joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413630
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov ebx, ecx
pop edi
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jle 0x413683
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x413666
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + edi*8 + 4], eax
je 0x413666
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
je 0x41367d
and dword [ebp - 4], 0
jmp 0x41367d
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x413676
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xc]
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jl 0x413647
cmp dword [ebp - 4], 0
je 0x4136b1
push esi
lea ecx, [ebx + 0x14]
call fcn.00413312
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x4136a7
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5ac000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x14], ecx
push edi
mov dword [esp + 0x1c], ebx
mov edi, ecx
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0xc], al
inc eax
cmp eax, 8
jb 0x5ac020
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
xor eax, ecx
rol ecx, 3
mov dword [esp + 0x20], eax
mov eax, dword [edx + 4]
xor eax, ecx
rol ecx, 3
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
xor eax, ecx
rol ecx, 3
xor ecx, dword [edx + 0xc]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov dword [esp + 0x28], eax
xor edx, edx
nop
mov eax, ecx
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
add eax, ecx
sub ecx, 0x61c88647
mov dword [esp + edx*4 + 0x30], eax
mov eax, ecx
sar eax, 0xb
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
add eax, ecx
mov dword [esp + edx*4 + 0xb0], eax
inc edx
cmp edx, 0x20
jl 0x5ac060
cmp edi, ebx
jae 0x5ac1f2
lea esi, [esp + 0x30]
nop dword [eax]
mov ebx, dword [esp + 0xc]
xor edi, edi
mov eax, dword [esp + 0x10]
nop word [eax + eax]
mov edx, eax
mov ecx, eax
shr edx, 5
shl ecx, 4
xor edx, ecx
add edx, eax
xor edx, dword [esi + edi*4]
lea esi, [edx + ebx]
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
xor ecx, edx
add ecx, esi
xor ecx, dword [esp + edi*4 + 0xb0]
add ecx, eax
mov edx, ecx
mov eax, ecx
shl eax, 4
shr edx, 5
xor edx, eax
lea eax, [esp + 0x34]
add edx, ecx
xor edx, dword [eax + edi*4]
add edx, esi
mov esi, edx
mov eax, edx
shl eax, 4
shr esi, 5
xor esi, eax
lea eax, [esp + 0xb4]
add esi, edx
xor esi, dword [eax + edi*4]
add esi, ecx
mov ecx, esi
mov eax, esi
shl eax, 4
shr ecx, 5
xor ecx, eax
lea eax, [esp + 0x38]
add ecx, esi
xor ecx, dword [eax + edi*4]
add ecx, edx
mov edx, ecx
mov dword [esp + 0x14], ecx
mov eax, ecx
shr edx, 5
shl eax, 4
xor edx, eax
lea eax, [esp + 0xb8]
add edx, ecx
xor edx, dword [eax + edi*4]
add edx, esi
lea esi, [esp + 0x30]
mov ebx, edx
mov dword [esp + 0x14], edx
shr ebx, 5
mov eax, edx
shl eax, 4
xor ebx, eax
lea eax, [esp + 0x3c]
add ebx, edx
xor ebx, dword [eax + edi*4]
add ebx, ecx
mov eax, ebx
mov ecx, ebx
shr eax, 5
shl ecx, 4
xor eax, ecx
lea ecx, [esp + 0xbc]
add eax, ebx
xor eax, dword [ecx + edi*4]
add edi, 4
add eax, edx
cmp edi, 0x20
jl 0x5ac0b0
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x14]
mov bl, byte [edi]
mov byte [esp + 0xc], ch
mov dl, bl
xor dl, cl
mov dword [esp + 0x10], eax
movzx ecx, byte [esp + 0xe]
cmp byte [ebp + 0x10], 0
mov byte [esp + 0xd], cl
movzx ecx, byte [esp + 0xf]
mov byte [esp + 0xf], al
mov byte [esp + 0x10], ah
movzx eax, byte [esp + 0x12]
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x13]
mov byte [esp + 0xe], cl
mov byte [esp + 0x12], al
movzx ecx, dl
movzx eax, bl
cmovne ecx, eax
mov byte [edi], dl
inc edi
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], edi
cmp edi, dword [esp + 0x1c]
jb 0x5ac0a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ac390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx + 0x3c]
push ebx
push esi
push edi
mov ebx, dword [eax + ecx + 0x78]
xor esi, esi
mov eax, dword [ebx + ecx + 0x24]
add ebx, ecx
mov dword [ebp - 8], edx
add eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x20]
add edx, ecx
add edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edi
cmp dword [ebx + 0x18], esi
jbe 0x5ac425
nop dword [eax + eax]
movzx eax, word [eax + esi*2]
cmp eax, dword [ebx + 0x14]
jae 0x5ac41c
mov edi, dword [edi + esi*4]
mov eax, dword [edx + eax*4]
add edi, ecx
add eax, ecx
mov dword [ebp - 4], eax
xor eax, eax
mov cl, byte [edi]
test cl, cl
je 0x5ac401
mov edx, edi
rol eax, 3
lea edx, [edx + 1]
movsx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x5ac3f0
push dword [ebp + 8]
push dword [ebp - 4]
push eax
push edi
call dword [ebp - 8]
add esp, 0x10
test al, al
jne 0x5ac425
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x5ac3d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ad100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
xor eax, 0xadc3d15d
mov dword [ebp - 0x1c], 0xaa7575b3
mov dword [ebp - 0x18], 0xf0a59521
mov dword [ebp - 0x14], 0x315b1289
mov dword [ebp - 0x10], 0x5985ddca
push esi
push edi
cmp eax, 0xadc3d15c
jne 0x5ad31f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0xc0]
mov ecx, eax
xor ecx, 0xd81e41ff
lea esi, [eax + edx]
xor eax, eax
cmp ecx, 0xd81e41ff
cmove esi, eax
mov eax, esi
xor eax, 0xa313930
cmp eax, 0xa313930
je 0x5ad31f
mov ebx, dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push 0
push 0xf67b7b8d
push eax
lea edx, [esi + 0x340]
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 0xd8]
call section..gcode
mov eax, dword [ebx + 4]
add esp, 0xc
xor eax, 0x2acabb4b
cmp eax, 0x2acabb4b
je 0x5ad31f
mov eax, dword fs:[0x18]
xor edx, edx
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 8]
mov eax, dword fs:[0x18]
lea edi, [ebx + 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ecx + ebx + 0x14]
add eax, ecx
add edi, eax
movzx eax, word [ecx + ebx + 6]
xor ecx, ecx
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], eax
cmp cx, ax
jae 0x5ad31f
nop dword [eax]
movzx eax, dx
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0xc]
lea edi, [edi + eax*8]
lea eax, [ecx + ebx]
cmp eax, entry1
ja 0x5ad215
mov eax, dword [edi + 0x10]
add eax, ecx
add eax, ebx
cmp eax, entry1
ja 0x5ad225
inc edx
cmp dx, word [ebp + 0xc]
jae 0x5ad31f
