joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019a0
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push section..data
mov eax, dword [ebp + 8]
push eax
call fcn.0045e9af
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4019e3
mov ecx, dword [ebp + 8]
push ecx
push 0x478004
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
push 1
call fcn.00461731
push 2
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.0045ef03
add esp, 0xc
test eax, eax
je 0x401a26
mov eax, dword [ebp + 8]
push eax
push str.Error_reading_input_file__s_n
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045e889
add esp, 4
push 1
call fcn.00461731
mov edx, dword [ebp - 4]
push edx
call fcn.0045f4ed
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffff
jne 0x401a6e
mov eax, dword [ebp + 8]
push eax
push str.Error_parsing_the_input_file__s_n
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045e889
add esp, 4
push 1
call fcn.00461731
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
call fcn.00461423
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x401ab8
mov eax, dword [ebp + 8]
push eax
push str.Can_not_allocate_buffer_for_input_input_file__s_n
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045e889
add esp, 4
push 1
call fcn.00461731
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.0045ef03
add esp, 0xc
test eax, eax
je 0x401b09
mov eax, dword [ebp + 8]
push eax
push 0x478094
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045e889
add esp, 4
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00461406
add esp, 4
push 1
call fcn.00461731
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.0045eb9f
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
je 0x401b6d
mov edx, dword [ebp + 8]
push edx
push str.Error_reading_the_input_file__s_n
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call fcn.0045e889
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.00461406
add esp, 4
push 1
call fcn.00461731
mov eax, dword [ebp - 4]
push eax
call fcn.0045e889
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x401d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4780dc
mov eax, dword [ebp + 8]
push eax
call fcn.0045e9af
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401d53
mov ecx, dword [ebp + 8]
push ecx
push str.Error_opening_file__s_n
push 2
call fcn.0045e78f
add esp, 4
push eax
call fcn.004021f0
add esp, 0xc
push 1
call fcn.00461731
mov dword [ebp - 4], 0
jmp 0x401d65
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x4adff0]
jae 0x401ddc
imul ecx, dword [ebp - 4], 0x1c
mov edx, dword [0x4adff4]
mov eax, dword [edx + ecx + 0x14]
push eax
imul ecx, dword [ebp - 4], 0x1c
mov edx, dword [0x4adff4]
mov eax, dword [edx + ecx + 0x10]
push eax
imul ecx, dword [ebp - 4], 0x1c
mov edx, dword [0x4adff4]
mov eax, dword [edx + ecx + 0xc]
push eax
imul ecx, dword [ebp - 4], 0x1c
mov edx, dword [0x4adff4]
mov eax, dword [edx + ecx + 8]
push eax
imul ecx, dword [ebp - 4], 0x1c
mov edx, dword [0x4adff4]
mov eax, dword [edx + ecx + 4]
push eax
imul ecx, dword [ebp - 4], 0x1c
mov edx, dword [0x4adff4]
mov eax, dword [edx + ecx]
push eax
push str._s._s._s._s_s_s_n
mov ecx, dword [ebp - 8]
push ecx
call fcn.004021f0
add esp, 0x20
jmp 0x401d5c
cmp dword [ebp - 8], 0
je 0x401dee
mov edx, dword [ebp - 8]
push edx
call fcn.0045e889
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x464196
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x4adc38]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4641d7
cmp byte [edx], 0xa
jne 0x4641d7
or byte [eax + edi + 0x28], 4
jmp 0x4641dc
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4642cd
mov al, byte [ebx]
cmp al, 0x1a
je 0x4642ae
cmp al, 0xd
je 0x464205
mov byte [esi], al
inc esi
inc ebx
jmp 0x4642a3
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x464225
cmp byte [eax], 0xa
jne 0x46421a
push 2
mov byte [esi], 0xa
pop eax
jmp 0x464220
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4642a3
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46429c
cmp dword [ebp - 0x14], 0
je 0x46429c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4adc38]
test byte [eax + edi + 0x28], 0x48
je 0x464273
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x464263
mov byte [esi], dl
jmp 0x46429f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4adc38]
mov byte [eax + edi + 0x2a], dl
jmp 0x46429f
cmp byte [ebp - 1], 0xa
jne 0x464285
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x464285
mov byte [esi], 0xa
jmp 0x464222
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00464e25
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4642a0
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4641ee
jmp 0x4642cd
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4adc38]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4642c8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4642cd
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4642d8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x4adc38]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x46431c
cmp word [edx], bx
jne 0x46431c
or byte [edi + eax + 0x28], 4
jmp 0x464321
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x464475
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x464455
cmp ax, word [ebp - 0x10]
je 0x46435a
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x46444a
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x464380
push 0xa
pop ecx
cmp word [eax], cx
jne 0x464370
push ecx
pop eax
push 4
jmp 0x464375
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x464444
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46443b
cmp dword [ebp - 0x18], 0
je 0x46443b
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x4adc38]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x464407
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4643cb
mov word [esi], ax
jmp 0x4643ff
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x4adc38]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x4adc38]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4adc38]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x46444a
cmp word [ebp - 4], ax
jne 0x46441c
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x46441c
mov word [esi], ax
add esi, 2
jmp 0x46444a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00464e25
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x464447
jmp 0x46443e
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x46433a
jmp 0x464475
mov ecx, dword [ecx*4 + 0x4adc38]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x46446c
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x464475
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464c7f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00464afc

Function at 0x467982
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00467624
Function at 0x40111c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401157
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40113e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40114f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x401159
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401134
xor eax, eax
pop edi
pop esi
ret
Function at 0x40167b
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x401724
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004010dc
das
inc eax
dec esi
int3
call fcn.004010dc
jge 0x40177e
sbb dl, byte [edi - 0x75]
xchg dword [eax + 0x3b000000], esp
ret
cmp dword [eax], ebx
je 0x401790
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40178b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x401775
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40177d
cmp edx, ebx
jne 0x4018cb
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
dec eax
add al, 0x83
inc ebp
or byte [edx], al
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40174c
add eax, dword [eax + 4]
jmp 0x401739
mov dword [ebp + 0xc], ebx
jmp 0x40179b
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4017b3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4017d1
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40182f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401816
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40181f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401829
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40180b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x401795
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40187c
dec eax
je 0x401873
sub eax, 3
je 0x40186a
mov dword [ebp - 4], 0x40
jmp 0x401899
mov dword [ebp - 4], 4
inc ebp
cld
add al, 0
add byte [eax], al
jmp 0x40187f
mov dword [ebp - 4], 0x20
jmp 0x40187f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4018cb
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40184b
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004010dc
pushal
loop 0x40186b
or al, 0xff
jne 0x4018d6
push 1
push esi
call edi
mov eax, esi
jmp 0x4018d7
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40340d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x403454
push 7
push str..custom
push edi
call fcn.0040167b
add esp, 0xc
test eax, eax
je 0x40345b
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x403431
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.0040379a
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x4032ca
mov dword [ebp - 0x14], 0x4032d5
call fcn.00403208
add esp, 0x28
test eax, eax
je 0x4034bb
push dword [ebp - 4]
call fcn.004037b1
pop ecx
jmp 0x403454
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x403456

Function at 0x10015af3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10015b02
pop dword [ebp - 0x2c]
mov eax, 0xd70df147
add eax, 0x38f369bb
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x30aeebe1
add dword [ebp - 0x3c], 0x1da3596a
mov dword [ebp - 0x38], 0x64d1cc56
sub dword [ebp - 0x38], 0x329e8011
mov dword [ebp - 0x34], 0x3da40aaf
add dword [ebp - 0x34], 0xea8397f
mov dword [ebp - 0x30], 0xb501938c
sub dword [ebp - 0x30], 0xb501938c
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x3dc214b1
add eax, 0xd23f8b57
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x8d5b71c9
sub dword [ebp - 0x3c], 0x18e90873
mov dword [ebp - 0x38], 0xa3128e3b
sub dword [ebp - 0x38], 0x61a62cc6
mov dword [ebp - 0x34], 0x841bf5d1
sub dword [ebp - 0x34], 0x20ac8965
mov dword [ebp - 0x30], 0x276f53ad
sub dword [ebp - 0x30], 0x276f53ad
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa8926878
add eax, 0x676f3794
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4191a
push 0
call eax
mov ecx, 0x6365ed32
sub ecx, 0x63658825
mov ebx, eax
mov esi, 0x10024a00
add esi, dword [ebp - 0x2c]
mov edi, 0x3f748e06
mov dword [ebp - 0x28], 0xe38d4f11
mov edx, dword [esi]
xor dword [ebp - 8], ebx
add edx, edi
mov dword [ebx], edx
add ebx, 0xc3f50773
sub ebx, 0xc3f5076f
add esi, 4
loop 0x10015c18
add eax, 0x18707
mov ebx, eax
add eax, 5
mov ecx, 0x17c656cf
sub ecx, 0x7c656cf
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x404290
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f6bf
