joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100246d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10028e91
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0x1c], 0
jne 0x1002471d
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0xc]
mov eax, 0x2aaaaaab
sub ecx, dword [ebx + 8]
imul ecx
mov dword [esp + 0x14], 4
sar edx, 2
mov esi, edx
mov dword [esp + 0x10], 0
shr esi, 0x1f
add esi, edx
mov dword [esp + 0x24], esi
je 0x100246f9
push dword [ebp + 0xc]
lea ecx, [ebx + 0x20]
call sym.ChartCtrl.dll_public:_void___thiscall_CChartFont::SelectFont_class_CDC__const
xor edi, edi
test esi, esi
jle 0x10024845
mov dword [esp + 0xc], edi
mov eax, dword [ebx + 0x14]
mov edx, eax
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x10024785
cmp dword [ecx + 0x10], edi
jge 0x1002477b
mov ecx, dword [ecx + 8]
jmp 0x1002477f
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x10024771
cmp edx, eax
je 0x10024798
cmp edi, dword [edx + 0x10]
jl 0x10024798
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x1c]
jmp 0x100247a0
mov dword [esp + 0x20], eax
lea esi, [esp + 0x20]
mov esi, dword [esi]
cmp esi, eax
je 0x100247b1
push dword [ebp + 0xc]
lea ecx, [esi + 0x14]
call sym.ChartCtrl.dll_public:_void___thiscall_CChartFont::SelectFont_class_CDC__const
mov eax, dword [ebx + 8]
add eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x100247c0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1c]
push edi
call fcn.100c2877
mov dword [esp + 0x3c], 0
lea ecx, [esp + 0x28]
mov eax, dword [esp + 0x18]
push ecx
push dword [eax - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
push ebx
call fcn.100a8d80
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x18]
push edx
call fcn.100b6290
mov ecx, dword [esp + 0x14]
add ecx, 2
add ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x28], ecx
cmovg ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
cmp esi, dword [ebx + 0x14]
je 0x10024835
mov ecx, dword [ebp + 0xc]
push dword [esi + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [esi + 0x20], 0
add dword [esp + 0xc], 0x18
inc edi
cmp edi, dword [esp + 0x24]
jl 0x10024763
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebp + 0xc]
mov edi, dword [esp + 0x14]
add eax, edi
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x60], eax
add esi, 2
mov eax, dword [ecx]
push dword [ebx + 0x2c]
call dword [eax + 0x30]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x34]
mov dword [ebx + 0x2c], 0
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100849db
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100b6192
pushfd
lea esp, [esp + 0x2c]
jae 0x10102d9b
cmp di, dx
lea ecx, [edi + edi*2]
bsf ax, ax
das
cmc
movzx ax, cl
add ecx, ecx
cmc
add ecx, ecx
rol di, cl
neg di
btr edi, 0x18
mov eax, dword [esi + 0x20]
shrd di, cx, 0xf
shr di, cl
mov edi, dword [eax + ecx + 0xc]
bt ax, sp
call fcn.100dee67

Function at 0x100e2f0d
Capabilities:
Encode data using xor

Disassembly:
call fcn.100e1a06
not di
pushal
mov edi, dword [esp + 0x20]
jmp 0x10102e61
call fcn.100c7bbc
add byte [edx + 0x31ccf70], bh
adc al, 0xac
jb 0x100e2eea
insb byte es:[edi], dx
cld
fld xword [ebp - 0x1e]
jge 0x100e2f21
loop 0x100e2fa0
std
sbb dword [0x6985f981], 0xa0f5cad5
mov esi, 0xafbf689
test eax, 0xc81e4136
sbb eax, 0x6985f981
aad 0xca
cmc
mov al, byte [0xfbf689be]
or ch, byte [ecx - 0x37e1beca]
push ss
mov al, 0x2f
inc eax
pushfd
bound esp, qword [ebx + 0x6161d852]
xor al, 0xdd
loope 0x100e2f25
rol dword [edx], 0x28
shr dword [esi - 0x42de4974], 0x2c
pop edx
and al, 0x9a
push edi
mov bl, 0x2c
aad 0xe9
fld st(6)
inc esp
wait
invalid
sbb ah, dl
sub dword [ebx - 0xc0e7da3], ebx
or byte [ebx + 0x44], bh
jle 0x100e2fed
adc dword [edi + 0x26c8b747], 0xaf5b7a19
inc edi
invalid
fisub word [esi - 0x21]
shr ah, 0x58
out 0xa4, eax
sub dword [ecx + 0x3b], ebp
in eax, 0xce
invalid
xchg dword [esp + 0x24], edi
mov byte [esp + 4], ah
pushal
pushfd
call fcn.100c3109
mov ebp, dword [ebp + 0xf5787]
call fcn.100c4fc3

