joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x87c
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004e7ab0
test eax, eax
je 0x4c0058
xor eax, eax
add esp, 0x87c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebp]
mov dword [esp], eax
call fcn.004e7ab0
mov ebx, eax
test eax, eax
jne 0x4c0044
mov eax, dword [esp + 0x60]
cmp dword [esp + 0x3c], eax
jne 0x4c0044
mov dword [esp + 4], 0
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll__open
test eax, eax
mov dword [esp + 0x1c], eax
js 0x4c0044
mov dword [esp + 4], 0
mov eax, dword [ebp]
mov dword [esp], eax
call sub.msvcrt.dll__open
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
js 0x4c0160
lea ebp, [esp + 0x70]
mov eax, ebx
mov ecx, 0x100
mov dword [esp + 0x1c], edx
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, 0x100
lea edi, [esp + 0x470]
rep stosd dword es:[edi], eax
xor edi, edi
jmp 0x4c0114
test edi, edi
je 0x4c0170
cmp ebx, edi
mov esi, edi
lea eax, [esp + 0x470]
mov dword [esp], ebp
cmovle esi, ebx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4c013e
sub ebx, esi
sub edi, esi
mov eax, ebx
or eax, edi
js 0x4c013e
test ebx, ebx
jne 0x4c00e0
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
test edi, edi
je 0x4c0170
test ebx, ebx
jle 0x4c013e
test edi, edi
jg 0x4c00e8
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
call sub.msvcrt.dll__close
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__close
or edi, ebx
sete al
jmp 0x4c0046
mov dword [esp], edx
call sub.msvcrt.dll__close
jmp 0x4c0044
lea eax, [esp + 0x470]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov edi, eax
jmp 0x4c0136
Function at 0x4c0810
Capabilities:
Create directory

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x101c
call fcn.004e20f0
sub esp, eax
mov eax, dword [esp + eax]
lea esi, [esp + 0x20]
mov dword [esp + 8], 0x604619
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__snprintf]
movzx eax, byte [esp + 0x20]
test al, al
je 0x4c088b
xor ebx, ebx
xor ecx, ecx
jmp 0x4c086f
cmp al, 0x2f
lea edx, [ebx + 1]
sete al
test al, al
jne 0x4c0873
movzx eax, byte [esp + edx + 0x20]
mov ebx, edx
test al, al
je 0x4c088b
cmp al, 0x5c
jne 0x4c0858
cmp ebx, ecx
jg 0x4c0898
lea edx, [ebx + 1]
mov byte [esi + ebx], 0x5c
movzx eax, byte [esp + edx + 0x20]
mov ecx, edx
mov ebx, edx
test al, al
jne 0x4c086f
add esp, 0x1020
pop ebx
pop esi
pop edi
ret
lea eax, [esi + ecx]
mov byte [esi + ebx], 0
cmp byte [eax], 0x2e
jne 0x4c08b0
cmp byte [eax + 1], 0
je 0x4c0877
lea esi, [esi]
cmp byte [eax], 0x2e
jne 0x4c08bb
cmp byte [eax + 1], 0x2e
je 0x4c0930
test ecx, ecx
jne 0x4c08cb
cmp ebx, 2
jne 0x4c08cb
cmp byte [esp + 0x21], 0x3a
je 0x4c0877
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__mkdir]
test eax, eax
je 0x4c0877
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
cmp dword [eax], 0x11
je 0x4c0877
call edi
mov ebx, dword [eax]
call edi
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.make_folders
mov dword [esp + 4], str._s:_Unable_to_create__s:__s___d__n
mov dword [esp], 1
call fcn.0043ce70
mov dword [esp], 0x4a
call sub.msvcrt.dll_exit
lea esi, [esi]
cmp byte [eax + 2], 0
je 0x4c0877
jmp 0x4c08bb

Function at 0x4c1270
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [fcn.004f0760]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4c12ac
mov dword [esp], 2
call ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0x604615
mov dword [esp], eax
call fcn.004bfe30
mov dword [esp], 1
call fcn.0043cae0
mov dword [esp], 2
call ebx
mov dword [esp + 4], str.Try_running_with__h_for_usage_information_n
mov dword [esp], eax
call fcn.004bfe30
mov dword [esp + 0x20], 1
add esp, 0x14
pop ebx
pop esi
jmp fcn.0043cae0
Function at 0x4c7240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x78]
mov dword [esp + 0x1c], eax
mov eax, edx
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
cmp dword [esp + 0x74], ebx
je 0x4c7338
mov dword [esp + 0x20], esi
lea esi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 0x2c], edi
lea edi, [esp + 0x30]
mov dword [esp + 0x24], ecx
mov dword [esp + 0xc], esi
jmp 0x4c72b4
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x28], edx
lea edx, [eax + 0x200]
