joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404020
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x453929
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x2c], esi
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 8]
push 0x7d0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
push 0x66
push eax
call edx
cmp eax, esi
jne 0x4040f1
mov ebx, dword [esp + 0x14]
cmp ebx, esi
je 0x4040e3
call fcn.00402f60
push eax
push 0x4585c8
mov edi, ebp
call fcn.00404e80
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 0x4c]
add esp, 8
push eax
call edx
jmp 0x4040f1
push 0x4581a0
xor edi, edi
mov eax, ebp
call fcn.00404710
mov eax, dword [ebp]
push eax
push str.GetFileNameByComx3_Retun__s
push 0x80
call fcn.004025a0
add esp, 0xc
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x405be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4525a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.00405a60
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add esp, 0x10
test eax, eax
je 0x405c4c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x405ef0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x405f00
mov eax, 0x400000
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
test ecx, ecx
je 0x405f36
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
test al, al
je 0x405f3f
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405f51
mov eax, 0x80004005
ret 0x10
jle 0x405f5d
and eax, 0xffff
or eax, 0x80070000
ret 0x10
Function at 0x406010
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406038
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x406060
mov eax, dword [esp + 0xc]
push 1
push 0
push 0
push eax
call fcn.0044d4d0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret 8
call edi
test eax, eax
jne 0x406070
pop edi
mov eax, 0x80004005
pop esi
ret 8
jle 0x40607c
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
ret 8

Function at 0x406090
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x4060a0
mov eax, 0x400000
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x4060df
mov dword [ecx], eax
test dl, dl
je 0x4060e8
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4060fa
mov eax, 0x80004005
ret 0x10
jle 0x406106
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x406f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x452988
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x28]
push 0
push 0
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov eax, dword [edi]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ebx, eax
test ebx, ebx
je 0x407008
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edi, dword [edi]
mov ecx, dword [edi]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [ecx + 0xc]
push edx
push edi
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14

Function at 0x407d40
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x407d80
push 0
push 0
call fcn.0043f7c1
mov edx, dword [esp + 0x20]
add esp, 0x18
mov dword [edx], eax
test eax, eax
je 0x407d69
xor eax, eax
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x407d78
mov eax, 1
pop ecx
ret 4
Function at 0x40bda0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
mov dword [edi + 4], vtable.ISetProperties.0
xor ebx, ebx
mov dword [edi + 8], ebx
push esi
mov dword [edi], vtable.NArchive::N7z::CHandler.0
mov dword [edi + 4], vtable.NArchive::N7z::CHandler.1.0
lea esi, [edi + 0x10]
mov dword [edi + 0xc], ebx
call fcn.0040be20
lea eax, [esp + 8]
mov dword [edi + 0x1ec], ebx
mov dword [edi + 0x1f0], ebx
mov dword [edi + 0x1f4], ebx
mov dword [edi + 0x1f8], 8
mov dword [edi + method.CBaseRecordVector.virtual_0], vtable.CRecordVector_unsigned_long_long_unsigned___int64__.0
push eax
mov dword [edi + 0x1e4], 4
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x1c]
pop esi
mov dword [edi + 0x1e0], ecx
mov eax, edi
pop ebx
add esp, 0x24
ret
Function at 0x4143b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x4143cd
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
add dword [esp + 0x18], 5
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x4143fd
nop
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4143fd
inc edi
cmp edi, ebx
jb 0x4143f0
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x4144fc
cmp eax, 3
jbe 0x414430
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x414468
cmp al, 0xff
je 0x414468
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x4143e8
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x414416
movzx ecx, byte [esi + 0x458cf0]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x458ce8], 0
mov al, byte [eax + 4]
je 0x414459
test al, al
je 0x414459
cmp al, 0xff
jne 0x414416
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x4143e8
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
sub edx, ebp
sub edx, dword [esp + 0x20]
mov eax, edx
test esi, esi
je 0x4144ce
movzx edx, byte [esi + 0x458cf0]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x4144b3
cmp bl, 0xff
jne 0x4144ca
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x414486
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x4143e8
pop edi
pop ebx
cmp eax, 3
jbe 0x414513
mov eax, dword [esp + 0x1c]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x1c]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret

Function at 0x41b920
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
cmp byte [0x568c61], 0
push ebx
push esi
mov esi, eax
mov ebx, ecx
jne 0x41b960
lea ecx, [esp + 8]
call fcn.00418030
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call fcn.0043f105
add esp, 4
test esi, esi
je 0x41b974
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41b974
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x41bdb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4526f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov esi, ecx
mov eax, dword [esi]
mov dword [ebp + 0x20], eax
mov ecx, dword [esi + 4]
mov dword [ebp + 8], ecx
mov edx, dword [esi + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x10]
mov dword [ebp + 0x14], ecx
mov edx, dword [esi + 0x14]
push 1
mov dword [ebp + 0x18], edx
mov eax, dword [esi + 0x18]
push 0
mov dword [ebp + 0x1c], eax
mov ecx, dword [esi + 0x1c]
push 0
push ecx
call fcn.0044d4d0
mov ecx, dword [esi + 0x20]
xor edi, edi
add eax, ecx
adc edx, edi
add esi, 0x2c
push esi
lea esi, [esp + 0x14]
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov byte [ebp + 0x24], 0
call fcn.004180a0
mov ecx, esi
lea esi, [esp + 0x1c]
mov dword [esp + 0x30], edi
call fcn.0041c430
mov edi, eax
lea eax, [ebp + 0x28]
mov byte [esp + 0x30], 1
call fcn.00407370
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043f105
mov eax, dword [esp + 0x14]
push eax
call fcn.0043f105
add esp, 8
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret

Function at 0x41c890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45379e
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TiXmlAttribute.0
mov eax, 0xf
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
lea edi, [esi + 0x30]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov eax, ebp
lea edx, [eax + 1]
mov byte [esp + 0x1c], 2
mov dword [esp + 0x28], edx
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41c900
sub eax, dword [esp + 0x28]
push eax
push ebp
call fcn.004053c0
mov ebp, dword [esp + 0x2c]
mov eax, ebp
lea edx, [eax + 1]
jmp 0x41c920
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41c920
sub eax, edx
push eax
push ebp
mov ecx, edi
call fcn.004053c0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x422e70
Capabilities:
Get file size

Disassembly:
sub esp, 0x220
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x121]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x128], 0
call fcn.00443400
add esp, 0xc
push 0x104
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.00443400
add esp, 0xc
push 0x104
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x422f33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.CreateFile_Failed__SoucFile__s_Error__d
push 0x80
call fcn.004025a0
push 9
call fcn.00423960
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0043defc
add esp, 0x220
ret
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x422f97
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x422f97
push 0
push 0x104
lea eax, [esp + 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea ecx, [esp + 0x11c]
push ecx
push str.GetFileSize_fails_because__s
push 0x80
call fcn.004025a0
add esp, 0xc
mov ecx, dword [edi + 4]
mov eax, ebp
mov edx, 2
mul edx
cmp ecx, edx
ja 0x422fe2
jb 0x422faf
mov edx, dword [edi]
cmp edx, eax
jae 0x422fe2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Not_enough_space_for_install
push 0x80
call fcn.004025a0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0043defc
add esp, 0x220
ret
mov ecx, dword [edi + 0x2c]
lea eax, [esp + 0x14]
push eax
push ecx
push str.Try_to_cut_zip_file__s_out_from__s
push 0x80
call fcn.004025a0
mov edi, dword [edi + 0x2c]
add esp, 0x10
mov eax, esi
call fcn.004231b0
mov ecx, eax
mov edx, edi
call fcn.00423050
cmp eax, 0xffffffff
jne 0x423027
push str.FileCut_fail
push 0x80
call fcn.004025a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0043defc
add esp, 0x220
ret
Function at 0x423050
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x118
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push edi
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov ebx, ecx
mov edi, edx
mov byte [esp + 0x20], 0
call fcn.00443400
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
push 0
cmp esi, 0xffffffff
jne 0x4230f1
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x14]
push edx
push str.Open_Source_file_fail_because__s
push 0x40
call fcn.004025a0
add esp, 0xc
or eax, esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043defc
add esp, 0x118
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp ebx, eax
jbe 0x423128
push eax
push ebx
push str.Open_Source_file_fail_because_dwBeginPos__d___dwFileSize__d
push 0x40
call fcn.004025a0
add esp, 0x10
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043defc
add esp, 0x118
ret
xor edi, edi
push edi
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [esp + 0x10]
push eax
push 0x100000
push 0x468a98
push esi
call ebx
test eax, eax
je 0x423189
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x423189
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x468a98
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [esp + 0x10]
push 0
lea edx, [esp + 0x10]
push edx
push 0x100000
push 0x468a98
push esi
call ebx
test eax, eax
jne 0x423151
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043defc
add esp, 0x118
ret