mov edi, dword [ebp - 8]
jmp 0x5ad1f0
mov eax, edi
xor eax, 0xaef6509f
cmp eax, 0xaef6509f
je 0x5ad31f
mov eax, dword fs:[0x18]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
add edi, ecx
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
add edi, edx
lea eax, [ecx + edx]
cmp eax, edi
jae 0x5ad31f
mov ebx, dword [esi + 0x318]
nop
mov edx, dword [eax + 4]
mov ecx, ebx
xor ecx, dword [eax]
xor edx, dword [esi + 0x31c]
xor ecx, 0x45ecc763
xor edx, 0
cmp ecx, 0x45ecc763
jne 0x5ad2f7
test edx, edx
jne 0x5ad2f7
mov ecx, dword [esi + 0x320]
xor ecx, dword [eax + 8]
mov edx, dword [esi + 0x324]
xor ecx, 0xc3464624
xor edx, dword [eax + 0xc]
xor edx, 0
cmp ecx, 0xc3464624
jne 0x5ad2f7
test edx, edx
jne 0x5ad2f7
mov ecx, dword [esi + 0x328]
xor ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x32c]
xor ecx, 0x5ce40551
xor edx, dword [eax + 0x14]
xor edx, 0
cmp ecx, 0x5ce40551
jne 0x5ad2f7
test edx, edx
jne 0x5ad2f7
mov ecx, dword [esi + 0x330]
xor ecx, dword [eax + 0x18]
mov edx, dword [esi + 0x334]
xor ecx, 0x15070819
xor edx, dword [eax + 0x1c]
xor edx, 0
cmp ecx, 0x15070819
jne 0x5ad2f7
test edx, edx
je 0x5ad309
inc eax
cmp eax, edi
jb 0x5ad260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
xor ecx, 0x1fa09093
cmp ecx, 0x1fa09093
je 0x5ad31f
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409e11
Capabilities:
Write file on windows

Disassembly:
dec eax
mov eax, esp
push ebp
push edi
inc ecx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 0x70
dec eax
mov dword [ebp - 0x38], 0xfffffffe
dec eax
mov dword [eax + 0x10], ebx
dec eax
mov dword [eax + 0x18], esi
dec eax
mov eax, dword [0x26aff]
dec eax
xor eax, esp
dec eax
mov dword [ebp - 8], eax
dec eax
mov ebx, ecx
dec eax
cmp dword [ecx + 0x80], 0
add byte [eax], al
je 0x409f8b
cmp byte [ecx + 0x8a], 0
je 0x409f8b
dec eax
mov eax, dword [ecx]
mov edi, 0xffff
mov edx, edi
call dword [eax + 0x18]
cmp di, ax
jne 0x409e3f
dec eax
Function at 0x40a065
Capabilities:
Write file on windows

Disassembly:
movzx eax, si
jmp 0x40a23b
mov dword [eax], ecx
dec eax
sub ecx, ecx
dec eax
sar ecx, 1
dec eax
mov eax, dword [ebx + 0x58]
inc ebx
pop eax
mov dword [eax], ecx
dec esp
cmp dword [ebx + 0x80], esp
jne 0x40a09c
dec eax
mov edx, dword [ebx + 0x98]
movzx ecx, si
call fcn.0040fb18
cmp ax, di
je 0x40a238
movzx edi, si
jmp 0x40a238
mov word [ebp - 0x19], si
dec eax
mov dword [ebp + 0x1f], 0xf
dec esp
mov dword [ebp + 0x17], esp
inc esp
mov byte [ebp + 7], ah
inc ecx
mov ebp, 8
inc ecx
cmp ch, 0xfe
jbe 0x40a0c9
dec eax
lea ecx, [0x1e1d5]
call fcn.00407e04
int3
dec ebp
mov eax, ebp
xor edx, edx
dec eax
lea ecx, [ebp + 7]
call fcn.0040f550
dec esp
mov dword [ebp + 0x17], ebp
dec eax
lea eax, [ebp + 7]
dec eax
cmp dword [ebp + 0x1f], 0x10
dec eax
cmovae eax, dword [ebp + 7]
inc esp
mov byte [eax + 8], ah
dec esp
mov ecx, dword [ebp + 7]
dec esp
mov edx, dword [ebp + 0x1f]
dec eax
lea edx, [ebp + 7]
dec ecx
cmp edx, 0x10
dec ecx
cmovae edx, ecx
dec esp
lea eax, [ebp + 7]
dec ebp
cmovae eax, ecx
dec eax
mov ecx, dword [ebx + 0x80]
dec esp
mov edx, dword [ecx]
