
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40c9bd
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40c98a
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40c9b9
xor eax, eax
inc eax
jmp 0x40c9fd
cmp edi, eax
jae 0x40c9c1
xor eax, eax
jmp 0x40c9fd
cmp eax, esi
jae 0x40c9c8
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x460fdc]
jmp 0x40c9e1
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d295
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4301f0
call fcn.00410638
push 8
call fcn.00410ddd
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x46101c], esi
jne 0x40d2c9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x461018], esi
mov al, byte [ebp + 0x10]
mov byte [0x461014], al
cmp dword [ebp + 0xc], edi
jne 0x40d313
cmp dword [0x46290c], edi
je 0x40d303
mov eax, dword [0x462908]
sub eax, 4
mov dword [0x462908], eax
cmp eax, dword [0x46290c]
jb 0x40d303
mov eax, dword [eax]
cmp eax, edi
je 0x40d2e4
call eax
jmp 0x40d2e4
push 0x43709c
mov eax, 0x437094
call fcn.0040d213
pop ecx
push 0x4370a8
mov eax, 0x4370a0
call fcn.0040d213
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x40d344
cmp dword [ebp + 0x10], edi
jne 0x40d352
mov dword [0x46101c], esi
push dword [ebp + 8]
call fcn.0040d1d1
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x40d351
push 8
call fcn.00410d28
pop ecx
ret
call fcn.00410673
ret
Function at 0x40d54f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x430200
call fcn.00410638
mov edi, 0x94
mov eax, edi
call fcn.0040cc10
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x460fdc], ecx
mov eax, dword [esi + 4]
mov dword [0x460fe8], eax
mov edx, dword [esi + 8]
mov dword [0x460fec], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x460fe0], esi
cmp ecx, 2
je 0x40d5af
or esi, 0x8000
mov dword [0x460fe0], esi
shl eax, 8
add eax, edx
mov dword [0x460fe4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40d5ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d5ea
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40d602
cmp eax, 0x20b
je 0x40d5ef
mov dword [ebp - 0x1c], esi
jmp 0x40d616
cmp dword [ecx + 0x84], 0xe
jbe 0x40d5ea
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40d610
cmp dword [ecx + 0x74], 0xe
jbe 0x40d5ea
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00410e28
pop ecx
test eax, eax
jne 0x40d62a
push 0x1c
call fcn.0040d52b
pop ecx
call fcn.00412858
test eax, eax
jne 0x40d63b
push 0x10
call fcn.0040d52b
pop ecx
call fcn.004129fc
mov dword [ebp - 4], esi
call fcn.00413c04
test eax, eax
jge 0x40d654
push 0x1b
call fcn.0040d506
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x462900], eax
call fcn.00413ae2
mov dword [0x461020], eax
call fcn.00413a40
test eax, eax
jge 0x40d67a
push 8
call fcn.0040d506
pop ecx
call fcn.0041380d
test eax, eax
jge 0x40d68b
push 9
call fcn.0040d506
pop ecx
push 1
call fcn.0040d22b
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40d6a1
push eax
call fcn.0040d506
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004137b0
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40d6c2
movzx eax, word [ebp - 0x40]
jmp 0x40d6c5
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041bc9e
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40d6e3
push edi
call fcn.0040d358
call fcn.0040d37a
jmp 0x40d715
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00410673
ret
Function at 0x40f253
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x40f26f
call fcn.0040f7fe
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x40f2e1
push esi
push 0x8c
push 1
call fcn.0040f8da
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40f2c7
push esi
call fcn.0041265e
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x40f1c1
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x40f2bf
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40f2de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0040c8b1
test ebx, ebx
pop ecx
je 0x40f2d9
push ebx
call fcn.0040f810
pop ecx
or eax, 0xffffffff
jmp 0x40f2e0
mov eax, edi
pop esi
pop edi
pop ebx
ret