joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43370a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1f4
lea eax, [ebp - 0x314]
push 0
push eax
call fcn.0046ca80
mov esi, 0x114
lea eax, [ebp - 0x120]
push esi
push 0
mov ebx, 0x1f8
push eax
mov dword [ebp - 0x318], ebx
call fcn.0046ca80
add esp, 0x18
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x433777
sub dword [ebp - 0x318], 4
push 0
lea eax, [ebp - 0x318]
push eax
push ebx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret

Function at 0x433812
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x433863
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [ebp - 0x10], 0
pop ebx
je 0x433873
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret

Function at 0x434410
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
xor eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test bl, bl
push edi
push 5
mov edi, ecx
pop ecx
cmovne eax, ecx
push eax
push dword [edi + 8]
mov dword [ebp + 8], eax
call esi
push str._Checkbox_Stub_
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetPropW]
push 0
push eax
call esi
mov esi, dword [edi + 0x14]
mov byte [edi + 0x48], bl
mov ebx, dword [ebp + 8]
push ebx
cmp esi, dword [edi + 0x18]
je 0x434463
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
add esi, 0x14
jmp 0x434450
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x436dd9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
add ecx, 0x18
call fcn.0040cb09
call fcn.00430b91
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x43a345
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 8
mov edi, ecx
call fcn.0043d3a8
mov edx, eax
xor esi, esi
pop ecx
test edx, edx
je 0x43a360
mov dword [edx], esi
mov dword [edx + 4], esi
jmp 0x43a362
mov edx, esi
mov eax, dword [edi + 0x98]
push esi
push esi
push edx
push 0x40c109
mov dword [edx], eax
mov eax, dword [edi + 0x20]
push esi
push esi
mov dword [edx + 4], eax
call fcn.0046ac19
push 8
call fcn.0043d3a8
mov ecx, eax
add esp, 0x1c
test ecx, ecx
je 0x43a396
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x43a398
mov ecx, esi
mov eax, dword [edi + 0x98]
push esi
push esi
push ecx
push 0x40c0e1
mov dword [ecx], eax
mov eax, dword [edi + 0x20]
push esi
push esi
mov dword [ecx + 4], eax
call fcn.0046ac19
add esp, 0x18
pop edi
pop esi
ret

Function at 0x43a3bb
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x98]
cmp byte [eax + 0x1086], 0
je 0x43a3de
cmp dword [eax + 0x10ec], 0
jne 0x43a3de
mov ecx, dword [ecx + 0x9c]
jmp fcn.00436dd9
ret

Function at 0x43a8e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4909fc
mov eax, dword fs:[0]
push eax
sub esp, 0x8d0
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x8c8], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x8e0]
mov dword fs:[0], eax
mov edi, ecx
and dword [esp + 0x18], 0
mov esi, 0x7d2
mov ecx, dword [edi + 0x98]
call fcn.00406f28
mov dword [esp + 0x14], eax
test eax, eax
je 0x43aa1b
cmp eax, 4
jne 0x43aa20
mov ecx, dword [edi + 0x98]
lea eax, [esp + 0x304]
push eax
call fcn.0042d7c1
and dword [esp + 0x8e8], 0
xor ebx, ebx
inc ebx
cmp dword [eax + 0x1bc], 0
mov dword [esp + 0x18], ebx
jbe 0x43a99b
mov ecx, dword [edi + 0x98]
lea eax, [esp + 0x1c]
push eax
call fcn.0042d7c1
push 3
pop ebx
mov byte [esp + 0x13], 1
cmp dword [eax + 0x224], 0
je 0x43a9a0
mov byte [esp + 0x13], 0
test bl, 2
je 0x43a9b1
lea ecx, [esp + 0x1c]
and ebx, 0xfffffffd
call fcn.0040420a
or dword [esp + 0x8e8], 0xffffffff
test bl, 1
je 0x43a9ca
lea ecx, [esp + 0x304]
call fcn.0040420a
cmp byte [esp + 0x13], 0
je 0x43aa10
mov ecx, dword [edi + 0x98]
lea eax, [esp + 0x5ec]
push eax
call fcn.0042d7c1
add eax, 0x1c4
cmp dword [eax + 0x14], 8
jb 0x43a9f1
mov eax, dword [eax]
push 1
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x5ec]
call fcn.0040420a
mov eax, dword [esp + 0x14]
mov esi, 0x7d1
jmp 0x43aa20
mov esi, 0x7d0
push eax
push esi
push 0x401
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x8e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8c8]
xor ecx, esp
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret
Function at 0x43b0ac
Capabilities:
Get graphical window text
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x490bb1
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
test edi, edi
je 0x43b110
imul eax, eax, 0x64
xor edx, edx
div edi
mov ebx, eax
