joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov esi, dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
add eax, 0x1a
sub esp, 8
cmp eax, ebx
jbe 0x10004ff0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], edi
call esi
mov ebx, eax
lea eax, [eax + 0x7fffffff]
sub esp, 8
cmp word [edi + eax*2], 0x5c
lea edx, [eax + eax]
je 0x1000501b
mov eax, 0x5c
add ebx, 1
mov word [edi + edx + 2], ax
lea edx, [ebx + ebx]
mov ecx, dword [str.spoolPRINTERS_]
lea eax, [edi + edx]
mov dword [eax], ecx
mov ecx, dword [0x10016804]
mov dword [eax + 4], ecx
mov ecx, dword [0x10016808]
mov dword [eax + 8], ecx
mov ecx, dword [0x1001680c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x10016810]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x10016814]
mov dword [eax + 0x14], ecx
mov ecx, dword [0x10016818]
mov dword [eax + 0x18], ecx
mov ecx, dword [0x1001681c]
mov dword [eax + 0x1c], ecx
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], str._05d.SPL
mov dword [esp + 0xc], eax
lea eax, [edi + edx + 0x1e]
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sym._swprintf
lea esp, [ebp - 0xc]
lea eax, [ebx + 0x19]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10005cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
test byte [0x100131d8], 8
jne 0x10005d38
test ebx, ebx
je 0x10005ce2
mov eax, dword [ebx]
cmp eax, 3
je 0x10005da0
cmp eax, 1
je 0x10005d00
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10005d80
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___p___ld___p__n
mov dword [esp + 8], str.fpWritePrinter
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
mov dword [ebp - 0x10], edx
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x10]
jmp 0x10005cce
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xbbb
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebx + 4]
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x14], edx
mov edx, dword [ebx + 8]
mov dword [ebp + 8], edx
mov eax, dword [eax + 0x28]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp eax
Function at 0x10005f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
test byte [0x100131d8], 8
jne 0x10005f88
test ebx, ebx
je 0x10005f6c
cmp dword [ebx], 4
je 0x10005fd0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._p__p__lu__p_n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], str.fpReadPrinter
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x100131d8
mov dword [esp + 0x14], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10005f63
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov ebx, dword [ebp - 4]
sub esp, 0x14
leave
ret 0x10
Function at 0x10006ae0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [eax + 4]
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x48
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x10006c58
sub eax, edi
sar eax, 1
mov edx, eax
test edx, edx
je 0x10006bf0
test byte [0x100131d8], 8
jne 0x10006c00
mov eax, edx
neg eax
cmp edx, 0xf
ja 0x10006bf2
test esi, esi
je 0x10006ba9
lea ecx, [edx + edx]
cmp ecx, 4
jb 0x10006b90
mov eax, dword [ebx + 4]
lea ebx, [esi + 4]
and ebx, 0xfffffffc
mov dword [esi], eax
mov eax, dword [edi + ecx - 4]
mov dword [esi + ecx - 4], eax
mov eax, esi
sub eax, ebx
mov dword [ebp - 0x38], ebx
mov ebx, edi
sub ebx, eax
add eax, ecx
and eax, 0xfffffffc
cmp eax, 4
jb 0x10006ba3
mov dword [ebp - 0x40], edx
and eax, 0xfffffffc
mov dword [ebp - 0x3c], edi
mov edi, ebx
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
xor eax, eax
mov edx, dword [edi + eax]
mov dword [ebx + eax], edx
add eax, 4
cmp eax, dword [ebp - 0x34]
jb 0x10006b78
mov edi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jmp 0x10006ba3
test ecx, ecx
je 0x10006ba3
movzx eax, byte [ebx + 4]
mov byte [esi], al
test cl, 2
jne 0x10006c68
xor eax, eax
mov word [esi + ecx], ax
lea eax, [ebp - 0x30]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
mov edx, dword [ebp - 0x34]
sub esp, 8
test eax, eax
je 0x10006c48
cmp edx, dword [ebp - 0x30]
jne 0x10006c48
mov dword [esp + 8], edx
mov dword [ebp - 0x34], edx
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov edx, dword [ebp - 0x34]
test eax, eax
jne 0x10006c48
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
mov dword [ebp - 0x34], edx
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.found__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x10016aa8
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x34]
mov eax, edx
neg eax
cmp edx, 0xf
jbe 0x10006b31
jmp 0x10006bf2
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edx, eax
jmp 0x10006b0f
movzx eax, word [edi + ecx - 2]
mov word [esi + ecx - 2], ax
jmp 0x10006ba3
Function at 0x10006c80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x18
test byte [0x100131d8], 8
jne 0x10006d58
test edi, edi
je 0x10006ce0
cmp word [edi], 0
je 0x10006ce0
mov eax, str.Windows_NT_x86
xor ebx, ebx
mov dword [esp + 4], eax
mov esi, dword [ebx*4 + 0x10016c84]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
je 0x10006cf5
add ebx, 1
cmp ebx, 6
je 0x10006d90
mov eax, dword [ebx*4 + 0x10016c84]
mov eax, dword [eax]
jmp 0x10006ca9
call dword [sym.imp.kernel32.dll_GetVersion]
mov esi, 0x10016cdc
test eax, eax
mov eax, 0x10016dc0
cmovns esi, eax
test byte [0x100131d8], 8
jne 0x10006d10
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__using__p:__s_n
mov dword [esp + 8], str.validate_envW
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.validate_envW
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10006c98
movzx eax, byte [0x100131d8]
test al, 1
jne 0x10006dba
mov edx, dword fs:[0x18]
xor esi, esi
mov dword [edx + 0x34], 0x70d
test al, 8
je 0x10006cfe
xor eax, eax
jmp 0x10006d12
mov edx, 0xffffffff
mov eax, edi
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.unsupported_Environment:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.validate_envW
mov dword [esp + 4], 0x100131d8
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
movzx eax, byte [0x100131d8]
jmp 0x10006d9b
Function at 0x10006ef0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
xor ebx, ebx
sub esp, 0x1c
mov eax, dword [ecx + 0x820]
mov word [ecx + eax*2], bx
mov eax, dword [ecx + 0x824]
mov word [ecx + eax*2 + 0x410], di
mov eax, 1
test esi, esi
je 0x10006fda
cmp word [esi], 0
je 0x10006fda
mov eax, dword [ecx + 0x828]
mov edi, ecx
and eax, 0x10
jne 0x10006f68
cmp word [ecx], 0
mov esi, ecx
je 0x10006f58
nop
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x10006f48
lea esi, [esi]
movzx ebx, word [edx + eax]
mov word [ecx + eax], bx
add eax, 2
test bx, bx
jne 0x10006f58
lea ebx, [edi + 0x410]
cmp word [edi + 0x410], 0
mov dword [ebp - 0x10], ebx
je 0x10007070
nop
add ebx, 2
cmp word [ebx], 0
jne 0x10006f80
xor eax, eax
nop
lea esi, [esi]
movzx ecx, word [edx + eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x10006f90
test byte [0x100131d8], 8
jne 0x10007020
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_CopyFileW]
sub esp, 0xc
mov ebx, eax
test byte [0x100131d8], 8
jne 0x10006fe8
xor eax, eax
or ebx, dword [edi + 0x82c]
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.got__d_with__lu_n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.apd_copyfile
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10006fcf
mov eax, dword [ebp - 0x10]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov edx, 0xffffffff
mov ebx, eax
mov eax, esi
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s____s_n
mov dword [esp + 8], str.apd_copyfile
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10006fa9
mov ebx, dword [ebp - 0x10]
jmp 0x10006f89
Function at 0x10007de0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
lea eax, [ebp - 0x218]
push ebx
sub esp, 0x240
mov dword [ebp - 0x21c], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.SystemCurrentControlSetControlPrintMonitors_
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x10007e38
test byte [0x100131d8], 8
jne 0x10007f2c
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x21c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x218]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test byte [0x100131d8], 8
jne 0x10007f60
mov edi, dword [ebp - 0x21c]
test edi, edi
je 0x10007f0d
xor ebx, ebx
xor edi, edi
lea esi, [ebp - 0x214]
lea esi, [esi]
xor eax, eax
mov dword [esp + 4], ebx
mov word [ebp - 0x214], ax
mov eax, dword [ebp - 0x218]
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
xor edx, edx
mov eax, esi
sub esp, 0x10
call sym._monitor_load
cmp eax, 1
sbb edi, 0xffffffff
add ebx, 1
cmp dword [ebp - 0x21c], ebx
ja 0x10007ec8
mov eax, dword [ebp - 0x218]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x100131d8], 8
je 0x10007e2b
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str._ld_monitors_loaded_n
mov dword [esp + 8], str.monitor_loadall
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0xc], str._ld_monitors_registered_n
mov dword [esp + 8], str.monitor_loadall
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10007eb1
Function at 0x1000e2e0
Capabilities:
Check if process is running under wine
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x100131d8], 8
jne 0x1000e320
test ebx, ebx
je 0x1000e300
cmp dword [ebx], 1
je 0x1000e350
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
add esp, 0x18
xor eax, eax
pop ebx
pop esi
pop ebp
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._p__ld_n
mov dword [esp + 8], str.fpScheduleJob
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x1000e2f7
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
add esp, 0x18
pop ebx
pop esi
pop ebp
jmp sym._fpScheduleJob_8.part.0
Function at 0x10011df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10011e48
cmp byte [esi + ebx - 1], 0xa
je 0x10011e1c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1001b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10012470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10012648