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x569434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x40430b
cmp dword [esi + 4], 0
je 0x4042ef
mov eax, dword [esi + 4]
test eax, eax
je 0x4042ef
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x40430b
mov ecx, esi
call fcn.00422be0
push 0x50
push esi
call fcn.004dbfeb
add esp, 8
push 0x50
call fcn.004dc01c
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 0
call fcn.0048a050
sub esp, 0x18
mov ecx, 0x404380
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40434d
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x404380
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.00422990
mov dword [edi + 0xf0], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40436e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f7ea
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x569434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004c69c4
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4051c0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004890ce
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x5666bc
push eax
call fcn.0048a580
push edi
push esi
call fcn.004c6d3a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dbfda
mov esp, ebp
pop ebp
ret 4
Function at 0x40c040
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520065
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x569434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c150
mov ebx, eax
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x40c0b6
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40c08f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004017f0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40c0a7
mov eax, dword [esi]
jmp 0x40c0a9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.004034f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x40c0d2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004017f0
push 0x50
call fcn.004dc01c
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.0048a050
sub esp, 0x18
mov ecx, 0x40d4c0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40c114
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____stdcall___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x40d4c0
mov dword [eax + 0x24], eax
push 0x5541c8
push edi
mov ecx, esi
call fcn.00422990
mov dword [edi + 0x74], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40c132
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414dc0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520bf8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x569434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x414e11
mov eax, dword [esi]
jmp 0x414e13
mov eax, esi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x414e34
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e25
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004031a0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
cmp word [edi], ax
jne 0x414e64
xor ecx, ecx
jmp 0x414e7f
mov ecx, edi
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e70
sub ecx, ebx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x18]
call fcn.004031a0
mov eax, dword [ebp + 0x14]
movsd xmm0, qword [0x556910]
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x38], 0x4047b0
movsd qword [esi + 0x40], xmm0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [esi + 0x58], 0
mov dword [esi + 0x70], 7
mov dword [esi + 0x6c], 0
mov word [esi + 0x5c], ax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41bef0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5219ad
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x569434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
call fcn.0048a050
mov dword [esi + 0x10], 0
lea ecx, [edi + 0x758]
mov dword [esi + 0x14], 0
add esp, 0xc
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41bf7c
mov eax, dword [esi]
jmp 0x41bf7e
mov eax, esi
xor edx, edx
push 0xffffffffffffffff
push edx
push ecx
mov ecx, esi
mov word [eax], dx
call fcn.004032a0
xor eax, eax
mov dword [ebp - 0x234], 1
mov byte [edi + 0x7b9], 1
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.00423c50
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
call fcn.00423b40
test eax, eax
mov dword [ebp - 0x238], eax
mov byte [edi + 0x7ba], 1
setne al
mov byte [edi + 0x7b9], al
call fcn.00423ac0
mov ebx, eax
test ebx, ebx
setne al
mov byte [edi + 0x7ba], al
cmp dword [edi + 0x768], 0
je 0x41c03a
cmp dword [edi + 0x754], 8
lea eax, [edi + 0x740]
jb 0x41c02b
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c0ff
cmp dword [ebp - 0x238], 0
je 0x41c082
test ebx, ebx
je 0x41c082
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
lea eax, [ebp - 0x218]
push 0
je 0x41c08a
push str.hudun
push eax
push 0
push 0x104
push eax
call fcn.00503972
add esp, 0x18
jmp 0x41c0a9
push 0
lea eax, [ebp - 0x218]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x2a
push eax
push 0
call edi
test eax, eax
jne 0x41c0a9
push eax
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call edi
push 0x5537bc
push str.UniversalDocumentTranslator
lea eax, [ebp - 0x218]
push eax
push 0
push 0x104
push eax
call fcn.00503972
add esp, 0x18
cmp word [ebp - 0x218], 0
jne 0x41c0d8
xor ecx, ecx
jmp 0x41c0f0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c0e1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004031a0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41c11d
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.004017f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dbfda
mov esp, ebp
pop ebp
ret 4