jmp 0x43b113
push 0x64
pop ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push ebx
push 0x402
push dword [ecx + 0x34]
call esi
mov edx, ebx
lea ecx, [esp + 0x50]
call fcn.00405f75
and dword [esp + 0x178], 0
lea ecx, [esp + 0x68]
push 0x4a6cfc
mov edx, eax
call fcn.0040ed8a
pop ecx
mov ebx, dword [esp + 0x1c]
mov edx, eax
mov byte [esp + 0x178], 1
lea ecx, [ebx + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call fcn.0040ed62
pop ecx
push 0
push 1
lea ecx, [esp + 0x70]
call fcn.0040513f
push 0
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x180], 4
call fcn.0040513f
cmp dword [esp + 0x4c], 8
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
push eax
push 0
push 0xc
push dword [ebx + 0x30]
call esi
push ecx
push str.Downloaded
lea ecx, [esp + 0xd4]
call fcn.00411337
push dword [esp + 0x14]
lea edx, [esp + 0xd0]
mov byte [esp + 0x17c], 5
lea ecx, [esp + 0x104]
call fcn.0042274c
pop ecx
add eax, 0x18
mov byte [esp + 0x178], 6
push eax
lea ecx, [esp + 0x24]
call fcn.00404e91
lea ecx, [esp + 0x100]
call fcn.004114c7
lea ecx, [esp + 0xcc]
mov byte [esp + 0x178], 9
call fcn.004114c7
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push 0
push dword [esp + 0x1c]
call fcn.004246a8
pop ecx
pop ecx
push 0xffffffffffffffff
mov byte [esp + 0x17c], 0xa
push 0
push eax
lea ecx, [esp + 0x2c]
call fcn.00405282
push 0
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x180], 9
call fcn.0040513f
push ecx
push str._from
lea ecx, [esp + 0xa0]
call fcn.00411337
push dword [esp + 0x14]
lea edx, [esp + 0x9c]
mov byte [esp + 0x17c], 0xb
lea ecx, [esp + 0x138]
call fcn.0042274c
pop ecx
push 0xffffffffffffffff
push 0
add eax, 0x18
mov byte [esp + 0x180], 0xc
push eax
lea ecx, [esp + 0x2c]
call fcn.00405282
lea ecx, [esp + 0x134]
call fcn.004114c7
lea ecx, [esp + 0x98]
mov byte [esp + 0x178], 9
call fcn.004114c7
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x80]
push 0
push edi
call fcn.004246a8
pop ecx
pop ecx
push 0xffffffffffffffff
xor edi, edi
mov byte [esp + 0x17c], 0xd
push edi
push eax
lea ecx, [esp + 0x2c]
call fcn.00405282
push edi
push 1
lea ecx, [esp + 0x88]
call fcn.0040513f
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
push edi
push 0xc
push dword [ebx + 0x38]
call esi
push edi
push 1
lea ecx, [esp + 0x28]
call fcn.0040513f
push edi
push 1
lea ecx, [esp + 0x40]
call fcn.0040513f
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43c7e9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1f4
lea eax, [ebp - 0x314]
mov esi, ecx
push 0
push eax
call fcn.0046ca80
mov edi, 0x114
mov dword [ebp - 0x318], 0x1f8
push edi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0046ca80
add esp, 0x18
mov dword [ebp - 0x120], edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x43c857
sub dword [ebp - 0x318], 4
push 0
lea eax, [ebp - 0x318]
push eax
push 0x1f8
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea eax, [ebp - 0x180]
neg esi
push eax
mov dword [ebp - 0x180], esi
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret
Function at 0x441478
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4414bd
call fcn.00451935
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4414bd
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4414d9
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043cf91
mov ebx, eax
test edi, edi
je 0x4414d7
test esi, esi
je 0x4414d7
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x446035
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00451935
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44606c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0044608d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47c7b2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0047151e
mov dword [ebp - 0x14], eax
cmp dword [0x4c34ec], esi
jne 0x47c8a5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47c832
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x47c985
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x47c985
push 0x49c170
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47c985
push eax
call ebx
push 0x49c17c
push edi
mov dword [0x4c34ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x49c18c
push edi
mov dword [0x4c34f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c34f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c34fc], eax
test eax, eax
je 0x47c8a2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c34f8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47c8ca
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47c8bd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47c8df
push 4
pop eax
jmp 0x47c987
cmp dword [ebp - 0x14], esi
je 0x47c8df
push dword [0x4c34ec]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x47c8c4
mov eax, dword [0x4c34f8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47c93d
cmp dword [0x4c34fc], edi
je 0x47c93d
push eax
call ebx
push dword [0x4c34fc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47c93d
test eax, eax
je 0x47c93d
call ecx
test eax, eax
je 0x47c932
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47c932
test byte [ebp - 8], 1
jne 0x47c93d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47c96d
mov eax, dword [0x4c34f0]
cmp eax, edi
je 0x47c96a
push eax
call ebx
test eax, eax
je 0x47c96a
call eax
mov esi, eax
test esi, esi
je 0x47c96a
mov eax, dword [0x4c34f4]
cmp eax, edi
je 0x47c96a
push eax
call ebx
test eax, eax
je 0x47c96a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c34ec]
call ebx
test eax, eax
je 0x47c985
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x47c987
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret
Function at 0x10005210
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x10023008
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1002b060]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov edi, str.d3dx11_42.dll
lea esi, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.10001030
test eax, eax
jne 0x1000527d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10005266
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x80004005
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
mov edi, dword [esp + 0xc]
test edi, edi
je 0x1000532c
push str.D3DX11CompileFromMemory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005325
mov edx, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push 0
push 0
push 0x800
push ecx
push edx
push 0
push 0
push str.D3D11_FX.fx
push 0x52e
push 0x10027338
call eax
mov esi, eax
mov eax, dword [esp + 0x10]
test esi, esi
jge 0x10005319
test eax, eax
je 0x100052fe
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100052fe
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
test eax, eax
je 0x10005325
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x1000ced0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000cee7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000cf18
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x1000cf14
cmp esi, eax
jae 0x1000cf18
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x1000cf04
cmp esi, eax
jb 0x1000cf1e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x1000d9a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, 1
sub esp, 0x10
cmp eax, ecx
jle 0x1000da05
cmp eax, 0x270f
jl 0x1000d9bf
mov dword [esp + 0x18], 0x270f
push esi
push edi
push ecx
push ecx
push ecx
push ecx
mov edi, 0x3e8
mov esi, 4
mov dword [esp + 0x20], ecx
call dword [0x10033b18]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x28]
cmp eax, 2
je 0x1000da0b
cmp eax, 5
je 0x1000da0b
mov ecx, dword [esp + 0x20]
cmp ecx, edi
jge 0x1000da0f
mov dword [esp + 8], 0x64
mov edi, dword [esp + 8]
mov esi, 3
jmp 0x1000da0f
mov dword [esp + 0x18], ecx
jmp 0x1000d9bf
mov ecx, dword [esp + 0x20]
test esi, esi
jle 0x1000dbb0
fldz
push ebx
push ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], esi
jmp 0x1000da31
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
cmp ecx, edi
jge 0x1000da56
cmp dword [esp + 0x18], 0
je 0x1000da56
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x1000db9c
mov eax, ecx
fld1
cdq
idiv edi
sub esp, 0x10
xor ebp, ebp
mov dword [esp + 0x28], ebp
fstp dword [esp + 0xc]
fst dword [esp + 8]
fst dword [esp + 4]
fstp dword [esp]
mov esi, eax
mov edx, esi
imul edx, edi
sub ecx, edx
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], eax
call dword [0x10033b0c]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + esi]
imul edi, edi, 0xa4
cmp dword [edi + 0x1002ed58], ebp
jle 0x1000daed
lea esi, [edi + 0x1002d3c0]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov ebx, dword [esi - 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esi + 4]
push eax
sub edx, ebx
push edx
push ecx
push ebx
call dword [0x10033b14]
push 0x4000
call dword [0x10033b10]
inc ebp
add esi, 0x10
cmp ebp, dword [edi + 0x1002ed58]
jl 0x1000dab8
mov eax, dword [esp + 0x24]
fld1
sub esp, 0x10
cmp dword [eax + 0x18], 0
je 0x1000db0c
fst dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fst dword [esp + 4]
jmp 0x1000db4c
cmp dword [esp + 0x3c], 0
je 0x1000db3c
cmp dword [0x10036224], 0
je 0x1000db30
fstp dword [esp + 0xc]
fld dword [0x10028348]
fst dword [esp + 8]
fst dword [esp + 4]
jmp 0x1000db4c
fst dword [esp + 0xc]
fldz
fst dword [esp + 8]
jmp 0x1000db48
fst dword [esp + 0xc]
fldz
fst dword [esp + 8]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
call dword [0x10033b0c]
xor ebp, ebp
cmp dword [edi + 0x1002ed58], ebp
jle 0x1000db9a
lea esi, [edi + 0x1002ed60]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov ebx, dword [esi - 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esi + 4]
push eax
sub edx, ebx
push edx
push ecx
push ebx
call dword [0x10033b14]
push 0x4000
call dword [0x10033b10]
inc ebp
add esi, 0x10
cmp ebp, dword [edi + 0x1002ed58]
jl 0x1000db65
fldz
add dword [esp + 0x14], 0xa
sub dword [esp + 0x1c], 1
jne 0x1000da29
pop ebp
fstp st(0)
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 0xc
Function at 0x1000f3f0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push ebp
mov dword [esp + 0x14], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x1000f475
push edi
push esi
call fcn.10013c23
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1000f46b
mov ecx, dword [esp + 0x10]
push edi
push esi
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x10027b38
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000f462
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov ebx, 1
push edi
call fcn.10012d57
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x10011030
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [eax + 0x10]
push edx
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [esp]
pop ecx
ret 0xc

Function at 0x10011070
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [eax + 0x10]
push edx
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp]
pop ecx
ret 0xc

Function at 0x10011140
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 4]
add esp, 8
ret 4
Function at 0x100116c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
push 0x10000
mov dword [esp + 0x14], 0
call fcn.10013c23
add esp, 4
mov ebp, eax
lea ecx, [ecx]
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
mov edi, dword [esi + 0x38]
test eax, eax
jne 0x1001171f
cmp dword [esi + 0x20], eax
jne 0x1001171f
xor ecx, ecx
cmp edi, 0x10000
setl cl
dec ecx
and ecx, 0x10000
mov edi, ecx
test edi, edi
jne 0x1001172c
test eax, eax
je 0x10011789
mov dword [esp + 0x10], 1
jmp 0x10011789
cmp edi, 0x10000
jl 0x1001170d
mov edi, 0x10000
cmp dword [esi + 0x38], edi
jl 0x10011789
test edi, edi
jle 0x10011789
mov eax, dword [esi + 0x30]
cmp eax, dword [esi + 0x34]
jle 0x1001176a
mov ebx, dword [esi + 0x2c]
sub ebx, eax
cmp ebx, edi
jl 0x10011748
mov ebx, edi
mov edx, dword [esi + 0x28]
push ebx
add edx, eax
push edx
push ebp
call fcn.10016e80
add esp, 0xc
cmp ebx, edi
jge 0x1001177a
mov ecx, dword [esi + 0x28]
mov eax, edi
sub eax, ebx
push eax
push ecx
add ebx, ebp
push ebx
jmp 0x10011772
mov edx, dword [esi + 0x28]
push edi
add edx, eax
push edx
push ebp
call fcn.10016e80
add esp, 0xc
mov eax, dword [esi + 0x30]
add eax, edi
cdq
idiv dword [esi + 0x2c]
sub dword [esi + 0x38], edi
mov dword [esi + 0x30], edx
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x100117f8
mov ecx, dword [esi + 0x10]
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ebp
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, dword [esp + 0xc]
cmp ebx, edi
je 0x100117c9
mov dword [esi + 0x78], 1
jmp 0x100117e3
lea edi, [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, ebx
cdq
add dword [esi + 0x40], eax
push edi
adc dword [esi + 0x44], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 0x38], 0x400000
jae 0x10011804
mov edx, dword [esi + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10011804
mov eax, dword [esi + 0x70]
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0x10], 0
je 0x100116e0
push ebp
call fcn.10012d57
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10012841
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002b060]
jne 0x1001284b
repz ret
jmp fcn.100143f7