joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488060
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b6fd0
push eax
mov eax, 0x10478
mov dword fs:[0], esp
call fcn.004b5d60
push edi
mov edi, ecx
cmp dword [edi + 8], 0
jne 0x48809e
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov byte [edi], 1
cmp dword [0x4e9e28], edi
je 0x4880b9
mov dword [0x4e9e28], edi
mov dword [0x4e9e30], 0
cmp dword [0x4e9e2c], 0
jne 0x4880d9
mov ecx, 0x7d0
call fcn.0047e780
test eax, eax
je 0x4882d5
mov dword [0x4e9e2c], eax
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x4e4788]
mov esi, eax
add ecx, 0x58
push ecx
push esi
mov ecx, edi
call fcn.00488510
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x488106
xor ecx, ecx
mov dword [0x4e9e30], ecx
jmp 0x48810c
mov ecx, dword [0x4e9e30]
mov dword [ebp - 0x1047c], 0
mov dword [ebp - 0x10478], 0
mov dword [ebp - 0x10444], 0
mov dword [ebp - 0x10440], 0
mov dword [ebp - 0x1043c], 0
mov dword [ebp - 0x10430], 0
mov dword [ebp - 0x10424], 0
mov dword [ebp - 0x10420], 0
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
je 0x488174
mov byte [ebp - 0x10447], 0
test eax, eax
je 0x48817b
mov byte [ebp - 0x10447], 1
mov eax, dword [0x4e4788]
mov edx, dword [0x4e9e2c]
mov dword [ebp - 0x10438], edx
mov dword [ebp - 0x10434], ecx
mov dword [ebp - 0x10468], 0x4cee98
mov dword [ebp - 0x10464], 0
mov dword [ebp - 0x10460], 0x4cee98
mov dword [ebp - 0x1045c], 0x4cee98
test eax, eax
je 0x4881c9
add eax, 0x58
mov dword [ebp - 0x10480], eax
jmp 0x4881d3
mov dword [ebp - 0x10480], 0
test ecx, ecx
mov dword [ebp - 0x10450], edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x10484], 0x10
setg bl
nop dword [eax + eax]
test edi, edi
je 0x48821c
xor eax, eax
test ecx, ecx
jle 0x48820a
nop word [eax + eax]
cmp dword [edx + eax*4], esi
je 0x48821c
inc eax
cmp eax, ecx
jl 0x488200
cmp ecx, 0x1f4
jge 0x48821c
mov dword [edx + ecx*4], esi
inc ecx
mov dword [0x4e9e30], ecx
lea eax, [ebp - 0x10484]
mov dword [ebp - 0x10434], ecx
push eax
push 0x486730
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0x10440]
test ecx, ecx
jne 0x488256
test bl, bl
je 0x488252
mov edx, dword [0x4e9e2c]
xor bl, bl
mov dword [0x4e9e30], ecx
jmp 0x4881f0
xor esi, esi
jmp 0x4882b2
call fcn.00485cc0
mov ecx, dword [0x4e9e30]
xor eax, eax
mov esi, dword [ebp - 0x10440]
mov edx, dword [0x4e9e2c]
test ecx, ecx
jle 0x48827d
cmp dword [edx + eax*4], esi
je 0x488295
inc eax
cmp eax, ecx
jl 0x488273
cmp ecx, 0x1f4
jge 0x488295
mov dword [edx + ecx*4], esi
inc ecx
mov esi, dword [ebp - 0x10440]
mov dword [0x4e9e30], ecx
mov eax, dword [0x4e4788]
mov ecx, dword [eax + 0x64]
cmp ecx, 0xffffffff
jle 0x4882b2
mov edx, 1
call fcn.004015e0
mov esi, dword [ebp - 0x10440]
push dword [ebp - 0x1047c]
call fcn.0049f542
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
call fcn.0040dcf0
int3
Function at 0x4882e0
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b6fb0
push eax
mov eax, 0x10474
mov dword fs:[0], esp
call fcn.004b5d60
push esi
mov esi, ecx
push edi
mov byte [esi], 0
cmp dword [0x4e9e28], esi
je 0x488321
mov dword [0x4e9e28], esi
mov dword [0x4e9e30], 0
cmp dword [0x4e9e2c], 0
jne 0x488341
mov ecx, 0x7d0
call fcn.0047e780
test eax, eax
je 0x488508
mov dword [0x4e9e2c], eax
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
push 4
push edi
call ebx
test eax, eax
je 0x48836b
nop dword [eax]
push 4
push eax
mov edi, eax
call ebx
test eax, eax
jne 0x488360
mov eax, dword [0x4e4788]
mov ecx, esi
add eax, 0x58
push eax
push edi
call fcn.00488510
pop ebx
test eax, eax
je 0x48838b
xor ecx, ecx
mov dword [0x4e9e30], ecx
jmp 0x488391
mov ecx, dword [0x4e9e30]
mov dword [ebp - 0x10480], 0
mov dword [ebp - 0x10478], 0
mov dword [ebp - 0x10474], 0
mov dword [ebp - 0x10464], 0x4cee98
mov dword [ebp - 0x10440], 0
mov dword [ebp - 0x1043c], 0
mov dword [ebp - 0x10438], 0
mov dword [ebp - 0x10420], 0
mov dword [ebp - 0x1041c], 0
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
je 0x488403
mov byte [ebp - 0x10443], 0
test ecx, ecx
je 0x48840a
mov byte [ebp - 0x10443], 1
mov eax, dword [0x4e9e2c]
mov dword [ebp - 0x10434], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x1042c], eax
lea eax, [ebp - 0x10480]
push eax
push 0x488620
mov dword [ebp - 0x10430], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x1043c]
test eax, eax
je 0x48849b
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ecx, eax
call fcn.00485cc0
mov ecx, dword [0x4e9e30]
xor eax, eax
mov edx, dword [ebp - 0x1043c]
mov esi, dword [0x4e9e2c]
test ecx, ecx
jle 0x488470
cmp dword [esi + eax*4], edx
je 0x488482
inc eax
cmp eax, ecx
jl 0x488466
cmp ecx, 0x1f4
jge 0x488482
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4e9e30], ecx
mov eax, dword [0x4e4788]
mov ecx, dword [eax + 0x64]
cmp ecx, 0xffffffff
jle 0x4884e8
mov edx, 1
call fcn.004015e0
jmp 0x4884e8
mov eax, dword [0x4e9e30]
test eax, eax
je 0x4884d4
cmp eax, 1
mov dword [0x4e9e30], 0
setg al
test al, al
je 0x4884e8
mov eax, dword [0x4e9e2c]
mov ecx, esi
push 0
mov dword [0x4e9e30], 1
mov dword [eax], edi
call fcn.004882e0
jmp 0x4884e8
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, eax
call fcn.00485cc0
push dword [ebp - 0x10478]
call fcn.0049f542
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0040dcf0
int3
Function at 0x49c48f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49c4ce
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49c4ce
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49c4ce
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49c4ce
cmp dword [ecx + 0x74], 0xe
jbe 0x49c4ce
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4ae18f
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4e2018]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4ae1da
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004ae32a
test al, al
jne 0x4ae1d4
sub edx, 2
cmp edx, edi
jne 0x4ae1ba
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4ae1fc
lea eax, [edi + 2]
cmp edx, eax
je 0x4ae1fc
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004ae0db
add esp, 0x10
jmp 0x4ae2f6
push esi
lea ecx, [ebp - 0x255]
call fcn.004ae32a
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ae23f
push dword [ebp - 0x25c]
jmp 0x4ae1ec
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4ae27c
cmp word [ebp - 0x226], 0
je 0x4ae29d
cmp word [ebp - 0x226], ax
jne 0x4ae27c
cmp word [ebp - 0x224], 0
je 0x4ae29d
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004ae0db
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4ae2e9
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4ae256
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4ae2d1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4ae2f6
push 0x4adf0b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004a96a0
add esp, 0x10
jmp 0x4ae2c6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049c6e3
leave
ret

Function at 0x4af030
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4bb7fc
push 0x4bb7f4
push str.FlsAlloc
push 0x1f
call fcn.004aef6b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4af064
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b87a8]
call esi
jmp 0x4af06a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x4af0ae
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4bb80c
push 0x4bb804
push str.FlsGetValue
push 0x21
call fcn.004aef6b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4af0e5
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b87a8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4af0ed
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4bb814
push 0x4bb80c
push str.FlsSetValue
push 0x22
call fcn.004aef6b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4af127
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4b87a8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4b5910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b593d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b593d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x412d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UzBUtnck
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x412da2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412da9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412d98
mov eax, 1
add ebx, ebx
jne 0x412dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412db0
jne 0x412dcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412db0
xor ecx, ecx
sub eax, 3
jb 0x412de0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412e52
mov ebp, eax
add ebx, ebx
jne 0x412deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412df8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412e1c
inc ecx
add ebx, ebx
jne 0x412e08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412dfd
jne 0x412e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412dfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412e3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412e2d
jmp 0x412d9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412e3c
