joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e352
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46e38a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046c3df
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046c3b7
jmp 0x46e396
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46fa47
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46fa89
call fcn.004757bd
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46fa89
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46fa80
xor eax, eax
jmp 0x46fa91
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046fa97
pop edi
pop esi
pop ebx
ret 4

Function at 0x475ced
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475d1b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475d39
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475c53
jmp 0x475d39
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475d39
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00475c53
test edi, edi
mov eax, edi
jne 0x475d23
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x404bee
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x404c35
cmp ebx, 0x20
je 0x404c35
cmp ebx, 0xffffffe0
je 0x404c35
jne 0x404c3e
add eax, 1
cmp esi, eax
je 0x404c4b
jne 0x404c1a
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x404c4f
jne 0x404c16
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x404c63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x404d24
test ecx, ecx
je 0x404d24
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x404d24
test ebx, ebx
je 0x404d24
mov ebx, eax
add ebx, edx
je 0x404d24
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x404d24
cmp dword [edx + eax + 0x14], 0
je 0x404d24
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x404d24
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x404d14
test dl, dl
je 0x404d10
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x404d14
add edi, 2
add esi, 2
test dl, dl
jne 0x404cf4
xor eax, eax
jmp 0x404d19
sbb eax, eax
or eax, 1
test eax, eax
je 0x404d30
inc ebp
cmp ebp, dword [esp + 4]
jb 0x404ce1
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x405c26
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x405c54
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x405c4b
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x405c43
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405c75
mov esp, ebp
pop ebp
ret

Function at 0x405c79
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x405ce5
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x405d12
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x405d01
xor ecx, eax
xor edx, ebx
dec edi
jne 0x405cf2
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x405d38
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x405cd9
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405d64
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407930
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x40794e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x407943
pop esi
ret
Function at 0x41672f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41675d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41677b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00416695
jmp 0x41677b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41677b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00416695
test edi, edi
mov eax, edi
jne 0x416765
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x408dd0
Capabilities:
Parse credit card information

Disassembly:
ja 0x408e3b
outsb dx, byte [esi]
sub eax, 0x2d747263
jb 0x408e4f
outsb dx, byte [esi]
je 0x408e46
insd dword es:[edi], dx
sub eax, 0x312d316c
sub eax, 0x6c642e30
insb byte es:[edi], dx
add byte [eax], al
add byte [ecx + 0x70], ah
imul ebp, dword [0x772d736d], 0x632d6e69
jb 0x408e6f
sub eax, 0x70616568
sub eax, 0x312d316c
sub eax, 0x6c642e30
insb byte es:[edi], dx
add byte [eax], al
push esi
inc ebx
push edx
add byte [eax], al
push esp
cmp byte [eax], al
cmp byte [eax], al
add byte [eax + edi + 0x38ba0000], cl
add byte [eax], al
les edi, [eax]
add byte [eax], al
into
cmp byte [eax], al
add dh, dl
cmp byte [eax], al
add dh, bl
cmp byte [eax], al
add ah, ch
cmp byte [eax], al
add al, bh
cmp byte [eax], al
add byte [ecx + edi], bl
add byte [eax], al
cmp dword ds:[eax], eax
add byte [eax + 0x39], bl
add byte [eax], al
je 0x408eb0
add byte [eax], al
pop eax
cmp dword [eax], eax
add byte [ecx + edi], dh
add byte [ecx + edi + 0x39960000], al
add byte [eax], al
test byte [ecx], bh
add byte [eax], al
xchg esi, eax
cmp dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx + edi], ah
add byte [eax], al
mov eax, 0xc8000039
add byte [edx + 0x3a], dl
add byte [eax], al
push 0x8200003a
cmp al, byte [eax]
Function at 0x41e9d0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.004267b0
cmp eax, 0x17
je 0x41ea0e
mov dword [esi], 0x4189d8
pop esi
ret
mov dword [esi], 0x411570
pop esi
ret

