joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4645b0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4645c7
add esp, 0xfffffff0
call fcn.004aa654
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0049cbb0
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x4941a0]
call fcn.004aa2e4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4941a0]
call fcn.004aa2e4
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x451f6c]
call fcn.00459364
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x46473c
mov eax, dword [0x4d68ec]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00459734
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466160
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4d68ec]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004a6a04
test eax, eax
je 0x4646ba
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004a3484
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004a6a2c
test eax, eax
je 0x4646ce
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.004ab1e0
mov eax, dword [0x4d68f4]
cmp byte [eax], 0
jne 0x4646ff
mov eax, ebx
call fcn.00464828
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x464731
call fcn.004aa6ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x464a98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4d6a44]
cmp dword [eax + 0x24], 0
je 0x464b3b
cmp dword [ebx + 0x84], 0
jne 0x464b35
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x464a28
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x464b35
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x464afe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x464b35
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00495cb8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x464b0d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x465548
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x46557d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004ab098
jmp 0x465587
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.004ab004
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4664d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x46650c
mov eax, esi
call fcn.0047b004
test al, al
je 0x46650c
mov eax, dword [ebx + 0x74]
call fcn.0047ad08
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46650c
push 0
mov eax, dword [ebx + 0x74]
call fcn.0047ad08
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x472998
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x4d6ae0], 0
sete dl
or al, dl
jne 0x472ad8
mov eax, dword [0x4d6ae4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4d6ae0]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x472aa7
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4d6ae0]
call fcn.00495cb8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x472a9f
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x472a9f
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x472a9f
mov eax, dword [ebp - 0x14]
call fcn.0047ad08
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x472a9f
push ebp
call fcn.00472954
pop ecx
test al, al
jne 0x472a9f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x472a5b
mov eax, dword [ebp - 0x14]
call fcn.00479694
dec eax
jle 0x472a9f
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.004aa4f0
cmp byte [ebp - 1], 0
je 0x472a9f
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x472a9f
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4d6ae4]
call fcn.004721a0
inc edi
dec esi
jne 0x4729ee
mov eax, dword [0x4d6ae4]
cmp dword [eax + 8], 0
jle 0x472abf
mov eax, dword [0x4d6ae4]
call fcn.00472230
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x472ad8
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004727bc
pop ecx
test al, al
jne 0x472ad8
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483b24
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483bfc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d6b2c], 0
jne 0x483be0
lea eax, [ebp - 4]
mov edx, 0x483c14
call fcn.004ab048
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004ab3f4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x483be0
mov eax, ebx
call fcn.004a9bf4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x483bd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x483bc3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x483c24
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x483bc3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4d6b2c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483be0
mov eax, dword [ebp - 0xc]
call fcn.004a9c0c
ret
mov ebx, dword [0x4d6b2c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483c03
lea eax, [ebp - 4]
call fcn.004aafb0
ret

Function at 0x49cb2c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x49cb41
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4a55b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4a55ed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004ab098
jmp 0x4a55f6
mov eax, ebx
mov edx, esi
call fcn.004ab004
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a5600
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4a5621
mov al, byte [esp]
jmp 0x4a5623
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4a9e38
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4a9e67
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004ab098
jmp 0x4a9e85
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004a9dc0
mov edi, eax
test ebx, ebx
je 0x4a9e85
cmp dword [esi], 0
je 0x4a9e85
dec ebx
jmp 0x4a9e6e
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x4ac93c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4acaf8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4ac99d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4acb14
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4aca0f
xor eax, eax
push ebp
push 0x4aca08
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004ac794
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4ac9f1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4acb34
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aca0f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4acaf0
cmp byte [ebp - 0xd], 0
jne 0x4aca51
cmp byte [ebp - 0x12], 0
je 0x4acaf0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4aca6a
dec ebx
cmp byte [ebx], 0x2e
je 0x4aca79
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4aca69
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4acaf0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4acaa6
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4acaf0
cmp byte [ebp - 0xd], 0
je 0x4acaf0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4acaf0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b292c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004add84
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004ade14
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004ade14
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA
push 0x4d4419
lea ecx, [ebp - 0x200]
push ecx
call fcn.004add84
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004ade14
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004b3ac8
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4b2a3d
push esi
call fcn.004ade14
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004ade14
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004ad820
