joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa

Function at 0xa453eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0xa453eb
lcall 0x5de5, 0x8b10c483
jmp loc.01d57584
Function at 0x418f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
or ebp, 0xffffffff
jmp 0x418f92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x418f99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418f88
mov eax, 1
add ebx, ebx
jne 0x418fab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x418fa0
jne 0x418fbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418fa0
xor ecx, ecx
sub eax, 3
jb 0x418fd0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419042
mov ebp, eax
add ebx, ebx
jne 0x418fdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418fe8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41900c
inc ecx
add ebx, ebx
jne 0x418ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x418fed
jne 0x419009
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418fed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41902c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41901d
jmp 0x418f8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41902c
add edi, ecx
jmp 0x418f8e
pop esi
mov edi, esi
mov ecx, 0x4e0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41904a
cmp byte [edi], 2
jne 0x41904a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41904f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4190c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a588]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a650]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41907c
mov ecx, edi
jns 0x4190ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a654]
or eax, eax
je 0x4190c1
mov dword [ebx], eax
add ebx, 4
jmp 0x419099
call dword [esi + 0x1a664]
mov ebp, dword [esi + 0x1a658]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4190fb
sub esp, 0xffffff80
jmp 0x40d4fc
Function at 0x406a69
Capabilities:
Encode data using xor

Disassembly:
pop edi
pop esi
xor ebx, dword [edx + 0x2be58b5b]
xchg dword [eax], ecx
add bh, bh
and byte [edi], dh
aaa
pop esi
add eax, 0x4e71de
pop ebx
mov esi, ebp
pop ebp
dec eax
or byte [eax], al
mov eax, dword [ebp + 8]
test eax, eax
jne 0x406997
pop edi
mov eax, 0x5dd98b5b
ret 0x1d08
push ecx
add byte [ebx + 0x708b1848], cl
and byte [edi + 0x41042c], bh
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jbe 0x40698a
pop edi
mov dword [ebx + 0x30], 0xc5
pop esi
xor eax, eax
test byte [ebx + 0x8fd5de5], cl
add byte [eax - 0x69f68a7d], bh
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
sub byte [ebx - 0x2f138214], cl
lea ebp, [ebp - 0x18a908]
adc eax, 0x40c00f
call dword [0x40c00f]
jle 0x406a68
cld
mov eax, dword [ebp - 8]
xor esi, esi
xor ecx, ecx
or edx, esi
push esi
or esp, eax
push 0xa
push edx
push ecx
call 0x1d40b590
sub eax, 0x48864000
pop esi
lcall 0x4100, 0x295e9674
in eax, 0x5d
jbe 0x4069ca
nop
nop
nop
and dl, byte [eax - 0x13f9aa70]
mov eax, dword [ebp + 0xc]
pop esi
leave
push esi
xor esi, esi
invalid
add al, 0x33
shl byte [esi - 0x75], cl
push eax
or cl, byte [ecx - 0x2dcc83af]
stc
push eax
cmp al, 0x89
jle 0x406a0b
xor edx, edx
mov bp, word [esi]
push es
push es
mov dword [ebx + 0x66d20810], eax
xor edi, ebp
add cl, byte [edx - 0x77]
push ecx
adc al, 0x33
rcl byte [ebx + ecx*4 + 0x10], cl
jne 0x406a7f
insb byte es:[edi], dx
pop es
dec dword [edx]
mov dword [ecx + 0x18], edx
xor edx, edx
imul di, word [ecx + 4], 0x2289
sbb al, 0x8b
int1
adc al, 0x66
mov esi, dword [eax + 6]
mov edx, dword [edx*4 + 0x65c240]
lea edx, [edx + esi - 1]
xor esi, esi
mov ecx, edi
imul esi, dword [ebx], 0xffffff80
mov ebx, edx
and al, 0x89
push ecx
add ebp, dword [ebp - 0x75]
xor byte [ebx + 0x325c6], cl
add byte [eax + 0x5948c179], al
dec eax
pop ecx
enter 0x40fc, 0x75
cmpsb byte [esi], byte es:[edi]
mov eax, esi
push edi
cdq
mov edi, 0x190
idiv edi
pop edi
test edx, edx
jne 0x406b01
cmpsb byte [esi], byte es:[edi]
invalid
pop esi
pop ebp
ret
Function at 0x401207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4182d8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4182dc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x9e3779b9
mov dword [ebp - 0x34], eax
call fcn.00401200
add dword [ebp - 0x10], 0x23f
cmp dword [0xaf5664], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x834]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov eax, dword [0x4182e4]
mov edi, dword [0x4182e0]
push 0x20
pop edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov eax, esi
mov dword [ebp - 0xc], 0xedeb2e40
shl eax, 4
add eax, edi
cmp dword [0xaf5664], 0xfa9
mov dword [ebp - 8], eax
mov eax, dword [0xaf5660]
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp dword [0xaf5664], 0x3eb
mov dword [0xaf5660], eax
mov eax, dword [0xaf55b8]
cmove eax, dword [ebp - 0xc]
mov dword [0xaf55b8], eax
mov eax, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x14], 0
mov dword [0xaf565c], 0xf4ea3dee
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 0x18], eax
mov eax, ebx
