joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bb0
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
lea esi, [eax + 1]
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x58
lea eax, [ebp - 0x68]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], 0x58
lea eax, [ebp - 0x68]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x5c], str.text_.txt_
mov dword [ebp - 0x4c], 0x405430
push eax
mov dword [ebp - 0x44], 0x405538
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x48], 0x104
mov dword [ebp - 0x40], 0x104
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x2c], 0x4032a0
mov dword [ebp - 0x38], 0x4032d8
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
jne 0x401c57
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x405430
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
push 0x405538
push 0x4050a0
push 0x405020
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x405020
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x401cdb
push eax
push str.Error
push str.Error_CloseHandle
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 0xb9
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d10
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x403265
mov ebx, ecx
push 0x405430
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401d55
push eax
push 0x4032b8
push 0x40330c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, ebx
call fcn.00401bb0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
lea esi, [eax + 1]
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov edi, eax
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0x80
push 5
push 0
push 0
push 0x40000000
push 0x405430
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [ebp - 0xc]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp - 4]
push 0
push 0
push 0xb9
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 8]
push 0x405538
push 0x4050a0
push 0x405020
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x405020
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x401e2c
push eax
push str.Error
push str.Error_CloseHandle
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402776
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4027b5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4027b5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4027b5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4027b5
cmp dword [ecx + 0x74], 0xe
jbe 0x4027b5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40e849
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40e858
pop dword [ebp - 0x20]
mov eax, 0xfcd67b73
sub eax, 0xfc95931b
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x72f0a75e
add dword [ebp - 0x30], 0xdb619ded
mov dword [ebp - 0x2c], 0x3507ef65
add dword [ebp - 0x2c], 0xfd2b5ce0
mov dword [ebp - 0x28], 0x5d8987a3
add dword [ebp - 0x28], 0xeec2bc8b
mov dword [ebp - 0x24], 0x15704d49
sub dword [ebp - 0x24], 0x15704d49
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xebfe539b
add dword [ebp - 0x30], 0x887415bb
mov dword [ebp - 0x2c], 0xbe7ae480
sub dword [ebp - 0x2c], 0x7d0e830b
mov dword [ebp - 0x28], 0x2b79e327
add dword [ebp - 0x28], 0x37f58945
mov dword [ebp - 0x24], 0x4d8012fe
add dword [ebp - 0x24], 0xb27fed02
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x24ab3bfe
sub eax, 0x24658b7e
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x51084
push 0
call eax
mov ecx, 0x854cff4
sub ecx, 0x8547922
mov ebx, eax
mov edi, 0x476000
add edi, dword [ebp - 0x20]
mov edx, 0x502b7093
sub edx, 0x5a75ec91
xor dword [ebp - 0x18], 0x8a6c8792
mov esi, dword [edi]
xor dword [ebp - 0xc], edx
add esi, edx
add dword [ebp - 0xc], edi
mov dword [ebx], esi
sub dword [ebp - 8], edx
add ebx, 0xece7d58f
sub ebx, 0xece7d58b
add edi, 0xa2195c42
sub edi, 0xa2195c3e
loop 0x40e96f
add eax, 0x7599d434
sub eax, 0x75988619
xor ebx, ebx
add ebx, eax
add eax, 0x4fc58bf8
add eax, 0xb03a740d
mov ecx, 0xfdca5bc2
sub ecx, 0xfd8a5bc2
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x402c00
pop dword [ebp - 0x4c]
mov eax, 0x402c00
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xa68a1a56
sub dword [ebp - 0x5c], 0x5837d50b
mov dword [ebp - 0x58], 0x79de516d
add dword [ebp - 0x58], 0xb854fad8
mov dword [ebp - 0x54], 0x9c88a18d
add dword [ebp - 0x54], 0xafc3a2a1
mov dword [ebp - 0x50], 0x73e6dfe8
add dword [ebp - 0x50], 0x8c192018
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf07f597e
sub dword [ebp - 0x5c], 0x7c0cf028
mov dword [ebp - 0x58], 0xc61951d
add dword [ebp - 0x58], 0x350acc58
mov dword [ebp - 0x54], 0x400b0677
add dword [ebp - 0x54], 0x236465f5
mov dword [ebp - 0x50], 0x404eba0b
sub dword [ebp - 0x50], 0x404eba0b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xf3a365c8
add eax, 0xc9d1b0c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x334c2
push 0
call eax
mov ecx, 0x336daf62
add ecx, 0xcc928b0d
xor ebx, ebx
add ebx, eax
mov esi, 0x17feb34a
add esi, 0xe8425cb6
add esi, dword [ebp - 0x4c]
mov edx, 0x8ce1dd
xor dword [ebp - 0x30], edx
mov edi, dword [esi]
sub dword [ebp - 0x40], esi
xor edi, edx
mov dword [ebp - 0x24], 0x58beedf8
mov dword [ebx], edi
mov dword [ebp - 0x20], 0xabb3e143
add ebx, 0x4b510e9
add ebx, 0xfb4aef1b
add esi, 4
loop 0x402d14
add eax, 0x1f73783c
sub eax, 0x1f729bad
xor ebx, ebx
add ebx, eax
add eax, 0x4180b073
add eax, 0xbe7f4f92
mov ecx, 0xeed70514
sub ecx, 0xee970514
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401b20
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x429108
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x18]
mov edx, dword [0x447adc]
mov dword [0x447ad0], eax
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x401b79
push 0x104
mov ecx, 0x447adc
call fcn.004015c0
mov edx, dword [0x447adc]
cmp dword [edx - 4], 1
jle 0x401b93
mov ecx, dword [edx - 0xc]
push ecx
mov ecx, 0x447adc
call fcn.00401610
mov edx, dword [0x447adc]
push 0x104
push edx
mov edx, dword [0x447ad0]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x447adc]
test edx, edx
jne 0x401bb4
xor eax, eax
jmp 0x401bd5
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401bc0
sub eax, esi
sar eax, 1
js 0x401cbf
cmp eax, dword [edx - 8]
jg 0x401cbf
mov dword [edx - 0xc], eax
mov ecx, dword [0x447adc]
mov word [ecx + eax*2], 0
push 0x447adc
mov ecx, 0x447b3c
call fcn.004041e0
mov edx, dword [0x447b3c]
push 0x5c
push edx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x401c17
or eax, 0xffffffff
jmp 0x401c1f
sub eax, dword [0x447b3c]
sar eax, 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
mov edx, 0x447b3c
call fcn.00401e00
mov dword [esp + 0x10], 0
push eax
mov ecx, 0x447b3c
call fcn.004041e0
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00401130
cmp byte [0x447b44], 0
je 0x401c73
or eax, 0xffffffff
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x18]
mov ecx, eax
call fcn.00404450
cmp al, 1
jne 0x401ca8
call fcn.00402520
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10
push 0x80070057
call fcn.004016e0
int3

Function at 0x402da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42832a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ATL::CComObject_class_pmpEventHandler_.0
mov dword [esi + 4], vtable.ATL::CComObject_class_pmpEventHandler_.1.0
mov dword [esi + 0x30], vtable.ATL::CComObject_class_pmpEventHandler_.2.0
mov dword [esp + 0x14], 0
mov dword [esi + 0x5c], 0xc0000001
mov ecx, dword [0x447b48]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [esp + 0x14], 0xffffffff
push esi
call fcn.004030b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4031c0
Capabilities:
Create thread

Disassembly:
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x447b10], eax
jne 0x4031da
pop ecx
ret
push esi
lea eax, [esp + 4]
push eax
push 0
push 0x447ae0
push 0x403280
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x403209
mov ecx, dword [0x447b10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x404350
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x429c60
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [0x447b20]
cmp eax, 1
jne 0x404428
lea eax, [esp + 8]
push eax
call fcn.00404750
mov dword [esp + 0x18], 0
mov eax, dword [eax]
push 0
push eax
mov ecx, str.Delcam_PostProcessor_Version__s_n_nCopyright__c__Delcam_plc.__Birmingham__England__2002_2006_n_n
call fcn.00404660
add esp, 0xc
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 8]
call fcn.00401130
mov ecx, dword [0x447b2c]
push 0
push ecx
mov ecx, str.Using_option_file__s_n
call fcn.00404660
add esp, 8
cmp dword [0x447b24], 0
jne 0x404403
mov edx, dword [0x447b30]
mov eax, dword [0x447b2c]
mov edi, dword [0x447b38]
mov ecx, dword [0x447b34]
push edx
push eax
call fcn.00404fe0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
call fcn.00404910
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
test eax, eax
jne 0x404437
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.00405ae0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
Function at 0x404750
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x429159
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x38]
xor ebp, ebp
mov dword [esp + 0x30], ebp
push 0x7fff
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
call fcn.00420f90
mov ecx, 1
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x14]
cmp dword [eax - 4], ecx
jle 0x4047b6
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00401610
mov eax, dword [esp + 0x14]
mov ecx, dword [0x447ad0]
push 0x7fff
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0xffffffff
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
jne 0x4047f2
cmp edx, ebp
jne 0x4047de
xor eax, eax
jmp 0x4047fa
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4047e3
sub eax, esi
sar eax, 1
cmp eax, ebp
jl 0x4048b5
cmp eax, dword [edx - 8]
jg 0x4048b5
mov dword [edx - 0xc], eax
mov edx, dword [esp + 0x14]
mov word [edx + eax*2], bp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
push edi
call fcn.004237d0
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
push esi
push edi
push ebp
push edx
mov dword [esp + 0x28], ebp
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x42c040
push esi
call sub.VERSION.dll_VerQueryValueW
mov ecx, ebx
call fcn.00420f40
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 0x14]
movzx ecx, word [eax + 0x16]
push edx
movzx edx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push edx
push eax
push 0x42c044
push ebx
mov dword [esp + 0x38], 1
call fcn.00405e50
add esp, 0x18
cmp esi, ebp
je 0x404892
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x30], ebp
lea ecx, [esp + 0x14]
call fcn.00401130
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0x80070057
call fcn.004016e0
int3
Function at 0x4067a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4299fb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x128]
push eax
call fcn.00402b60
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [0x42b5e8]
mov dword [esi + 0x14], ecx
mov edx, dword [0x42b5ec]
mov dword [esi + 0x18], edx
mov eax, dword [0x42b5f0]
mov dword [esi + 0x1c], eax
mov ecx, dword [0x42b5f4]
mov dword [esi + 0x20], ecx
mov edx, dword [0x42b5e8]
mov dword [esi + 0x24], edx
mov eax, dword [0x42b5ec]
mov dword [esi + 0x28], eax
mov ecx, dword [0x42b5f0]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x42b5f4]
mov dword [esi + 0x30], edx
mov word [esi + 0x34], di
mov word [esi + 0x36], di
mov eax, 0xfefefefe
mov dword [esi + 0x38], eax
mov ecx, dword [0x42b5e8]
mov dword [esi + 0x40], ecx
mov edx, dword [0x42b5ec]
mov dword [esi + 0x44], edx
mov ecx, dword [0x42b5f0]
mov dword [esi + 0x48], ecx
mov edx, dword [0x42b5f4]
mov dword [esi + 0x4c], edx
mov ecx, dword [0x42b5e8]
mov dword [esi + 0x50], ecx
mov edx, dword [0x42b5ec]
mov dword [esi + 0x54], edx
mov ecx, dword [0x42b5f0]
mov dword [esi + 0x58], ecx
mov edx, dword [0x42b5f4]
mov dword [esi + 0x64], eax
lea eax, [esi + 0x68]
push eax
mov dword [esi + 0x5c], edx
mov word [esi + 0x60], di
mov word [esi + 0x62], di
call fcn.004068d0
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x90]
push ecx
call fcn.00409f70
mov byte [esp + 0x14], 2
mov dword [esi + 0x14c], edi
mov dword [esi + 0x148], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x420840
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
jne 0x42087a
call fcn.00420790
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x4208cf
call fcn.00420790
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret
Function at 0x423100
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4248c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.utlInfoOutput.0
mov eax, 3
mov dword [esp + 0x18], eax
lea ecx, [esi + 0x30]
mov dword [esp + 0xc], ecx
mov byte [esp + 0x18], al
call fcn.00401130
mov byte [esp + 0x18], 2
lea ecx, [esi + 0x24]
call fcn.00423090
mov al, 1
mov byte [esp + 0x18], al
lea ecx, [esi + 0x20]
mov dword [esp + 0xc], ecx
mov byte [esp + 0x18], al
call fcn.00401130
xor ecx, ecx
mov byte [esp + 0x18], cl
lea eax, [esi + 0x18]
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], cl
mov eax, dword [eax]
cmp eax, ecx
je 0x42318b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
or eax, 0xffffffff
mov dword [esp + 0x18], eax
lea ecx, [esi + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], eax
call fcn.00401130
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x423230
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42495f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x446044]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
mov dword [esi], vtable.utlInfoOutput.0
call fcn.00420f40
xor edi, edi
mov dword [esp + 0x1c], edi
lea eax, [esi + 0x18]
mov dword [esp + 0x10], eax
mov dword [eax], edi
mov byte [esp + 0x1c], 2
lea ecx, [esi + 0x20]
call fcn.00420f40
mov byte [esp + 0x1c], 3
lea ecx, [esi + 0x24]
call fcn.004231c0
mov byte [esp + 0x1c], 4
lea ecx, [esi + 0x30]
call fcn.00420f40
mov byte [esp + 0x1c], 5
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x42370e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004236a3
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42375d
cmp dword [ebp - 0x1c], 5
jb 0x423775
jmp 0x423771
cmp dword [ebp - 0x10], 1
jne 0x423775
cmp dword [ebp - 0x1c], 4
ja 0x423771
jne 0x423775
cmp dword [ebp - 0x18], 0
jbe 0x423775
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x42b674
call fcn.004035f0
test eax, eax
jge 0x423796
mov byte [0x447b44], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042382b
add ebp, 0x78
leave
ret
Function at 0x42382b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446044]
jne 0x423835
repz ret
jmp fcn.00423dd8