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4b2a14
xor eax, eax
jmp 0x4b2ac4
push esi
call fcn.004ade14
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004ade14
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004adce0
add esp, 0xc
jmp 0x4b2a7d
mov edi, dword [ebx + 0x24]
push edi
call fcn.004ade14
pop ecx
push eax
push esi
call fcn.004ade14
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004ade14
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004ad840
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4b2a7d
xor eax, eax
jmp 0x4b2ac4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004add84
add esp, 8
push 0x4d441b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004add84
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004add84
add esp, 8
push 0x4d441d
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004add84
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b5a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
je 0x4b5ab2
call fcn.004b5a00
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004ade14
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004ade14
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41a1c0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x41a348
pushal
mov esi, 0x413015
lea edi, [esi - 0x12015]
push edi
or ebp, 0xffffffff
jmp 0x41a1ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41a1f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41a1e0
mov eax, 1
add ebx, ebx
jne 0x41a203
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41a1f8
jne 0x41a214
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41a1f8
xor ecx, ecx
sub eax, 3
jb 0x41a228
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41a29a
mov ebp, eax
add ebx, ebx
jne 0x41a233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41a240
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41a264
inc ecx
add ebx, ebx
jne 0x41a250
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41a245
jne 0x41a261
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41a245
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41a284
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41a275
jmp 0x41a1e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41a284
add edi, ecx
jmp 0x41a1e6
pop esi
mov edi, esi
mov ecx, 0x9b1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41a2a2
cmp byte [edi], 9
jne 0x41a2a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41a2a7
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41a316
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41a2d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a168]
or eax, eax
je 0x41a310
mov dword [ebx], eax
add ebx, 4
jmp 0x41a2f1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41a347
cmp al, 0xef
ja 0x41a33a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41a31c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x41a329
popal
jmp 0x40f028
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, ecx
cmp eax, 0x3d
cmp eax, 0x1e
inc eax
cmp eax, 0x7c
mov eax, ebx
mov eax, ecx
cmp eax, 0x48
mov eax, ecx
mov eax, ecx
mov eax, ebx
mov eax, 0x1b5b9bb1
nop
cmp eax, 0x51
mov eax, 0xee4bad1
nop
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
inc eax
mov eax, ebx
inc eax
cmp eax, 0xfffffff7
inc eax
cmp eax, 0x7a
cmp eax, 0x3871ea85
mov eax, ecx
nop
mov eax, 0x2393e76c
mov eax, 0xd06d7933
nop
mov eax, ebx
nop
cmp eax, 0x6fa47c2f
nop
nop
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
mov eax, 0xa5b2a32c
cmp eax, 0x50
nop
cmp eax, 0xfce156c
mov eax, ebx
nop
mov eax, 0x334d6cf9
mov eax, 0x81b1f291
cmp eax, 0xfffffff1
nop
inc eax
nop
nop
mov eax, 0xa9472c4c
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0x34a16fb6
mov eax, ecx
mov eax, 0x22e9b2da
nop
cmp eax, 0x27
mov eax, ecx
inc eax
mov eax, 0x535945ff
mov eax, ecx
mov eax, 0x1d766986
mov eax, 0x4903d349
cmp eax, 0xd3625a48
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
inc eax
mov eax, ebx
cmp eax, 0xbe32cd93
nop
mov eax, ebx
cmp eax, 0x91e1d433
mov eax, ebx
mov eax, ecx
mov eax, ecx
mov eax, 0x73eefe1a
inc eax
inc eax
mov eax, 0xac6a12c3
inc eax
mov eax, ebx
mov eax, ecx
inc eax
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ecx
mov eax, ecx
nop
nop
nop
cmp eax, 0x69
mov eax, 0xc02dbd67
mov eax, ebx
mov eax, 0xbf882077
nop
cmp eax, 0xffffffa4
mov eax, ebx
cmp eax, 0x7c
mov eax, ecx
cmp eax, 0xc1afce12
mov eax, ebx
inc eax
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e916
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001e93b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001e936
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1001e9e2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x1001e95d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1001e9e2
mov dword [ebp - 0xc], 0
jmp 0x1001e975
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x1001e988
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c], 0x37d45db3
jmp 0x1001e96e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1c], 0
jmp 0x1001e9aa
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1c], 2
jg 0x1001e9dd
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001e9db
push 0x895
push 0x6fd
push 0
push 0
push 0x1047
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x1001e997
jmp 0x1001e952
mov esp, ebp
pop ebp
ret
Function at 0x1002cc27
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002cc7f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002cc63
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002cc7d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100186a0
and dword [eax], 0
jmp 0x1002cc58
jmp 0x1002cc9b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002cc9b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret
Function at 0x10030378
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003039c
xor eax, eax
jmp 0x1003050b
push 0x5678
push 0x56e5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 1
call fcn.1002fe00
add esp, 0x18
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100303ce
xor eax, eax
jmp 0x1003050b
push 0x236
push 0x17e2
push 1
push 0xdb8
lea eax, [ebp - 0xc]
push eax
push 0x2a80
push 0x6746
lea eax, [ebp - 8]
push eax
call fcn.1002fe95
add esp, 0x20
cmp dword [ebp - 0xc], 0
jne 0x10030406
xor eax, eax
jmp 0x1003050b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push 0x62f2
push 0x2061
push 0x3d23
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x7aa6
push 0x60b7
call fcn.1002ffe8
add esp, 0x2c
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push 0x4bfa
push dword [ebp + 8]
call fcn.1002eb11
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10030493
push 0x1963
push 0xeb6
push 0x69b6
push 0x5dfc
push 1
lea eax, [ebp - 0x14]
push eax
push 0x3a34
lea eax, [ebp - 4]
push eax
push 0x427f
call fcn.100300ad
add esp, 0x24
push dword [ebp - 4]
call fcn.1002f8c4
pop ecx
test eax, eax
jne 0x100304a4
xor eax, eax
jmp 0x1003050b
lea eax, [ebp - 4]
push eax
push 1
call fcn.10030334
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100304f3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x100304d0
xor eax, eax
jmp 0x1003050b
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100304e9
xor eax, eax
jmp 0x1003050b
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10030504
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10030508
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret