joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f741
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x481564]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call 0x4a522f
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14

Function at 0x430745
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in al, dx
add byte [eax], al
add byte [ebp + 0xa], bh
push 0xf
call dword [0x481588]
jmp 0x4306cc
push eax
lea ecx, [esp + 0x88]
call 0x4a6477
mov al, byte [esp + 0xf0]
mov esi, dword [esp + 0xdc]
test al, 0x20
mov byte [esp + 0xd4], 1
je 0x430753
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x54], eax
and al, 0x54
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x50], edx
test eax, eax
mov dword [esp + 0x58], ecx
je 0x43072f
push eax
lea edx, [esp + 0x50]
lea eax, [esp + 0x50]
push edx
push eax
call dword [0x481564]
mov ecx, dword [esp + 0x88]
lea eax, [esp + 0x84]
mov edx, dword [esi + 4]
neg eax
sbb eax, eax
and eax, ecx
invalid
lea ecx, [esp + 0x4c]
dec esp
and al, 0x4c

Function at 0x430a4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add al, ch
inc eax
leave
add al, byte [eax]
test eax, eax
mov dword [esp + 0x18], eax
je 0x430dd5
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
neg eax
push eax
push eax
push edx
call dword [0x48155c]
mov ecx, dword [esi + 8]
lea eax, [esp + 0x2c]
push 2
push eax
push ecx
call dword [0x481158]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x34]
push 0
push 0
push 0
push 0
call dword [0x481120]
mov ecx, dword [esi + 4]
mov ebx, eax
push ebx
push ecx
mov dword [esp + 0x94], ebx
call dword [0x4810a0]
mov ebp, eax
test dword [edi + 0x27], ecx
push eax
add byte [eax], al
add byte [eax], al
dec ebp
mov dword [esp + 0x4c], vtable.CRgn.0
neg ebp
sbb ebp, ebp
inc ebp
mov dword [esp + 0x3c], ebp
mov edx, dword [esp + 0x14]
mov byte [esp + 0xd4], 7
test byte [edx + 0x44], 8
je 0x430aef
mov eax, edx
mov ecx, dword [eax + 0x6c]
test ecx, ecx
jne 0x430b12
lea ecx, [esp + 0x2c]
push ecx
call dword [0x481098]
push eax
lea ecx, [esp + 0x50]
call 0x4a67e5
lea edx, [esp + 0x4c]
push 1
push edx
mov ecx, esi
Function at 0x432897
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x58]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00471436
add esp, 0xc
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x74]
push edx
call fcn.0045fb27
mov eax, dword [esp + 0x34]
push 1
push edi
push eax
mov byte [esp + 0x70], 2
call dword [0x48115c]
cmp ebx, 0xffffffff
je 0x432963
mov ebp, dword [esp + 0x78]
mov eax, dword [edi + 4]
cmp ebp, eax
out dx, eax
lodsb al, byte [esi]
or eax, 0x53000001
mov ecx, esi
call fcn.0045fb8a
mov ecx, dword [edi + 4]
mov dword [esp + 0x78], eax
neg ebp
push ebp
push ecx
mov ecx, esi
call fcn.0045ff6c
mov edx, dword [esp + 0x78]
push eax
push edx
mov ecx, esi
call fcn.0045ff79
cmp eax, 0x14
jge 0x432915
mov eax, 0x14
jmp 0x43292e
mov eax, dword [edi + 4]
push ebp
push eax
mov ecx, esi
call fcn.0045ff91
mov ecx, dword [esp + 0x78]
push eax
push ecx
mov ecx, esi
call fcn.0045ff9e
cmp eax, dword [esp + 0x78]
invalid
invalid
mov ah, 0
invalid

Function at 0x439c45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 1
add al, 4
add al, 4
add al, byte [ebx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0xb4]
mov ebp, dword [esi + 0x94]
push edi
add ebp, 9
mov cx, word [eax]
add eax, 2
mov dword [esi + 0x60], ecx
mov dword [esi + 0xb4], eax
mov dx, word [eax]
add eax, 2
xor ecx, ecx
Function at 0x439dea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x58]
imul eax, ecx
mov dword [esi + 0x98], eax
add eax, 0x6428
push eax
mov byte [esi + 0x3d], dl
mov dword [esi + 0x94], ebp
call 0x4a8981
mov edx, dword [esi + 0x98]
mov edi, eax
add esp, 4
mov dword [esp + 0x24], edi
lea eax, [edi + 0x28]
lea ecx, [eax + 0x400]
mov dword [esi + 0xac], ecx
add ecx, edx
mov dword [esp + 0x30], ecx
add ecx, 2
mov edx, 0x1000
xor ebx, ebx
mov word [ecx + 2], bx
mov word [ecx], bx
add ecx, 6
dec edx
jne 0x439d00
mov dword [edi], 0x28
mov ecx, dword [esi + 0x54]
mov dword [edi + 4], ecx
mov edx, dword [esi + 0x58]
neg edx
mov ecx, 0x100
mov dword [edi + 8], edx
mov word [edi + 0xc], 1
mov word [edi + 0xe], 8
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], ecx
mov cl, byte [esi + 0x3d]
test cl, 0x80
je 0x439df0
and ecx, 7
mov edi, 1
inc ecx
shl edi, cl
cmp dword [esi + 0x88], ebx
je 0x439d8d
mov ecx, dword [esi + 0x8c]
mov edx, dword [esi + 0xb4]
lea ecx, [ecx + ecx*2]
lea ebp, [ecx + edx]
xor ecx, ecx
xor edx, edx
mov ch, byte [ebp + 2]
mov dl, byte [ebp]
mov cl, byte [ebp + 1]
shl ecx, 8
or ecx, edx
mov dword [esi + 0xa0], ecx
mov edx, dword [esi + 0x94]
lea ecx, [edi + edi*2]
add edx, ecx
cmp edi, ebx
mov dword [esi + 0x94], edx
jbe 0x439e53
mov edx, dword [esi + 0xb4]
add eax, 4
mov cl, byte [edx]
mov byte [eax - 2], cl
mov edx, dword [esi + 0xb4]
inc edx
mov ecx, edx
mov dword [esi + 0xb4], edx
mov dl, byte [ecx]
mov byte [eax - 3], dl
mov ecx, dword [esi + 0xb4]
inc ecx
mov dword [esi + 0xb4], ecx
mov cl, byte [ecx]
mov byte [eax - 4], cl
mov ebp, dword [esi + 0xb4]
inc ebp
dec edi
mov dword [esi + 0xb4], ebp
mov byte [eax - 1], 0
inc dword [eax]
jne 0x439da6
jmp 0x439e53
mov ecx, dword [esi + 0x88]
mov edi, dword [esi + 0xa8]
cmp ecx, ebx
Function at 0x439dfe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x439e23
mov ebp, dword [esi + 0x8c]
xor ecx, ecx
lea edx, [edi + ebp*2]
add ebp, edx
xor edx, edx
mov ch, byte [ebp + 2]
mov dl, byte [ebp]
mov cl, byte [ebp + 1]
shl ecx, 8
or ecx, edx
mov dword [esi + 0xa0], ecx
mov edx, dword [esi + 0x80]
xor ecx, ecx
cmp edx, ebx
jle 0x439e53
mov dl, byte [edi]
inc edi
mov byte [eax + 2], dl
add eax, 4
mov dl, byte [edi]
inc edi
mov byte [eax - 3], dl
mov dl, byte [edi]
mov byte [eax - 1], 0
mov byte [eax - 4], dl
mov edx, dword [esi + 0x80]
inc edi
inc ecx
cmp ecx, edx
jl 0x439e2f
mov eax, dword [esi + 0xb4]
xor ecx, ecx
mov edx, 1
mov cl, byte [eax]
inc eax
mov dword [esi + 0xb4], eax
mov eax, dword [esi + 0x94]
inc eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x94], eax
mov eax, edx
shl eax, cl
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x3c], 0
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x7c], ebx
add eax, 2
mov dword [esi + 0x78], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
dec eax
inc ecx
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x40]
inc eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], ebx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x40]
cmp eax, ecx
jb 0x439eef
mov dl, byte [esi + 0x3c]
mov bl, 1
shl bl, cl
mov ecx, edx
and ecx, 0xff
dec bl
and ebx, 0xff
and ebx, ecx
mov cl, byte [esi + 0x40]
shr dl, cl
mov ecx, dword [esi + 0x40]
mov ebp, ebx
mov dword [esp + 0x38], ebp
sub eax, ecx
mov byte [esi + 0x3c], dl
jmp 0x473f91
mov edi, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
xor edx, edx
cmp ecx, edi
mov dl, byte [esi + 0x3c]
mov ebp, edx
jb 0x439f65
mov ecx, dword [esi + 0xb4]
xor edx, edx
mov ebx, dword [esi + 0x94]
mov dl, byte [ecx]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], edx
mov edi, dword [esi + 0x50]
lea edx, [ecx + 1]
lea ecx, [edi + 1]
mov dword [esi + 0xb4], edx
add ebx, ecx
mov dword [esi + 0x94], ebx
mov ecx, ebx
cmp ecx, dword [esi + 0x74]
jle 0x439f4a
sub ecx, edi
dec ecx
or dl, 0xff
mov dword [esi + 0x94], ecx
mov byte [esp + 0x28], dl
jmp 0x439f7f
test edi, edi
jne 0x439f65
dec edx
dec ecx
mov dword [esi + 0xb4], edx
or dl, 0xff
mov dword [esi + 0x94], ecx
mov byte [esp + 0x28], dl
jmp 0x439f7f
mov ecx, dword [esi + 0x4c]
inc ecx
mov dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0xb4]
mov dl, byte [ecx]
inc ecx
mov byte [esp + 0x28], dl
mov dword [esi + 0xb4], ecx
mov ecx, dword [esi + 0x40]
Function at 0x439f82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esi + 0x3c], dl
sub ecx, eax
cmp ecx, 8
ja 0x439fd0
mov cl, byte [esi + 0x40]
mov bl, byte [esi + 0x48]
sub cl, bl
mov bl, 1
shl bl, cl
mov byte [esp + 0x13], cl
mov ecx, dword [esp + 0x28]
and ecx, 0xff
dec bl
and ebx, 0xff
and ebx, ecx
mov ecx, eax
shl ebx, cl
mov cl, byte [esp + 0x13]
shr dl, cl
add ebp, ebx
mov dword [esp + 0x38], ebp
mov edx, dword [esp + 0x28]
mov ecx, eax
and edx, 0xff
shl edx, cl
mov ecx, dword [esi + 0x4c]
add ebp, edx
cmp ecx, edi
jb 0x43a045
mov ecx, dword [esi + 0xb4]
mov ebx, dword [esi + 0x94]
xor edx, edx
mov dl, byte [ecx]
lea edi, [ecx + 1]
mov dword [esi + 0x50], edx
mov dword [esi + 0xb4], edi
lea ecx, [edx + 1]
mov dword [esi + 0x4c], 0
invalid

