joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401301
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x482503
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x490818], eax
mov dword [0x490814], ecx
mov dword [0x490810], edx
mov dword [0x49080c], ebx
mov dword [0x490808], esi
mov dword [0x490804], edi
mov word [0x490830], ss
mov word [0x490824], cs
mov word [0x490800], ds
mov word [0x4907fc], es
mov word [0x4907f8], fs
mov word [0x4907f4], gs
pushfd
pop dword [0x490828]
mov eax, dword [ebp]
mov dword [0x49081c], eax
mov eax, dword [ebp + 4]
mov dword [0x490820], eax
lea eax, [ebp + 8]
mov dword [0x49082c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x490768], 0x10001
mov eax, dword [0x490820]
mov dword [0x49071c], eax
mov dword [0x490710], 0xc0000409
mov dword [0x490714], 1
mov eax, dword [section..data]
mov dword [ebp - 0x328], eax
mov eax, dword [0x490354]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x490760], eax
push 1
call sub.MSVCR100_CLR0400.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x482604
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x490760], 0
jne 0x4825ef
push 1
call sub.MSVCR100_CLR0400.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x401fcc
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + ebx]
cmp eax, ecx
jb 0x402052
lea edx, [eax + ecx - 1]
mov dword [ebp + 8], edx
cmp edx, eax
jb 0x402052
lea edi, [ecx - 1]
not edi
mov edx, edi
and edx, dword [ebp + 8]
cmp edx, dword [esi + 8]
ja 0x42fae4
lea edx, [eax - 1]
cmp edx, ebx
jb 0x402052
mov eax, edi
and eax, edx
mov edx, dword [esi + 4]
lea ecx, [edx + ecx - 1]
cmp ecx, edx
jb 0x402052
and edi, ecx
cmp eax, edi
ja 0x402036
mov dword [esi + 4], ebx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
mov ecx, dword [esi]
mov ecx, dword [ecx]
push 4
push 0x1000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40202a
jmp 0x42faeb
call fcn.00433969
int3
xor al, al
jmp 0x40202f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42faff
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
call fcn.00424fc2
push 0x48b5bc
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], esi
call sub.MSVCR100_CLR0400.dll__CxxThrowException
int3
Function at 0x402ba6
Capabilities:
Get memory capacity

Disassembly:
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x2c]
je 0x401540
call fcn.00402ba6
test al, al
jne 0x427636
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00401410
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x3c
lea eax, [ebp - 0x44]
push 0
push eax
call sub.MSVCR100_CLR0400.dll_memset
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x427609
cmp dword [ebp - 0x44], 0x5f
ja 0x402c12
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
shrd ecx, eax, 2
shr eax, 2
cmp dword [ebp - 0x14], eax
ja 0x402c03
jb 0x402c12
mov eax, dword [ebp - 0x18]
cmp eax, ecx
jb 0x402c12
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401301
leave
ret
mov al, 1
jmp 0x402c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42761d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
call fcn.00424fc2
push 0x48b5bc
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], esi
call sub.MSVCR100_CLR0400.dll__CxxThrowException
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x28]
and eax, 0xfffffffc
cmp eax, 4
jne 0x42764b
mov dword [esi + 0x38], 0xa
push esi
call fcn.00432798
jmp 0x40152b

Function at 0x405df1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov cx, word [ebp + 0x10]
mov word [eax + 0x32], cx
push ebx
push esi
mov ecx, 0x7fff
mov esi, ecx
mov word [eax + 0x24], cx
mov word [eax + 0x22], si
push edi
mov ecx, 0xffff8000
mov esi, ecx
mov word [eax + 0x28], cx
xor ecx, ecx
mov word [eax + 0x7e], cx
mov word [eax + 0x2a], cx
mov word [eax + 0x2e], cx
mov cx, word [ebp + 0xc]
mov word [eax + 0x20], cx
xor ecx, ecx
mov word [eax + 0x3a], cx
mov word [eax + 0x3c], cx
mov word [eax + 0x3e], cx
mov word [eax + 0x40], cx
mov word [eax + 0x26], si
push 9
pop ecx
mov ebx, 0x405ed8
xor edx, edx
mov esi, ebx
lea edi, [eax + 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xffff
mov word [eax + 0x7c], cx
movzx ecx, word [ebp + 0x10]
imul ecx, ecx, 0x38
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0xc], edx
mov word [eax + 0x69], dx
mov byte [eax + 0x68], dl
mov dword [eax + 0x80], edx
mov byte [eax + 0x38], dl
mov dword [eax + 0x6c], edx
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov edx, dword [ebp + 8]
mov dword [eax + 0x1c], 3
mov dword [eax + 0x34], 2
mov edx, dword [edx + 8]
add ecx, edx
push 9
mov dword [eax + 0x84], ecx
xor edx, edx
mov word [ecx + 0x28], dx
pop ecx
mov esi, ebx
lea edi, [eax + 0x88]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov byte [eax + 0xac], 1
pop ebx
pop ebp
ret 0xc
Function at 0x40a3be
Capabilities:
Print debug messages

Disassembly:
cmp byte [ebp + 0x14], bl
je 0x40a41c
jmp 0x42d225
call fcn.004439d8
int3
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [edx], ebx
mov dword [esi], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x4057a8
cmp dword [eax + ecx*8 + 0x18], ebx
jbe 0x4057a8
push edi
mov edi, 0x7fffffff
cmp dword [ebp + 0x10], edi
ja 0x4057b6
mov ecx, dword [eax + ecx*8 + 0x14]
add ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0xc]
jb 0x4057b6
cmp ecx, edi
pop edi
ja 0x4057b6
push edx
push dword [ebp + 0x10]
push ecx
push dword [eax]
call dword [eax + 4]
mov dword [esi], eax
test eax, eax
je 0x42d206
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp byte [ebp + 0x14], bl
je 0x42d215
mov eax, 0x1408
jmp 0x40a41e
push 0x42d230
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40a41c
mov eax, 0x1409
jmp 0x40a41e
Function at 0x417b3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [eax]
test ecx, ecx
je 0x417b7e
xor edx, edx
ja 0x430b29
cmp esi, 0xffffffff
ja 0x430b29
mov edx, dword [eax + 8]
cmp esi, edx
ja 0x417b82
push ebx
mov ebx, edx
sub ebx, esi
cmp edi, ebx
pop ebx
ja 0x417b82
cmp dword [eax + 4], edx
jb 0x417b82
push esi
push dword [ebp + 8]
add ecx, edi
push ecx
call sub.MSVCR100_CLR0400.dll_memcpy
add esp, 0xc
pop ebp
ret 4
call dword [sym.imp.MSVCR100_CLR0400.dll_abort]
call fcn.00433969
int3
Function at 0x431320
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x484620
call fcn.00401298
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push dword [esi]
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
cmp dword [eax], edi
jne 0x431351
push dword [esi]
jmp 0x43143f
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call ebx
mov dword [ebp - 0x14], eax
push edi
push 0x80
push 2
push edi
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
push edi
add eax, 8
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x431397
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x10]
push ecx
call fcn.00425067
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
push edi
lea edx, [ebp - 0x10]
push edx
push eax
push ecx
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4313fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x4313d7
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0x28], eax
call fcn.00424fc2
mov eax, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 0x20], esi
push 0x4251cc
lea eax, [ebp - 0x28]
push eax
call sub.MSVCR100_CLR0400.dll__CxxThrowException
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
je 0x43142a
mov eax, 0x800703e3
push eax
mov dword [ebp - 0x28], eax
call fcn.00424fc2
mov eax, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 0x20], 0x3e3
jmp 0x4313f0
cmp esi, edi
je 0x431435
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call ebx
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0x10]
call fcn.00401424
call fcn.00401410
ret 0xc
Function at 0x4444b5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push 8
pop edi
cmp eax, edi
jae 0x4444d1
push 0x43113c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x44450d
movzx ecx, byte [esi + 4]
