joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10196920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 0x60], eax
mov edx, dword [edx]
push ebx
mov ebx, dword [esp + 0x74]
push esi
mov eax, dword [edx + 0x1c]
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
mov eax, dword [edx + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x20]
sub eax, dword [edx + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x30]
push edi
mov edi, dword [esp + 0x78]
sub eax, 4
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
push 1
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov word [esp + 0x3c], 0
mov byte [esp + 0x3f], 0
call fcn.10153c10
cmp eax, 6
je 0x10196b02
movss xmm1, dword [0x103000e8]
nop
cmp eax, 5
ja case.0x101969b9.3
jmp dword [eax*4 + 0x10196b14]
push ebx
push edi
push 1
lea edx, [esp + 0x58]
lea ecx, [esp + 0x40]
call fcn.10196790
add esp, 0xc
lea ecx, [esp + 0xc]
push 0
push 0
push esi
call fcn.10194ac0
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push 0
xorps xmm2, xmm2
mov eax, dword [eax + 0x28]
mov dword [esi + 4], eax
call fcn.10153460
movss xmm0, dword [esp + 0x34]
mov cl, 2
movss dword [eax], xmm0
movss xmm0, dword [esp + 0x38]
movss dword [eax + 4], xmm0
lea eax, [esi + 0xa]
mov byte [esi + 9], 0
xchg byte [eax], cl
jmp case.0x101969b9.3
movss xmm0, dword [esp + 0x54]
lea edx, [esp + 0x4c]
addss xmm0, dword [esp + 0x4c]
mulss xmm0, xmm1
movss dword [esp + 0x4c], xmm0
movss xmm0, dword [esp + 0x58]
addss xmm0, dword [esp + 0x50]
mulss xmm0, xmm1
movss dword [esp + 0x50], xmm0
push ebx
push edi
push 2
lea ecx, [esp + 0x40]
call fcn.10196790
movss xmm0, dword [esp + 0x4c]
add esp, 8
movss xmm3, dword [esp + 0x40]
mov ecx, esi
movss xmm2, dword [esp + 0x3c]
movss xmm1, dword [esp + 0x38]
movss dword [esp], xmm0
call fcn.10155230
jmp case.0x101969b9.3
lea edx, [esp + 0x54]
jmp 0x10196a4d
push ebx
push edi
push 3
lea edx, [esp + 0x60]
lea ecx, [esp + 0x40]
call fcn.10196790
movss xmm0, dword [esp + 0x54]
mov ecx, esi
movss xmm3, dword [esp + 0x48]
movss xmm2, dword [esp + 0x44]
movss xmm1, dword [esp + 0x40]
movss dword [esp + 8], xmm0
movss xmm0, dword [esp + 0x50]
movss dword [esp + 4], xmm0
movss xmm0, dword [esp + 0x4c]
movss dword [esp], xmm0
call fcn.10155480
jmp case.0x101969b9.3
mov ecx, esi
call fcn.10155540
push 0
push 1
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.10153c10
movss xmm1, dword [0x103000e8]
cmp eax, 6
jne 0x101969b0
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.102af935
add esp, 0x68
ret
Function at 0x101b4b60
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push ecx
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x101b4c04
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x101b4c04
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x101b4c04
mov ecx, dword [esp + 0x10]
jg 0x101b4c04
test ecx, ecx
jb 0x101b4c04
test eax, eax
jg 0x101b4c04
jl 0x101b4bb0
cmp ecx, 0xffffffff
ja 0x101b4c04
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x101b4bf2
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x101b4bf2
mov eax, dword [esp + 0x10]
push esi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101efcb0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sar dword [esp + 4], 3
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov ebp, ecx
push edi
sub ebp, edx
movzx eax, word [edx]
lea edx, [edx + 2]
movzx ecx, word [edx + ebp - 2]
mov esi, eax
and esi, 0x7e0
mov edi, ecx
and edi, 0x7e0
shl esi, 0x10
shl edi, 0x10
or esi, eax
or edi, ecx
and esi, 0xfffff81f
and edi, 0xfffff81f
dec ebx
sub edi, esi
imul edi, dword [esp + 0x14]
shr edi, 5
add edi, esi
mov eax, edi
shr eax, 0x10
xor eax, edi
and eax, 0x7e0
xor eax, edi
mov word [edx - 2], ax
test ebx, ebx
jg 0x101efcc1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10222a70
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp byte [0x10372ac2], 0
jne 0x10222ad7
push esi
or eax, 0xffffffff
mov esi, 0x1036a39c
lock xadd dword [esi], eax
test eax, eax
jg 0x10222a9b
mov ecx, esi
call fcn.10172c80
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x10372ac2], 0
jne 0x10222ab6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10372ae0], eax
mov byte [0x10372ac2], 1
mov eax, 1
lock xadd dword [esi], eax
test eax, eax
jns 0x10222ad6
mov ecx, esi
call fcn.10172c80
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop esi
push dword [0x10372ae0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret

Function at 0x10222b00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 3
je 0x10222b0d
test eax, eax
jne 0x10222b61
cmp byte [0x10372ac2], 0
je 0x10222b61
push esi
push dword [0x10372ae0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10222b60
push edi
nop word [eax + eax]
mov eax, dword [esi + 0xc]
mov edi, dword [esi]
test eax, eax
je 0x10222b41
push dword [esi + 4]
call eax
add esp, 4
push 0x10
push esi
call fcn.102afea2
add esp, 8
mov esi, edi
test edi, edi
jne 0x10222b30
push edi
push dword [0x10372ae0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
ret 0xc
Function at 0x102ace10
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x102acf0a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x102acf03
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x102acee9
call ebx
cmp dword [ebp - 0x14], eax
jne 0x102acee9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x102acee9
mov edx, dword [esi]
test edx, edx
jne 0x102aceb2
push 0x200
push edx
push dword [0x1036f60c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x102acf03
jmp 0x102acedd
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x102acedd
shl eax, 3
push eax
push edx
push 0
push dword [0x1036f60c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x102acf03
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x102ace71
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x102acf4f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x102acf4f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x102acf49
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.102acba0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x102acf16
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102af935
mov esp, ebp
pop ebp
ret

Function at 0x102acf60
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x102acfae
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x102acf9e
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x102acf95
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x102acf72
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x1036f60c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x102acfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10372ff0]
mov al, byte [esi + 0x14]
mov edi, dword [esi]
and al, 1
je 0x102acfcc
sub edi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x102acff4
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x102ad00f
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10e69058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10e691a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10e6907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e6906a
add dl, dl
jne 0x10e69089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e690dc
xor eax, eax
add dl, dl
jne 0x10e69096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10e6917d
add dl, dl
jne 0x10e690a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e690b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e690bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e690c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10e690d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10e69075
mov eax, 1
add dl, dl
jne 0x10e690ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10e690f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e690e1
sub eax, ebx
mov ebx, 1
jne 0x10e69128
mov ecx, 1
add dl, dl
jne 0x10e6910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e69119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e69105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e69075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10e6913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10e6914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10e69136
cmp eax, 0x7d00
jae 0x10e6916d
cmp eax, 0x500
jb 0x10e69168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e69075
cmp eax, 0x7f
ja 0x10e69170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10e69075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10e6919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10e69075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4401a4
Capabilities:
Parse pe header

Disassembly:
push 0x14
push 0x4abfd0
call fcn.004461c0
call fcn.00448abe
movzx esi, ax
push 2
call fcn.004488ba
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x44005b
xor ebx, ebx
jmp 0x44008e
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x440057
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x440057
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x44008e
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call 0x4480b8
test eax, eax
jne 0x4400a2
push 0x1c
call fcn.0044017d
pop ecx
call fcn.00448025
test eax, eax
jne 0x4400b3
push 0x10
call fcn.0044017d
pop ecx
call fcn.004489a3
and dword [ebp - 4], 0
call fcn.004480cd
test eax, eax
jns 0x4400cd
push 0x1b
call fcn.0044017d
pop ecx
call dword [0x48418c]
mov dword [0x4ba968], eax
call fcn.004489e3
mov dword [0x4b80ac], eax
call fcn.00448381
test eax, eax
jns 0x4400f3
push 8
call fcn.00446df9
pop ecx
call fcn.004485be
test eax, eax
jns 0x440104
push 9
call fcn.00446df9
pop ecx
push 1
call int.00446e33
pop ecx
test eax, eax
je 0x440117
push eax
call fcn.00446df9
pop ecx
call fcn.00448e3c
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x440139
push esi
call fcn.0044709c
call fcn.00446e24
jmp 0x44016e
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00446205
ret
call fcn.00448907
jmp 0x44002d

Function at 0x466800
Capabilities:
Encode data using xor

Disassembly:
rcl byte [eax]
fsubrp st(1)
pop es
sub ebx, edi
test eax, 0xd3464d07
pop edx
in al, 0xbd
invalid