mov dword [esp + 8], edx
add ebx, 4
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.005badd0
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x74], ebx
jne 0x4c7298
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
call fcn.005badd0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc], eax
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x38], edx
lea edx, [esp + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 0x30], esi
call fcn.005badd0
jmp 0x4c7309
Function at 0x4e13d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004f0760
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004f0760
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4e1430
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6bd550]
test esi, esi
jle 0x4e1550
mov eax, dword [0x6bd554]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4e1464
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4e14e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4e1450
mov dword [esp], ebx
call fcn.004e1e20
mov edi, eax
test eax, eax
je 0x4e1577
mov eax, dword [0x6bd554]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004e1f60
mov edx, dword [0x6bd554]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4e1557
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4e14e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4e14f0
add dword [0x6bd550], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6bd554]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4e14e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004e13d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4e146e
mov eax, dword [0x6bd554]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004e13d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004e13d0
lea esi, [esi]
nop
Function at 0x4e1a90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6bd56c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6bd564]
sub esp, 4
test ebx, ebx
je 0x4e1ae5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4e1ade
test esi, esi
je 0x4e1ade
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4e1ac0
mov dword [esp], 0x6bd56c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4e1e20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4e1e45
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4e1e50
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4e1e45
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4e1e98
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4e1e8e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4e1e9a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4e1e80
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4f5180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x624e59
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x624ebd]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.004e20f0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.005da210
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x5e8d10], 0
jne 0x4f52a6
mov byte [0x5e8d10], 1
call fcn.005c3180
test eax, eax
je 0x4f5274
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.004e0fe0
mov dword [esp], 2
mov esi, dword [fcn.004f0760]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x4f5264
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x623825
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x5d8ec0
jmp 0x5d8eb8
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x4f522a
mov dword [esp], 2
call dword [0x5e7ad4]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x5d8eb3
mov dword [esp], 2
call dword [0x5e7ad4]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x62ed34
call fcn.005b9c00
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.005c2f30
add esp, 0x18
pop ebx
ret
Function at 0x551060
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x5510a0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x551071
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x5a2580
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [ecx + 0x98]
cmp dword [ecx + 0x94], eax
je 0x5a25b0
mov eax, dword [ecx + 0x7c]
test eax, eax
je 0x5a25a0
cmp eax, 2
je 0x5a25a8
cmp eax, 1
je 0x5a25c0
ret
jmp fcn.005a2710
jmp fcn.005a3360
mov dword [ecx + 0x84], 0x1b
ret
jmp fcn.005a2af0
Function at 0x5b9e50
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
xor edx, esi
cmp esi, 3
jbe 0x5b9ee0
lea eax, [esi - 4]
shr eax, 2
lea ebx, [ecx + eax*4 + 4]
imul edi, dword [ecx], 0x5bd1e995
add ecx, 4
imul edx, edx, 0x5bd1e995
mov eax, edi
shr eax, 0x18
xor eax, edi
imul eax, eax, 0x5bd1e995
xor edx, eax
cmp ecx, ebx
jne 0x5b9e70
and esi, 3
cmp esi, 2
je 0x5b9ec9
cmp esi, 3
je 0x5b9ec0
cmp esi, 1
je 0x5b9ed2
mov eax, edx
pop ebx
pop esi
shr eax, 0xd
pop edi
xor edx, eax
imul edx, edx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor eax, edx
ret
movzx eax, byte [ebx + 2]
shl eax, 0x10
xor edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [ebx]
xor eax, edx
imul edx, eax, 0x5bd1e995
jmp 0x5b9ea4
mov ebx, ecx
jmp 0x5b9e95
Function at 0x401000
Capabilities:
Accept command line arguments
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403084], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4030a8], eax
push eax
call sub.kernel32.dll_lstrlenA
add eax, dword [0x4030a8]
mov dword [0x4030ac], eax
push 0x100
push 0x4030b0
push 0
call sub.kernel32.dll_GetModuleFileNameA
add eax, 2
add dword [0x4030a8], eax
mov edi, dword [0x4030a8]
push 0x4031b0
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4011a3
push 0x4031b0
push 0
push 0x40307f
push 0x4031b0
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x4011a3
push 0
push 0x100
push 2
push 0
push 1
push 0x40000000
push 0x4031b0
call sub.kernel32.dll_CreateFileA
mov dword [0x403094], eax
cmp eax, 0xffffffff
je 0x4011a3
push 0xa
push 0x40307b
push 0
call sub.kernel32.dll_FindResourceA
mov dword [0x403088], eax
test eax, eax
je 0x4011a3
push eax
push 0
call sub.kernel32.dll_LoadResource
mov dword [0x40308c], eax
test eax, eax
je 0x4011a3
push eax
call sub.kernel32.dll_LockResource
mov dword [0x403090], eax
test eax, eax
je 0x4011a3
push dword [0x403088]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x403098], eax
test eax, eax
je 0x4011a3
push 0
push 0x40309c
push dword [0x403098]
push dword [0x403090]
push dword [0x403094]
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x4011a3
mov eax, dword [0x40309c]
cmp eax, dword [0x403098]
jne 0x4011a3
push dword [0x403094]
call sub.kernel32.dll_CloseHandle
test eax, eax
je 0x4011a3
push 0x4031b0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4030a0], eax
test eax, eax
je 0x4011a3
push section..data
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x4030a4], eax
test eax, eax
je 0x4011a3
push dword [0x403084]
push dword [0x4030a8]
push 0x4030b0
call dword [0x4030a4]
push dword [0x4030a0]
call sub.kernel32.dll_FreeLibrary
test eax, eax
je 0x4011a3
push 0x4031b0
call sub.kernel32.dll_DeleteFileA
test eax, eax
je 0x4011a3
push 1
call sub.kernel32.dll_ExitProcess
push 0x10
push str.Paquet_Builder_SFX_Loader
push str.A_unknown_error_occurred_while_loading_the_package._Please_contact_your_provider.
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
int3
Function at 0x427dbe
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x449164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x403984
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x48], ebx
xor edi, edi
mov ecx, ebx
inc edi
call fcn.0042fe55
test eax, eax
jne 0x427e7e
mov ecx, dword [esi + 0x34]
mov edx, ebx
call fcn.0042fe55
test eax, eax
jne 0x427efb
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x427e18
push dword [esi + 0x34]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov dword [esi + 0x34], ebx
mov ecx, dword [ebp - 0x48]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x427e1e
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004399fc
mov dword [ebp - 0x4c], eax
mov dword [esi + 0x34], eax
pop ecx
test eax, eax
je 0x427ef9
mov ecx, dword [ebp - 0x48]
mov edx, ecx
lea eax, [edx + 2]
mov dword [ebp - 0x48], eax
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x427e5e
sub edx, dword [ebp - 0x48]
sar edx, 1
push ecx
mov ecx, dword [ebp - 0x4c]
inc edx
call fcn.004124db
or dword [esi + 0x5c], 0x10
jmp 0x427eee
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