dec eax
add edx, dword [ebp + 0x17]
dec eax
lea eax, [ebp - 9]
dec eax
mov dword [esp + 0x38], eax
dec eax
mov dword [esp + 0x30], edx
dec esp
mov dword [esp + 0x28], eax
dec eax
lea eax, [ebp - 0x11]
dec eax
mov dword [esp + 0x20], eax
dec esp
lea ecx, [ebp - 0x17]
dec esp
lea eax, [ebp - 0x19]
dec eax
lea edx, [ebx + 0x8c]
inc ecx
call dword [edx + 0x28]
test eax, eax
js 0x40a228
cmp eax, 1
jg 0x40a1fb
dec eax
lea eax, [ebp + 7]
dec esp
mov ecx, dword [ebp + 7]
dec esp
mov edx, dword [ebp + 0x1f]
dec ecx
cmp edx, 0x10
dec ecx
cmovae eax, ecx
dec esp
mov ebp, dword [ebp - 9]
dec esp
sub ebp, eax
je 0x40a1a1
dec eax
lea ecx, [ebp + 7]
dec ecx
cmp edx, 0x10
dec ecx
cmovae ecx, ecx
dec esp
mov ecx, dword [ebx + 0x98]
dec ebp
mov eax, ebp
mov edx, 1
call fcn.00410828
dec esp
cmp ebp, eax
jne 0x40a1d7
dec esp
mov edx, dword [ebp + 0x1f]
dec esp
mov ecx, dword [ebp + 7]
mov byte [ebx + 0x8a], 1
dec eax
lea eax, [ebp - 0x19]
dec eax
cmp dword [ebp - 0x11], eax
jne 0x40a1e4
dec ebp
test ebp, ebp
jne 0x40a0f5
dec eax
cmp dword [ebp + 0x17], 0x20
jae 0x40a1d9
inc ebp
xor eax, eax
inc ecx
lea edx, [ebp + 8]
dec eax
lea ecx, [ebp + 7]
call fcn.00406370
jmp 0x40a0ed
jmp 0x40a228
dec ecx
cmp edx, 0x10
jb 0x40a238
dec ecx
mov ecx, ecx
jmp 0x40a233
dec ecx
cmp edx, 0x10
jb 0x40a030
dec ecx
mov ecx, ecx
call fcn.0040c73c
jmp 0x40a030
cmp eax, 3
jne 0x40a228
dec eax
mov edx, dword [ebx + 0x98]
movzx ecx, word [ebp - 0x19]
call fcn.0040fb18
cmp ax, di
jne 0x40a217
mov esi, edi
dec eax
cmp dword [ebp + 0x1f], 0x10
jb 0x40a030
dec eax
mov ecx, dword [ebp + 7]
jmp 0x40a1f1
dec eax
cmp dword [ebp + 0x1f], 0x10
jb 0x40a238
dec eax
mov ecx, dword [ebp + 7]
call fcn.0040c73c
movzx eax, di
dec eax
mov ecx, dword [ebp + 0x2f]
dec eax
xor ecx, esp
call fcn.0040c760
dec esp
lea ebx, [esp + 0x90]
dec ecx
mov ebx, dword [ebx + 0x40]
dec ecx
mov esi, dword [ebx + 0x48]
dec ecx
mov esp, ebx
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
pop edi
pop ebp
ret
Function at 0x40a17e
Capabilities:
Write file on windows

Disassembly:
movzx eax, si
jmp 0x40a23b
mov dword [eax], ecx
dec eax
sub ecx, ecx
dec eax
sar ecx, 1
dec eax
mov eax, dword [ebx + 0x58]
inc ebx
pop eax
mov dword [eax], ecx
dec esp
cmp dword [ebx + 0x80], esp
jne 0x40a09c
dec eax
mov edx, dword [ebx + 0x98]
movzx ecx, si
call fcn.0040fb18
cmp ax, di
je 0x40a238
movzx edi, si
jmp 0x40a238
mov word [ebp - 0x19], si
dec eax
mov dword [ebp + 0x1f], 0xf
dec esp
mov dword [ebp + 0x17], esp
inc esp
mov byte [ebp + 7], ah
inc ecx
mov ebp, 8
inc ecx
cmp ch, 0xfe
jbe 0x40a0c9
dec eax
lea ecx, [0x1e1d5]
call fcn.00407e04
int3
dec ebp
mov eax, ebp
xor edx, edx
dec eax
lea ecx, [ebp + 7]
call fcn.0040f550
dec esp
mov dword [ebp + 0x17], ebp
dec eax
lea eax, [ebp + 7]
dec eax
cmp dword [ebp + 0x1f], 0x10
dec eax
cmovae eax, dword [ebp + 7]
inc esp
mov byte [eax + 8], ah
dec esp
mov ecx, dword [ebp + 7]
dec esp
mov edx, dword [ebp + 0x1f]
dec eax
lea edx, [ebp + 7]
dec ecx
cmp edx, 0x10
dec ecx
cmovae edx, ecx
dec esp
lea eax, [ebp + 7]
dec ebp
cmovae eax, ecx
dec eax
mov ecx, dword [ebx + 0x80]