Function at 0x100e9e63
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edx
pushfd
dec eax
stc
add ecx, 0xc
cmc
cmp edx, eax
jmp 0x10102d90

Function at 0x100fdf06
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x40], edx
mov byte [esp + 0xc], 0x35
pushfd
seta dh
and al, 0xc
xor eax, 0xc6970f9c
mov byte [esp + 4], al
mov edx, 0x1000e3e9
call fcn.100a69ec
pop esi
jbe 0x100fdf0c
retf

Function at 0x10120bbe
Capabilities:
Encode data using xor

Disassembly:
bsf cx, si
mov ecx, edi
pushfd
push edi
lea esp, [esp + 0x10]
jmp 0x101297dc
bt eax, 0x1d
lea ebx, [0xc7b2a177]
xor bl, 0x62
mov ebx, eax
pushfd
cmp byte [edi], 0x23
pushfd
push ebp
lea esp, [esp + 0xc]
jne 0x1011a425
movsx ax, dl
sub edx, edx
cmc
test cl, 0x46
not ah
mov eax, edx
rcr al, cl
pushfd
add edi, 1
test edx, 0x6849027c
mov al, byte [edi]
call fcn.1011d9ea
neg byte [edi + 0x40b16e00]
lds eax, [esi]
fsubr qword [esi]
loop 0x10127078
pop ecx
insd dword es:[edi], dx
xchg ecx, eax
push cs
mov cl, 0xa9
cmc
stc
inc ebp
lds edi, [ecx]
inc ecx
cmp eax, 0xb7a65fa5
add bl, ch
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
ret
push ecx
mov es, word [ecx + 0x5cb628be]
add cl, byte [edx + edx]
lodsd eax, dword [esi]
fadd qword [edx + 0x53]
jle 0x1012705f
jbe 0x10127068
retf
adc edx, esi
adc eax, 0x12900a54
int 0x1a
sub eax, 0x6c718c93
mov eax, dword gs:[0xcdd5803e]
adc ah, byte [ecx]
and al, ah
pushal
jg 0x10127005
add bh, byte [edi]
xchg ecx, eax
loop 0x1012702d
arpl word [edi + 0x32d3310e], di
fadd dword [edi]
invalid
jmp 0x10126fc4
Function at 0x1012a865
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x50]
je 0x1012f4ca
pushal
mov dword [esp + 0x1c], eax
pushfd
push ebp
lea eax, [ebx*4 - 0x38424fc4]
push 0x7bc7f403
mov dword [esp + 0x24], 0xb
movsx ax, dl
pushfd
lea eax, [0x10129700]
push 0x58083d9c
pushfd
mov dword [esp + 0x2c], 0x1011e1b7
call fcn.10118474
call fcn.101300b8
inc edx
test dword [eax + 0x68f7801e], eax
test eax, 0x3080efef
ja 0x101164a0
ljmp 0xee30:0xdee1021d
sbb ch, byte [eax + 0x5462fc16]
stosb byte es:[edi], al
invalid
push cs
and eax, 0x619291e
out 0x7f, al
dec esp
mov dword [eax - 0x7a], ecx
fsub qword [edi]
push ds
mov al, byte [0x70a68fd4]
jno 0x1011644a
jmp 0xd0595616
cwde
mov dword [esp + 0x48], ebx
pushfd
push dword [esp]
movsx eax, al
movzx ax, bl
lea eax, [ebp - 4]
jmp 0x101163ec
pushal
mov byte [esp + 8], cl
xchg dword [esp + 0x1c], eax
not ah
pop eax
movsx ax, dl
lahf
mov dword [esp + 0x14], 0xb
pushal
lea eax, [0x10129700]
mov word [esp], bp
push 0xcc3faa9d
call fcn.101180a6
sbb dword [ebx - 0x69], edi
xchg dword [ebx - 0x1ec17385], eax
fnsave dword [ebp - 0x4cfe742]
inc esp
xor ebp, dword [edi + ebp*2]
adc byte [edx], al
pop esp
inc edx
pop esp
and bl, byte [edi + eax*2 + 0x3f84ba78]
mov al, byte [0xccd2cc93]
xor ch, byte [ebp + 0x55]
dec edx
pop ebx
test al, 0x5d
mov cl, 0x2f
fstp dword [edi + edx*2 - 0x7037494b]
invalid

Function at 0x1012ce00
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
call fcn.10126be4
pushfd
lea esp, [esp + 4]
jne 0x1012efb2
push 0xeb0cc6ae
pushal
pushfd
setp al
mov eax, dword [edx + 8]
pushfd
pushfd
lea esp, [esp + 0x30]
jmp fcn.10117bfe
Function at 0x10134df9
Capabilities:
Encode data using xor