movzx edx, byte [esi + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 7]
push ebx
shl ecx, 8
or ecx, edx
push 0x30
add eax, 0xfffffff8
xor edx, edx
pop ebx
div ebx
cmp ecx, eax
jbe 0x444512
push 0x43113c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
pop ebx
pop edi
pop ebp
ret 0xc
test ecx, ecx
je 0x44450a
xor eax, eax
mov edx, edi
add edx, 0x2c
mov ebx, eax
adc ebx, eax
test ebx, ebx
ja 0x444580
jb 0x44452c
cmp edx, 0xffffffff
ja 0x444580
movzx edx, byte [edx + esi]
cmp word [ebp + 8], dx
jne 0x44456e
mov edx, edi
add edx, 0x2d
mov ebx, eax
adc ebx, eax
test ebx, ebx
ja 0x444580
jb 0x44454a
cmp edx, 0xffffffff
ja 0x444580
movzx edx, byte [edx + esi]
cmp word [ebp + 0xc], dx
jne 0x44456e
mov edx, edi
add edx, 0x2e
mov ebx, eax
adc ebx, eax
test ebx, ebx
ja 0x444580
jb 0x444568
cmp edx, 0xffffffff
ja 0x444580
cmp byte [edx + esi], 1
je 0x444585
dec ecx
add edi, 0x30
adc eax, 0
test eax, eax
ja 0x444580
jb 0x444512
cmp edi, 0xffffffff
jbe 0x444512
call fcn.004439d8
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov al, 1
jmp 0x44450c

Function at 0x444591
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push 8
pop ebx
cmp dword [ebp + 8], ebx
jae 0x4445af
push 0x43113c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x4445ff
movzx eax, byte [edi + 5]
push esi
movzx esi, byte [edi + 4]
shl esi, 8
or esi, eax
movzx eax, byte [edi + 6]
shl esi, 8
or esi, eax
movzx eax, byte [edi + 7]
shl esi, 8
or esi, eax
push 0x1c
mov eax, esi
pop ecx
mul ecx
test edx, edx
ja 0x444658
jb 0x4445e1
cmp eax, 0xffffffff
ja 0x444658
push eax
lea eax, [ebp - 4]
call fcn.004462d7
mov ecx, dword [ebp + 8]
cmp dword [eax], ecx
jbe 0x444604
push 0x43113c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
pop esi
pop ebx
leave
ret 0x10
test esi, esi
je 0x4445fc
xor eax, eax
mov ecx, ebx
add ecx, 0x18
mov edx, eax
adc edx, eax
test edx, edx
ja 0x444658
jb 0x44461e
cmp ecx, 0xffffffff
ja 0x444658
movzx ecx, byte [ecx + edi]
cmp word [ebp + 0xc], cx
jne 0x444646
mov ecx, ebx
add ecx, 0x19
mov edx, eax
adc edx, eax
test edx, edx
ja 0x444658
jb 0x44463c
cmp ecx, 0xffffffff
ja 0x444658
movzx ecx, byte [ecx + edi]
cmp word [ebp + 0x10], cx
je 0x44465d
dec esi
add ebx, 0x1c
adc eax, 0
test eax, eax
ja 0x444658
jb 0x444604
cmp ebx, 0xffffffff
jbe 0x444604
call fcn.004439d8
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov al, 1
jmp 0x4445fe
Function at 0x446c97
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, eax
movzx eax, word [esi + 0x22]
test ax, ax
je 0x446cbf
cmp eax, 2
je 0x446cbf
push 0x446e04
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 1]
push edx
lea edx, [ebp + 0xf]
push edx
lea edx, [esi + 0x30]
push edx
lea eax, [esi + 0x2e]
push eax
lea eax, [esi + 0x4a]
push eax
lea eax, [esi + 0x48]
push eax
lea eax, [esi + 0x46]
push eax
lea ecx, [esi + 0x44]
push ecx
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x2a]
push eax
push dword [esi + 4]
movzx eax, word [esi + 0x26]
push eax
movzx eax, word [esi + 0x24]
push eax
push dword [ebp + 8]
call fcn.00445820
test eax, eax
jne 0x446dfb
cmp byte [ebp + 0xf], al
jne 0x446d1b
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.0044833d
test eax, eax
jne 0x446dfb
movzx eax, word [esi + 0x22]
sub eax, 0
je 0x446d9a
dec eax
dec eax
je 0x446d32
mov eax, 0x1802
jmp 0x446dfb
push ecx
mov cx, word [esi + 0x2e]
mov eax, esp
mov word [eax], cx
lea eax, [ebp + 0xa]
push eax
call fcn.00448f75
movzx eax, word [eax]
shl eax, 6
neg eax
mov dword [edi], eax
movzx eax, word [esi + 0x44]
push ecx
mov ecx, esp
test ax, ax
jns 0x446d60
call fcn.004439d8
mov word [ecx], ax
lea eax, [ebp + 0xe]
push eax
call fcn.00448f75
movzx eax, word [eax]
shl eax, 6
neg eax
push ecx
mov cx, word [esi + 0x2c]
mov dword [ebx], eax
mov eax, esp
mov word [eax], cx
lea eax, [ebp - 2]
push eax
call fcn.00448f75
movzx eax, word [eax]
mov ecx, dword [ebp + 0x10]
shl eax, 6
sub eax, dword [ebx]
add eax, dword [edi]
mov dword [ecx], eax
jmp 0x446df9
push ecx
mov cx, word [esi + 0x2e]
mov eax, esp
mov word [eax], cx
lea eax, [ebp - 4]
push eax
call fcn.00448f75
movzx eax, word [eax]
shl eax, 6
mov dword [edi], eax
movzx eax, word [esi + 0x44]
push ecx
mov ecx, esp
test ax, ax
js 0x446d5b
mov word [ecx], ax
lea eax, [ebp - 6]
push eax
call fcn.00448f75
movzx eax, word [eax]
shl eax, 6
push ecx
mov cx, word [esi + 0x2c]
mov dword [ebx], eax
mov eax, esp
mov word [eax], cx
lea eax, [ebp - 8]
push eax
call fcn.00448f75
movzx eax, word [eax]
mov ecx, dword [edi]
shl eax, 6
sub ecx, eax
sub ecx, dword [ebx]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
pop esi
pop ebx
leave
ret 0xc

Function at 0x44d3dc
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x488050
call fcn.00401726
xor ebx, ebx
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x1c
push ebx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jl 0x44d44e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44d41a
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x218]
push ecx
mov edi, eax
call fcn.00402081
mov dword [esi], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], 1
mov eax, esi
call fcn.004013f7
ret
push edi
call fcn.00424fc2
push 0x48b5bc
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x21c], edi
call sub.MSVCR100_CLR0400.dll__CxxThrowException
int3
Function at 0x44d6d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [edi], 0
jne 0x44d6e9
xor al, al
leave
ret
mov ecx, dword [edi + 0x20]
push ebx
push esi
lea eax, [edi + 0xc]
call fcn.00419a7d
mov esi, dword [edi + 0x30]
sub esi, dword [edi + 0x28]
lea eax, [edi + 0x28]
call fcn.0040275f
mov eax, dword [edi + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x28]
lea esi, [edi + 0xc]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x10], eax
jb 0x44d729
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
jmp 0x44d72c
mov dword [ebp - 0xc], esi
cmp byte [edi], 0
mov eax, dword [edi + 4]
jne 0x44d739
call fcn.0044d61a
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x10]
lea ecx, [edi + 0x38]
push ecx
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0xc]
push dword [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x44d7b0
cmp eax, 0x103
je 0x44d7ce
cmp eax, 0xea
jne 0x44d7d2
mov eax, dword [ebp - 4]
mov ecx, dword [edi + 0x1c]
mov dword [ebp - 0x10], eax
cmp ecx, eax
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x10]
jb 0x44d77f
lea eax, [ebp - 0xc]
mov ecx, dword [eax]
mov eax, esi
call fcn.00419a7d
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp eax, ecx
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
jb 0x44d7a1
lea eax, [ebp - 0xc]
mov esi, dword [eax]
lea eax, [edi + 0x28]
call fcn.0040275f
jmp 0x44d713
mov ecx, dword [ebp - 4]
mov eax, esi
call fcn.00419a7d
mov esi, dword [ebp - 8]
lea eax, [edi + 0x28]
call fcn.0040275f
inc dword [edi + 8]
mov al, 1
pop esi
pop ebx
leave
ret
xor al, al
jmp 0x44d7ca
test eax, eax
jle 0x44d7e0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
call fcn.00424fc2
push 0x48b5bc
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
call sub.MSVCR100_CLR0400.dll__CxxThrowException
int3
Function at 0x4010c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor ecx, ecx
jmp 0x4010d0
mov eax, ecx
shr eax, 1
test cl, 1
je 0x4010de
xor eax, 0xedb88320
test al, 1
je 0x4010eb
shr eax, 1
xor eax, 0xedb88320
jmp 0x4010ed
shr eax, 1
test al, 1
je 0x4010fa
shr eax, 1
xor eax, 0xedb88320
jmp 0x4010fc
shr eax, 1
test al, 1
je 0x401109
shr eax, 1
xor eax, 0xedb88320
jmp 0x40110b
shr eax, 1
test al, 1
je 0x401118
shr eax, 1
xor eax, 0xedb88320
jmp 0x40111a
shr eax, 1
test al, 1
je 0x401127
shr eax, 1
xor eax, 0xedb88320
jmp 0x401129
shr eax, 1
test al, 1
je 0x401136
shr eax, 1
xor eax, 0xedb88320
jmp 0x401138
shr eax, 1
test al, 1
je 0x401145
shr eax, 1
xor eax, 0xedb88320
jmp 0x401147
shr eax, 1
mov dword [ebp + ecx*4 - 0x400], eax
add ecx, 1
cmp ecx, 0x100
jl 0x4010d0
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x401191
push ebx
push edi
jmp 0x401170