dec esp
mov edx, dword [ecx]
dec eax
add edx, dword [ebp + 0x17]
dec eax
lea eax, [ebp - 9]
dec eax
mov dword [esp + 0x38], eax
dec eax
mov dword [esp + 0x30], edx
dec esp
mov dword [esp + 0x28], eax
dec eax
lea eax, [ebp - 0x11]
dec eax
mov dword [esp + 0x20], eax
dec esp
lea ecx, [ebp - 0x17]
dec esp
lea eax, [ebp - 0x19]
dec eax
lea edx, [ebx + 0x8c]
inc ecx
call dword [edx + 0x28]
test eax, eax
js 0x40a228
cmp eax, 1
jg 0x40a1fb
dec eax
lea eax, [ebp + 7]
dec esp
mov ecx, dword [ebp + 7]
dec esp
mov edx, dword [ebp + 0x1f]
dec ecx
cmp edx, 0x10
dec ecx
cmovae eax, ecx
dec esp
mov ebp, dword [ebp - 9]
dec esp
sub ebp, eax
je 0x40a1a1
dec eax
lea ecx, [ebp + 7]
dec ecx
cmp edx, 0x10
dec ecx
cmovae ecx, ecx
dec esp
mov ecx, dword [ebx + 0x98]
dec ebp
mov eax, ebp
mov edx, 1
call fcn.00410828
dec esp
cmp ebp, eax
jne 0x40a1d7
dec esp
mov edx, dword [ebp + 0x1f]
dec esp
mov ecx, dword [ebp + 7]
mov byte [ebx + 0x8a], 1
dec eax
lea eax, [ebp - 0x19]
dec eax
cmp dword [ebp - 0x11], eax
jne 0x40a1e4
dec ebp
test ebp, ebp
jne 0x40a0f5
dec eax
cmp dword [ebp + 0x17], 0x20
jae 0x40a1d9
inc ebp
xor eax, eax
inc ecx
lea edx, [ebp + 8]
dec eax
lea ecx, [ebp + 7]
call fcn.00406370
jmp 0x40a0ed
jmp 0x40a228
dec ecx
cmp edx, 0x10
jb 0x40a238
dec ecx
mov ecx, ecx
jmp 0x40a233
dec ecx
cmp edx, 0x10
jb 0x40a030
dec ecx
mov ecx, ecx
call fcn.0040c73c
jmp 0x40a030
cmp eax, 3
jne 0x40a228
dec eax
mov edx, dword [ebx + 0x98]
movzx ecx, word [ebp - 0x19]
call fcn.0040fb18
cmp ax, di
jne 0x40a217
mov esi, edi
dec eax
cmp dword [ebp + 0x1f], 0x10
jb 0x40a030
dec eax
mov ecx, dword [ebp + 7]
jmp 0x40a1f1
dec eax
cmp dword [ebp + 0x1f], 0x10
jb 0x40a238
dec eax
mov ecx, dword [ebp + 7]
call fcn.0040c73c
movzx eax, di
dec eax
mov ecx, dword [ebp + 0x2f]
dec eax
xor ecx, esp
call fcn.0040c760
dec esp
lea ebx, [esp + 0x90]
dec ecx
mov ebx, dword [ebx + 0x40]
dec ecx
mov esi, dword [ebx + 0x48]
dec ecx
mov esp, ebx
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
pop edi
pop ebp
ret
Function at 0x40b797
Capabilities:
Write file on windows

Disassembly:
dec eax
mov eax, esp
push ebp
push edi
inc ecx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 0x70
dec eax
mov dword [ebp - 0x38], 0xfffffffe
dec eax
mov dword [eax + 0x10], ebx
dec eax
mov dword [eax + 0x18], esi
dec eax
mov eax, dword [0x2528f]
dec eax
xor eax, esp
dec eax
mov dword [ebp - 8], eax
dec eax
mov ebx, ecx
dec eax
cmp dword [ecx + 0x80], 0
je 0x40b7f7
cmp byte [ecx + 0x89], 0
je 0x40b7f7
dec eax
mov eax, dword [ecx]
or edx, 0xffffffff
call dword [eax + 0x18]
cmp eax, 0xffffffff
jne 0x40b6ab
xor al, al
jmp 0x40b7f9
dec eax
mov dword [ebp - 0x18], 0xf
dec eax
and dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
inc ecx
mov ebp, 8
inc ecx
cmp ch, 0xfe
jbe 0x40b6d5
dec eax
lea ecx, [0x1cbc9]
call fcn.00407e04
int3
dec ebp
mov eax, ebp
xor edx, edx
dec eax
lea ecx, [ebp - 0x30]
call fcn.0040f550
dec esp
mov dword [ebp - 0x20], ebp
dec eax
lea eax, [ebp - 0x30]
dec eax
cmp dword [ebp - 0x18], 0x10
dec eax
cmovae eax, dword [ebp - 0x30]
mov byte [eax + 8], 0
dec esp