Function at 0x4730c0
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
sub byte [eax - 0x73], dl
mov edx, 0xd8e56524
lea edi, [edx - 0x271a9adc]
mov bl, byte [eax]
xlatb
dec ebp
xlatb
in eax, 0xca
sahf
xor dword [ecx], esi
cld
push esi
mov ah, 0x38
mov dword [eax - 0x57565c1c], esi
mov dl, 0x80
mov bl, 0x60
mov cl, 2
imul ebp, dword [ebx + 0x7b8c332c], 0x845d4202
or ch, bl
dec edi
push ebx
jg 0x4730c3
enter 0xffffffffffffff07, 0x31
dec ebp
xor eax, 0x424518e9
enter 0x2943, 0x6e
jnp 0x473131
dec ebp
mov word [edi + ebp*8 - 0x60], ss
pop eax
adc eax, 0x361d1370
dec ecx
mov byte [ebx], dl
popal
out dx, eax
cmp al, 0x6d
mov word [edi - 0x1700523b], cs
push eax
dec edx
mov esp, 0xee35f684
jecxz 0x473107
lahf
leave
cmp dword [eax + ecx*8 + 0x51], 0x42400751
inc eax
inc edx
Function at 0x40ce38
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004078cb
mov dword [ebp - 0x14], eax
cmp dword [0x453d98], esi
jne 0x40cf2b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40ceb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d00b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d00b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d00b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x453d98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x453d9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x453da0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x453da8], eax
test eax, eax
je 0x40cf28
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x453da4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cf50
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cf43
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cf65
push 4
pop eax
jmp 0x40d00d
cmp dword [ebp - 0x14], esi
je 0x40cf65
push dword [0x453d98]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cf4a
mov eax, dword [0x453da4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cfc3
cmp dword [0x453da8], edi
je 0x40cfc3
push eax
call ebx
push dword [0x453da8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cfc3
test eax, eax
je 0x40cfc3
call ecx
test eax, eax
je 0x40cfb8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cfb8
test byte [ebp - 8], 1
jne 0x40cfc3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cff3
mov eax, dword [0x453d9c]
cmp eax, edi
je 0x40cff0
push eax
call ebx
test eax, eax
je 0x40cff0
call eax
mov esi, eax
test esi, esi
je 0x40cff0
mov eax, dword [0x453da0]
cmp eax, edi
je 0x40cff0
push eax
call ebx
test eax, eax
je 0x40cff0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x453d98]
call ebx
test eax, eax
je 0x40d00b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d00d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041de
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x850
push ebx
push ebp
push esi
mov esi, dword [esp + 0x860]
xor ebx, ebx
push 0x7f00
push ebx
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x401be0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x30], 6
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x3c], str.PostBuild
mov dword [esp + 0x40], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push ebx
push esi
push ebx
push ebx
push ebx
push 0x80000000
push ebx
push 0x80000000
push 0xcf0000
push str.PostBuild
push str.PostBuild
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebp, ebx
jne 0x4010ad
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x850
ret 0x10
mov edx, dword [esp + 0x868]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x40b74c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ax, word [0x409088]
and ecx, 3
mov word [esp + 0x10], ax
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x409084]
mov word [esp + 0x12], cx
lea ecx, [esp + 0x12]
push ecx
push edx
call fcn.00401fee
add esp, 8
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.install
push esi
call edi
test eax, eax
jne 0x401125
push ebx
push ebx
push 0x5f5
jmp 0x40114d
push str.uninstall
push esi
call edi
test eax, eax
jne 0x40113a
push ebx
push ebx
push 0x5f6
jmp 0x40114d
push str.patch
push esi
call edi
test eax, eax
jne 0x401154
push ebx
push ebx
push 0x5f7
push ebp
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40b74c
lea eax, [esp + 0x64]
push str._PostBuild___s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea edx, [esp + 0x4c]
push ebx
push edx
call esi
test eax, eax
je 0x4011dc
mov edi, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x44]
push eax
push ebx
push ecx
call edi
test eax, eax
jne 0x4011ce
lea edx, [esp + 0x44]
push edx
call ebp
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea ecx, [esp + 0x4c]
push ebx
push ecx
call esi
test eax, eax
jne 0x4011ab
push 0x409040
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov eax, dword [esp + 0x44]
pop ebp
pop ebx
add esp, 0x850
ret 0x10
Function at 0x401480
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x81c]
xor ebp, ebp
stosw word es:[edi], ax
push esi
mov dword [esp + 0x18], ebp
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401588
mov ax, word [0x409084]
mov cx, word [0x409088]
lea edx, [esp + 0x12]
xor edi, edi
push edx
push esi
mov word [esp + 0x1a], ax
mov word [esp + 0x18], cx
call fcn.00401fee
mov ebx, dword [sym.imp.SHLWAPI.dll_StrTrimA]
add esp, 8
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test esi, esi
je 0x401588
mov eax, edi
dec eax
je 0x401528
dec eax
je 0x40151b
dec eax
jne 0x401535
push esi
lea ecx, [esp + 0x1c]
push 0x409128
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x401535
push esi
call fcn.00402115
add esp, 4
mov ebp, eax
jmp 0x401535
push esi
call fcn.00402115
add esp, 4
mov dword [esp + 0x14], eax
lea edx, [esp + 0x12]
inc edi
push edx
push 0
call fcn.00401fee
add esp, 8
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test esi, esi
jne 0x4014fa
cmp dword [esp + 0x14], 1
jne 0x401588
push ebp
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.00401cc0
add esp, 8
push str._PostBuild__UnInstallHandler_Done
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret