joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b190
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fdc18
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x47b1c9
inc eax
mov dword [esi + 0x10], eax
jmp 0x47b2dc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x47b1dd
mov eax, 0xffffffc7
jmp 0x47b2de
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x47b1ee
cmp dword [esi + 8], eax
jne 0x47b1dd
cmp dword [esi + 8], eax
jne 0x47b207
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x47b207
mov eax, 0xffffffc7
jmp 0x47b2de
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x47b21b
push eax
mov ecx, ebx
call fcn.0047a9c0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00446a10
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x47b24c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00446a30
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0047a130
test eax, eax
mov dword [esp + 0x38], eax
je 0x47b27f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7760c8
call fcn.00446c10
mov eax, dword [esp + 0x38]
jmp 0x47b2de
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0047aff0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x47b2c3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0047b010
mov esi, eax
test esi, esi
jne 0x47b2f3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0047aff0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x47b295
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7760c8
call fcn.00446c10
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7760c8
call fcn.00446c10
mov eax, esi
jmp 0x47b2de
Function at 0x48bc80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fe643
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004f0de3
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x777c38
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x777b80
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call fcn.0098d608
dec ebx
push eax
mov ecx, edi
call fcn.004f6481
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004f799d
test eax, eax
je 0x48bd9c
mov ecx, dword [esp + 0x3c]
call fcn.004f64ae
mov ecx, dword [esi + 0x1c]
call fcn.009a9b4a
in al, dx
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x48bd60
push edi
mov ecx, esi
call fcn.004f3b14
mov ecx, esi
call fcn.0048bf40
cmp dword [esp + 0x38], 1
jne 0x48bd95
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004f3c4f
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x48df90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x48dfc3
push esi
call fcn.0049c200
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x48dfbc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x48e049
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x48e032
mov eax, dword [esi + 8]
test eax, eax
je 0x48dfe7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x48e02e
cmp eax, 2
je 0x48e032
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x48dfda
cmp eax, 3
je 0x48e00d
cmp eax, 1
jne 0x48dfda
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x48dfda
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x48dfda
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0048e070
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x48e058
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0048e070
add esp, 4
pop esi
ret
Function at 0x4b3e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ff476
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0xc]
mov dword [esp + 0x24], edi
mov dword [edi + 0x34], 0xffffffff
call fcn.004ee860
push 0xffffffffffffffff
lea ecx, [edi + 0x20]
push ebx
call fcn.004ee860
lea ecx, [edi + 0x38]
mov dword [esp + 0x14], ecx
call fcn.004ef795
lea eax, [esp + 0x30]
mov byte [esp + 0x30], bl
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], 0x400
mov dword [esp + 0x24], ebx
call fcn.0098a84f
int3

Function at 0x4bccf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8b90e4]
xor edx, edx
cmp eax, edx
jne 0x4bcd16
xor eax, eax
mov byte [eax + 0x8b8fe4], al
inc eax
cmp eax, 0x100
jl 0x4bccfe
mov dword [0x8b90e4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8b8fe4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4bcda7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4bcd7a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4bcd48
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4bcdb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4bce03
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4bcdea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c37c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ff68e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004c40e0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x77b554
call fcn.004ef54b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4c3853
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ef54b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4c384c
push 0
mov ecx, eax
call fcn.004ba930
mov dword [esi + 0xc], eax
jmp 0x4c3855
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4c3855
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x5259e5
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00525a64
jae 0x5259f1
xor ecx, ecx
call fcn.00525a64
jae 0x525a1b
xor eax, eax
call fcn.00525a64
jae 0x525a2c
mov al, 0x10
call fcn.00525a64
adc al, al
jae 0x525a0d
jne 0x525a59
stosb byte es:[edi], al
jmp 0x5259f2
call fcn.00525a70
dec ecx
loop 0x525a38
mov eax, ebp
call fcn.00525a6e
jmp 0x525a5a
lodsb al, byte [esi]
shr eax, 1
je 0x525a80
adc ecx, 2
mov ebp, eax
jmp 0x525a5a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00525a6e
cmp eax, 0x7d00
jae 0x525a58
cmp eax, 0x500
jae 0x525a59
cmp eax, 0x7f
ja 0x525a5a
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5259f2
pop ebp
ret 8
Function at 0x5d6049
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x5bccab
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x5bccc5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5bccb4
pop esi
jmp 0x5bccd0
ret 4
jmp 0x5bcc9e
Function at 0xa072cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
cld
mov dh, ah
mov eax, dword [esp + 5]
mov cx, dx
stc
jmp 0xa0730f
lea edi, [ebp*4]
pushfd
lea ebx, [edx*4]
jmp 0xa072b9
neg bh
push word [esp + 0xc]
mov dword [esp + 0x1b], edx
pop si
lea edx, [eax + ebx]
bswap eax
jmp 0xa072f9

Function at 0xa07650
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [ecx + edx]
dec al
mov dword [esp + 0xb], ebx
lea ebx, [ebp - 0x16]
mov dh, byte [esp + 0x1a]
pop si
mov byte [esp + 0x1f], cl
setb ch
jmp 0xa07638

Function at 0xa078db
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1a
push dword [esp + 3]
mov byte [esp + 0x15], ah
xchg word [esp + 5], bx
jmp 0xa07927
pop word [esp + 1]
pop ax
mov dx, word [esp + 1]
mov word [esp], bp
lea esp, [esp + 2]
bsr edi, esp
jmp 0xa0789d
mov word [esp + 1], si
lea esp, [esp]
pop ax
dec ebx
jmp 0xa078b3
bsf ebx, esi
xchg byte [esp + 0x1d], al
setle bh
shr ebx, cl
dec ah
xchg ch, dh
jmp 0xa07960
push dword [esp + 0x13]
mov dword [esp + 9], esp
bswap ebp
xchg bl, ch
bsf ax, dx
xchg dword [esp + 0x1f], ebp
jmp 0xa078e8
setbe dl
xchg bx, di
mov bl, 0x6c
dec ebx
push word [esp + 0x12]
btc ebp, edx
jmp 0xa078fe
dec eax
mov eax, 0x54ad23be
mov si, bp
pushal
lea esp, [esp + 0x43]
mov eax, 0x58be65e
jmp 0xa07977
lea edi, [0x569440de]
pop si
shl bx, cl
mov dword [esp + 7], ebp
mov di, 0x772b
rdtsc
jmp 0xa0793a
lea ecx, [ecx + 0x7a]
bswap esi
mov ch, 0x17
rcr di, 3
xchg esi, eax
dec edx
jmp 0xa07a8b
xchg edx, esi
mov eax, dword [esp + 3]
sub edx, 0x59f611e4
not ax
lea esp, [esp + 2]
jmp 0xa07a31
std
mov ax, cx
bsr bx, si
bswap ebp
dec ecx
pushfd
jmp 0xa079b4
mov si, word [esp + 5]
seto cl
mov cx, bp
push ax
clc
sub esp, 6
jmp 0xa07a12
mov dword [esp], ebx
lea esi, [edi + 0xc0]
rol dh, 5
xchg byte [esp], dh
mov ax, word [esp + 3]
mov dl, 0x21
jmp 0xa079dd
push esp
lea edx, [ebp + 0xba52]
mov byte [esp + 6], al
mov al, byte [esp + 6]
mov esi, dword [esp + 0xd]
pop edi
jmp 0xa07a5a
mov edx, 0xf1d67100
mov dl, 0x97
mov ebx, ecx
pushfd
bswap ebx
mov bp, word [esp + 2]
jmp 0xa079fa
lea edi, [ecx - 0xf4ea]
xchg dword [esp + 9], eax
pop cx
xchg byte [esp + 6], bl
jmp 0xa07a70
bswap ecx
xchg byte [esp + 0xb], cl
xchg dword [esp + 2], ecx
mov word [esp + 4], cx
sets cl
neg edi
jmp 0xa07a44
pop word [esp + 2]
pushal
lea ebp, [edx + 0x6185309]
mov ax, si
mov al, bl
jmp 0xa07b0f
xchg bp, ax
lea ebx, [ebx - 0xe2]
neg eax
mov cx, 0x4d10
mov esi, esp
lea ebp, [esp - 0x8c20]
jmp 0xa079cf
clc
pop word [esp + 0x2f]
cpuid
mov esi, dword [esp + 0x2a]
rdtsc
push dword [esp + 0xa]
jmp 0xa07af8
inc si
pop word [esp + 0x20]
bts ecx, ecx
pop di
pop word [esp + 0x22]
lea ecx, [edi + edi]
jmp 0xa07aa7
rcl bx, cl
add esp, 0x32
call fcn.00a07ae2
inc eax
retf 0x3f58
lea ebp, [ebx*4]
mov si, di
bswap ecx
sub esp, 0x10
mov ebp, edx
clc
jmp 0xa07acc
Function at 0xa07c98
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 6], eax
mov byte [esp + 1], bh
xchg byte [esp + 3], ch
add esp, 7
jmp 0xa07cf6
setae cl
xchg edx, edi
adc ax, bx
mov si, bx
mov byte [esp + 1], cl
jmp 0xa07d24
add esp, 3
neg ch
mov dx, word [esp + 1]
lea eax, [ebx - 0xdb]
std
mov ch, byte [esp + 1]
jmp 0xa07ce0
mov dx, word [esp]
bt dx, si
add esp, 0
lea edx, [0x3883def2]
jmp 0xa07d4a
add esp, 2
neg ah
ror bl, cl
std
rcl edx, cl
mov bp, word [esp]
jmp 0xa07d0d
rdtsc
sub dl, 0x6b
lea esi, [eax - 0xea]
xchg byte [esp], dh
inc si
jmp 0xa07d60
mov bh, al
mov edi, 0xb59debb3
lea esp, [esp]
mov dx, bp
bswap eax
mov edi, 0xeaf3afa0
jmp 0xa07d34
cld
cld
bswap esi
mov bx, si
xchg dl, cl
mov bl, 8
jmp 0xa07e49
mov ebp, dword [esp]
xchg cl, dh
push eax
push word [esp + 4]
cpuid
jmp 0xa07dfe
mov eax, 0xd4858996
mov ah, byte [esp]
mov al, dl
cpuid
bsr eax, ecx
lea edi, [esi + 9]
jmp 0xa07d91
mov byte [esp + 1], bh
mov bx, 0x4643
mov dx, word [esp + 1]
jmp 0xa07ddf
rdtsc
not edx
mov esi, edx
pop si
not di
pushfd
jmp 0xa07dbb
pop word [esp]
not ecx
mov cl, byte [esp + 1]
mov byte [esp + 1], bh
xchg di, cx
lea edx, [esp - 0x3bfcf1af]
jmp 0xa07e25
mov ax, 0xdd72
clc
lea ebp, [edx + edi]
xchg dword [esp], edi
lea ecx, [ebx + edi]
pop eax
jmp 0xa07dd1
mov di, word [esp + 1]
lea esp, [esp + 1]
call fcn.00a07eef
inc ebp
rol byte [esi + 0x21], 1
sar byte [ecx - 0x33], 1
pop esp
lea esp, [esp]
setae dl
lea esi, [edi + 0x171cdea1]
lea esp, [esp + 1]
xchg byte [esp], ah
neg ah
jmp 0xa07e0f
bsr esi, ecx
neg ax
bswap edi
lea ebp, [0xb14ee4d3]
lea edx, [edi + edi]
lea ebx, [ebp - 0xba67]
jmp 0xa07da7

Function at 0xa07eef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [esp]
not ebx
xchg bl, dl
xchg bp, ax
sbb ebp, edx
add esp, 0
jmp 0xa07ea6
sub esp, 9
mov bp, word [esp + 8]
rdtsc
mov dword [esp], edi
add esp, 9
lea esp, [esp]
jmp 0xa07e65
add esp, 0
neg bx
setnp bh
setp bh
xchg dx, bp
jmp 0xa07ece
mov dl, al
lea esp, [esp]
lea esp, [esp]
lea ebx, [edx + edx]
clc
mov si, 0xcc79
jmp 0xa07e90
sub esp, 0x1e
sub esp, 0x1d
mov dword [esp + 0x10], ecx
popal
xchg byte [esp + 0xf], cl
jmp 0xa07f30
xchg dl, al
rcr cl, cl
btc di, si
mov bp, dx
xchg cx, bp
cpuid
jmp 0xa07eb8
lea esp, [esp + 4]
bsr edx, eax
rol ax, 2
xchg byte [esp], bl
jmp 0xa07e7b
lea esp, [esp + 0x13]
ror cl, 2
mov dh, bh
mov dl, byte [esp + 0xd]
bswap esi
jmp 0xa07f67
rcl edi, cl
mov ecx, dword [esp]
pushfd
xchg byte [esp + 0x1a], ah
lea edx, [ecx + edx]
push dword [esp + 0xe]
jmp 0xa07f02
mov edi, esi
rdtsc
xchg bx, cx
stc
xchg edx, ecx
btc ebp, edi
jmp 0xa07f18
mov byte [esp + 0xf], bh
mov dh, bl
mov bl, 0xef
lea ebx, [edi*4]
pop word [esp]
lea esi, [ebx*4]
jmp 0xa07f79
neg ebx
std
mov dword [esp + 0xa], esp
add esp, 2
push dword [esp + 4]
bswap eax
jmp 0xa07f3f
cmc
not cl
xor esi, 0xcc90d657
mov dl, byte [esp]
mov ebx, 0xc3570ced
mov al, 0xe2
jmp 0xa07fba
xchg ecx, eax
bswap eax
push edi
neg bx
xchg byte [esp + 0xd], al
mov edi, 0x1acfb49a
jmp 0xa07f9f
Function at 0x401c20
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 4], eax
test eax, eax
jne 0x401c32
pop esi
ret 4
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x401be0
push 0
push 0
call fcn.0058453d
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret 4

Function at 0x401df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401e09
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e44
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401e40
lea ebx, [ebx]
cmp esi, eax
jae 0x401e44
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401e30
cmp esi, eax
jb 0x401e4a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x402340
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push eax
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov esi, eax
test esi, esi
je 0x402375
mov edi, dword [esi]
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SProgress::GetClassNameW_void_]
mov edx, dword [edi + 4]
push eax
mov ecx, esi
call edx
test eax, eax
je 0x402375
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
push ebp
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x402392
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov ebp, eax
jmp 0x402394
xor ebp, ebp
push 0x2800
call fcn.00584b20
push 0x5000
mov edi, eax
call fcn.00584b20
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SProgress::GetClassNameW_void_]
push eax
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.0058495c
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
cmp eax, 0x2800
jae 0x4023fe
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push esi
call fcn.005847fc
add esp, 4
test ebp, ebp
je 0x402457
mov edx, dword [ebp]
mov eax, dword [edx + 0x2c]
push 1
push 0
mov ecx, ebp
call eax
test al, al
je 0x402457
mov eax, dword [esp + 0x10]
mov edx, dword [ebp]
mov edx, dword [edx + 0x34]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
mov ecx, ebp
call edx
push edi
call fcn.005847fc
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
push 0x2800
call fcn.00584b20
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.00584720
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.005847fc
add esp, 4
push edi
call fcn.005847fc
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x405f30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5bda38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x63727c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00404850
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405f90
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00404cd0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00404850
cmp dword [esp + 0x28], 8
jb 0x405fdd
mov eax, dword [esp + 0x14]
push eax
call fcn.0053e50d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x407420
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push ebx
push ebp
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::FindChildByName_wchar_t_const___int_]
mov esi, eax
test esi, esi
je 0x407453
mov eax, dword [esi]
mov edx, dword [eax + 4]
push str.mclistview2
mov ecx, esi
call edx
test eax, eax
je 0x407453
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingletonPtr_void_]
test eax, eax
je 0x407471
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::ILog4zManager____thiscall_SOUI::SApplication::GetLogManager_void_]
mov dword [esp + 0x14], eax
jmp 0x407479
mov dword [esp + 0x14], 0
push edi
push 0x2800
call fcn.00584b20
push 0x5000
mov edi, eax
call fcn.00584b20
push ebx
push ebp
push str.mclistview2
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.0058495c
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x24
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
cmp eax, 0x2800
jae 0x4074db
push 0
push 0
push eax
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push esi
call fcn.005847fc
mov esi, dword [esp + 0x1c]
add esp, 4
test esi, esi
je 0x407536
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push 1
push 0
mov ecx, esi
call edx
test al, al
je 0x407536
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
push ecx
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push edi
push str.soui
push 1
push 0
mov ecx, esi
call edx
push edi
call fcn.005847fc
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
push 0x2800
call fcn.00584b20
push 0x20e
push str.d:winappsdr_trunk_thirdparty_soui_master_souiincludecoreSWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.00584720
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.005847fc
add esp, 4
push edi
call fcn.005847fc
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8