joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac818
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4ac82f
add esp, 0xfffffff0
call fcn.00405c04
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004446fc
mov eax, dword [0x57a150]
cmp byte [eax], 0
jne 0x4ac85c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x57a6bc]
cmp word [eax + 2], 0
jne 0x4ac876
mov eax, dword [0x57a6bc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ae910
mov eax, dword [0x57a8a0]
cmp word [eax + 2], 0
jne 0x4ac890
mov eax, dword [0x57a8a0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004aeb20
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44fcf0]
call fcn.00454cf8
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4af0d0
mov dl, 1
mov eax, dword [0x42d430]
call fcn.004056b8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x42d430]
call fcn.004056b8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x453388]
call fcn.0045baf0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4aca70
mov eax, dword [0x57a464]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045bf84
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4af3b8
mov dl, 1
mov eax, dword [0x42d430]
call fcn.004056b8
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x57a464]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00414280
test eax, eax
je 0x4ac9a1
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413fac
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00414264
test eax, eax
je 0x4ac9b9
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00407dc8
push ebx
push 0x4ae2e0
call fcn.004a2528
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x57a150]
cmp byte [eax], 0
jne 0x4aca0a
mov eax, ebx
call fcn.004acbe4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004af5e4
mov eax, ebx
call fcn.004b0218
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4aca67
call fcn.00405c5c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aceb8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4acf5a
cmp dword [ebx + 0x94], 0
jne 0x4acf54
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4ace04
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4acf54
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4acf1a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4acf54
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004387f0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4acf29
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ad178
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x580284]
cmp dword [eax + 0x170], 0
je 0x4ad2dd
test bl, bl
jne 0x4ad22b
cmp dword [esi + 0x9c], 0
jne 0x4ad220
mov eax, esi
call fcn.004b0068
push eax
push 0x4ad084
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4ad1f1
mov eax, dword [0x580284]
cmp byte [eax + 0xd3], 0
je 0x4ad1f1
mov eax, dword [esi + 0xd8]
call fcn.004095a8
mov edi, eax
cmp edi, 0
jl 0x4ad1f1
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ad1da
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ad220
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004387f0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ad200
inc dword [esi + 0x9c]
jmp 0x4ad2dd
cmp dword [esi + 0x9c], 0
jle 0x4ad2dd
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4ad2dd
cmp dword [esi + 0x44], 0
je 0x4ad288
mov eax, dword [0x580284]
cmp byte [eax + 0xd3], 0
je 0x4ad288
mov eax, dword [esi + 0xd8]
call fcn.004095a8
mov edi, eax
cmp edi, 0
jl 0x4ad288
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ad271
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ad2b7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004387f0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ad297
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a0400]
call fcn.00409768
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4adf2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4adf97
cmp byte [ebx + 0xd3], 0
jne 0x4adf97
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00407d04
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4adf84
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4adfa4
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407bc8
jmp 0x4adfa4
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407bc8
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4af7cc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4af83a
mov eax, esi
call fcn.00487e18
test al, al
je 0x4af83a
mov eax, dword [ebx + 0x84]
call fcn.00487a6c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4af83a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4af82e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00487a6c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0047ea40
jmp 0x4af83a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004af604
pop esi
pop ebx
ret

Function at 0x4d1990
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebx, eax
test ebx, ebx
je 0x4d1a9a
mov ebp, ebx
mov eax, ebp
test eax, eax
je 0x4d19b1
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test ebx, ebx
je 0x4d19c1
mov eax, ebp
sub eax, 0xa
movzx eax, word [eax]
jmp 0x4d19c5
mov ax, 2
cmp ax, 1
jne 0x4d1a3e
test ebx, ebx
je 0x4d19d9
mov eax, ebp
sub eax, 0xc
movzx eax, word [eax]
jmp 0x4d19e1
mov eax, dword [0x57a8f8]
movzx eax, word [eax]
push 0
push 0
push edi
push ebx
push 0
movzx eax, ax
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x100
jle 0x4d1a09
mov eax, edi
add eax, eax
call fcn.004044a0
mov esi, eax
jmp 0x4d1a0b
mov esi, esp
test ebx, ebx
je 0x4d1a19
mov eax, ebp
sub eax, 0xc
movzx edx, word [eax]
jmp 0x4d1a22
mov edx, dword [0x57a8f8]
movzx edx, word [edx]
mov eax, ebp
test eax, eax
je 0x4d1a2d
sub eax, 4
mov eax, dword [eax]
push edi
push esi
push eax
push ebx
push 0
movzx eax, dx
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
jmp 0x4d1a62
cmp edi, 0x100
jle 0x4d1a53
mov eax, edi
add eax, eax
call fcn.004044a0
mov esi, eax
jmp 0x4d1a55
mov esi, esp
mov ecx, edi
add ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00404658
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4d1a8b
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4d1a75
mov eax, esp
cmp esi, eax
je 0x4d1a9c
mov eax, esi
call fcn.004044bc
jmp 0x4d1a9c
xor ebx, ebx
mov eax, ebx
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e705c
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x4e7081
cmp dword [esp + 4], 5
jb 0x4e7081
mov al, 1
jmp 0x4e7083
xor eax, eax
add esp, 0x114
ret

Function at 0x513320
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
test dl, dl
je 0x51333d
add esp, 0xfffffff0
call fcn.00405c04
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x513491
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.004446fc
lea eax, [ebp - 0x18]
call fcn.00519828
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x70]
call fcn.0040ad00
mov byte [ebx + 0x34], 0
mov eax, dword [ebx + 0x70]
mov edx, dword [eax]
call dword [edx + 0x18]
mov byte [ebx + 0x34], 1
mov byte [ebx + 0x6d], 0
mov byte [ebx + 0x3e], 1
mov ecx, ebx
mov dl, 1
mov eax, dword [0x51f58c]
call fcn.00523c48
mov edi, eax
mov dword [ebx + 0x38], edi
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], 0x5136e0
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], 0x514ad8
mov byte [ebx + 0x3c], 0
mov byte [ebx + 0x3d], 0
mov byte [ebx + 0x40], 0
xor eax, eax
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x42fb30]
call fcn.0043c0a4
mov edi, eax
mov dword [ebx + 0x58], edi
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x38], 0x514ab4
mov dl, 1
mov eax, dword [0x42fb30]
call fcn.0043c0a4
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x4c], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x50d5d4]
call fcn.0051298c
mov dword [ebx + 0x64], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x50d5d4]
call fcn.0051298c
mov dword [ebx + 0x68], eax
mov byte [ebx + 0x6c], 0
mov byte [ebx + 0x5c], 1
lea eax, [ebp - 0x11]
push eax
call fcn.00411ff4
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x11]
call fcn.00412014
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x48]
mov ecx, 0
call fcn.00407e0c
mov eax, esi
mov edx, dword [0x51daf0]
call fcn.00405904
test al, al
je 0x513459
mov edx, esi
mov eax, ebx
call fcn.00514438
jmp 0x513473
mov eax, esi
mov edx, dword [0x51eb10]
call fcn.00405904
test al, al
je 0x513473
mov edx, esi
mov eax, ebx
call fcn.00514a8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513498
lea eax, [ebp - 0x1c]
call fcn.00407bb8
lea eax, [ebp - 0x18]
call fcn.0040ace8
ret
Function at 0x52504c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x52505f
add esp, 0xfffffff0
call fcn.00405c04
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov dl, 1
mov eax, dword [0x42fb30]
call fcn.0043c0a4
mov dword [ebx + 4], eax
mov ecx, esi
mov dl, 1
mov eax, dword [0x50e034]
call fcn.00513320
mov edi, eax
mov dword [ebx + 8], edi
mov eax, edi
mov edx, dword [esi + 0xcc]
call fcn.00514a8c
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x58]
mov edx, 0x525100
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ecx, esi
mov dl, 1
mov eax, dword [0x50e034]
call fcn.00513320
mov edi, eax
mov dword [ebx + 0xc], edi
mov eax, edi
mov edx, dword [esi + 0xcc]
call fcn.00514a8c
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x58]
mov edx, 0x525394
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5250ec
call fcn.00405c5c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x55eb78
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407bb0
xor eax, eax
push ebp
push 0x55ecf9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.005314d4
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005314f4
mov ebx, eax
jmp 0x55ecc5
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00407dc8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00413cd0
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00412118
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.00412118
mov edx, dword [ebp - 0x240]
pop eax
call fcn.004082a0
je 0x55ec9c
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00407dc8
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00412118
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00412118
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.004082a0
jne 0x55ecb6
push 1
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.00531514
mov ebx, eax
test ebx, ebx
jne 0x55ebf7
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ed00
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.00407bc0
lea eax, [ebp - 4]
call fcn.00407bb8
ret
Function at 0x56206c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004071c4
xor eax, eax
push ebp
push 0x5620b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.004071d4
push eax
call sub.kernel32.dll_WinExec
push ebx
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5620bf
lea eax, [ebp - 4]
call fcn.00406a70
ret
Function at 0x565918
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e2718
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, 0x565b18
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e270c
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, 0x565bd8
call fcn.004e3990
mov edx, dword [eax]
call dword [edx + 0x64]
test eax, eax
jle 0x565b01
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e2718
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, 0x565bf0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e270c
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, 0x565c70
call fcn.004e3990
mov edx, dword [eax]
call dword [edx + 0x54]
fstp qword [ebp - 8]
wait
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, 0x565c94
call fcn.004e3990
mov edx, dword [eax]
call dword [edx + 0x54]
fstp qword [ebp - 0x10]
wait
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e2718
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, 0x565cb8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e270c
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, 0x565bd8
call fcn.004e3990
mov edx, dword [eax]
call dword [edx + 0x64]
test eax, eax
jle 0x565b01
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e2718
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x268]
mov edx, 0x565d80
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, 0x565e24
call fcn.005301a8
call fcn.004e1868
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, 0x565e3c
call fcn.005301a8
call fcn.004e18c0
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
call fcn.004e270c
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov edx, dword [eax + 0x58]
cmp edx, dword [eax + 0x54]
setge al
test al, al
je 0x565b01
mov bl, 1
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56e154
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407bb0
xor eax, eax
push ebp
push 0x56e271
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x56e244
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00407c54
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, ebx
call fcn.004044a0
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x56e280
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
shr edx, 0x10
mov word [ebp - 0x16], dx
movzx edx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x18], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1a], dx
movzx edi, word [eax + 0xc]
and di, 0xffff
mov edx, ebx
mov eax, esi
call fcn.004044bc
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0x16]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x56e290
call fcn.00414528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56e25b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56e278
lea eax, [ebp - 4]
call fcn.00407bb8
ret
Function at 0x100a6fd0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100a7178
pushal
mov esi, section.UPX1
lea edi, [esi - 0x80000]
push edi
or ebp, 0xffffffff
jmp 0x100a6ffa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100a7001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100a6ff0
mov eax, 1
add ebx, ebx
jne 0x100a7013
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100a7024
jne 0x100a7043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100a7043
dec eax
add ebx, ebx
jne 0x100a7030
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100a7008
add ebx, ebx
jne 0x100a703f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100a7095
xor ecx, ecx
sub eax, 3
jb 0x100a705b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100a70ca
sar eax, 1
mov ebp, eax
jmp 0x100a7066
add ebx, ebx
jne 0x100a7066
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100a7034
inc ecx
add ebx, ebx
jne 0x100a7074
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100a7034
add ebx, ebx
jne 0x100a7081
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100a7076
jne 0x100a7092
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100a7076
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100a70b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100a70a6
jmp 0x100a6ff6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100a70b4
add edi, ecx
jmp 0x100a6ff6
pop esi
mov edi, esi
mov ecx, 0xec6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100a70d2
cmp byte [edi], 0x16
jne 0x100a70d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100a70d7
lea edi, [esi + 0xa3000]
mov eax, dword [edi]
or eax, eax
je 0x100a7146
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa7028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100a7104
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa702c]
or eax, eax
je 0x100a7140
mov dword [ebx], eax
add ebx, 4
jmp 0x100a7121
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100a7177
cmp al, 0xef
ja 0x100a716a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100a714c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100a7159
popal
jmp 0x1004c6ba