add edi, ecx
jmp 0x412d9e
pop esi
mov edi, esi
mov ecx, 0x2ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x412e5a
cmp byte [edi], 0
jne 0x412e5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x412e5f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412ece
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x120b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1211c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412e8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12124]
or eax, eax
je 0x412ec8
mov dword [ebx], eax
add ebx, 4
jmp 0x412ea9
call dword [esi + 0x12120]
mov ebp, dword [esi + 0x12128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412f02
sub esp, 0xffffff80
jmp 0x406f9c
Function at 0x4093a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417bcc]
jne 0x4093aa
repz ret
jmp fcn.0041297c

Function at 0x40b9fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417bcc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404ca7
and dword [ebp - 0x14], 0
cmp dword [0x499284], 0
mov dword [ebp - 0x18], eax
jne 0x40baae
push 0x402adc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40bb56
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ad0
push ebx
call edi
test eax, eax
je 0x40bb56
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402ac0
push ebx
mov dword [0x499284], eax
call edi
push eax
call esi
push 0x402aac
push ebx
mov dword [0x499288], eax
call edi
push eax
call esi
push 0x402a90
push ebx
mov dword [0x49928c], eax
call edi
push eax
call esi
mov dword [0x499294], eax
test eax, eax
je 0x40baae
push 0x402a78
push ebx
call edi
push eax
call esi
mov dword [0x499290], eax
mov eax, dword [0x499290]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40bb07
cmp dword [0x499294], ecx
je 0x40bb07
push eax
call esi
push dword [0x499294]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40bb07
test ebx, ebx
je 0x40bb07
call edi
test eax, eax
je 0x40bafe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40bafe
test byte [ebp - 8], 1
jne 0x40bb07
or dword [ebp + 0x10], 0x200000
jmp 0x40bb3a
mov eax, dword [0x499288]
cmp eax, dword [ebp - 0x18]
je 0x40bb3a
push eax
call esi
test eax, eax
je 0x40bb3a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40bb3a
mov eax, dword [0x49928c]
cmp eax, dword [ebp - 0x18]
je 0x40bb3a
push eax
call esi
test eax, eax
je 0x40bb3a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x499284]
call esi
test eax, eax
je 0x40bb56
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40bb58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093a0
leave
ret

Function at 0x414700
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0x818
cmp dword [0x5149ec], 0x37
jne 0x414768
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea eax, [esp + 0x41c]
push eax
push 0x403418
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov ecx, dword [0x514e00]
mov eax, dword [0x5144d0]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x818
ret
Function at 0x4085f0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x4d404c]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, dword [esp + 0x148]
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.0047a230
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x408737
cmp dword [esi + 4], 6
push edi
ja 0x40864b
jne 0x4086d3
cmp dword [esi + 8], 2
jb 0x4086d3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x4086d3
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4086d3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4086d3
movups xmm0, xmmword [0x4b93fc]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x4b940c]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4086d3
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4086d3
cmp word [edi + 2], ax
jbe 0x4086d3
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40871e
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0047a230
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x40871e
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.00477374
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.00477374
add esp, 0x140
ret

Function at 0x409a70
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c314
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4d404c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004075a0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004075a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004075a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004075a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.004075a0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40aab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c6a8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004073f0
test al, al
je 0x40aaf0
xor al, al
jmp 0x40ac26
push esi
lea ecx, [ebp - 0x28]
call fcn.004075c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 4
push eax
call fcn.0040e030
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00407400
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ac13
lea ecx, [ebp - 0x40]
call fcn.004075a0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0041ca30
test al, al
je 0x40ab52
lea ecx, [ebp - 0x40]
call fcn.00407400
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004074c0
cmp esi, 0xffffffff
jne 0x40ac13
lea ecx, [ebp - 0x28]
call fcn.004077a0
cmp eax, 2
jbe 0x40ac0f
lea ecx, [ebp - 0x28]
call fcn.004077a0
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00407700
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x40ab97
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x40abb6
lea ecx, [ebp - 0x28]
call fcn.004077a0
cmp dword [esi + 0x14], 8
jb 0x40abae
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x40ac0f
lea eax, [ebp - 0x28]
push 0x20
push eax
call fcn.0040e030
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00407400
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ac13
lea ecx, [ebp - 0x40]
call fcn.004075a0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0041ca30
test al, al
je 0x40abfe
lea ecx, [ebp - 0x40]
call fcn.00407400
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004074c0
cmp esi, 0xffffffff
jne 0x40ac13
xor bl, bl
jmp 0x40ac15
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004074c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477374
mov esp, ebp
pop ebp
ret
Function at 0x40ac50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004073f0
test al, al
je 0x40ac90
xor al, al
jmp 0x40adcc
push esi
lea ecx, [ebp - 0x2c]
call fcn.004075c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push 4
push eax
call fcn.0040e030
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00407400
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40acff
lea ecx, [ebp - 0x44]
call fcn.004075a0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0041ca30
test al, al
je 0x40acee
lea ecx, [ebp - 0x44]
call fcn.00407400
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004074c0
cmp ebx, 0xffffffff
je 0x40ad08
test bl, 0x10
je 0x40adb9
lea ecx, [ebp - 0x2c]
call fcn.004077a0
cmp eax, 2
jbe 0x40adb5
lea ecx, [ebp - 0x2c]
call fcn.004077a0
lea ecx, [ebp - 0x2c]
lea ebx, [eax - 1]
call fcn.00407700
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x40ad38
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x40ad57
lea ecx, [ebp - 0x2c]
call fcn.004077a0
cmp dword [esi + 0x14], 8
jb 0x40ad4f
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x40adb5
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.0040e030
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00407400
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40adb0
lea ecx, [ebp - 0x44]
call fcn.004075a0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0041ca30
test al, al
je 0x40ad9f
lea ecx, [ebp - 0x44]
call fcn.00407400
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.004074c0
cmp ebx, 0xffffffff
je 0x40adb5
test bl, 0x10
je 0x40adb9
xor bl, bl
jmp 0x40adbb
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004074c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00477374
mov esp, ebp
pop ebp
ret
Function at 0x40adf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c720
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4d404c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004073f0
test al, al
je 0x40ae2f
xor al, al
jmp 0x40aeba
push esi
lea ecx, [ebp - 0x28]
call fcn.004075c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 4
push eax
call fcn.0040e030
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00407400
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40ae9e
lea ecx, [ebp - 0x40]
call fcn.004075a0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0041ca30
test al, al
je 0x40ae8d
lea ecx, [ebp - 0x40]
call fcn.00407400
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004074c0
cmp ebx, 0xffffffff
je 0x40aea7
test bl, 0x10
je 0x40aea7
mov bl, 1
jmp 0x40aea9
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004074c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477374
mov esp, ebp
pop ebp
ret