Disassembly:
dec ebp
sti
aad 0xa2
test dword [0x9a02ba44], ebp
xor edx, ebp
sbb eax, 0xb77d0405
dec edx
outsd dx, dword [esi]
xor esp, dword [esi + 0x2b]
daa
add ebx, dword [ebp + 0x584e0199]
in eax, 0x7f
jb 0x10134d84
int 0x14
ljmp 0xc2d5
mov eax, dword [0x4063831f]
mov dl, 0x7a
lahf
and dword [ebx + 0x40], 0xffffffb2
jp 0x10134d80
mov cs, esi
or al, 0x1d
fadd qword [edx]
or esi, ebp
imul edx, esp, 0xffffffdc
pop ecx
or dh, cl
jg 0x10134d81
popfd
loop 0x10134dfe
cmpsb byte [esi], byte es:[edi]
fcom dword [0x7e021566]
adc ax, 0x7e02
adc ax, 0x7e02
add bh, byte [esi - 0x77]
mov dword [esp], ebx
sbb al, 0x24
mov ax, dx
push edx
dec ah
mov eax, dword [ebp + 8]
pushal
test eax, eax
call fcn.10116cde
xchg ecx, eax
ja 0x10134ddb
shr al, 0xcd
push ds
invalid
out dx, eax
btr dword [ebx], ecx
sbb al, 0x79
inc esi
insb byte es:[edi], dx
dec esi
and esi, dword [ebx - 0x2dcc2e6b]
jecxz 0x10134e6a
shr dword [ebp - 0x39c1f12], 1
bound edi, qword [esi]
mov ecx, 0x3e09b549
and bh, dl
jo 0x10134dfb
out 0x1f, al
jg 0x10134dd9
fadd dword [edi - 0x1050540c]
ror bh, 1
mov bh, dh
pop edi
push dword [eax]
out dx, eax
mul edi
or bh, bl
xor al, 0xeb
inc edi
not dword [esi + 0x28]
cmp dword [ebx], ecx
xor eax, dword [ebx + ebp*8 + 0x54]
sti
sub dword [ebp + esi*2 + 0x54], ebx
jne 0x10134e68
dec edx
sbb byte [edx + 0x41a16da7], 0xc4
aad 0x90
nop
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
wait
out dx, eax
add al, 0x69
adc eax, 0x2b88c5a2
test eax, 0x3e02111c
sub esi, dword [ebx]
push edi
leave
push 0x65
mov bl, ch
jae 0x10134e8e
je 0x10134e0b
test eax, 0xbc06190a
add dl, byte [edi + 0x2e]
sub dword [ebx], ecx
xor edx, dword [eax + 0x53cb43bb]
mov bh, 0x6f
shl cl, 1
adc edi, dword [ecx - 0x67]
inc bx
jmp 0x10134f15
push esi
xor dword [esi + 0x6f], ebp
push 0x60
inc ecx
add esp, dword [ecx + edx*2 + 0x79]
mov dword [ecx + 0x30389197], esi
das
sub esi, dword [ebx - 0x4c]
mov cr4, edx
inc ebx
retf
Function at 0x4067a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0044ca40
mov eax, dword [0x4c2594]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.0046de20
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x406896
test edi, edi
je 0x406896
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x406896
cmp eax, 0x3fff
ja 0x406896
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x406896
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x49cb30
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x406896
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.0046de20
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x49cb68
lea eax, [esi - 1]
push eax
push edi
call fcn.00408740
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ca21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0044ca21
mov esp, ebp
pop ebp
ret
Function at 0x406cf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493326
mov eax, dword fs:[0]
push eax
sub esp, 0x194
push ebx
push esi
push edi
mov eax, dword [0x4c2594]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.eye_care_app_instance_name
push 1
mov bl, 1
push 0
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x406e0e
call fcn.0042be50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x406edd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5e
push str.d:jenkins.jenkinsworkspacepay_groupeye_careeye_care_clienteye_careeye_care_srcmain.cc
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov ebx, eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040b280
push 3
push 0x49d070
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0040b280
mov byte [ebp - 4], 1
call fcn.0042be50
mov edi, eax
lea ecx, [ebp - 0x108]
push 0x1b
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403f10
mov esi, eax
push str.check_instance_fail__errno_
push esi
mov byte [ebp - 4], 2
call fcn.00404fc0
add esp, 8
mov ecx, esi
push ebx
call fcn.00404e20
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x108]
call fcn.00405220
lea ecx, [ebp - 0x28]
call fcn.004048d0
lea ecx, [ebp - 0x40]
call fcn.004048d0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406ef1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042be50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x406edd
push 0x5e
push str.d:jenkins.jenkinsworkspacepay_groupeye_careeye_care_clienteye_careeye_care_srcmain.cc
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], al
call fcn.0040b280
push 3
push 0x49d070
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 3
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.0040b280
mov byte [ebp - 4], 4
call fcn.0042be50
mov edi, eax
lea ecx, [ebp - 0x1a0]
push 0x20
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00403f10
mov esi, eax
push str.instance_exist
push esi
mov byte [ebp - 4], 5
call fcn.00404fc0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x1a0]
call fcn.00405220
lea ecx, [ebp - 0x58]
call fcn.004048d0
lea ecx, [ebp - 0x70]
call fcn.004048d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x406efa
mov dword [eax], esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4079f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493396
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4c2594]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], 0
push 0x404
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.0046de20
add esp, 0xc
mov dword [ebp - 0x420], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x407aac
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x407aac
call fcn.004060d0
mov esi, eax
jmp 0x407b99
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x407acf
call fcn.004060d0
jmp 0x407b8c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
test ebx, ebx
jne 0x407aed
call fcn.004060d0
jmp 0x407b8c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x407b0e
mov esi, 0x8007000e
jmp 0x407b8e
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.00405e70
jmp 0x407b38
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x407b4f
mov esi, 0x8007000e
jmp 0x407b8e
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x407b6f
call fcn.004060d0
jmp 0x407b8c
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.00407850
mov esi, eax
test edi, edi
je 0x407b99
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x407bb2
lea ecx, [ebp - 0x420]
call fcn.00406790
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ca21
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4094c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4c2594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x409547
test ebx, ebx
je 0x409547
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x409547
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x409547
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x409541
push esi
push ebx
push edi
call fcn.0046d320
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x409541
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ca21
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ca21
mov esp, ebp
pop ebp
ret

Function at 0x409560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4095b9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4095b9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4095aa
cmp esi, edx
jae 0x4095b9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x409598
cmp esi, edx
jae 0x4095b9
cmp word [esi], 0
je 0x4095b9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40c240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493688
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4c2594]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0044c532
mov edi, eax
add esp, 4
test edi, edi
je 0x40c2e3
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00422314
add esp, 4
mov dword [edi + 4], eax
jmp 0x40c2e5
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00403840
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40c345
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40c345
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x40c369
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40c38b
cmp byte [ebp + 0xc], 0
je 0x40c378
push esi
call fcn.0042283b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40c397
mov esi, str.ios_base::badbit_set
jmp 0x40c3a7
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040c3d0
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004044b0
push 0x4b6ef8
lea eax, [ebp - 0x30]
push eax
call fcn.0046cf05
int3
Function at 0x416e60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x4c2594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x4bc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x3e8
push 0
push eax
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], ebx
call fcn.0046de20
push 0xc8
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.0046de20
add esp, 0x18
test esi, esi
je 0x416f60
test ebx, ebx
je 0x416f60
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x416f60
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x416f60
xor ecx, ecx
movzx edx, ax
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x416f4b
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x4c4]
call fcn.0047529f
add esp, 0xc
test eax, eax
je 0x416f73
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x416ef1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ca21
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x416fc9
cmp edi, 0x7fffffff
ja 0x416fc0
mov ecx, ebx
mov esi, 0x7ffffffe
lea ebx, [ebp - 0xc]
sub esi, edi
mov edx, edi
sub ebx, ecx
nop
lea eax, [esi + edx]
test eax, eax
je 0x416fab
movzx eax, word [ebx + ecx]
test ax, ax
je 0x416fab
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x416f90
mov ebx, dword [ebp - 0x4c0]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x416fc9
test edi, edi
je 0x416fc9
xor eax, eax
mov word [ebx], ax
xor ecx, ecx
test edi, edi
je 0x416fd7
cmp edi, 0x7fffffff
jbe 0x416fdc
mov ecx, 0x80070057
test ecx, ecx
js 0x41700e
mov esi, edi
mov eax, ebx
test edi, edi
je 0x416ff6
cmp word [eax], 0
je 0x416ff6
add eax, 2
sub esi, 1
jne 0x416fe8
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x417010
xor esi, esi
test ecx, ecx
js 0x417066
mov edx, edi
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x417059
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
mov eax, dword [ebp - 0x4c8]
add eax, eax
sub eax, ecx
add edi, eax
nop word [eax + eax]
test esi, esi
je 0x417059
movzx eax, word [edi + ecx]
test ax, ax
je 0x417059
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x417040
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ca21
mov esp, ebp
pop ebp
ret