mov edi, dword [0x1001b0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10012557
test byte [0x10013208], 8
jne 0x100125f0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10013218], 8
jne 0x100125b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100124f9
cmp esi, 3
jbe 0x10012568
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1001250a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100186c8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100124f9
mov dword [esp], 0x10013218
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100124d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100124d0
mov dword [esp], 0x10013208
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100124bb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100124c3
mov eax, 0xffffffff
jmp 0x10012557
Function at 0x4013a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x1c], 0
jne 0x4013fc
xor eax, eax
jmp 0x401764
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x7ec], str.SOFTWARE11asses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 3
call fcn.00401390
mov edx, 0x43
mov eax, dword [ebp - 0x7ec]
mov word [eax + 0x12], dx
mov ecx, 0x6c
mov edx, dword [ebp - 0x7ec]
mov word [edx + 0x14], cx
lea eax, [ebp - 0x34]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x7ec]
push ecx
push 0x80000002
call dword [0x440d48]
test eax, eax
je 0x4014c1
xor eax, eax
jmp 0x401764
lea edx, [ebp - 0x34]
push edx
push 1
push 0
push str.clsid083863f1_70de_11d0_bd40_00a0c911ce86instance129d7e40_c10d_11d0_afb9_00aa00b67a42
push 0x80000000
call dword [0x440d48]
test eax, eax
je 0x4014e4
xor eax, eax
jmp 0x401764
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x4014fc
xor eax, eax
jmp 0x401764
push 1
mov eax, dword [0x440d44]
push eax
call fcn.00401a20
add esp, 8
mov dword [0x440d54], eax
mov ecx, dword [0x440d54]
push ecx
call fcn.00401900
add esp, 4
mov dword [ebp - 0x794], eax
mov edx, dword [0x440d54]
mov dword [ebp - 0x734], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x440d54]
jae 0x4015ab
mov ecx, dword [ebp - 0x734]
push ecx
mov edx, dword [ebp - 0x790]
push edx
call fcn.00401890
add esp, 8
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x788]
push eax
mov ecx, dword [0x440d44]
add ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x794]
add edx, dword [ebp - 4]
push edx
call fcn.004010a0
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x790]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x734]
sub edx, dword [ebp - 0x788]
mov dword [ebp - 0x734], edx
jmp 0x401532
mov eax, dword [0x440d54]
push eax
mov ecx, dword [ebp - 0x794]
push ecx
call fcn.00401350
add esp, 8
mov edx, dword [ebp + 8]
mov dword [0x440d38], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
push 2
mov eax, dword [0x440d44]
push eax
jmp 0x45b00a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str.777ll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4019af
cmp dword [ebp - 0x118], 0
je 0x4019af
jmp 0x401a13
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401a13
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x440d34], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x440d50], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x440d4c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.00401300
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4019af
mov esp, ebp
pop ebp
ret

Function at 0x401ab0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x440d40], 0x24e1
mov eax, dword [0x440d40]
sub eax, 0x24e1
mov dword [0x440d40], eax
mov ecx, 1
test ecx, ecx
je 0x401b5b
mov edx, dword [0x440d40]
cmp edx, dword [ebp + 0xc]
jb 0x401ae7
jmp 0x401b5b
cmp dword [0x440d40], 0
jne 0x401b05
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401b05
xor eax, eax
jmp 0x401b5b
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
mov ecx, dword [eax]
add ecx, dword [0x440d40]
mov edx, dword [ebp + 8]
add edx, dword [0x440d40]
mov dword [edx], ecx
mov dword [ebp - 4], 0xdaa90
mov eax, dword [0x440d40]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
push eax
call fcn.004011c0
add esp, 8
mov ecx, dword [0x440d40]
add ecx, 4
mov dword [0x440d40], ecx
jmp 0x401acd
mov esp, ebp
pop ebp
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40a27c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40a2c6
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40a295
jmp 0x40a2c6
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40a2b6
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40b1e9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b21e
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40b248
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40b248
test edi, edi
je 0x40b215
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b215
test edi, edi
je 0x40b250
mov eax, edi
jmp 0x40b217
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b217
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040ed8e
add esp, 0xc
int3