Function at 0x41ea20
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x4c
mov eax, dword [0x43c4b0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x18]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
push edi
mov edi, 0x38
jb 0x41ea52
mov edi, 0x78
sub edi, eax
push edi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0041855d
add esp, 0xc
mov byte [esp + 0x10], 0x80
lea ecx, [esp + edi + 0x11]
lea eax, [esi + 0x1a]
mov ebp, 2
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x41ea75
add edi, 8
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0041e8a0
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [esi + 0xa]
lea edi, [ebp + 4]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x41eab5
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.004267b0
cmp eax, 0x17
je 0x41eb24
pop edi
mov dword [esi], 0x4189d8
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call 0x43bb96
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi], 0x411570
pop esi
pop ebp
pop ebx
xor ecx, esp
call 0x43bb96
add esp, 0x4c
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4050fe
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x4050fe
add byte [esi], bh
dec esp
xor al, 0x33
cmp byte [edi], bh
xor al, byte [ebx - 0x38a7fb3c]
test dword [edi + ebx*8 - 1], ebx
Function at 0x405b76
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
add edx, 0x6fda
call fcn.00405b76
add byte [ebp + 0x35], cl
inc ebp
dec esi
inc eax
cmp byte [ebp + 0x43], cl
add esp, 4
or edx, 0x8d64
pop edx
push eax
push edx
add esp, 4
add eax, 0x151cc
or eax, 0x15b00
pop eax
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
add ecx, 0x5ce3
pop ecx
push esi
push edx
add esp, 4
xor esi, 0x110a6
xor esi, 0x13b89
pop esi
push eax
push ebx
add esp, 4
and eax, 0x17426
jmp 0x405bea
add eax, 0xff1e
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push ebx
or ebx, 0x21e
jmp 0x405c59
or ebx, 0x9a0c
pop ebx
push esi
push edx
add esp, 4
sub esi, 0x138eb
sub esi, 0xa197
add esi, 0x129bb
jmp 0x405c7c
pop esi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405ca0
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405d03
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405bbf
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x405bbf
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405ced
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405cf7
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405d4c
push ecx
push edx
add esp, 4
or ecx, 0x1105e
add ecx, 0x92f3
pop ecx
push esi
push edx
add esp, 4
jmp 0x405d2a
and esi, 0x155c6
jmp 0x405d37
add esi, 0xc9e4
pop esi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x405db4
push ebx
push ecx
add esp, 4
call 0x405d5e
add byte [eax + 0x48], al
inc eax
aas
cmp byte [eax + 0x39], cl
add esp, 4
jmp 0x405d68
jmp 0x405d6f
xor ebx, 0xa9e9
pop ebx
push edx
xor edx, 0xde74
pop edx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405daa
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405b60
mov dword [ebp - 0x750], 0
Function at 0x405d5e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
add edx, 0x6fda
call fcn.00405b76
add byte [ebp + 0x35], cl
inc ebp
dec esi
inc eax
cmp byte [ebp + 0x43], cl
add esp, 4
or edx, 0x8d64
pop edx
push eax
push edx
add esp, 4
add eax, 0x151cc
or eax, 0x15b00
pop eax
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
add ecx, 0x5ce3
pop ecx
push esi
push edx
add esp, 4
xor esi, 0x110a6
xor esi, 0x13b89
pop esi
push eax
push ebx
add esp, 4
and eax, 0x17426
jmp 0x405bea
add eax, 0xff1e
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push ebx
or ebx, 0x21e
jmp 0x405c59
or ebx, 0x9a0c
pop ebx
push esi
push edx
add esp, 4
sub esi, 0x138eb
sub esi, 0xa197
add esi, 0x129bb
jmp 0x405c7c
pop esi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405ca0
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405d03
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405bbf
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x405bbf
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405ced
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405cf7
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405d4c
push ecx
push edx
add esp, 4
or ecx, 0x1105e
add ecx, 0x92f3
pop ecx
push esi
push edx
add esp, 4
jmp 0x405d2a
and esi, 0x155c6
jmp 0x405d37
add esi, 0xc9e4
pop esi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x405db4
push ebx
push ecx
add esp, 4
call 0x405d5e
add byte [eax + 0x48], al
inc eax
aas
cmp byte [eax + 0x39], cl
add esp, 4
jmp 0x405d68
jmp 0x405d6f
xor ebx, 0xa9e9
pop ebx
push edx
xor edx, 0xde74
pop edx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405daa
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405b60
mov dword [ebp - 0x750], 0
Function at 0x427d30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5107ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x541f38]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004d5010
push 4
mov dword [esp + 0x20], 0
call fcn.004d7e4b
mov edi, eax
add esp, 4
test edi, edi
je 0x427dae
call fcn.004d4d68
mov dword [edi], eax
call fcn.004d4b6c
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004d49e5
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x427da3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004d4a0d
jmp 0x427db0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4342c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x511508
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x541f38]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x43432a
cmp dword [edi + 0x18], eax
je 0x43432a
push ebx
push eax
call fcn.004261d0
test al, al
je 0x43432a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x434323
mov eax, dword [edi + 4]
jmp 0x434326
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x43450b
jmp 0x434346
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x43450b
cmp al, 0x5c
jne 0x434447
cmp esi, ecx
je 0x434463
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x434387.35
movzx eax, byte [eax + 0x43454c]
jmp dword [eax*4 + 0x434524]
push 0x22
jmp 0x43444c
push 0x2f
jmp 0x43444c
push 0x5c
jmp 0x43444c
push 8
jmp 0x43444c
push 0xc
jmp 0x43444c
push 0xa
jmp 0x43444c
push 0xd
jmp 0x43444c
push 9
jmp 0x43444c
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.004345a0
test al, al
je 0x4344af
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x5c]
call fcn.004324d0
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov dword [esp + 0x8c], ebx
call fcn.00427720
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x74], 0x10
jb 0x434429
mov ecx, dword [esp + 0x60]
push ecx
call fcn.004d72b6
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
jmp 0x434454
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, edi
call fcn.00425f40
cmp esi, dword [esp + 0x18]
jne 0x434342
jmp 0x43450b
push 0x1f
xor edi, edi
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
call fcn.00427950
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], edi
call fcn.00434850
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x43450b
mov eax, dword [esp + 0x28]
push eax
jmp 0x434503
xor al, al
jmp 0x43450d
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.00427950
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x88], 2
call fcn.00434850
cmp dword [esp + 0x58], 0x10
mov bl, al
jb 0x43450b
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004d72b6
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x438670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x438689
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4386c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4386c0
lea ebx, [ebx]
cmp esi, eax
jae 0x4386c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4386b0
cmp esi, eax
jb 0x4386ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x43a8a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x43a8b2
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push eax
call edx
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esi + 0x70]
call fcn.0043a540
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0
push esi
push 0x43a620
push 0
push 0
mov dword [esi + 0x74], ecx
mov dword [esp + 0x24], 0
call fcn.004d7fc0
mov eax, dword [esi + 4]
add esp, 0x18
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
movzx edx, word [esi + 0x68]
push 0
shl edx, 0x10
or edx, 0x8004
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
pop esi
ret 0x10