joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
push esi
push edi
mov eax, str.XnaNative.dll
push str.GetNativeSystemInfo
xor edi, edi
push str.kernel32.dll
mov dword [esp + 0x84], str.SOFTWAREMicrosoftXNAFramework_v1.0
mov dword [esp + 0x88], str.SOFTWAREMicrosoftXNAFramework_v2.0
mov dword [esp + 0x8c], str.SOFTWAREMicrosoftXNAFramework_v3.0
mov dword [esp + 0x90], str.SOFTWAREMicrosoftXNAFramework_v3.1
mov dword [esp + 0x94], str.SOFTWAREMicrosoftXNAFramework_v4.0
mov dword [esp + 0x70], str.SOFTWAREWow6432NodeMicrosoftXNAFramework_v1.0
mov dword [esp + 0x74], str.SOFTWAREWow6432NodeMicrosoftXNAFramework_v2.0
mov dword [esp + 0x78], str.SOFTWAREWow6432NodeMicrosoftXNAFramework_v3.0
mov dword [esp + 0x7c], str.SOFTWAREWow6432NodeMicrosoftXNAFramework_v3.1
mov dword [esp + 0x80], str.SOFTWAREWow6432NodeMicrosoftXNAFramework_v4.0
mov dword [esp + 0x38], str.XnaNative1.dll
mov dword [esp + 0x3c], str.XnaNative2.dll
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], 8
mov dword [esp + 0x34], 0x10
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x41128b
xor ecx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], edi
call eax
mov eax, dword [esp + 0x44]
cmp ax, 9
je 0x411249
cmp ax, 6
jne 0x41128b
xor esi, esi
jmp 0x411250
mov eax, dword [esp + esi + 0x30]
mov ecx, dword [esp + esi + 0x68]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.004112d0
test al, al
je 0x41127d
mov ecx, dword [esp + esi + 0x1c]
or dword [ebx], ecx
add esi, 4
cmp esi, 0x14
jb 0x411250
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esp + esi + 0x30]
mov ecx, dword [esp + esi + 0x7c]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.004112d0
test al, al
je 0x4112bd
mov ecx, dword [esp + esi + 0x1c]
or dword [ebx], ecx
add esi, 4
cmp esi, 0x14
jb 0x411290
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x416c17
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x416cf4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a80]
inc ecx
sub edx, 8
sub esi, 1
jne 0x416c30
pop edi
test edx, edx
je 0x416d1b
jmp 0x416d00
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x466a80]
inc ecx
sub edx, 1
jne 0x416d00
not eax
pop esi
ret

Function at 0x416d20
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x466a80]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x466a80]
mov dword [edx + 8], ecx
ret

Function at 0x416d70
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x466a80]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x466a80]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x4174d0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x417502
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4174f8
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x417515
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0044a770
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x41c250
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2004]
mov eax, 0x2004
call fcn.00445900
push 0xffffffffffffffff
push 0x45970e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4747c0]
xor eax, ebp
mov dword [ebp + 0x2000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push str.session
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
call fcn.0042ff3e
push esi
push esi
push 0x600002
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x200c]
push esi
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00430bcd
mov ecx, dword [ebp + 0x2010]
push esi
push 0x80
push 2
push esi
push 2
push 0xc0000000
mov ebx, eax
push ecx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
jne 0x41c35b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00430730
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x200c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41c329
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x2010]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c491
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41c491
push 0x1ffe
lea edx, [ebp + 2]
xor ecx, ecx
push esi
push edx
mov word [ebp], cx
call fcn.004438f0
add esp, 0xc
mov dword [ebp - 0x1c], esi
mov eax, dword [ebx]
mov edx, dword [eax + 0x34]
push 0x1000
lea ecx, [ebp]
push ecx
mov ecx, ebx
call edx
push 0
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
jg 0x41c376
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
call fcn.00430730
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x200c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41c3dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x2010]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c491
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41c491
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2000]
xor ecx, ebp
call fcn.00440c2a
add ebp, 0x2004
mov esp, ebp
pop ebp
ret
Function at 0x41e250
Capabilities:
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x41e32b
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x41e284
cmp dword [esi + 0x40], edi
jae 0x41e284
push eax
call fcn.00421f78
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x41e29b
lea eax, [edi + edi]
push eax
call fcn.00421f83
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0044a770
add esp, 0xc
cmp edi, ebp
jbe 0x41e327
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4652a0]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4652a0]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x41e2b0
