joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3d60730
Capabilities:
Encode data using base64

Disassembly:
sar ecx, 0x7b
ror edx, 2
rol byte [esp + 5], 0x26
bswap eax
and dword [esp + eax - 0x7490fe], 0x37079a21
lea edx, [eax + edx + 0x1a3be10f]
add eax, dword [esp + eax - 0x7490fb]
ror byte [esp + eax - 0x65623a18], 0xe7
xor ebx, edx
add esi, edx
xchg dword [esp + eax - 0x65623a1f], eax
mov dword [esp + eax*4 - 0xe400300], esi
ret 4
inc ecx
neg ebx
inc esi
lea ebx, [eax + ebx - 0x7abea339]
inc ecx
rol ebx, 3
inc esp
movzx esi, ax
inc ecx
mov edi, esp
inc ebp
lea ebx, [ebx + eax*2 - 0x6d0548f3]
ror bx, 1
sub ax, di
inc ecx
ror ebx, 1
jmp 0x35d6a50
inc ecx
dec ebx
dec ecx
neg esi
js 0x361ab23
xchg esp, eax
and dword [ecx - 0x594efdd4], 0xafe0b85b
ret 0xd02e
inc ecx
neg ebx
call fcn.03d5a810
rol edx, 0x2a
mov dword [esp], edx
mov edx, dword [edi - 5]
sbb edi, 5
xor dword [esp + 4], eax
or al, 0x1c
movsx ecx, word [esp + 2]
xor edx, ebx
and cl, 0x2e
dec edx
shl cl, 0x61
not edx
bswap eax
bswap eax
shl eax, 0xea
neg edx
shl byte [esp], 0x21
not edx
inc edx
dec ecx
sete al
not edx
jp 0x23477e6
inc ecx
mov ebx, 0x5a862bbe
inc ecx
movzx eax, bl
dec esi
lea edi, [ebx*2 + 0x6bb6d49c]
inc edi
mov ebx, dword [eax + ebx - 0x5a862bbe]
dec eax
lea ebx, [eax*8 - 0x31c176cb]
inc ecx
movzx ecx, bh
dec ebp
lea eax, [eax + eax*4 - 0x2f4]
inc ebp
mov ecx, edi
inc ebp
xor ebx, ebp
inc ecx
movsx edx, cx
xor cx, dx
inc ecx
not ebx
inc cx
xadd ecx, eax
seto al
inc ecx
xor ebx, 0x12a71b1c
or al, 0xaf
inc ebp
movzx esp, di
inc edi
lea ebx, [ecx + ebx + 0x6ebd3f2c]
jno 0x35be155
xor edx, ebx
call fcn.036f1799
lea ebp, [edx + ebp - 0x3820e3fb]
jnp 0x3d29bcd
mov ax, word [ebp]
movsx edx, cx
dec ecx
call fcn.03d17b71
add dl, 0x28
mov eax, 0x4ead9e12
shr eax, 0x70
ror dword [esp + eax - 0x4ead], 0xe2
rol dl, 1
inc dword [esp + eax - 0x4ead]
not eax
mov dword [esp], eax
inc dl
not byte [esp + 1]
jmp 0x36be7de

Function at 0x3d60acc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea eax, [eax + edx*2 + 0x633e3cba]
push edx
jo 0x36e1042
or dx, 0xcdb4
neg eax
add dword [esp + edx - 0xcff1], 0x4600ac2a
sub word [esp + edx - 0xcff0], dx
dec eax
and dx, dx
jae 0x3d8834f
mov dword [esp + eax - 0x7186f6ab], eax
lea edi, [edi + eax - 0x7186f6af]
movzx edx, al
sal dl, 0xe7
dec dword [esp + eax - 0x7186f6ab]
mov eax, dword [edi + eax - 0x7186f6ab]
xadd word [esp + edx - 0x7e], dx
xor eax, ebx
bswap eax
rol eax, 1
inc dl
bswap eax
xchg dh, dl
jne 0x23444d9
push 0x7bb83cb5
mov dx, word [ebp]
sar byte [esp], 0x65
pop eax
lea ecx, [eax*8 + 0x6b921707]
mov ax, word [eax + ebp - 0x7bb83cfb]
dec ecx
or dx, ax
xor ecx, ecx
not dx
rol ecx, 0xba
mov word [ebp + ecx*8 + 2], dx
jp 0x3d794f1
mov eax, dword [edi + ecx - 4]
xor eax, ebx
ror ecx, 0xc7
rol eax, 1
xor eax, 0x75276a9f
dec eax
sub cl, 0x29
not eax
xor ebx, eax
call fcn.036fdaff

Function at 0x3d61343
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edx + eax + 0x1bffda25]
mov dword [esp], edx
bswap eax
adc cx, word [esp + 2]
call fcn.0364856c
Function at 0x3d752bd
Capabilities:
Encode data using xor

Disassembly:
inc ecx
add ah, 0x99
sal byte [esp + eax*2 - 0x10d], 0x67
inc ecx
neg ah
inc ecx
inc ah
inc ebp
xchg cl, dh
jmp 0x3d2cfb8
dec eax
mov dword [esp + eax*2 - 0x110], 0x8a2fdbb0
shl word [esp + eax*2 - 0x10d], 0x85
inc ebp
xor ah, ch
jmp 0x3d1c832
Function at 0x3d7cfb4
Capabilities:
Encode data using xor

Disassembly:
or dl, dh
lea edi, [ecx + edi - 0x7956d5a5]
pop edx
sal edx, 0x47
or cx, dx
xor eax, ebx
xor edx, ecx
not eax
sal edx, cl
call fcn.035fea80
lea edi, [ecx + edi + 4]
xor edx, 0x4805af19
xor eax, ebx
lea edx, [edx - 0x659d970]
neg cx
setg cl
not eax
dec eax
ror eax, 1
xadd ecx, edx
bswap ecx
bswap eax
sub edx, 0x29335230
adc cx, cx
xor ebx, eax
bswap ecx
push ecx
sub byte [esp + ecx - 0x7956d5a9], ch
add esi, eax
sar byte [esp + ecx - 0x7956d5a8], 0x81
mov eax, dword [edi + ecx - 0x7956d5a9]
sal edx, 0x44
jp 0x361a19c
sub edi, 4
mov ecx, 0x449fa515
mov edx, dword [edi + ecx - 0x449fa515]
and cl, cl
xor edx, ebx
call fcn.03d185e3
mov ecx, dword [esp + 4]
xchg dword [esp + 0xc], ecx
and eax, edx
call fcn.03d78137
inc ecx
rol byte [esp + eax - 0x6e9770fa], 0xc1
mov dword [esp + eax - 0x6e9770fc], 0x1d938b05
ror ecx, 2
and dword [esp + eax - 0x6e9770fc], eax
rol ax, 0xe4
sub ecx, 0xb92b7c84
mov dword [esp + eax - 0x6e971007], eax
inc ax
xchg word [esp + eax - 0x6e971003], ax
bswap ecx
jp 0x3642971
rol dword [esp + eax - 0x6e9792fd], 0xb2
xor ebx, ecx
xor al, al
lea edx, [eax + eax*8 - 0x70f400d0]
adc esi, ecx
dec dword [esp + edx - 0x72602a2e]
dec byte [esp + edx - 0x72602a2e]
sete dl
mov dword [esp + eax - 0x6e979300], esi
ret 4

Function at 0x3d86ff0
Capabilities:
Encode data using xor

Disassembly:
dec al
pop eax
add eax, 0xfff27b45
jmp eax
inc ecx
not edi
inc edx
movsx ecx, byte [esp + ebx + 3]
dec ebp
xadd esi, esp
mov ebx, edx
inc ebp
add edi, ebx
inc esi
and dword [esp + ebx*4 + 1], esi
inc ecx
push esp
setge dl
dec esi
mov dword [esp + ebx + 0x17], ebp
neg dl
inc esi
xor dword [esp + ebx*4 + 0x14], edi
xadd dword [esp + eax*2 - 0xa22], ecx
dec esi
jl 0x36bbb3b
adc al, 0xf
ror dword [esp + eax*2 - 0xa22], 0x4e
mov ebp, dword [esp + ebx + 0x17]
inc dx
xor dword [esp + ebx*8 - 7], 0xf74a9a81
push esp
pop esp
push cs
dec ebp
arpl di, di
inc dx
mov dword [esp + ebx + 0x15], 0xc3fe9f3a
inc ecx
bswap esp
dec ebp
adc edx, edi
inc dx
add dword [esp + ebx + 9], 0x830f0f02
jo 0x36bbb9d
insb byte es:[edi], dx
add byte [eax + 0x1902f797], bh
lea esi, [esi + eax - 0x1902f79b]
mov eax, dword [eax + esi - 0x1902f797]
mov ecx, 0xb80bb016
xor eax, ebx
jmp 0x36d1ba9
neg cl
sal ecx, cl
xor eax, 0x2c3d7821
jmp 0x3d5796b
ror eax, 1
sar cx, 0xe5
neg eax
sub eax, 0xd014cbbc
sal cl, 0xe1
xor ebx, eax
movsx edx, cx
add edi, eax
fsub qword [ecx + ebp - 0x2ec3fd80]
inc dl
jmp edi
inc ecx
not edi
dec edx
mov dword [esp + ebx - 1], esi
inc ecx
xor edi, 0xe12fc297
jmp 0x36bbb78

Function at 0x3d8f162
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add ebp, 6
mov edx, 0xaa26b821
neg dx
mov word es:[eax], cx
movzx ecx, dx
mov dword [esp + ecx - 0x47df], ecx
call fcn.03d943ae
Function at 0x3d8f183
Capabilities:
Check for vm using instruction vpcext

Disassembly:
rol eax, 3
sal ecx, 0xdd
jp 0x22bd909
inc ecx
mov esp, 0x7e2f419e
inc edi
mov edi, dword [eax - 0x7e2f419e]
inc ecx
movsx ecx, ah
dec edi
lea eax, [eax - 0x7e2f419a]
inc ecx
mov ecx, 0xe10a6a20
jmp 0x3d38ed8
inc ebp
xor edi, ebp
inc ecx
ror ecx, 0x67
inc ecx
mov edx, ebx
inc ecx
sbb edi, 0x90be40b2
dec ecx
or ecx, 0x2aa382d
inc ecx
rol edi, 1
mov edi, 0xef069936
inc ecx
bswap edi
inc dl
inc edi
lea edi, [edi - 0x7fbfcdfe]
inc ecx
sal bl, 0x43
xadd cx, di
inc ecx
push ebp
dec ebp
xadd ebx, ecx
ror ecx, 0xa9
dec edi
lea ebp, [ecx - 0x3cfce7e6]
inc esp
xor dword [esp + ecx - 0x6a7fffcc], edi
dec eax
lea esi, [ecx*8 + 0x1d9c7f24]
inc ecx
shr ebx, cl
inc ecx
pop ebp
adc edx, 0x5c1f183d
shr esi, 0xd2
call fcn.036b1889
sub esi, 4
mov ecx, 0x84281127
or ecx, 0x43994f32
movsx edx, cx
mov eax, dword [esi + edx*2 - 0xbe6e]
sub ecx, 0xc422b199
xor eax, ebx
inc eax
jmp 0x235386f
inc esi
js 0x36d88d4
not edi
dec edi
dec esi
mov dword [esp + esi + 0x38], ebp
push edx
inc ecx
and bh, 0x37
inc edx
xor dword [esp + esi + 0x40], edi
sub al, 0xac
dec esi
mov ebp, dword [esp + esi*4 + 0x40]
inc ecx
mov dword [esi + ebp - 0xc], edi
inc edx
neg byte [esp + esi + 0x38]
dec eax
lea ebp, [ebp + esi - 0x51f]
dec edx
inc dword [esp + esi + 0x25]
pop esi
pop esi
pop edx
pop esi
pop esi
inc ecx
pop ebx
pop eax
inc ecx
pop ecx
inc ecx
pop ecx
jbe fcn.022bb722
mov edx, 0xd41e6439
sub edi, 4
neg dl
inc dx
call fcn.03d51347
imul esp, dword [edi + 0x750b482b], 0xffffff8c
clc
rcr byte [edx - 4], 1
ror byte [esp + eax*4 - 0x5303a530], 1
sub ah, 0xc9
adc ebx, dword [eax - 0x17a2e2b3]
les ecx, [edx]
and dword [edi - 0x31], ecx
scasd eax, dword es:[edi]
sbb eax, 0x4b83cf17
rcr dword [0xdf5fcf17], cl
scasd eax, dword es:[edi]
sbb eax, 0x3f9bcf17
sbb eax, 0xbc5fcf17
ljmp 0x245
mov ax, word [ebp + 2]

Function at 0x3d9fbf3
Capabilities:
Encode data using xor

Disassembly:
sal ax, 0xcd
adc esi, edx
dec dword [esp + 4]
pop eax
pop edx
jl fcn.03cfab6b
test byte [edx], 0xf1
xchg esi, eax
or byte [eax + 0x2e], dl
and al, 0xfc
movsd dword es:[edi], dword [esi]
in eax, 0x18
and al, 0xfc
pop ebp
test dword [eax + 0x2e], ebx
and al, 0xfc
insd dword es:[edi], dx
jge 0x3d9fc95
and al, 0xfc
ror byte [0xfc242ee0], 0x68
mov al, 0xf0
invalid
and byte [edx], dl
dec dx
dec ecx
xchg esi, eax
sub dword [eax + 0x27], ebx
pop ebx
or edi, dword [eax + 0x38]
add ecx, esi
stc
adc byte [ebx - 0xe], cl
mov dh, 0x3b
add ecx, esi
clc
imul ebp, esi, 0xf3cddf
sbb dword [ebp + 0xd], esp
inc edi
insb byte es:[edi], dx
adc dword [edi + 0x2e], 0xffffffb5
xchg dword [edi + 0x2e], edx
mov ch, 0x6f
outsd dx, dword [esi]
jae 0x3d9fcc0
loope 0x3d9fcd9
mov edi, 0xaeecfaba
or bh, byte [edx]
jnp 0x3d9fcce
cmp bh, byte [ebx]
xor eax, 0xbccaca88
pushal
cmp ebp, edi
js 0x3d9fccb
fsub qword [edx]
mov ebp, 0x5caa4877
and bh, byte [ebp + 0x5caa4877]
jmp 0xe930da6b
Function at 0x406580
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x50b624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x50]
call fcn.0043bdf0
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
push edi
call fcn.00407330
add esp, 8
test al, al
je 0x4066c4
lea eax, [ebp - 0x78]
push eax
call fcn.0044d220
add esp, 4
mov ecx, eax
call fcn.00452590
lea ecx, [ebp - 0x30]
mov ebx, eax
mov esi, edx
call fcn.00452590
sub ebx, eax
mov eax, dword [ebp + 0xc]
sbb esi, edx
cdq
cmp esi, edx
jl 0x4066c4
jg 0x40660b
cmp ebx, eax
jbe 0x4066c4
cmp dword [edi + 0x14], 8
jb 0x406613
mov edi, dword [edi]
mov ecx, edi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406630
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.0040a7f0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov eax, 0x414
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x64], 0
movlpd qword [ebp - 0x5e], xmm0
mov dword [ebp - 0x56], 0
mov dword [ebp - 0x6c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4066c4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4066ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4066e8
push edx
push ecx
call fcn.0045e1a8
add esp, 8
lea ecx, [ebp - 0x50]
call fcn.00409c30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e450
mov esp, ebp
pop ebp
ret
call fcn.0049f39a
int3
Function at 0x406770
Capabilities:
Check if file exists
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce916
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x50b624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x4067ae
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4067c3
xor al, al
jmp 0x4068c1
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4067cd
mov eax, dword [edi]
push eax
call ebx
cmp eax, 0xffffffff
setne cl
jne 0x4068bf
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
mov dword [ebp - 0x2cc], 0x18
mov dword [ebp - 0x2d4], 0x400
lea eax, [ebp - 0x2fc]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00443960
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x406823
mov esi, dword [esi]
push 0x2b4
lea eax, [ebp - 0x2c4]
push 0
push eax
call fcn.0049be60
add esp, 0xc
lea eax, [ebp - 0x2c4]
xor ebx, ebx
push 0x100
push 0x2b4
push eax
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x2c4]
test eax, eax
je 0x406876
mov dword [ebp - 0x2dc], ebx
mov ebx, esi
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2e0], 0x20
lea ecx, [ebp - 0x2fc]
call fcn.00405200
lea eax, [ebp - 0x314]
mov ecx, edi
push eax
call fcn.00443960
push eax
push esi
mov byte [ebp - 4], 1
call fcn.004084f0
add esp, 8
mov byte [ebp - 0x2c5], al
lea ecx, [ebp - 0x314]
call fcn.00405200
test ebx, ebx
je 0x4068b9
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov cl, byte [ebp - 0x2c5]
mov al, cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e450
mov esp, ebp
pop ebp
ret
Function at 0x406ed0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cea5e
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x50b624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x21c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.0049be60
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x407019
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406fa0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040a7f0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x250]
call fcn.0043bc20
mov ecx, eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 2
push ecx
cmp dword [esi + 8], eax
je 0x406ff7
mov ecx, eax
call fcn.0043bc00
add dword [esi + 4], 0x18
jmp 0x406fff
push eax
mov ecx, esi
call fcn.00403190
lea ecx, [ebp - 0x250]
call fcn.00405200
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00405200
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0049be60
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4070e7
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407072
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040a7f0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x250]
call fcn.0043bc20
mov ecx, eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 4
push ecx
cmp dword [esi + 8], eax
je 0x4070c9
mov ecx, eax
call fcn.0043bc00
add dword [esi + 4], 0x18
jmp 0x4070d1
push eax
mov ecx, esi
call fcn.00403190
lea ecx, [ebp - 0x250]
call fcn.00405200
lea ecx, [ebp - 0x234]
call fcn.00405200
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e450
mov esp, ebp
pop ebp
ret
Function at 0x408450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40845e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x409630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cedb0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x50b624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0045e178
mov edi, eax
add esp, 4
test edi, edi
je 0x4096e2
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042de72
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40cf50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0045e4f0
mov eax, dword [0x50b624]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.0049be60
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x40d046
test edi, edi
je 0x40d046
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40d046
cmp eax, 0x3fff
ja 0x40d046
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40d046
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x4dbf18
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d046
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.0049be60
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.0040de40
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e450
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0045e450
mov esp, ebp
pop ebp
ret
Function at 0x40dee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x50b624]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40df67
test ebx, ebx
je 0x40df67
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40df67
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40df67
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40df61
push esi
push ebx
push edi
call fcn.0049b360
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40df61
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e450
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e450
mov esp, ebp
pop ebp
ret

Function at 0x40df80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40dfd9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40dfd9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40dfca
cmp esi, edx
jae 0x40dfd9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40dfb8
cmp esi, edx
jae 0x40dfd9
cmp word [esi], 0
je 0x40dfd9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41e3d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0eeb
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x50b624]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0045d090
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x41e53a
push 0x72
push str.d:jenkins.jenkinsworkspacegroup_cleandesktop_quickdesktop_quickdesktop_quick_ui_srcdesktop_quick_ui_wnd.cc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.0040a6f0
push 3
push 0x4db970
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.0040a6f0
mov byte [ebp - 4], 1
call fcn.0045d090
mov edi, eax
lea ecx, [ebp - 0xd4]
push 0x220
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404840
mov esi, eax
push str.Close_Msg
push esi
mov byte [ebp - 4], 2
call fcn.00405890
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xd4]
call fcn.00405b20
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x41e4df
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41e4d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e57a
push edx
push ecx
call fcn.0045e1a8
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x41e528
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41e51e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e57f
push edx
push ecx
call fcn.0045e1a8
add esp, 8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0xd4]
test ecx, ecx
je 0x41e55f
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov dword [ebx + 0xd4], 0
mov ecx, ebx
call fcn.00429900
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0049f39a
call fcn.0049f39a
int3