joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1027f417
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102971f0], 0x1927
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1027f49d
mov dword [0x102971f0], 0x21a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1027f4d6
jmp 0x1027f51c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x1027f44d
jmp 0x1027f51c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x1a], dx
mov ax, word [ebp - 0x1a]
cmp ax, 0x64
je 0x1027f4e7
jmp 0x1027f51c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
je 0x1027f46b
mov dword [0x102971f0], 0x9f6
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
jl 0x1027f49d
jmp 0x1027f46b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1027f482
jmp 0x1027f51c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1027f51c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1027f51c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x1027f523
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1027f523
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x1027f52b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x10281573]
mov dh, byte [eax + 0x10281544]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1027f543
lea eax, [ebp - 0x24]
mov dword [0x102971f0], 0x1372
mov dword [ebp - 0x34], eax
call fcn.1027fc5f
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1027ea28
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1027f657
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x102971f0]
add ecx, 0xffffdbc9
mov dword [0x102971f0], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1027ebc0
xor eax, eax
mov ecx, dword [0x102971f0]
add ecx, 0xffffe005
mov dword [0x102971f4], ecx
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x20], ecx
mov dword [0x102971f0], 0x19c4
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x28], ecx
add ecx, 0x1531
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1027f64e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1027f779
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102971f8], 0
mov dword [0x102971fc], 0
mov dword [0x10297208], 0
mov ebx, dword [0x102971f4]
add ebx, 0xfffff338
mov dword [0x102971f0], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x1027f7e8
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102971f0], 0x20d1
mov dword [0x102971f4], 0x7e7
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102971f8], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102971fc], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10297200], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10297200]
mov edx, dword [0x102971fc]
mov byte [edi + edx], cl
mov dword [0x102971f4], 0x2664
mov edx, dword [0x102971f8]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102971fc]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10297208], ebx
mov dword [0x102971f0], 0x1fb1
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x1029720d], ch
mov byte [0x1029720e], cl
xor ch, cl
mov byte [0x1029720c], ch
mov dword [0x102971f0], 0x251f
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov dword [0x102971f4], 0x13d3
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x1027f7e0
mov eax, dword [0x102971f8]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x102971fc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x1027f7e8
Function at 0x1027fa38
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov eax, 0x10
call fcn.10279e20
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
call fcn.10001066
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x20], ecx
je 0x1027fac4
jmp 0x1027fb91
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x64], eax
mov dword [0x102971f4], 0xe73
mov ecx, dword [esi + 0x18]
mov edx, dword [eax + ecx + 0x50]
mov dword [esi + 0x40], edx
call fcn.1027f417
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x14], ecx
je 0x1027fb5a
jmp 0x1027fb8b
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
cmp dword [eax], 0x4550
je 0x1027fa72
jmp 0x1027fb48
lea eax, [esi + 0x28]
mov dword [0x102971f0], 0x1f19
sub esp, 4
mov ecx, dword [esi + 0x24]
mov dword [esp], ecx
mov dword [esi + 0xc], eax
call fcn.1027ee46
add esp, 4
lea ecx, [0x1027f3ca]
mov edx, dword [esi + 0x24]
mov edi, dword [edx]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], 0x113c00
mov edi, dword [0x102971dc]
mov dword [esi + 0x4c], edi
mov edi, dword [0x102971e0]
mov dword [esi + 0x68], edi
mov edi, dword [0x102971e4]
mov dword [esi + 0x7c], edi
mov edi, dword [0x102971e8]
mov dword [esi + 0x60], edi
mov edi, dword [0x102971ec]
mov dword [esi + 0x44], edi
mov dword [0x102971f4], 0x4bf
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp word [eax], 0x5a4d
mov dword [esi + 0x1c], eax
je 0x1027faa6
mov eax, dword [esi + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esi + 4], eax
jmp 0x1027fb37
lea eax, [esi + 0x28]
mov dword [0x102971f4], 0x341
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + 8]
push edx
push eax
call fcn.1027f52b
add esp, 8
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x28]
mov dword [ecx], edx
call eax
mov eax, 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x406970
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4878
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x513624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x50]
call fcn.00441b40
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
push edi
call fcn.00407ed0
add esp, 8
test al, al
je 0x406ab4
lea eax, [ebp - 0x78]
push eax
call fcn.00452f70
add esp, 4
mov ecx, eax
call fcn.004582e0
lea ecx, [ebp - 0x30]
mov ebx, eax
mov esi, edx
call fcn.004582e0
sub ebx, eax
mov eax, dword [ebp + 0xc]
sbb esi, edx
cdq
cmp esi, edx
jl 0x406ab4
jg 0x4069fb
cmp ebx, eax
jbe 0x406ab4
cmp dword [edi + 0x14], 8
jb 0x406a03
mov edi, dword [edi]
mov ecx, edi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406a20
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b910
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov eax, 0x414
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x64], 0
movlpd qword [ebp - 0x5e], xmm0
mov dword [ebp - 0x56], 0
mov dword [ebp - 0x6c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x406ab4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406aaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406ad8
push edx
push ecx
call fcn.00463d78
add esp, 8
lea ecx, [ebp - 0x50]
call fcn.0040ad50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464020
mov esp, ebp
pop ebp
ret
call fcn.004a52aa
int3
Function at 0x406b60
Capabilities:
Check if file exists
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d48b6
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x513624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x406b9e
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x406bb3
xor al, al
jmp 0x406cb1
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x406bbd
mov eax, dword [edi]
push eax
call ebx
cmp eax, 0xffffffff
setne cl
jne 0x406caf
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
mov dword [ebp - 0x2cc], 0x18
mov dword [ebp - 0x2d4], 0x400
lea eax, [ebp - 0x2fc]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004496b0
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x406c13
mov esi, dword [esi]
push 0x2b4
lea eax, [ebp - 0x2c4]
push 0
push eax
call fcn.004a1d70
add esp, 0xc
lea eax, [ebp - 0x2c4]
xor ebx, ebx
push 0x100
push 0x2b4
push eax
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x2c4]
test eax, eax
je 0x406c66
mov dword [ebp - 0x2dc], ebx
mov ebx, esi
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2e0], 0x20
lea ecx, [ebp - 0x2fc]
call fcn.00405450
lea eax, [ebp - 0x314]
mov ecx, edi
push eax
call fcn.004496b0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00409610
add esp, 8
mov byte [ebp - 0x2c5], al
lea ecx, [ebp - 0x314]
call fcn.00405450
test ebx, ebx
je 0x406ca9
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov cl, byte [ebp - 0x2c5]
mov al, cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464020
mov esp, ebp
pop ebp
ret
Function at 0x4072c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d49fe
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x513624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x21c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.004a1d70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x407409
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407390
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040b910
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x250]
call fcn.00441970
mov ecx, eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 2
push ecx
cmp dword [esi + 8], eax
je 0x4073e7
mov ecx, eax
call fcn.00441950
add dword [esi + 4], 0x18
jmp 0x4073ef
push eax
mov ecx, esi
call fcn.00403340
lea ecx, [ebp - 0x250]
call fcn.00405450
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00405450
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a1d70
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4074d7
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407462
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040b910
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x250]
call fcn.00441970
mov ecx, eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 4
push ecx
cmp dword [esi + 8], eax
je 0x4074b9
mov ecx, eax
call fcn.00441950
add dword [esi + 4], 0x18
jmp 0x4074c1
push eax
mov ecx, esi
call fcn.00403340
lea ecx, [ebp - 0x250]
call fcn.00405450
lea ecx, [ebp - 0x234]
call fcn.00405450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464020
mov esp, ebp
pop ebp
ret
Function at 0x409220
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x513624]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00402e60
add esp, 0xc
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
cmovae eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, 0x54
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x3c]
push eax
movlpd qword [ebp - 0x2a], xmm0
mov dword [ebp - 0x22], 0
mov dword [ebp - 0x38], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, dword [ebp - 8]
mov esi, eax
cmp edx, 8
jb 0x4092c0
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4092b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4092d1
push edx
push ecx
call fcn.00463d78
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00464020
mov esp, ebp
pop ebp
ret
call fcn.004a52aa
int3

Function at 0x409570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40957e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x40a750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4ee0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x513624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00463d48
mov edi, eax
add esp, 4
test edi, edi
je 0x40a802
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00433bc5
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e260
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00464440
mov eax, dword [0x513624]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.004a1d70
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x40e356
test edi, edi
je 0x40e356
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40e356
cmp eax, 0x3fff
ja 0x40e356
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40e356
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x4e3050
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40e356
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.004a1d70
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.0040f150
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464020
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00464020
mov esp, ebp
pop ebp
ret
Function at 0x40f1f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x513624]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40f277
test ebx, ebx
je 0x40f277
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40f277
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40f277
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40f271
push esi
push ebx
push edi
call fcn.004a1270
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40f271
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464020
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464020
mov esp, ebp
pop ebp
ret

Function at 0x40f290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f2e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40f2e9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40f2da
cmp esi, edx
jae 0x40f2e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40f2c8
cmp esi, edx
jae 0x40f2e9
cmp word [esi], 0
je 0x40f2e9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41ece0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6d78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x513624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0xbc], 8
lea esi, [ecx + 0xa8]
mov dword [ebp - 4], 1
mov eax, esi
jb 0x41ed1f
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
jne 0x41ed32
mov esi, dword [ebp + 0x10]
jmp 0x41ed7e
cmp dword [esi + 0x14], 8
jb 0x41ed3a
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x10]
call fcn.00414950
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004746a0
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov esi, eax
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41ed7e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ed9c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41edbb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422b30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d74fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x513624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00462c60
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x422c9a
push 0x72
push str.d:jenkins.jenkinsworkspacegroup_cleandesktop_quickdesktop_quickdesktop_quick_ui_srcdesktop_quick_ui_wnd.cc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.0040b810
push 3
push 0x4e2990
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.0040b810
mov byte [ebp - 4], 1
call fcn.00462c60
mov edi, eax
lea ecx, [ebp - 0xd4]
push 0x320
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404a90
mov esi, eax
push str.Close_Msg
push esi
mov byte [ebp - 4], 2
call fcn.00405c80
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xd4]
call fcn.00405f10
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x422c3f
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x422c35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422cda
push edx
push ecx
call fcn.00463d78
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x422c88
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x422c7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422cdf
push edx
push ecx
call fcn.00463d78
add esp, 8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0xd8]
test ecx, ecx
je 0x422cbf
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov dword [ebx + 0xd8], 0
mov ecx, ebx
call fcn.0042f2b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a52aa
call fcn.004a52aa
int3