joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402520
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x10]
call fcn.00402320
mov ecx, dword [esi + 0x10]
mov ebx, eax
test ecx, ecx
je 0x402588
test eax, eax
je 0x4025d0
cmp word [ebx], 0
je 0x4025e0
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402558
sub eax, ebx
add eax, 2
mov edx, dword [ebp + 8]
test edx, edx
je 0x402595
mov esi, 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
test ebx, ebx
jne 0x402549
mov edx, dword [ebp + 8]
test edx, edx
jne 0x40256d
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x40256d
test byte [section..data], 2
jne 0x4025ea
xor esi, esi
jmp 0x402572
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x402566
mov esi, dword [esi + 8]
test esi, esi
je 0x402666
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x402654
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x402625
mov edx, 0xffffffff
mov eax, esi
call fcn.00401490
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0xc], str.Failed_to_set_registry_key__s_n
mov dword [esp + 8], str.install_registry_string
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x402572
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x402625
mov eax, 0x40a00e
jmp 0x402625
Function at 0x407c50
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x407cc0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x407ca0
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00405200
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1248781c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2250530e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x47716aec
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x4a035dd4
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404e7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x404e86
repz ret
jmp fcn.0040528d

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40eda0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5dd470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5dd46c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5dd470], edx
cmp eax, 0x26f
jl 0x40eda8
mov dword [0x56cfc0], 0x270
ret

Function at 0x40ede0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5dd474]
mov ebx, dword [eax*4 + 0x5dd470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5ddaa4]
mov dword [eax*4 + 0x5dd470], edx
cmp eax, 0xe2
jl 0x40ede8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5dd474]
mov ebx, dword [eax*4 + 0x5dd470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5dd0e4]
mov dword [eax*4 + 0x5dd470], edx
cmp eax, 0x26e
jl 0x40ee38
mov edx, dword [0x5dd470]
mov ecx, dword [0x5dde2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5ddaa0]
mov dword [0x5dde2c], eax
mov dword [0x56cfc0], 0
pop ebx
ret

Function at 0x40eec0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x56cfc0]
add dword [0x56cfc0], 1
mov eax, dword [0x5dc020]
cmp eax, dword [0x56c710]
jne 0x40eee3
cmp ebx, 0x271
jb 0x40ef04
mov eax, dword [0x5dc020]
call fcn.0040eda0
not dword [0x5dc020]
mov eax, dword [0x5dc020]
mov dword [0x56c710], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40ef20
call fcn.0040ede0
xor ebx, ebx
mov dword [0x56cfc0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5dd470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410a70
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x56c450]
cmp ax, 0xcb
je 0x410b7c
cmp ax, 0xcc
je 0x410b7c
lea esi, [esi]
mov edx, dword [0x5de070]
test edx, edx
je 0x410aa5
mov eax, dword [0x5ddf20]
call edx
mov ebx, eax
jmp 0x410aaa
mov ebx, 0x5ddf24
cmp word [0x5ddf10], 0
jle 0x410ad0
mov eax, 0x5ddef0
call fcn.00410ce0
mov eax, ebx
call fcn.00410630
mov eax, ebx
call fcn.004106a0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410af2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410aed
mov edx, edi
mov eax, ebx
call fcn.0040faa0
jmp 0x410af0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410ad8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5ddf10], 0
jle 0x410b7c
mov edx, 0x5dde30
mov eax, ebx
call fcn.0040fbe0
mov edi, eax
test edi, edi
je 0x410b4c
mov eax, dword [0x5ddec4]
mov dword [edi + 0xc], eax
cmp dword [0x5ddec4], 0
je 0x410b40
mov eax, dword [0x5ddec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5ddec4], eax
nop
sub word [0x5ddf10], 1
cmp word [0x5ddf10], 0
sete bl
mov eax, 0x5ddef0
call fcn.00410d00
test bl, bl
je 0x410b7c
mov eax, 0x5ddef0
call fcn.00410cd0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x413750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413730
push ebp
push 0x414b60
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41387a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b620
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x4137df
mov edx, 0x5dd2f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413831
call sub.kernel32.dll_GetLastError
call fcn.00404120
lea eax, [ebp - 0x10]
call fcn.0040a200
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a6a0
mov edx, dword [ebp - 0x14]
mov ecx, 0x588314
lea eax, [ebp - 0x10]
call fcn.0040a530
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040aef0
jmp 0x4138c8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41384a
cmp eax, ecx
je 0x413854
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b620
cmp byte [0x56c6d0], 0
jne 0x4138c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bbc0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040af80
lea esi, [esi]
jmp 0x4138c8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b620
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41389e
mov eax, 0x5dd2f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x56c6d0], 0
jne 0x4138c8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bbc0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040af80
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413c60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5dd260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413e40
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5dd260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403690
call sub.kernel32.dll_GetCommandLineA
mov dword [0x56c4d0], eax
mov ebx, eax
jmp 0x413e03
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413ce8
cmp byte [ebx], 0
je 0x413e0c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413d63
mov al, byte [ebx]
cmp al, 1
jb 0x413d58
sub al, 0x20
jbe 0x413d28
sub al, 2
je 0x413d3c
jmp 0x413d58
mov al, byte [ebp - 0x114]
test al, al
je 0x413d68
add dword [ebp - 0x110], 1
jmp 0x413d60
cmp byte [ebx + 1], 0x22
je 0x413d53
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413d60
add ebx, 1
jmp 0x413d60
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413d18
test dword [ebp - 0x10c], 0xffffffff
je 0x413dfc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413e40
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5dd260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413df3
mov al, byte [ebx]
cmp al, 1
jb 0x413de8
sub al, 0x20
jbe 0x413db8
sub al, 2
je 0x413dcc
jmp 0x413de8
mov al, byte [ebp - 0x114]
test al, al
je 0x413df8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413df0
cmp byte [ebx + 1], 0x22
je 0x413de3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413df0
add ebx, 1
jmp 0x413df0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413da8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413ceb
mov ebx, dword [ebp - 0x10c]
mov dword [0x5dd250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5dd260
call fcn.004108b0
mov eax, dword [0x5dd260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417560
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov dx, 0xffff
lea esi, [esi]
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x417591
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x417593
shr ecx, 1
cmp bx, 8
jl 0x417578
movzx eax, dx
mov dword [eax*4 + 0x5ffd00], ecx
cmp dx, 0xff
jl 0x417568
pop ebx
ret

Function at 0x4175b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x5ffd04], 0
jne 0x4175c8
call fcn.00417560
nop
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x4175fc
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x5ffd00]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x4175d8
mov esi, esi
not eax
pop edi
pop esi
pop ebx
ret
Function at 0x42c270
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x42c31a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x42c336
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x42c336
sub dx, 0x20
je 0x42c310
sub dx, 0x80
je 0x42c310
sub dx, 0x1f62
jb 0x42c336
sub dx, 1
jbe 0x42c310
sub dx, 6
je 0x42c310
sub dx, 0x26
jne 0x42c336
nop
jmp 0x42c310
cmp eax, dword [ebp - 0x20]
jg 0x42c2b8
lea esi, [esi]
jmp 0x42c336
cmp dword [ebp - 0x1c], 2
jne 0x42c32a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x42c336
mov al, byte [ebp - 0xc]
call fcn.0040b280
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x42c3b4
sub ax, 0x21
je 0x42c3c8
sub ax, 0x17
je 0x42c3d4
sub ax, 0x222
je 0x42c3e0
sub ax, 0x392
je 0x42c3e8
sub ax, 1
je 0x42c3f0
sub ax, 0x1996
je 0x42c3f8
sub ax, 1
je 0x42c400
sub ax, 6
je 0x42c408
sub ax, 0xb
je 0x42c418
sub ax, 0x1b
je 0x42c410
sub ax, 0x367
je 0x42c420
jmp 0x42c428
mov ax, word [ebp - 0x24]
call fcn.0040b320
mov byte [ebp - 0x10], al
jmp 0x42c430
mov byte [ebp - 0x10], 0x20
jmp 0x42c430
mov byte [ebp - 0x10], 0x2e
jmp 0x42c430
mov byte [ebp - 0x10], 0x27
jmp 0x42c430
mov byte [ebp - 0x10], 0x2c
jmp 0x42c430
mov byte [ebp - 0x10], 0x27
jmp 0x42c430
mov byte [ebp - 0x10], 0x20
jmp 0x42c430
mov byte [ebp - 0x10], 0x20
jmp 0x42c430
mov byte [ebp - 0x10], 0x20
jmp 0x42c430
mov byte [ebp - 0x10], 0x20
jmp 0x42c430
mov byte [ebp - 0x10], 0x2d
jmp 0x42c430
mov byte [ebp - 0x10], 0x27
jmp 0x42c430
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4391f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.004391e0
push ebp
push 0x414b60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x439300
mov al, byte [ebp - 0x110]
test al, al
je 0x4392c9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e40
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092b0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a080
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x58f5d8
call fcn.004523a0
mov edx, 0x43925a
mov ecx, ebp
call fcn.00414a20
jmp 0x439300
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x58f5d8
call fcn.004523a0
mov edx, 0x4392c9
mov ecx, ebp
call fcn.00414a20
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4393c4
mov al, byte [ebp - 0x110]
test al, al
je 0x43938d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e40
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092b0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a080
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x58f5d8
call fcn.004523a0
mov edx, 0x43931e
mov ecx, ebp
call fcn.00414a20
jmp 0x4393c4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x58f5d8
call fcn.004523a0
mov edx, 0x43938d
mov ecx, ebp
call fcn.00414a20
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00438b80
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004391e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43c480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x590264
call fcn.0040ce50
test al, al
je 0x43c566
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0043c580
xor eax, eax
push fcn.0043c470
push ebp
push 0x414b60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408a30
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0043b690
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0043b1e0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043c470
jmp 0x43c571
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043ea10
mov esp, ebp
pop ebp
ret
Function at 0x4489c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004489b0
push ebp
push 0x414b60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408a30
lea eax, [ebp - 0xc10]
call fcn.00403bb0
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x448a20
mov eax, 0x5dd2f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x448aca
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040f8e0
xor eax, eax
push fcn.004489a0
push ebp
push 0x414b60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x448a7c
mov eax, 0x5dd2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x448ab8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x594d7c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x448ab8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004489a0
jmp 0x448b28
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x448aec
mov eax, 0x5dd2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x448b28
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x594d7c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x448b28
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004489b0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret