joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47de50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x47de5b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x47df5e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4b8b1c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4b8b1c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4b8b1c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4b8b1c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4b8b1c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4b8b1c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4b8b1c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4b8b1c]
xor eax, edx
inc ecx
dec edi
jne 0x47de76
pop edi
test esi, esi
je 0x47df80
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4b8b1c]
xor eax, edx
inc ecx
dec esi
jne 0x47df62
pop esi
pop ebx
not eax
ret

Function at 0x47e8f0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x47e931
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47e926
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x47e944
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x47f880
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x47f935
cmp dword [ebp + 4], 0xffffffff
jne 0x47f935
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x4d74a8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x47f8fd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x47f8fd
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.0047e680
add esp, 0x10
test eax, eax
jne 0x47f920
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.0047ebc0
add esp, 4
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x47fd90
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x208
test ecx, ecx
je 0x47fe58
mov al, byte [ecx]
test al, al
je 0x47fe58
push ebx
push esi
push edi
mov ebx, ecx
mov esi, ecx
cmp al, 0x2f
je 0x47fdbb
cmp al, 0x5c
jne 0x47fdbd
mov ebx, esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x47fdb3
mov edi, dword [esp + 0x218]
cmp ebx, ecx
je 0x47fdf4
mov esi, ebx
lea eax, [esp + 0xc]
sub esi, ecx
push esi
push ecx
push eax
call fcn.0048ba6c
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.0047fd90
add esp, 0x14
inc ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x481d48
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9099
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004847c0
lea edi, [esi + 0x108]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xc]
mov dword [edi], 0x4b90d8
call fcn.00498bc5
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 1
call fcn.00498bc5
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 2
call fcn.004843e0
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 3
call fcn.004843e0
lea ecx, [edi + 0x50]
mov byte [esp + 0x18], 4
call fcn.00498bc5
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 5
call fcn.00498bc5
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 6
call fcn.004843e0
lea ecx, [edi + 0x74]
mov byte [esp + 0x18], 7
call fcn.004843e0
mov dword [edi], 0x4b90d0
lea ecx, [esi + 0x264]
mov byte [esp + 0x18], 8
call fcn.004847c0
lea ecx, [esi + 0x360]
mov byte [esp + 0x18], 9
call fcn.004847c0
lea ecx, [esi + 0x45c]
mov byte [esp + 0x18], 0xa
call fcn.004847c0
lea ecx, [esi + 0x558]
mov byte [esp + 0x18], 0xb
call fcn.004847c0
lea ecx, [esi + 0x654]
mov byte [esp + 0x18], 0xc
call fcn.004847c0
mov ecx, esi
mov byte [esp + 0x18], 0xd
mov dword [esi], method.CWnd.virtual_0
call fcn.00482070
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x481f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a91ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], method.CWnd.virtual_0
lea ecx, [esi + 0x654]
mov dword [esp + 0x18], 5
call fcn.00484990
lea ecx, [esi + 0x558]
mov byte [esp + 0x18], 4
call fcn.00484990
lea ecx, [esi + 0x45c]
mov byte [esp + 0x18], 3
call fcn.00484990
lea ecx, [esi + 0x360]
mov byte [esp + 0x18], 2
call fcn.00484990
lea ecx, [esi + 0x264]
mov byte [esp + 0x18], 1
call fcn.00484990
lea edi, [esi + 0x108]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x74]
mov byte [esp + 0x18], 0xc
mov dword [ecx], 0x4b90e0
call fcn.004845e0
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 0xb
mov dword [ecx], 0x4b90e0
call fcn.004845e0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 0xa
call fcn.00498bee
lea ecx, [edi + 0x50]
mov byte [esp + 0x18], 9
call fcn.00498bee
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 8
mov dword [ecx], 0x4b90e0
call fcn.004845e0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x4b90e0
call fcn.004845e0
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 6
call fcn.00498bee
lea ecx, [edi + 0xc]
mov byte [esp + 0x18], 0
call fcn.00498bee
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00484990
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x48ba26
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x48ba46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00489fda
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x48ba69
test byte [esp + 8], 2
je 0x48ba69
call fcn.0048a04d
mov dword [eax], 0xd
call fcn.0048a056
mov dword [eax], 5
jmp 0x48ba42
xor eax, eax
ret

Function at 0x49c53a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49c572
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049a5f1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049a5c9
jmp 0x49c57e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49dc2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49dc6d
call fcn.004a3a3a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49dc6d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49dc64
xor eax, eax
jmp 0x49dc75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049dc7b
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a3f6a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a3f98
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a3fb6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a3ed0
jmp 0x4a3fb6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a3fb6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a3ed0
test edi, edi
mov eax, edi
jne 0x4a3fa0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4061d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4150c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x420534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.004110e8
mov esi, eax
add esp, 4
test esi, esi
je 0x40626d
push 1
mov dword [ebp - 4], 0
call fcn.004106c4
add esp, 4
mov dword [esi + 4], eax
jmp 0x40626f
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [esi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x416228]
mov ecx, edi
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push eax
call fcn.00401790
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x416228]
mov ecx, edi
call esi
movzx edi, ax
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test edi, edi
je 0x406305
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x416228]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x406305
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x416228]
mov ecx, edi
call esi
cmp dword [ebx + 0x38], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov word [ebx + 0x40], ax
jne 0x40632c
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
and eax, 0x13
or eax, 4
mov dword [ebx + 0xc], eax
and ecx, eax
jne 0x40634f
cmp byte [ebp + 0xc], 0
je 0x40633b
push ebx
call fcn.00410927
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40635b
mov esi, str.ios_base::badbit_set
jmp 0x40636b
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.004063a0
add esp, 8
lea ecx, [ebp - 0x34]
push eax
push esi
call fcn.00402220
push 0x41e154
lea eax, [ebp - 0x34]
push eax
call fcn.004120a7
int3
Function at 0x407c90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415288
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x420534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x407d29
push esi
call fcn.0040c6a0
add esp, 4
test al, al
jne 0x407d29
push esi
call fcn.004086a0
add esp, 4
test al, al
je 0x407d05
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040b100
push eax
mov dword [ebp - 4], 0
call fcn.00407c90
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402900
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x407d0f
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407d29
push esi
call fcn.0040c6a0
add esp, 4
test al, al
je 0x407d43
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411126
mov esp, ebp
pop ebp
ret
push str.Failure_processing_application_bundle.
call fcn.0040a570
add esp, 4
mov ecx, esi
call fcn.00407a90
push eax
push str.Failed_to_create_directory___s__for_extracting_bundled_files
call fcn.0040a570
add esp, 8
mov dword [ebp - 0x2c], 0x800080a0
lea eax, [ebp - 0x2c]
push 0x41e1d0
push eax
call fcn.004120a7
int3
Function at 0x4085c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov bl, byte [ebp + 8]
test bl, bl
js 0x4085d3
movsx eax, bl
jmp 0x408604
push dword [ebp + 0xc]
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push 1
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x408614
mov cl, byte [ebp - 1]
test cl, cl
js 0x408640
movsx eax, bl
movsx ecx, cl
and eax, 0x7f
shl ecx, 7
or eax, ecx
lea ecx, [eax - 1]
pop ebx
cmp ecx, 0x103
ja 0x40866c
mov esp, ebp
pop ebp
ret
push str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.0040a570
push str.I_O_failure_reading_contents_of_the_bundle.
call fcn.0040a570
add esp, 8
mov dword [ebp - 8], 0x800080a0
lea eax, [ebp - 8]
push 0x41e1d0
push eax
call fcn.004120a7
push str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.0040a570
push str.Path_length_encoding_read_beyond_two_bytes
call fcn.0040a570
add esp, 8
mov dword [ebp - 8], 0x8000809f
lea eax, [ebp - 8]
push 0x41e1d0
push eax
call fcn.004120a7
push str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.0040a570
push str.Path_length_is_zero_or_too_long
call fcn.0040a570
add esp, 8
mov dword [ebp - 8], 0x8000809f
lea eax, [ebp - 8]
push 0x41e1d0
push eax
call fcn.004120a7
int3

Function at 0x408700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x408720
mov esp, ebp
pop ebp
ret
push str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.0040a570
push str.I_O_failure_reading_contents_of_the_bundle.
call fcn.0040a570
add esp, 8
mov dword [ebp - 4], 0x800080a0
lea eax, [ebp - 4]
push 0x41e1d0
push eax
call fcn.004120a7
int3