shl eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
add eax, ebx
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor dword [ebp - 0x14], eax
cmp dword [0xaf5664], 0xb03
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jne 0x401362
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x10], eax
dec edx
mov dword [ebp - 0x20], edx
jne 0x401277
mov edi, dword [ebp - 0x30]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c062
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f6c
mov dword [ebp - 0x14], eax
cmp dword [0x450e54], esi
jne 0x40c155
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c0e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c235
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c235
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c235
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x450e54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x450e58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x450e5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x450e64], eax
test eax, eax
je 0x40c152
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x450e60], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c17a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c16d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c18f
push 4
pop eax
jmp 0x40c237
cmp dword [ebp - 0x14], esi
je 0x40c18f
push dword [0x450e54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c174
mov eax, dword [0x450e60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c1ed
cmp dword [0x450e64], edi
je 0x40c1ed
push eax
call ebx
push dword [0x450e64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c1ed
test eax, eax
je 0x40c1ed
call ecx
test eax, eax
je 0x40c1e2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c1e2
test byte [ebp - 8], 1
jne 0x40c1ed
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c21d
mov eax, dword [0x450e58]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
call eax
mov esi, eax
test esi, esi
je 0x40c21a
mov eax, dword [0x450e5c]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x450e54]
call ebx
test eax, eax
je 0x40c235
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c237
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040a8
mov esp, ebp
pop ebp
ret
Function at 0x4036e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481713
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x474], 0
call sub.mfc140.dll_Ordinal_10421
lea ecx, [ebp - 0x48c]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_316]
adc eax, sym.imp.mfc140.dll_Ordinal_316
Function at 0x40dcf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4829b9
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
movlpd qword [ebp - 0x138], xmm0
movlpd qword [ebp - 0x130], xmm0
movlpd qword [ebp - 0x128], xmm0
call dword [sym.imp.FSUTIL.dll_public:_int___thiscall_AFilePath::exists_void_const]
test eax, eax
je 0x40dd90
lea eax, [ebp - 0x138]
push eax
push dword [ebp + 8]
call dword [sym.imp.FSUTIL.dll_public:_static_int___cdecl_AFile::GetStatus_char_const___struct_CFileStatus__]
add esp, 8
test eax, eax
je 0x40dd87
test byte [ebp - 0x118], 1
je 0x40dd87
lea eax, [ebp - 0x138]
mov dword [ebp - 0x118], 0
push eax
push dword [ebp + 8]
call dword [sym.imp.FSUTIL.dll_public:_static_void___cdecl_AFile::SetStatus_char_const___struct_CFileStatus_const__]
add esp, 8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp + 8]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047ff18
mov esp, ebp
pop ebp
ret
Function at 0x411b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483248
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call fcn.00477270
add esp, 4
lea ecx, [ebp - 0x218]
mov esi, eax
push str.CFG_FUNCTION_GENERATE_PRINTER_XMLFILE
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::constructor_char_const__]
mov edx, dword [esi]
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call dword [edx + 0x20]
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
sete bl
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::destructor_void_]
test bl, bl
jne 0x411cca
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x240], 1
mov eax, 1
mov word [ebp - 0x23c], ax
lea eax, [ebp - 0x210]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x411cca
mov byte [eax], bl
lea ecx, [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_310]
push str.PrinterXMLGenerator.exe
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], 1
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140.dll_Ordinal_5861]
push eax
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140.dll_Ordinal_5095]
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x411cb0
push dword [ebp - 0x228]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x224]
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140.dll_Ordinal_12503]
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047ff18
mov esp, ebp
pop ebp
ret
Function at 0x41aff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x100
push dword [eax]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
lea eax, [ebp - 0x104]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047ff18
mov esp, ebp
pop ebp
ret 4

Function at 0x41c390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x320], 0
jne 0x41c3d5
mov eax, dword [ebp + 8]
push 0
push 0
push 0x4c2790
push 0x41c3e0
push 0
mov dword [0x4c2790], esi
mov dword [0x4c2794], eax
push 0
mov dword [esi + 0x324], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x320], eax
pop esi
pop ebp
ret 4
Function at 0x41d5a0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484958
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call dword [sym.imp.PMCORE.dll_GetSetupDatabase]
mov esi, eax
test esi, esi
je 0x41d70c
push ebx
lea ecx, [ebp - 0x41c]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::constructor_char_const__]
lea eax, [ebp - 0x41c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call dword [sym.imp.PMCORE.dll_public:_class_ASetup____thiscall_ASetupDatabase::GetSetup_class_AString_const__]
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AString::destructor_void_]
test ebx, ebx
je 0x41d70c
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath]
add esp, 0x14
mov ecx, ebx
call dword [sym.imp.PMCORE.dll_public:_struct_ASetupCommonRec____thiscall_ASetup::GetCommonRec_void_]
add eax, 4
lea ecx, [ebp - 0x418]
push eax
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::constructor_class_AFilePath_const__]
push 0
push dword [ebp - 0x418]
mov dword [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x41d695
mov eax, dword [esi]
lea ecx, [ebp - 0x418]
push ecx
mov ecx, esi
call dword [eax + 0x38]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x114]
push eax
call fcn.0041d9e0
add esp, 0x10
lea eax, [ebp - 0x114]
mov ecx, edi
push 1
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41d6e5
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1529]
jmp 0x41d700
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x70
jne 0x41d700
push 0
push 0xfe58
call dword [sym.imp.FSUTIL.dll_int___cdecl_FSMessageBox_unsigned_int__unsigned_int_]
add esp, 8
lea ecx, [ebp - 0x418]
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_AFilePath::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047ff18
mov esp, ebp
pop ebp
ret
Function at 0x4328e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486944
mov eax, dword fs:[0]
push eax
sub esp, 0xd2c
mov eax, dword [0x4c0e0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xd34], esi
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
push eax
push 0xd8
mov dword [ebp - 0xd38], esi
call dword [sym.imp.FSUTIL.dll_public:_void___thiscall_APropertySheetK6::constructor_unsigned_int__class_CWnd___unsigned_int_]
lea ecx, [esi + 0x2f8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.AJobEstimationSheet.0
call sub.mfc140.dll_Ordinal_540
lea ecx, [esi + 0x300]
mov byte [ebp - 4], 1
call sub.mfc140.dll_Ordinal_983
or dword [esi + 0x84], 0x80
lea eax, [ebp - 0x30]
push 0x20
push eax
push 0x14
push 0x400
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x30]
mov ecx, 0x4c2c54
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1529]
lea ecx, [ebp - 0xd30]
call dword [sym.imp.PMCORE.dll_public:_void___thiscall_PMCorePreferences::constructor_void_]
lea eax, [ebp - 0xd30]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.PMCORE.dll_PMGetPreference]
mov eax, dword [ebp - 0xe0]
add esp, 4
cmp eax, 5
ja case.0x4329b1.0
jmp dword [eax*4 + 0x432af0]
push 3
mov ecx, 0x4c2c58
mov dword [0x4c2c28], 5
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 4
jmp 0x4329ec
push 1
mov ecx, 0x4c2c58
mov dword [0x4c2c28], 1
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 2
mov ecx, 0x4c2c5c
call dword [sym.imp.mfc140.dll_Ordinal_8426]
mov ecx, dword [0x4c2c28]
test ecx, ecx
js 0x432a0d
mov eax, dword [sym.imp.FSUTIL.dll_double_const__const_const_AUnits::s_ConversionFactors]
movsd xmm0, qword [eax + ecx*8]
jmp 0x432a15
movsd xmm0, qword [0x4978d8]
mulsd xmm0, qword [0x497908]
movsd qword [0x4c0048], xmm0
mov dword [esi + 0x2f4], 0
test edi, edi
je 0x432a4c
call dword [sym.imp.PMCORE.dll_GetJobDatabase]
test eax, eax
je 0x432a4c
push edi
mov ecx, eax
call dword [sym.imp.PMCORE.dll_public:_class_AJob____thiscall_AJobDatabase::GetJob_unsigned_int_]
mov dword [esi + 0x2f4], eax
push 0x9c8
call sub.mfc140.dll_Ordinal_1507
add esp, 4
mov dword [ebp - 0xd34], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x432a76
push dword [esi + 0x2f4]
mov ecx, eax
call fcn.004307e0
jmp 0x432a78
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [esi + 0x2ec], eax
call sub.mfc140.dll_Ordinal_1922
push 0x33c
call sub.mfc140.dll_Ordinal_1507
add esp, 4
mov dword [ebp - 0xd34], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x432aae
mov ecx, eax
call fcn.0042de10
jmp 0x432ab0
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [esi + 0x2f0], eax
call sub.mfc140.dll_Ordinal_1922
lea ecx, [ebp - 0xd30]
call dword [sym.imp.PMCORE.dll_public:_void___thiscall_PMCorePreferences::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047ff18
mov esp, ebp
pop ebp
ret 8