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x41e364
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x41e34c
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0044a770
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41e385
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x41e660
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
jne 0x41e66d
xor al, al
pop edi
ret
cmp dword [eax + 4], 0
je 0x41e669
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x41e560
push 0
push 0
call fcn.004421b5
mov edx, dword [edi]
mov dword [edx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], 0
jne 0x41e6c2
or esi, 0xffffffff
mov dword [eax + 0x10], esi
mov edi, dword [edi]
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x41e6b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
pop esi
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
xor al, al
pop edi
ret
mov byte [eax + 8], 1
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x41e6e4
mov esi, dword [edi]
call fcn.0041e5f0
mov edx, dword [edi]
mov byte [edx + 8], 0
pop esi
mov al, 1
pop edi
ret
Function at 0x451560
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00447763
and dword [ebp - 4], 0
cmp dword [0x478aa8], 0
mov ebx, eax
jne 0x451611
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4516c2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4516c2
push eax
call fcn.004476f1
mov dword [esp], 0x460bc8
push edi
mov dword [0x478aa8], eax
call esi
push eax
call fcn.004476f1
mov dword [esp], 0x460bb4
push edi
mov dword [0x478aac], eax
call esi
push eax
call fcn.004476f1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x478ab0], eax
call esi
push eax
call fcn.004476f1
pop ecx
mov dword [0x478ab8], eax
test eax, eax
je 0x451611
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004476f1
pop ecx
mov dword [0x478ab4], eax
mov eax, dword [0x478ab4]
cmp eax, ebx
je 0x451669
cmp dword [0x478ab8], ebx
je 0x451669
push eax
call fcn.0044776c
push dword [0x478ab8]
mov esi, eax
call fcn.0044776c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x451669
test edi, edi
je 0x451669
call esi
test eax, eax
je 0x451660
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x451660
test byte [ebp - 0xc], 1
jne 0x451669
or dword [ebp + 0x10], 0x200000
jmp 0x4516a2
mov eax, dword [0x478aac]
cmp eax, ebx
je 0x4516a2
push eax
call fcn.0044776c
pop ecx
test eax, eax
je 0x4516a2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4516a2
mov eax, dword [0x478ab0]
cmp eax, ebx
je 0x4516a2
push eax
call fcn.0044776c
pop ecx
test eax, eax
je 0x4516a2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x478aa8]
call fcn.0044776c
pop ecx
test eax, eax
je 0x4516c2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4516c4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4245bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1f0]
push edi
mov ebp, dword [esi + 0x3c]
mov eax, dword [esi + ebp + 0x78]
test eax, eax
je 0x4246c1
lea edi, [eax + esi]
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x4246c1
mov eax, dword [edi + 0x1c]
xor edx, edx
add eax, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x20]
add eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x24]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0xc]
add eax, esi
mov cl, byte [eax]
test cl, cl
je 0x424640
mov esi, dword [esp + 0x10]
lea edx, [esp + 0xe8]
sub edx, eax
or cl, 0x20
inc esi
mov byte [edx + eax], cl
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x424623
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1f4]
mov edx, dword [esp + 0x10]
push dword [esp + 0x204]
lea eax, [esp + 0xec]
mov byte [esp + edx + 0xec], 0
push dword [esp + 0x204]
push eax
call fcn.004264fa
mov dword [esp + 0x24], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, 0xfffffffc
mov dword [esp + 0x1c], edx
lea eax, [eax + ebx*4]
mov dword [esp + 0x10], eax
push dword [esp + 0x204]
mov ecx, dword [eax]
push dword [esp + 0x204]
add ecx, esi
push ecx
call fcn.004264fa
xor eax, dword [esp + 0x24]
add esp, 0xc
xor edx, dword [esp + 0x1c]
cmp eax, dword [esp + 0x1f8]
jne 0x4246b1
cmp edx, dword [esp + 0x1fc]
je 0x4246ce
mov eax, dword [esp + 0x10]
sub eax, 4
mov dword [esp + 0x10], eax
sub ebx, 1
jne 0x42467c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx eax, word [eax + ebx*2 - 2]
mov edx, dword [ecx + eax*4]
add edx, esi
cmp edx, edi
jb 0x42475a
mov eax, dword [esi + ebp + 0x7c]
add eax, edi
cmp edx, eax
jae 0x42475a
xor ecx, ecx
cmp byte [edx], cl
je 0x424711
lea ebx, [esp + 0x28]
mov edi, edx
sub ebx, edx
cmp ecx, 0x3c
jae 0x424711
mov al, byte [edi]
mov byte [ebx + edi], al
cmp al, 0x2e
je 0x424711
inc ecx
inc edi
cmp byte [edi], 0
jne 0x4246fc
inc edx
mov dword [esp + ecx + 0x29], 0x6c6c64
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x424739
lea edi, [esp + 0x68]
sub edi, ecx
cmp edx, 0x7f
jae 0x424739
mov al, byte [ecx]
inc edx
mov byte [edi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x424728
lea eax, [esp + 0x68]
mov byte [esp + edx + 0x68], 0
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push dword [esp + 0x1fc]
call fcn.00424761
add esp, 0x10
mov edx, eax
mov eax, edx
jmp 0x4246c3
Function at 0x424761
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], ecx
je 0x4247aa
mov ebx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4247c6
cmp dword [esi + 0x18], ebx
je 0x42479e
push ecx
push dword [ebp + 0x14]
push dword [esi + 0x18]
