joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f808
push 0x52f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x52b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x52b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0052e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x52b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x52b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x52b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0052b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x52bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x52bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x52bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x52bd94
push eax
push esi
call fcn.0052e20b
add esp, 8
pop esi
ret 0x10

Function at 0x52bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x52be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x52be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x544320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0052ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x52bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x52be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x52bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x52beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x544320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0052ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x52beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x52be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x52c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x52c131
push esi
call fcn.0052f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0051e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x52c131
push 0
push ebp
call fcn.0051e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0051e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x52c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0051e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x52c121
push 0x544918
push edi
call fcn.0052d3f0
push eax
push ebx
push esi
call fcn.0052bf60
push 0x5448f8
push edi
call fcn.0052d3f0
push eax
push ebx
push esi
call fcn.0052bf60
push 0x5448d8
push edi
call fcn.0052d3f0
push eax
push ebx
push esi
call fcn.0052bf60
push 0x5448c0
push edi
call fcn.0052d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0052bf60
push 0x5448a0
push edi
call fcn.0052d3f0
push eax
push ebx
push esi
call fcn.0052bf60
push 0x544888
push edi
call fcn.0052d3f0
push eax
push ebx
push esi
call fcn.0052bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x52d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0052d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0052d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0052d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0052d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x52dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x52dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x53f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x52dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x52dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ac639ca
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x225530fa
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x9cb49e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
ret 0x17ec
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
call fcn.009cb36e
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
jle 0x9cb477
mov byte [0x45ab6827], al
push edx
push esi
call fcn.009db0cc
rcl byte [eax - 0x3a], 0xa1
push eax
jecxz 0x9cb489
xor ebx, dword [ecx]
salc
mov esi, 0xfd559aa
sbb dh, byte [ebx + 0x70118107]
sub ebx, 0xffffffdd
call fcn.009db0cc
insd dword es:[edi], dx
hlt

Function at 0x9d7ec2
Capabilities:
Encode data using base64

Disassembly:
mov al, cl
xchg ah, al
mov eax, 0x47b84021
mov eax, 0x347c315a
jmp 0x9d7f45
mov ah, byte [esp]
xor eax, ebp
jae 0x9d8675
jb 0x9d7ffa
and byte [eax + eax - 0x68d0000], 0x69
or bl, bh
cmp bl, byte [eax + 0x11e28717]
fisttp qword [edx + 0x648dec42]
and al, 2
jae 0x9d7f51
imul ecx, dword [eax], reloc.MSVFW32.dll_DrawDibDraw
xchg edx, esp
adc ebp, ebx
mov al, byte [edx - 0x14]
lea eax, [ebx + esi]
neg ax
mov ah, 0xec
cmc
bswap eax
mov ax, 0x5a4
jmp 0x9d7fa5
inc eax
jmp 0x9d867a
neg ax
mov ah, 0xec
jmp 0x9d7fd4
pushfd
jb 0x9d7fd9
jae 0x9d7fd9
mov ax, word [esp]
jae 0x9d7fdd
clc
not ax
not al
clc
mov ah, byte [esp]
jmp 0x9d80e4
jb 0x9d7f72
lea eax, [ebx + esi]
jmp 0x9d7f9d
cmc
bswap eax
jmp 0x9d7f7e
neg cl
jmp 0x9d7faa
clc
jmp 0x9d814c
inc eax
shr eax, 0x1c
jmp 0x9d7f97
lea eax, [ecx + ebx]
jmp 0x9d8056
mov al, 0xe2
jae 0x9d8000
lea eax, [ecx + ebx]
sub ax, 0x7599
adc ax, ax
pushfd
bswap eax
jmp 0x9d80a4
mov eax, 0x7576052f
jmp 0x9d80d1
sub ax, 0x7599
adc ax, ax
jmp 0x9d8079
pushal
push dword [esp + 0x15]
jmp 0x9d804e
pushfd
bswap eax
dec eax
mov ah, byte [esp]
jmp 0x9d8072
dec eax
mov ah, byte [esp]
pushal
push dword [esp + 0x15]
mov eax, 0x7576052f
clc
sub cl, 0x1f
jmp 0x9d8020
mov eax, dword [esp]
mov eax, dword [esp]
jo 0x9d80c2
jno 0x9d809e
clc
mov ah, byte [esp]
jmp 0x9d80e4
not ax
not al
jmp 0x9d8104
inc eax
shr eax, 0x1c
inc eax
ror cl, 0
mov ax, word [esp]
jmp 0x9d7fcd

Function at 0x9f17a8
Capabilities:
Enumerate pe sections

Disassembly:
push esi
lea esp, [esp + 4]
pushfd
lea esp, [esp + 4]
jmp fcn.009c8efc

Function at 0x9f17d2
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push bp
lea esp, [esp + 2]
push bp
lea esp, [esp + 2]
jmp 0x9c8f6c

Function at 0x9f2192
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 4]
pushfd
lea esp, [esp + 4]
jmp 0x9c8f6c

Function at 0x9f227b
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
call fcn.009c8f01
mov word [esp], cx
mov word [esp], si
pushal
push dword [esp + 0x20]
push word [esp + 0xb]
lea esp, [esp + 1]
lea esp, [esp + 0x28]
pushfd
jmp 0x9f24c5
pushal
bswap cx
mov edx, 0x9844cd5
popal
push eax
lea esp, [esp]
mov byte [esp + 1], ah
push dword [esp + 1]
lea esp, [esp + 5]
jmp 0x9f224f
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x9c8f2c
Function at 0x9f2597
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
call fcn.009c8f31
xchg ebp, esi
setne dh
mov bp, ax
mov dh, al
mov esi, dword [esp + 8]
jmp 0x9f2654
push di
push word [esp + 1]
pop word [esp]
mov byte [esp], ch
push di
mov byte [esp + 1], ch
mov dword [esp], ebp
bswap ebp
bswap bp
not bp
lea ebp, [esi + edi]
lea ebp, [edi*4]
lea ebp, [ebx + ebx]
bswap ebp
pushal
lea ebp, [ecx + 0x69]
mov bp, 0x6856
lea ebp, [edx*4]
bswap ebp
push dword [esp + 0x1c]
push dword [esp + 0xa]
mov dword [esp + 0x10], edx
lea ebp, [edx + edi]
lea ebp, [edi - 0xfb]
mov ebp, dword [esp]
pushfd
mov dh, byte [esp + 2]
lea ebp, [esp + ecx]
mov dl, 0x5f
lea ebp, [esp + 0xaa]
mov dword [esp + 8], esi
mov edx, esp
lea ebp, [eax + ebx]
mov dx, 0x33b2
mov dl, byte [esp]
jmp 0x9f257b
push word [esp + 0xc]
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x9c8f6c
mov bp, 0x5aaa
mov dh, byte [esp]
lea edx, [ecx + ecx]
mov dx, di
mov bp, word [esp]
lea edx, [ecx*4]
mov ebp, dword [esp]
mov edx, dword [esp + 0x14]
not bp
lea ebp, [ecx - 0x79]
lea ebp, reloc.MSVFW32.dll_DrawDibDraw
not ebp
mov ebp, 0x51cd06d5
mov ebp, dword [esp]
pushfd
mov ebp, dword [esp + 0x30]
lea esp, [esp + 0x34]
pushal
jmp 0x9f2636
Function at 0x157c915
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec esi
movzx dx, cl
setnp dl
sub al, bl
lea edx, [ebx*2 - 0x4d33c1a3]
bt esi, edi
sub al, 0xe6
not dl
rol al, 1
sub edx, ebp
xor al, 0x92
rcr dh, cl
sub bl, al
setg dh
movzx eax, al
inc dl
pushfd
setb dl
mov dx, ax
mov edx, dword [eax*4 + 0x157e313]
pushfd
call fcn.0157cc9f
jmp 0x157d509
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.0040507c
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.0040507c
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.0040507c
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.0040507c
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.0040507c
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.0040507c
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.0040507c
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x4b2248
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp esi, edi
jmp 0x4b22ac
pop esi
jmp 0x4b2424
push edi
jmp 0x4b237a
jbe 0x4b2938
jmp 0x4b2324
cmp ebx, edx
jmp 0x4b2c49
mov ecx, dword [ecx + 0x1c]
jmp 0x4b24c0
jne 0x4b2239
jmp 0x4b2974
test bl, bl
jmp 0x4b2878
cmp edx, dword [ecx + 0x18]
jmp 0x4b2a12
mov eax, edi
jmp 0x4b26d3
add edx, esi
jmp 0x4b2aa5
cmp ebx, 0x10000
jmp 0x4b2bbc
lea eax, [eax + ebx*4]
jmp 0x4b262c
sbb edx, edx
jmp 0x4b25f1
xchg dword [esp], esi
lea esi, [esi - 0xca]
xchg dword [esp], esi
jmp 0x4b241d
cmp dword [edx + 0x7c], edi
jmp 0x4b2913
mov edi, dword [eax + esi]
jmp 0x4b2cf5
je 0x4b2938
jmp 0x4b2d28
xor edx, edx
jmp 0x4b2590
lea eax, [ecx + eax*4]
jbe 0x4b22a3
ja 0x4b22a3
mov esi, 0xc48394d7
sbb al, 0xe9
cmp al, byte [edx]
add byte [eax], al
pop eax
pop edx
push 0x500f0
add byte [eax], al
mov ebx, dword [ebp + 0xc]
jmp 0x4b220b
add ecx, esi
jmp 0x4b2269
xor edi, edi
jmp 0x4b2016
add edx, eax
jmp 0x4b2058
mov bl, byte [ebx + 1]
jmp 0x4b2bd1
push ebp
jmp 0x4b2ad5
pop ebx
jmp 0x4b2b46
cmp bl, byte [edx + 1]
jmp 0x4b2c69
inc edx
jmp 0x4b24fb
lea eax, [eax + edx*2]
jmp 0x4b2835
inc dword [ebp - 4]
jmp 0x4b2667
pop edi
jmp 0x4b201f
mov edx, dword [eax + edx*4]
jmp 0x4b2803
push esi
jmp 0x4b2b35
inc edx
jmp 0x4b21bc
mov edx, dword [ecx + 0x14]
jmp 0x4b2384
jmp 0x4b2c54
cmp bl, byte [edx]
jmp 0x4b2157
and dword [ebp - 4], edi
jmp 0x4b2aae
sbb edx, 0xffffffff
jmp 0x4b2c54
mov eax, dword [ecx + 0x20]
jmp 0x4b25da
jmp 0x4b22a3
jb 0x4b2938
jmp 0x4b2abf
ret
mov edx, dword [ebp - 4]
jmp 0x4b21d0
jmp 0x4b24d5
jbe 0x4b21ef
jmp 0x4b2ac7
mov edx, dword [ebp - 4]
jmp 0x4b24e7
je 0x4b2c87
jmp 0x4b24cb
add edx, esi
jmp 0x4b28b5
push ecx
jmp 0x4b2ab6
movzx eax, word [eax + esi]
jmp 0x4b2309
mov edx, dword [ebp - 4]
jmp 0x4b20b6
jne 0x4b28ec
jmp 0x4b22f5
mov dword [ebp - 8], ebx
jmp 0x4b28ec
jmp 0x4b21ef
mov ebx, dword [ebp - 8]
jmp 0x4b2cd6
je 0x4b2938
jmp 0x4b2a3d
xor eax, eax
jmp 0x4b24d5
mov ebx, dword [ebp + 0xc]
jmp 0x4b2775
test bl, bl
jmp 0x4b2a32
jb 0x4b294b
jmp 0x4b28dc
cmp ebx, eax
jmp 0x4b2639
je 0x4b22f5
jmp 0x4b2acc
cmp ecx, esi
jmp 0x4b204d
mov eax, dword [ecx + 0x10]
jmp 0x4b250b
mov ecx, dword [edx + 0x78]
jmp 0x4b2330
add eax, esi
jmp 0x4b2c5e
push ecx
jmp 0x4b2c7f
sub ebx, eax
jmp 0x4b2cdf
jmp 0x4b2775
mov ebx, dword [ebp - 8]
jmp 0x4b238d
mov ebp, esp
jmp 0x4b282e
mov esi, dword [ebp + 8]
jmp 0x4b2046
leave
jmp 0x4b2658
add dword [ebp - 8], 2
jmp 0x4b24ae
jae 0x4b2618
jmp 0x4b2a7f
mov byte [ebp + 0xb], bl
jmp 0x4b242c
jae 0x4b2938
jmp 0x4b2a28
test edx, edx
jmp 0x4b27d1
cmp dword [ecx + 0x18], edi
jmp 0x4b272b
jne 0x4b2239
jmp 0x4b2b50
push ebx
jmp 0x4b24f2
mov eax, dword [ecx + 0x24]
jmp 0x4b2842
mov bl, byte [ebx]
jmp 0x4b25b0
mov eax, dword [ecx + 0x1c]
jmp 0x4b2217
add edi, esi
jmp 0x4b21ef
mov edx, dword [esi + 0x3c]
jmp 0x4b2200
Function at 0x401000
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x40300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0xa8c]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8c]
push eax
mov dword [ebp - 0xa8c], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
mov edi, eax
lea eax, [ebp - 0xa38]
push eax
mov dword [ebp - 0xa38], ebx
call esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x401064
sub eax, ecx
sar eax, 1
mov ecx, eax
mov eax, str._draw
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, bx
jne 0x40107c
sub eax, edx
sar eax, 1
add eax, ecx
lea eax, [eax + eax + 4]
call fcn.00401230
mov edi, esp
mov dword [ebp - 0xa30], edi
call esi
mov edx, edi
movzx ecx, word [eax]
inc eax
mov word [edx], cx
inc eax
inc edx
inc edx
cmp cx, bx
jne 0x4010a1
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4010b2
mov esi, 0x40211c
mov eax, str._draw
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4010ca
mov edi, dword [ebp - 0xa30]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
cmp cx, bx
jne 0x4010de
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll__wsplitpath]
push 0x402120
push str.soffice
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll__wmakepath]
add esp, 0x28
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0xa8c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0xa30]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4011b1
push 0xffffffffffffffff
push dword [ebp - 0xa48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xa48]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa44]
call esi
xor eax, eax
jmp 0x4011f2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ebx
push ebx
lea ecx, [ebp - 0xa34]
push ecx
push 0x400
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x10
push ebx
push dword [ebp - 0xa34]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0xa34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
lea esp, [ebp - 0xa98]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040121c
leave
ret 0x10