mov ecx, dword [ebp - 0x30]
dec esp
mov edx, dword [ebp - 0x18]
dec eax
lea edx, [ebp - 0x30]
dec ecx
cmp edx, 0x10
dec ecx
cmovae edx, ecx
dec esp
lea eax, [ebp - 0x30]
dec ebp
cmovae eax, ecx
dec eax
mov ecx, dword [ebx + 0x80]
dec esp
mov edx, dword [ecx]
dec eax
mov eax, dword [ebp - 0x20]
dec esp
lea ecx, [edx + eax]
dec eax
lea eax, [ebp - 0x40]
dec eax
mov dword [esp + 0x20], eax
dec eax
lea edx, [ebx + 0x8c]
inc ecx
call dword [edx + 0x30]
test eax, eax
je 0x40b745
dec eax
jne 0x40b7bc
jmp 0x40b74c
mov byte [ebx + 0x89], 0
dec eax
lea eax, [ebp - 0x30]
dec esp
mov ecx, dword [ebp - 0x30]
dec esp
mov edx, dword [ebp - 0x18]
dec ecx
cmp edx, 0x10
dec ecx
cmovae eax, ecx
dec eax
mov edi, dword [ebp - 0x40]
dec eax
sub edi, eax
je 0x40b796
dec eax
lea ecx, [ebp - 0x30]
dec ecx
cmp edx, 0x10
dec ecx
cmovae ecx, ecx
dec esp
mov ecx, dword [ebx + 0x98]
dec esp
mov eax, edi
mov edx, 1
call fcn.00410828
dec eax
cmp edi, eax
jne 0x40b7d0
dec esp
mov edx, dword [ebp - 0x18]
dec esp
mov ecx, dword [ebp - 0x30]
cmp byte [ebx + 0x89], 0
je 0x40b7e9
dec eax
test edi, edi
jne 0x40b701
inc ebp
xor eax, eax
ror byte [ecx - 0x75], 0xd5
dec eax
lea ecx, [ebp - 0x30]
call fcn.00406370
jmp 0x40b6f9
sub eax, 2
je 0x40b7c3
jmp 0x40b7d0
dec eax
cmp dword [ebp - 0x18], 0x10
jb 0x40b7f7
dec eax
mov ecx, dword [ebp - 0x30]
jmp 0x40b7f2
dec eax
cmp dword [ebp - 0x18], 0x10
jb 0x40b6a4
dec eax
mov ecx, dword [ebp - 0x30]
call fcn.0040c73c
jmp 0x40b6a4
dec ecx
cmp edx, 0x10
jb 0x40b7f7
dec ecx
mov ecx, ecx
call fcn.0040c73c
mov al, 1
dec eax
mov ecx, dword [ebp - 8]
dec eax
xor ecx, esp
call fcn.0040c760
dec esp
lea ebx, [esp + 0x70]
dec ecx
mov ebx, dword [ebx + 0x28]
dec ecx
mov esi, dword [ebx + 0x30]
dec ecx
mov esp, ebx
inc ecx
pop ebp
pop edi
pop ebp
ret

Function at 0x418c00
Capabilities:
Read file on windows

Disassembly:
add byte [ebx + 0x6a021045], al
add byte [ebp + 0x6a50e845], cl
inc ebp
call 0x8d43f65e
inc ebp
clc
push eax
mov eax, dword [edi]
Function at 0x418c08
Capabilities:
Read file on windows

Disassembly:
dec eax
mov ebx, dword [esp + 0x60]
dec eax
mov esi, dword [esp + 0x68]
dec eax
mov edi, dword [esp + 0x70]
dec esp
mov esp, dword [esp + 0x78]
dec eax
add esp, 0x50
pop ebp
ret
dec esp
mov eax, edi
mov edx, 9
mov dword [esp + 0x28], eax
dec eax
mov dword [esp + 0x20], ebx
call dword [0xb567]
dec eax
mov ecx, dword [ebp - 0x20]
test eax, eax
jne 0x418b83
dec eax
arpl word [ecx + 0x10c], ax
dec eax
cmp esi, eax
jb 0x418ba3
inc esp
cmp byte [edi + 1], ah
je 0x418ba3
mov eax, dword [ecx + 0x10c]
inc esp
cmp byte [ebp - 8], ah
je 0x418ac9
dec eax
mov ecx, dword [ebp - 0x10]
and dword [ecx + 0xc8], 0xfffffffd
jmp 0x418ac9
call fcn.0040ee34
mov dword [eax], 0x2a
inc esp
cmp byte [ebp - 8], ah
je 0x418bbf
dec eax
mov eax, dword [ebp - 0x10]
and dword [eax + 0xc8], 0xfffffffd
or eax, 0xffffffff
jmp 0x418ac9
add byte [ebp + 0x9850fc0], al
invalid
inc ebp
call 0x8d43f65e
inc ebp
clc
push eax
mov eax, dword [edi]
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418c2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418c85