movzx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [ebp + edi*4 - 0x400]
add ecx, 1
cmp ecx, edx
jb 0x401170
pop edi
pop ebx
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401360
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x468], 0
push esi
push edi
mov dword [ebp - 0x218], 0
mov eax, str.BinAppLaunch.prf
jne 0x4013b0
mov eax, dword [ebx + 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebx + 0x480]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004029fc
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 4], 0
je 0x4013cf
push str.BinAppLaunch.prf
lea ecx, [ebx + 0x152]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x214], esi
jne 0x401400
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401489
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401418
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401489
push 0
push edi
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [ebp - 0x218], eax
jne 0x40143a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401489
push edi
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
lea edx, [edi - 4]
mov dword [ebx + 0x470], esi
call fcn.004010c0
cmp eax, dword [esi + edi - 4]
je 0x401468
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x401483
push ebx
call fcn.00401b70
test eax, eax
je 0x40147d
mov edi, ebx
call fcn.004014e0
test eax, eax
jne 0x401483
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x214]
mov eax, dword [ebx + 0x470]
test eax, eax
je 0x4014a4
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx + 0x470], 0
cmp dword [ebp - 0x218], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4014bc
mov eax, dword [ebp - 0x218]
push eax
call edi
cmp esi, 0xffffffff
je 0x4014c4
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004029fc
mov esp, ebp
pop ebp
ret
Function at 0x401540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0x50000080
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x401650
mov edx, dword [esi + 0x464]
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x290]
push edx
mov dword [esi + 0x460], ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov dword [ebp - 4], 0
add edi, 0x29c
lea esp, [esp]
mov eax, dword [esi + 0x468]
push 0x14
push 9
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [edi - 4]
mov dword [eax + 8], ecx
add dword [esi], 1
mov ecx, dword [ebp - 8]
push 0x401cf0
push eax
mov dword [eax + 0x10], esi
mov edx, dword [edi]
mov eax, dword [esi + 0x47c]
push edx
push eax
push ecx
call ebx
test eax, eax
jne 0x4015f3
add dword [esi], 0xffffffff
jne 0x4015ec
mov eax, esi
call fcn.004012a0
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
add dword [esi + 0x460], 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add eax, 1
add edi, 0xc
cmp eax, dword [edx + 0x290]
mov dword [ebp - 4], eax
jbe 0x4015a0
cmp dword [esi + 0x460], 0
jle 0x401644
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea esp, [esp]
mov eax, dword [esi + 0x464]
push 1
push 0x1388
push eax
call edi
test eax, eax
je 0x401644
cmp eax, 0x102
je 0x401644
cmp dword [esi + 0x460], 0
jg 0x401620
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4016b0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [esi + 4], 0
mov edi, eax
je 0x4016d2
lea eax, [esi + 0x35a]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp + 8]
push 1
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [ebp + 8], eax
je 0x401735
mov eax, dword [esi + 0x478]
mov edx, eax
imul edx, edx, 0x64
push edx
add eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
je 0x40172b
xor esi, esi
cmp dword [ebx + 0x10c], esi
jbe 0x40172b
lea edi, [ebx + 0x110]
mov ecx, dword [ebp + 8]
push edi
push ecx
mov ecx, ebx
call fcn.00401660
add esi, 1
add edi, 0x18
cmp esi, dword [ebx + 0x10c]
jb 0x401711
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
ret 4

Function at 0x402190
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
add eax, 1
call fcn.004029fc
mov esp, ebp
pop ebp
ret