Function at 0x43a19e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dl, 1
shl dl, cl
mov byte [esp + 0x13], cl
mov ecx, dword [esp + 0x1c]
and ecx, 0xff
dec dl
and edx, 0xff
and edx, ecx
mov ecx, eax
shl edx, cl
mov cl, byte [esp + 0x13]
add ebx, edx
mov dl, byte [esp + 0x1c]
shr dl, cl
mov byte [esi + 0x3c], dl
mov edx, dword [esi + 0x40]
sub eax, edx
add eax, 8
mov dword [esi + 0x48], eax
jmp 0x43a237
mov eax, dword [esp + 0x14]
mov edx, ebx
and edx, 0xffff
mov dword [esp + 0x20], ebx
cmp edx, eax
jg 0x43a7d5
test byte [esi + 0x3d], 0x40
je 0x43a2c1
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x54]
cmp eax, ecx
jne 0x43a2a7
mov eax, dword [esi + 0x64]
mov eax, dword [esi + 0x6c]
mov edx, dword [esi + 0x78]
imul eax, dword [esi + 0x68]
mov ecx, dword [esi + 0xac]
add eax, edx
mov byte [ecx + eax], bl
mov ecx, dword [esi + 0x78]
jmp 0x43a2e5
mov edx, dword [esi + 0x78]
mov eax, dword [esi + 0x54]
cmp edx, eax
jne 0x43a2d9
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x78], 0
inc eax
mov dword [esi + 0x7c], eax
mov eax, dword [esi + 0x7c]
mov ecx, dword [esi + 0x78]
imul eax, dword [esi + 0x6c]
add eax, ecx
inc ecx
mov dword [esi + 0x78], ecx
mov ecx, dword [esi + 0x98]
cmp eax, ecx
jg 0x439eb4
mov ecx, dword [esi + 0xac]
mov byte [ecx + eax], bl
jmp 0x4741b9
mov edx, dword [esp + 0x24]
push edx
call 0x4a94b7
add esp, 4
invalid

Function at 0x43a262
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esi + 0x78], 0
cmp eax, 1
jne 0x43a272
add dword [esi + 0x68], 8
cmp eax, 2
jne 0x43a27b
add dword [esi + 0x68], 8
cmp eax, 3
jne 0x43a284
add dword [esi + 0x68], 4
cmp eax, 4
jne 0x43a28d
add dword [esi + 0x68], 2
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x58]
cmp ecx, edx
jl 0x43a2a7
lea ecx, [eax + 1]
mov edx, 0x10
sar edx, cl
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx

Function at 0x44024d
Capabilities:
Access peb ldr_data

Disassembly:
dec esp
and al, 0x10
push ecx
push eax
push 0x4e
push edx
call ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
invalid
outsb dx, byte [esi]
out dx, eax
push es

Function at 0x447099
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jle 0x4470a9
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x4470a9
lea eax, [edx - 1]
neg eax
Function at 0x44721e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
jle 0x447230
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x447230
lea eax, [edx - 1]
neg eax
Function at 0x452a70
Capabilities:
Read data from internet
Receive data

Disassembly:
sub eax, dword [0x85f08b00]
div byte [ebp + 0x51]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
mov dword [ebp - 0x6c], 0x528a4c
call 0x4a57fc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call 0x4c1a06
lea ecx, [ebp - 0x18]
jo 0x452a9f
add eax, 0x6ef6ee8
add byte [ebp + 0x45c6e44d], cl
cld
add ebp, eax
outsb dx, byte [esi]
out dx, eax
push es
add byte [ebp + 0x45c6084d], cl
cld
add ch, al
outsb dx, byte [esi]
out dx, eax
push es
add byte [ebp + 0x45c6e04d], cl
cld
add eax, ebp
outsb dx, byte [esi]
out dx, eax
push es
add bl, ch
inc ecx
mov edi, dword [0x4816ac]
call 0x4c1a12
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call 0x4c1a1e
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call 0x4c1a2a
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call 0x4c1a36
jmp 0x452b0b
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x44]
push edx
push eax
push esi
push ebx
call edi
test eax, eax
je 0x452a79
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x452af0
mov dword [ebp - 0x38], 1
jmp 0x452a79
mov ecx, dword [ebp + 0xc]
push eax
push esi
call 0x4a58fa
invalid
add bl, ch
invalid
mov dword [ebp - 4], 0xffffffff
call 0x4c20a1
mov esi, dword [ebp - 0x2c]
xor edi, edi
cmp ebx, edi
je 0x452b27
push ebx
call dword [0x4816a8]
cmp esi, edi
je 0x452b32
push esi
call dword [0x4816a8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x30826c50
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3622651
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x64ef58
push eax
push dword fs:[0]
out dx, eax
add byte fs:[eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
and dh, byte es:[esp + ebp*4 - 0x23]
pop edx
enter 0xffffffffffffeae3, 0xffffffffffffff98
stosd dword es:[edi], eax
add eax, 0x6eeca138
out 0x20, eax
fcomp qword [edi + ecx*8 - 0x11]
aas
dec edi
sub bh, byte [eax + 0x37]
xor edx, dword [edx]
rol byte [eax + 0x43], 0xbe
call 0x994340fd
sub dword [edx + edx*8], 0x59
or byte [ebp + 0x4d], 0x13
mov ebp, 0x837088a5
in al, 0xcf
sti
sub dword [eax - 0x26fb9b57], esp
stosd dword es:[edi], eax
xlatb
mov byte [0xfd0f3f20], al
push ebp
cmp byte [esi + esi*2 - 0xf8a4bf2], dh
out dx, eax
in eax, 0x55
iretd
add dword [edi], eax
jp 0x401155
fnstenv [esi]
rcr dword [esi + ecx - 0x3170fcc3], 0xaa
dec ecx
cld
inc edx
inc eax
push ecx
lds edx, [ecx - 0x55b53a8b]
cld
test byte [ebp + edx*4 + 0x19], dh
push cs
loop 0x4010bd
add ebp, dword [ebp - 0x39]
jg 0x401198
fcom qword [0x6d805a99]
fidiv dword [ebx - 7]
inc ebp
movsd dword es:[edi], dword [esi]
xchg ecx, eax
rcl dl, cl
xor esp, dword [ecx - 0x3e5e23c6]
and cl, byte [edx - 0x55]
pop ss
cmp byte [ebp + 0x15], dl
aas
pop edx
sbb dl, dh
push ebp
adc eax, 0xd61a5a3f
dec edx
or al, dl
retf 0x6e55
invalid
Function at 0x4012d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
xor al, al
test edi, edi
mov dword [esi], 0
je 0x401357
mov edx, dword [ebx + 4]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 4]
push eax
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
push edx
call ebp
test eax, eax
jne 0x401354
cmp dword [esp + 8], 1
jne 0x401354
mov eax, dword [esp + 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MFC80U.DLL_Ordinal_265
add esp, 4
lea ecx, [esp + 4]
push ecx
push eax
push 0
push 0
mov dword [esi], eax
mov edx, dword [ebx + 4]
push edi
push edx
call ebp
test eax, eax
jne 0x401343
mov al, 1
pop ebp
add esp, 8
ret
mov eax, dword [esi]
push eax
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov dword [esi], 0
xor al, al
pop ebp
add esp, 8
ret