Function at 0x408750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415358
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x420534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
lea eax, [edi + 1]
push eax
call fcn.00411163
mov esi, eax
mov dword [ebp - 0x14], esi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push edi
push 1
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x14
cmp eax, edi
jne 0x4087d0
push dword [ebp + 8]
mov byte [esi + edi], 0
push esi
call fcn.0040c670
add esp, 8
test esi, esi
je 0x4087bf
push esi
call fcn.0041116c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.0040a570
push str.I_O_failure_reading_contents_of_the_bundle.
call fcn.0040a570
add esp, 8
mov dword [ebp - 0x10], 0x800080a0
lea eax, [ebp - 0x10]
push 0x41e1d0
push eax
call fcn.004120a7
int3
Function at 0x408b20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x408b3e
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x408b48
mov ecx, dword [edi]
push eax
push ecx
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wrename
add esp, 8
test eax, eax
je 0x408bc1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
push esi
mov ebx, dword [eax]
call fcn.0040c6a0
add esp, 4
test al, al
jne 0x408bb2
cmp ebx, 0xd
jne 0x408ba9
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x408b79
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x408b83
mov ecx, dword [edi]
push eax
push ecx
push str.Retrying_Rename___s__to___s__due_to_EACCES_error
call fcn.0040a7b0
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1f4
jl 0x408b34
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov byte [eax], 1
xor al, al
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a2a0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4155d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x420534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x4171ac
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 0x2d
push str.Description:_A_.NET_Core_application_failed._n
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.004095b0
push 0xd
push str.Application:
lea ecx, [ebp - 0x28]
call fcn.004095b0
mov ecx, esi
lea edi, [ecx + 2]
nop dword [eax + eax]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40a320
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, eax
call fcn.004095b0
push 1
push 0x4171a8
mov ecx, eax
call fcn.004095b0
push 6
push str.Path:
lea ecx, [ebp - 0x28]
call fcn.004095b0
mov edx, ebx
lea esi, [edx + 2]
nop word [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x40a360
sub edx, esi
mov ecx, eax
sar edx, 1
push edx
push ebx
call fcn.004095b0
push 1
push 0x4171a8
mov ecx, eax
call fcn.004095b0
push 9
push str.Message:
lea ecx, [ebp - 0x28]
call fcn.004095b0
cmp dword [0x42003c], 8
mov ecx, 0x420028
push dword [0x420038]
cmovae ecx, dword [0x420028]
push ecx
mov ecx, eax
call fcn.004095b0
push 1
push 0x4171a8
mov ecx, eax
call fcn.004095b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 1
push 0
push 0x3ff
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40a42e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a424
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a44a
push edx
push ecx
call fcn.00411118
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411126
mov esp, ebp
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x40a570
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415630
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x420534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x420b4c
mov dword [ebp - 0x18], 0x420b4c
call fcn.0040da30
mov dword [ebp - 4], 0
call fcn.00407550
mov ebx, eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov ecx, dword [ebx]
push 0
push 0
push dword [ebx + 4]
or ecx, 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf
mov esi, eax
lea ecx, [ebp - 0x24]
add esp, 0x1c
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
lea eax, [ebp - 0xd]
push eax
inc esi
push esi
call fcn.0040a450
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 1
push eax
mov eax, dword [ebx]
push 0
push dword [ebp + 8]
or eax, 1
push esi
mov esi, dword [ebp - 0x24]
push esi
push dword [ebx + 4]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf
mov ecx, dword [0x420e34]
add esp, 0x1c
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x14], eax
mov edi, dword [eax + 4]
test edi, edi
jne 0x40a64e
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
push eax
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputws
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
push eax
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputwc
add esp, 0x18
jmp 0x40a65c
push esi
mov ecx, edi
call dword [0x416228]
call edi
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x420b68], 0
je 0x40a6ab
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edi, dword [0x420b64]
add esp, 4
cmp edi, eax
jne 0x40a68c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 4], 0
je 0x40a6ab
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push edi
push dword [ebx + 4]
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfwprintf
push edi
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputwc
add esp, 0x20
mov byte [ebp - 4], 0
test esi, esi
je 0x40a6e1
mov eax, dword [ebp - 0x1c]
sub eax, esi
sar eax, 1
lea ecx, [eax + eax]
mov eax, esi
cmp ecx, 0x1000
jb 0x40a6d7
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a704
push ecx
push esi
call fcn.00411118
add esp, 8
mov ecx, 0x420b4c
mov dword [ebp - 4], 2
call fcn.0040e320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3

Function at 0x40bee0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07], 0x65
je 0x40bef0
xor al, al
pop ebp
ret
pop ebp
jmp fcn.0040d500