Function at 0x4231b0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ecx
push esi
push 0
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 8]
push eax
push 0x100000
push 0x468a98
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4231e3
or eax, 0xffffffff
pop esi
pop ecx
ret
mov ecx, 0x5a4d
cmp cx, word [0x468a98]
jne 0x4231dd
mov ecx, dword [0x468ad4]
cmp dword [ecx + 0x468a98], 0x4550
jne 0x4231dd
push edi
movzx edi, word [ecx + 0x468a9e]
xor eax, eax
xor esi, esi
test edi, edi
jle 0x423236
lea edx, [ecx + 0x468ba0]
lea esp, [esp]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
cmp ecx, eax
jbe 0x42322b
mov eax, ecx
inc esi
movsx ecx, si
add edx, 0x28
cmp ecx, edi
jl 0x423220
pop edi
pop esi
pop ecx
ret
Function at 0x423900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x423917
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x423948
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x423944
cmp esi, eax
jae 0x423948
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x423934
cmp esi, eax
jb 0x42394e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x423da0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x452208
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor ecx, ecx
xor edx, edx
mov word [esp + 0xc], cx
mov word [esp + 0xe], dx
mov dword [esp + 0x28], edx
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push 6
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
test esi, esi
je 0x423e10
lea ecx, [esp + 0xc]
call fcn.0041c3b0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
mov ax, word [esp + 0xc]
cmp ax, 0xb
jne 0x423e42
cmp word [esp + 0x14], 0
setne cl
mov byte [edi], cl
lea ecx, [esp + 0xc]
call fcn.0041c3b0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
test ax, ax
jne 0x423e65
lea ecx, [esp + 0xc]
mov byte [edi], al
call fcn.0041c3b0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0xc]
call fcn.0041c3b0
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x424130
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4536d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov edi, ecx
xor esi, esi
mov dword [esp + 0x2c], 1
mov dword [edi + 0x74], esi
mov dword [edi + 0x70], esi
mov dword [edi + 0x78], esi
mov dword [edi + 0x7c], esi
cmp ebp, esi
je 0x424180
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
push ebp
call ecx
mov eax, dword [edi + 0xc]
cmp eax, esi
je 0x42418f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x38]
lea esi, [edi + 0x1c]
push ecx
mov dword [edi + 0xc], ebp
call fcn.00425ed0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [edi + 0x4c], eax
lea ebx, [edi + 0x34]
lea eax, [esp + 0x44]
mov dword [edi + 0x48], edx
call fcn.004044d0
mov eax, ebx
call fcn.004041b0
lea ebx, [edi + 0x38]
lea eax, [esp + 0x48]
call fcn.004044d0
mov eax, ebx
call fcn.004041b0
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x14]
lea ebx, [edi + 0x50]
push ebx
push ebp
call edx
cmp dword [ebx], 0
jne 0x4241f4
push str._iTotals__0
push 0x40
call fcn.004025a0
add esp, 8
mov eax, dword [esp + 0x4c]
mov dword [edi + 0x54], eax
mov eax, dword [edi + 0x3c]
add edi, 0x3c
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x104
or eax, ecx
jge 0x424224
mov ecx, 0x104
mov eax, edi
call fcn.00404d80
mov eax, dword [edi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x42424d
push ecx
push eax
call fcn.0043ecbd
add esp, 8
test eax, eax
jl 0x424318
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x424318
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
mov ecx, esi
lea esi, [esp + 0x18]
call fcn.0041c430
mov byte [esp + 0x2c], 2
mov edx, dword [eax + 4]
test edx, edx
je 0x4242a8
mov esi, dword [eax]
cmp word [esi + edx*2 - 2], 0x5c
lea ecx, [esi + edx*2 - 2]
je 0x424293
cmp ecx, esi
je 0x424299
sub ecx, 2
cmp word [ecx], 0x5c
jne 0x424286
sub ecx, esi
sar ecx, 1
jmp 0x42429c
or ecx, 0xffffffff
dec edx
cmp ecx, edx
je 0x4242a8
push 0x5c
call fcn.004073c0
mov edx, dword [esp + 0x18]
push edx
call fcn.0043f105
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4242da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424302
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x1c
push 0x80070057
call fcn.004059f0
int3