push edi
call fcn.0042635c
add esp, 0x10
mov ecx, eax
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
jne 0x424783
test ecx, ecx
jne 0x4247c6
push dword [ebp + 0x10]
push edi
call fcn.004262be
pop ecx
pop ecx
test eax, eax
je 0x4247c4
push dword [ebp + 0x14]
push eax
call dword [edi + 0x34]
mov ecx, eax
jmp 0x4247c6
xor ecx, ecx
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x4262be
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
xor ecx, ecx
push ebx
push esi
or ebx, 0xffffffff
push edi
cmp byte [edx], cl
je 0x4262e9
lea esi, [ebp - 0x40]
sub esi, edx
cmp ecx, 0x40
jae 0x4262e9
mov al, byte [edx]
inc ecx
mov byte [esi + edx], al
inc edx
cmp byte [edx], 0
jne 0x4262d8
cmp byte [ebp + ecx - 0x44], 0x2e
mov byte [ebp + ecx - 0x40], 0
je 0x426302
mov dword [ebp + ecx - 0x40], 0x6c6c642e
mov byte [ebp + ecx - 0x3c], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x18]
test esi, esi
je 0x426349
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
xor eax, eax
test ecx, ecx
je 0x42633f
mov eax, dword [ecx + esi + 0xc]
add eax, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0042698c
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
test ebx, ebx
je 0x426358
mov edi, dword [edi]
test ebx, ebx
jne 0x426311
test eax, eax
jne 0x426353
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x30]
pop edi
pop esi
pop ebx
leave
ret
mov eax, esi
jmp 0x426353
Function at 0x42635c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
xor esi, esi
test edi, edi
je 0x4264aa
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + edi + 0x78]
test eax, eax
je 0x4264aa
lea ebx, [eax + edi]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
add eax, edi
mov dword [esp + 0x10], eax
add edx, edi
mov eax, dword [ebx + 0x24]
add eax, edi
mov dword [esp + 0x1c], edx
cmp dword [esp + 0xac], esi
je 0x426496
mov ebp, dword [ebx + 0x18]
test ebp, ebp
je 0x4264aa
lea eax, [eax + ebp*2]
add eax, 0xfffffffe
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + ebp*4]
add eax, 0xfffffffc
mov dword [esp + 0x10], eax
mov eax, dword [eax]
push dword [esp + 0xac]
add eax, edi
push eax
call fcn.00426965
pop ecx
pop ecx
test eax, eax
jne 0x4263fb
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax]
mov esi, dword [ecx + eax*4]
add esi, edi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], 2
sub eax, 4
mov dword [esp + 0x10], eax
sub ebp, 1
je 0x426414
test esi, esi
je 0x4263d4
mov ecx, dword [esp + 0x18]
cmp esi, ebx
jb 0x426492
mov eax, dword [ecx + edi + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x426492
xor ecx, ecx
cmp byte [esi], cl
je 0x426449
lea ebx, [esp + 0x20]
mov edx, esi
sub ebx, esi
cmp ecx, 0x3c
jae 0x426449
mov al, byte [edx]
mov byte [ebx + edx], al
cmp al, 0x2e
je 0x426449
inc ecx
inc edx
cmp byte [edx], 0
jne 0x426434
mov dword [esp + ecx + 0x21], 0x6c6c64
xor edx, edx
inc ecx
add ecx, esi
cmp byte [ecx], dl
je 0x426471
lea esi, [esp + 0x60]
sub esi, ecx
cmp edx, 0x3f
jae 0x426471
mov al, byte [ecx]
inc edx
mov byte [esi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x426460
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x60], 0
push eax
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0xb0]
call fcn.00424761
add esp, 0x10
mov esi, eax
mov eax, esi
jmp 0x4264ac
mov eax, dword [esp + 0xb0]
sub eax, dword [ebx + 0x10]
mov esi, dword [edx + eax*4]
add esi, edi
jmp 0x426418
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret

Function at 0x4264b7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
jmp 0x4264ee
test ecx, ecx
jne 0x4264f5
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004245bc
mov esi, dword [esi]
add esp, 0x18
mov ecx, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4264ce
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4265c1
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov ecx, esi
ror eax, 8
mov esi, dword [esp + 0x28]
add eax, edx
ror esi, 8
xor eax, edi
add esi, edi
rol edx, 3
xor esi, ebx
rol edi, 3
xor edx, eax
mov dword [esp + 0x28], ebp
xor edi, esi
mov ebp, ecx
inc ebx
cmp ebx, 0x1b
jb 0x4265f2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10010790
Capabilities:
Get file size
Read file via mapping

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
test byte [0x10072078], 8
jne 0x10010920
test esi, esi
je 0x10010904
test ebx, ebx
je 0x10010904
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x10010904
lea eax, [ebp - 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
sub esp, 8
test eax, eax
je 0x100108f8
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100108f8
mov dword [esp], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
sub esp, 0x18
mov edi, eax
mov dword [esp], ebx
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
sub esp, 4
test edi, edi
je 0x10010904
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x1c], eax
mov dword [esp], edi
call ebx
mov edx, dword [ebp - 0x1c]
sub esp, 4
test edx, edx
je 0x10010904
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.gdiplus.dll_GdipPrivateAddMemoryFont
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov ebx, eax
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0x10]
mov ebx, 2
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str._p___s_n
mov dword [esp + 8], str.GdipPrivateAddFontFile
mov dword [esp + 4], 0x10072078
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x100107b6