joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100138c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call sub.msvcr100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001395d
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x100139a0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10023c4a
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10013987
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100139a0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.msvcr100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0x78c
leave
ret

Function at 0x10013b9c
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10013bbd
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10013bbd
inc esi
mov eax, esi
pop esi
ret

Function at 0x1001460e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eac9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014668
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000df81
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014685
call fcn.100060e0
jmp 0x10014687
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100146d3
call fcn.10007f79
jmp 0x100146d3
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret
Function at 0x100146fd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eaf9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014757
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000df81
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014774
call fcn.100060e0
jmp 0x10014776
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100147c2
call fcn.10007f79
jmp 0x100147c2
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret

Function at 0x10014eb7
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001eb59
call fcn.1001bb3b
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000df81
test eax, eax
je 0x10014ee2
call fcn.10014ea8
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1002051c
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10014f3d
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.100178de
pop ecx
pop ecx
push edi
push esi
call fcn.1000df81
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10006f58
push eax
push esi
push 0x10023e3c
call fcn.100178de
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10014f36
ret
cmp ebx, edi
je 0x10014f48
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014fa5
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10014f01
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014ff9
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10014f01
mov eax, esi
call fcn.1001bbe0
ret
Function at 0x1001628d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x138]
sub esp, 0x1b8
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x134], eax
push ebx
push 0x104
xor ebx, ebx
lea eax, [ebp + 0x30]
push ebx
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
lea eax, [ebp + 0x30]
push eax
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x100162e8
xor eax, eax
mov ecx, dword [ebp + 0x134]
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0x138
leave
ret
push esi
lea eax, [ebp + 0x30]
push edi
mov dword [ebp + 0x28], 0xf
mov dword [ebp + 0x24], ebx
mov byte [ebp + 0x14], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100162fd
sub eax, esi
push eax
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp + 0x14]
call fcn.10016afd
push str.JavaJava_Updatejucheck.exe
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000df81
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp + 0x14]
call fcn.10007ace
push 0x22
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x14]
push 0x22
push eax
call fcn.10016def
add esp, 0xc
push eax
lea eax, [ebp - 8]
push eax
call fcn.1000df81
add esp, 0xc
push ebx
push esi
lea ecx, [ebp + 0x14]
call fcn.10007ace
push 0x40
lea eax, [ebp - 0x7c]
push ebx
push eax
call sub.msvcr100.dll_memset
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp + 0xc], 0x10
stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0x44
mov eax, ecx
jae 0x1001638f
lea eax, [ebp - 8]
add eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0x10
jae 0x1001639b
lea ecx, [ebp - 8]
push dword [ebp - 0x29]
mov dword [ebp + 0x20], ebx
push eax
push ecx
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
call fcn.10016e6a
lea eax, [ebp - 0x25]
push eax
lea ecx, [ebp + 0x20]
mov byte [ebp - 0x25], bl
call fcn.10016b94
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
jae 0x100163cc
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push ebx
push 0x8000000
push esi
push ebx
push ebx
push dword [ebp + 0x20]
push eax
call fcn.1000df81
add esp, 0x28
test eax, eax
jne 0x10016415
xor edi, edi
lea ecx, [ebp + 0x20]
call fcn.1001685d
push ebx
push esi
lea ecx, [ebp - 8]
call fcn.10007ace
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.10007ace
mov eax, edi
pop edi
pop esi
jmp 0x100162d2
mov edi, esi
jmp 0x100163f0
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x3cd47d1e
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x12830626
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x401330
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x7f00
mov esi, eax
mov dword [esp + 0x2c], 0x30
push 0
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0x4011a0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x4c], 6
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], str.ATWndCls
mov dword [esp + 0x58], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.AbsoluteTouch_Test
push str.ATWndCls
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0xc
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push 1
push eax
mov dword [esp + 0x28], 0x20001
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
je 0x40146c
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x58]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x401456
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x58]
push eax
call edi
lea eax, [esp + 0x58]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call esi
test eax, eax
jne 0x401437
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x60]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040179f
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xc]
call fcn.00401100
push 0x4039a8
lea eax, [esp + 0x10]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x401fe0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40201f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40201f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40201f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40201f
cmp dword [ecx + 0x74], 0xe
jbe 0x40201f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x671a75b9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4aa1090d
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
nop
mov ebx, 0x40de38
mov ecx, 0x2be86f0b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7b053b12
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401220
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8fa160]
mov ecx, dword [0x8f90b4]
shr eax, 3
sub esp, 0x81c
test eax, eax
jbe 0x401312
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x8fa160], 0x959
jne 0x4012f8
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push str.ducofikinevodugucexejayeyide_jofubupazekatajikuwayoj
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
lea eax, [ebp - 0x81c]
push eax
push 0
push str.lebogegimoramigefunolerulodidi_peyewuvuhicucalikid_suyucedizejabije
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
push 0
push str.laduvig_xupewufodarahut
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
push edx
call fcn.00401030
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40146a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x41edd0
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x41eff3
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
nop dword [eax]
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
sub byte [edi + ebp], 0x3e
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
xor byte [edi + ebp], 0xb5
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
xor byte [edi + ebp], 0x4d
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0x8b
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0x55
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
xor byte [edi + ebp], 0x5b
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0x8e
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0x6d
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0x8c
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add esp, 8
xor byte [edi + ebp], 9
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0xf4
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0xa8
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0xc9
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
xor byte [edi + ebp], 0x7c
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0xb5
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
xor byte [edi + ebp], 0x19
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0x65
add esp, 8
push 0
push 0
call esi
push str.RX_Engine_n
push 0x5d8148
call fcn.004032b5
add byte [edi + ebp], 0xa7
add esp, 8
inc edi
cmp edi, ebx
jb 0x41edf0
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x403c8d
Capabilities:
Terminate process

Disassembly:
jmp 0x461e19
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x461e2a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0040668b
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x403e18
Capabilities:
Query environment variable

Disassembly:
jmp 0x4ab65b
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ab66c
pop esi
ret
push ebx
push edi
push esi
call fcn.004ab542
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004048a9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4ab694
push ebx
push esi
push edi
call fcn.00406424
add esp, 0xc
push 0
call fcn.004071bc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x406500
Capabilities:
Parse pe header

Disassembly:
jmp 0x450b67
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x450ba6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x450ba6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x450ba6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x450ba6
cmp dword [ecx + 0x74], 0xe
jbe 0x450ba6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4075c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x41fc80
sub esp, 0x2c
mov eax, dword [0x5d4258]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
mov dword [esp + 0x10], 0
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add edi, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x41fd69
mov ebp, dword [esp + 0x44]
mov edx, dword [edi]
xorps xmm0, xmm0
add edx, ebx
mov dword [esp + 0x30], 0
mov eax, edx
mov dword [esp + 0x34], 0
movups xmmword [esp + 0x20], xmm0
lea ecx, [eax + 1]
mov dword [esp + 0x14], ecx
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fcf0
sub eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push edx
call fcn.00406172
test ebx, ebx
je 0x41fd29
cmp ebp, 3
jbe 0x41fd29
lea eax, [esp + 0x20]
push 0x14d
push eax
call fcn.00403201
add esp, 8
test eax, eax
je 0x41fd29
cmp eax, ebp
je 0x41fd82
mov ecx, dword [esp + 0x34]
add edi, 4
cmp ecx, 0x10
jb 0x41fd5e
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41fd54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fdd1
push ecx
push edx
call fcn.00401c12
add esp, 8
inc esi
cmp esi, dword [esp + 0x18]
jb 0x41fcc5
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
add eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004035ee
add esp, 0x2c
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + ebx]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x41fd69
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41fdc5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fdd1
push ecx
push edx
call fcn.00401c12
add esp, 8
jmp 0x41fd69
call fcn.004051c8
int3
Function at 0x4a2609
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00402027
mov eax, dword [0x5d4258]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406d02
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4a264b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4a27a7
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00406e8d
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5d9780]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403864
mov ecx, dword [esi*4 + 0x5d9780]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4a27a0
cmp eax, dword [edi + ecx + 0x24]
jne 0x4a27a0
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a27a0
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403864
add esp, 0x14
test edx, edx
jl 0x4a27a0
jg 0x4a2716
test eax, eax
jb 0x4a27a0
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4a27a0
jl 0x4a2730
cmp dword [ebp - 0x1008], eax
ja 0x4a27a0
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4a274e
test ebx, ebx
je 0x4a2787
cmp ecx, edi
jae 0x4a2787
mov al, byte [ecx]
cmp al, 0xd
jne 0x4a2768
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4a2774
cmp byte [ecx + 1], 0xa
jne 0x4a2774
inc ecx
jmp 0x4a2774
movzx eax, al
movsx eax, byte [eax + 0x5d4570]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4a274e
cmp edx, ebx
jne 0x4a274e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4a27a5
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004035ee
leave
ret