Function at 0x401a10
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x40bd23
mov eax, dword fs:[0]
push eax
mov eax, 0xfa18
call fcn.0040b760
mov eax, dword [0x412018]
xor eax, esp
mov dword [esp + 0xfa14], eax
mov eax, dword [0x412018]
xor eax, esp
push eax
lea eax, [esp + 0xfa1c]
mov dword fs:[0], eax
mov ecx, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xfa28], 0
push edi
mov dword [esp + 0x14], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [esp + 8]
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x401ae2
lea edx, [esp + 0x18]
push edx
push 0xfa00
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401ae2
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 8]
push ecx
push 0x40d7b4
lea edx, [esp + 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401ae2
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x10]
movzx ecx, word [ecx + 0x16]
push ecx
movzx edx, ax
push edx
shr eax, 0x10
push eax
push str._d._d_d
push esi
call dword [sym.imp.MFC80U.DLL_Ordinal_2311]
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0xfa1c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0xfa14]
xor ecx, esp
call fcn.0040b007
add esp, 0xfa24
ret
Function at 0x401e10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40ccb1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x412018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.SoftwareAutodeskHardcopy
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x28]
xor bl, bl
mov dword [esp + 0x28], 0x40dbac
mov dword [esp + 0x2c], edi
call dword [0x40dbb0]
mov dword [esp + 0x30], edi
cmp dword [esp + 0x24], edi
jne 0x401e7b
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
push 0x400
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
mov edx, dword [esp + 0x24]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x2c]
push ecx
push eax
push edi
push edx
mov dword [esp + 0x3c], 0x400
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov esi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_5398]
test esi, esi
jne 0x401f1c
add edi, 1
test bl, bl
jne 0x401f1c
mov ecx, dword [esp + 0x18]
call fcn.00401b10
push 0x400
lea ecx, [esp + 0x1c]
mov bl, al
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
mov edx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push eax
push edi
push edx
mov dword [esp + 0x3c], 0x400
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov esi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_5398]
test esi, esi
je 0x401ecb
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x20], 0x40dbac
je 0x401f3d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x403050
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403177
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push eax
call ebx
test eax, eax
jne 0x403177
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403177
push 0
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], 2
jne 0x403167
mov ax, word [esp + 0xc]
cmp ax, 0xfeff
jne 0x4030c6
mov dword [esi + 8], 3
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
cmp ax, 0xfffe
jne 0x4030db
mov dword [esi + 8], 4
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
cmp ax, 0xbbef
jne 0x40310d
lea eax, [esp + 0xb]
push eax
mov edx, 1
mov eax, esi
call fcn.00402ed0
cmp eax, 1
jne 0x403167
cmp byte [esp + 0xb], 0xbf
jne 0x403167
mov dword [esi + 8], 2
pop esi
mov al, al
pop ebx
add esp, 0xc
ret
test ax, ax
jne 0x403167
lea ecx, [esp + 0x10]
push ecx
mov edx, 2
mov eax, esi
call fcn.00402ed0
cmp eax, 2
jne 0x403167
mov ax, word [esp + 0xc]
test ax, ax
jne 0x40314b
cmp dword [esp + 0x10], 0xfffe
jne 0x403167
mov dword [esi + 8], 6
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
cmp ax, 0xfeff
jne 0x403167
cmp dword [esp + 0x10], 0
jne 0x403167
mov dword [esi + 8], 5
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x403177
push 0
push 0
push 0
push esi
call ebx
pop esi
xor al, al
pop ebx
add esp, 0xc
ret