cmp dword [ebp - 0x18], 0
je 0x418c85
mov eax, dword [edi]
test byte [esi + eax + 4], 0x48
je 0x418c61
cmp word [ebp - 8], 0xa
je 0x418bf2
push 0xd
pop eax
mov word [ebx], ax
mov eax, dword [edi]
mov cl, byte [ebp - 8]
mov byte [esi + eax + 5], cl
mov eax, dword [edi]
mov cl, byte [ebp - 7]
mov byte [esi + eax + 0x25], cl
mov eax, dword [edi]
mov byte [esi + eax + 0x26], 0xa
jmp 0x418c8b
cmp ebx, dword [ebp - 0x10]
jne 0x418c6d
cmp word [ebp - 8], 0xa
je 0x418bf2
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00415b25
add esp, 0x10
cmp word [ebp - 8], 0xa
je 0x418c8e
push 0xd
pop eax
mov word [ebx], ax
add ebx, 2
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0x10], eax
jb 0x418bb4
jmp 0x418cb5
sub ebx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
jmp 0x418b52
Function at 0x419320
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x42a560]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
push 0x425758
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp dword [ebx + 0x14], 8
jb 0x419394
mov eax, dword [ebx]
jmp 0x419396
mov eax, ebx
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
push edi
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
push 0
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push ebx
call fcn.0040b360
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419430
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ecba
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x42a560]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x23c], eax
mov eax, 0x105
lea esi, [ebp - 0x230]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
call fcn.00403c50
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x230]
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x244]
push ecx
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
lea edi, [ebp - 0x254]
mov esi, eax
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
call fcn.00403cd0
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x254]
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x230]
push edi
push esi
push edx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0x425788
push edi
call esi
mov eax, dword [ebp - 0x240]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push 0x4257c0
push 0x104
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00409cf0
add esp, 0x18
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x21c]
push eax
push edi
mov dword [ebp - 0x220], ebx
call esi
mov esi, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x220]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
mov ecx, eax
lea edx, [ecx + 2]
mov dword [ebp - 0x238], edx
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x419585
sub ecx, dword [ebp - 0x238]
sar ecx, 1
push ecx
call fcn.00401900
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x4195b9
push edi
call fcn.004092ec
add esp, 4
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x230]
cmp eax, ebx
je 0x4195e1
push eax
call fcn.004092ec
add esp, 4
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004092f7
mov esp, ebp
pop ebp
ret