call dword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
push 0x405e08
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.004271c7
mov ecx, dword [esi + 0x34]
lea edx, [ebp - 0x44]
add esp, 0x10
call fcn.0042fe55
test eax, eax
jne 0x427efb
cmp dword [esi + 0x34], ebx
je 0x427ecd
push dword [esi + 0x34]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov dword [esi + 0x34], ebx
push 0x40
call fcn.004399fc
mov dword [esi + 0x34], eax
pop ecx
test eax, eax
je 0x427ef9
and dword [esi + 0x5c], 0xffffffef
lea ecx, [ebp - 0x44]
push ecx
push 0x20
pop edx
mov ecx, eax
call fcn.004124db
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
jmp 0x427efb
mov edi, ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439ce0
leave
ret 4
Function at 0x42ee02
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x198]
test edi, edi
je 0x42ee8b
call fcn.00434275
cmp eax, 1
jne 0x42ee8b
push 0x40633c
push edi
call dword [sym.imp.msvcrt.dll__wfopen]
mov dword [ebp - 8], eax
pop ecx
pop ecx
test eax, eax
je 0x42ee5c
push eax
push 1
lea eax, [ebp - 4]
mov word [ebp - 4], 0xfeff
push 2
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
push 0x406344
push edi
call dword [sym.imp.msvcrt.dll__wfopen]
pop ecx
pop ecx
test eax, eax
jne 0x42ee7c
mov dword [esi + 0x90], 0xac6e
xor ebx, ebx
jmp 0x42ee82
mov dword [esi + 0x19c], eax
cmp ebx, dword [ebp + 0xc]
jne 0x42ef4b
cmp dword [ebp + 0x10], 0
jne 0x42ef4b
mov edi, dword [esi + 0x1a0]
test edi, edi
je 0x42ef4b
call fcn.004342ab
cmp eax, 1
jne 0x42ef4b
push 0x40634c
push edi
call dword [sym.imp.msvcrt.dll__wfopen]
mov dword [ebp - 8], eax
pop ecx
pop ecx
test eax, eax
je 0x42eee5
mov ecx, eax
call fcn.00431724
push dword [ebp - 8]
mov dword [esi + 0x1a8], eax
call dword [sym.imp.msvcrt.dll_fclose]
mov dword [esp], 0x406344
jmp 0x42ef2a
push 0x40633c
push edi
call dword [sym.imp.msvcrt.dll__wfopen]
mov dword [ebp - 8], eax
pop ecx
pop ecx
test eax, eax
je 0x42ef25
push eax
push 1
lea eax, [ebp - 4]
mov word [ebp - 4], 0xfeff
push 2
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
push dword [ebp - 8]
mov dword [esi + 0x1a8], 1
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
push 0x406344
push edi
call dword [sym.imp.msvcrt.dll__wfopen]
pop ecx
pop ecx
test eax, eax
jne 0x42ef45
mov dword [esi + 0x90], 0xac6d
xor ebx, ebx
jmp 0x42ef4b
mov dword [esi + 0x1a4], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x431724
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
push edi
push 1
mov word [ebp - 4], ax
xor esi, esi
lea eax, [ebp - 4]
push 2
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
test eax, eax
je 0x43178b
lea ecx, [ebp - 4]
mov eax, 0xfeff
cmp word [ecx], ax
jne 0x43175c
inc esi
jmp 0x43177d
lea ecx, [ebp - 4]
mov eax, 0xfffe
cmp word [ecx], ax
jne 0x43176d
push 2
jmp 0x43177c
lea ecx, [ebp - 4]
mov eax, 0xbbef
cmp word [ecx], ax
jne 0x43177d
push 3
pop esi
push 0
push 0
push edi
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x431d51
Capabilities:
Manipulate console buffer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x449164]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
mov edi, ecx
call fcn.004399fc
mov esi, eax
pop ecx
test esi, esi
je 0x431e21
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [edi + 6]
movsx edx, word [ebp - 0x16]
movsx eax, word [edi + 4]
sub edx, ecx
movsx ecx, word [ebp - 0xa]
imul edx, ecx
mov ecx, 0x400
sub edx, eax
movsx eax, word [ebp - 0x18]
add eax, edx
mov dword [ebp - 0x20], eax
cmp eax, ecx
jbe 0x431dc0
mov dword [ebp - 0x20], ecx
mov eax, ecx
add eax, eax
push eax
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
je 0x431ddf
movsx ecx, word [edi + 0x10]
movsx eax, word [edi + 0xc]
sub ecx, eax
jmp 0x431de1
xor ecx, ecx
test ecx, ecx
jle 0x431e18
xor eax, eax
mov word [ebp - 0x24], ax
mov ax, word [edi + 6]
mov word [ebp - 0x22], ax
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleCursorPosition]
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push esi
push ebx
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_WriteConsoleW]
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleCursorPosition]
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439ce0
leave
ret