joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1b
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x84]
mov esi, str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_http:__gcc.gnu.org_bugs.html_:_n
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
lea eax, [edx + 0x8a]
and eax, 0xfffffff0
call fcn.0040d060
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x84]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
mov word [edi], ax
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
lea eax, [ebx + 0x6b]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x6a], 0
mov dword [esp], ebx
call fcn.004967a0
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4a5c5c], 0
jne 0x41eff4
mov byte [0x4a5c5c], 1
call fcn.0049cad0
test eax, eax
je 0x41f08e
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.0040c360
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x41efea
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4a7441
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
je 0x41f021
call fcn.0049ced0
mov dword [esp], ebp
call sub.msvcrt.dll_fputs
jmp 0x41efbb
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x41efe5
call sub.msvcrt.dll_abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x41f089
Function at 0x414cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x414cda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414ce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414cd0
mov eax, 1
add ebx, ebx
jne 0x414cf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414ce8
jne 0x414d04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ce8
xor ecx, ecx
sub eax, 3
jb 0x414d18
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414d8a
mov ebp, eax
add ebx, ebx
jne 0x414d23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414d54
inc ecx
add ebx, ebx
jne 0x414d40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414d35
jne 0x414d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414d35
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414d74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414d65
jmp 0x414cd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414d74
add edi, ecx
jmp 0x414cd6
pop esi
mov edi, esi
mov ecx, 0x197
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414d92
cmp byte [edi], 9
jne 0x414d92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414d97
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414e06
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x187d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414dc4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1884c]
or eax, eax
je 0x414e00
mov dword [ebx], eax
add ebx, 4
jmp 0x414de1
call dword [esi + 0x18848]
mov ebp, dword [esi + 0x18850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414e3a
sub esp, 0xffffff80
jmp 0x402540
Function at 0x6726600
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x62c6000]
push edi
jmp 0x672661a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6726621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6726610
mov eax, 1
add ebx, ebx
jne 0x6726633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6726644
jne 0x6726663
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6726663
dec eax
add ebx, ebx
jne 0x6726650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6726628
add ebx, ebx
jne 0x672665f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x67266b5
xor ecx, ecx
sub eax, 3
jb 0x672667b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x67266ea
sar eax, 1
mov ebp, eax
jmp 0x6726686
add ebx, ebx
jne 0x6726686
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6726654
inc ecx
add ebx, ebx
jne 0x6726694
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6726654
add ebx, ebx
jne 0x67266a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6726696
jne 0x67266b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6726696
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x67266d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x67266c6
jmp 0x6726616
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x67266d4
add edi, ecx
jmp 0x6726616
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x67266f2
cmp byte [edi], 0x11
jne 0x67266f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x67266f7
lea edi, [esi + 0x631f000]
mov eax, dword [edi]
or eax, eax
je 0x672676f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc57463c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc5747b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6726724
mov ecx, edi
jns 0x6726753
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc5747bc]
or eax, eax
je 0x6726769
mov dword [ebx], eax
add ebx, 4
jmp 0x6726741
call dword [esi + 0xc5747cc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x67267a0
cmp al, 0xef
ja 0x6726793
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6726775
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6726782
mov ebp, dword [esi + 0xc5747c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x67267d4
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x42bf10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
or ebp, 0xffffffff
jmp 0x42bf32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42bf39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42bf28
mov eax, 1
add ebx, ebx
jne 0x42bf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42bf40
jne 0x42bf5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42bf40
xor ecx, ecx
sub eax, 3
jb 0x42bf70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42bfe2
mov ebp, eax
add ebx, ebx
jne 0x42bf7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42bf88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42bfac
inc ecx
add ebx, ebx
jne 0x42bf98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42bf8d
jne 0x42bfa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42bf8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42bfcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42bfbd
jmp 0x42bf2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42bfcc
add edi, ecx
jmp 0x42bf2e
pop esi
mov edi, esi
mov ecx, 0x1e3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42bfea
cmp byte [edi], 5
jne 0x42bfea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42bfef
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42c067
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x31ca4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31ce0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42c01c
mov ecx, edi
jns 0x42c04b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x31ce4]
or eax, eax
je 0x42c061
mov dword [ebx], eax
add ebx, 4
jmp 0x42c039
call dword [esi + 0x31ce8]
popal
jmp 0x401ff4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.0041a0ab

Function at 0x408ed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408ee9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408f24
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x408f20
lea ebx, [ebx]
cmp esi, eax
jae 0x408f24
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x408f10
cmp esi, eax
jb 0x408f2a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40d0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x465b93
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x482ad0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.004059f0
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.004059f0
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.004059f0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x4134e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
call fcn.00413610
test eax, eax
je 0x413500
mov ebx, dword [esp + 0x34]
push eax
add ebx, 0xa4
call fcn.00403650
mov ebp, 0x3e9
call fcn.0041c57b
mov esi, dword [eax + 0xc]
movzx eax, bp
push 0x472824
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x413551
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x413551
push eax
mov eax, ebx
call fcn.00409600
test eax, eax
je 0x413551
push eax
push ebp
call fcn.00401870
call fcn.0040c910
inc ebp
cmp ebp, 0x4b0
jl 0x413505
mov ebp, 0x2711
nop
call fcn.0041c57b
mov esi, dword [eax + 0xc]
movzx ecx, bp
push 0x472824
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4135f2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4135f2
push eax
mov eax, ebx
call fcn.00409600
mov ebx, eax
test ebx, ebx
je 0x4135f2
mov dword [esp + 0x34], ebp
call fcn.00401870
lea edx, [esp + 0x34]
lea edi, [eax + 4]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004141e0
mov ecx, dword [esp + 0x14]
mov esi, dword [edi + 0x18]
mov eax, dword [edi]
test ecx, ecx
je 0x4135ce
cmp ecx, eax
je 0x4135d3
call fcn.0044aa49
cmp dword [esp + 0x18], esi
jne 0x4135f2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x24], ebx
push edx
mov ebx, edi
mov dword [esp + 0x24], ebp
call fcn.0040cac0
inc ebp
cmp ebp, 0x2716
jl 0x413560
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 4

Function at 0x413610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push esi
push edi
xor ebp, ebp
call fcn.0041c57b
mov esi, dword [eax + 0xc]
push 0x472874
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x41366e
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x413667
push ebx
call fcn.0041969b
push ebx
mov edi, eax
push esi
push edi
call fcn.00453ab0
add esp, 0x10
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x413680
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46611e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x482ad0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
push 0x50
call fcn.00419661
add esp, 4
mov dword [esp + 0x28], eax
xor esi, esi
mov dword [esp + 0x38], esi
cmp eax, esi
je 0x4136ce
push eax
call fcn.004120e0
mov esi, eax
lea eax, [ebp + 8]
push eax
lea ecx, [esp + 0x20]
lea edi, [ebx + 0xf8]
mov dword [esp + 0x3c], 0xffffffff
push ecx
mov dword [esp + 0x30], edi
call fcn.004141e0
mov edx, dword [edi + 0x18]
mov eax, dword [esp + 0x1c]
mov edi, dword [edi]
mov dword [esp + 0x18], edx
test eax, eax
je 0x413703
cmp eax, edi
je 0x413708
call fcn.0044aa49
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x20], eax
jne 0x413867
push 0
push 4
push 0
push 0
push 0x471b44
call fcn.00428e72
mov ecx, dword [eax + 0x2c]
push ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x413740
mov eax, dword [eax + 0x20]
mov edx, dword [ebp + 8]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x10]
mov edi, 1
mov dword [esi + 4], edi
mov dword [esi], edx
mov dword [esi + 8], 0x3e8
test eax, eax
je 0x413767
push eax
lea ecx, [esi + 0xc]
call fcn.004094c0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.00409150
mov dword [esp + 0x38], edi
mov ebx, dword [esi + 0x2c]
mov ecx, dword [ebx + 4]
push eax
push ecx
push ebx
call fcn.0040c200
lea ecx, [esi + 0x18]
mov edi, eax
call fcn.0040c2a0
mov dword [ebx + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4137c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 8]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esi + 0x34], 0x50
mov dword [esi + 0x3c], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edi
call fcn.0040cac0
push 0x50
call fcn.00419661
add esp, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], 2
test eax, eax
je 0x413814
push eax
call fcn.004120e0
mov ebx, eax
jmp 0x413816
xor ebx, ebx
mov ecx, dword [esi]
push 0
mov dword [ebx], ecx
mov dword [ebx + 4], 5
mov edx, dword [esi + 0x44]
push esi
mov esi, dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x38], 0x200000
mov eax, dword [edi + 0x30]
push 0x80b4
push eax
call esi
mov ecx, dword [edi + 0x30]
push 0
push ebx
push 0x80b4
push ecx
call esi
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
or eax, 0xffffffff
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4138e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x482ad0]
xor eax, esp
mov dword [esp + 0x20c], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00409150
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, esi
call fcn.0044a4f0
add esp, 0x210
ret
Function at 0x413b80
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4659f6
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x482ad0]
xor eax, esp
mov dword [esp + 0x828], eax
push ebp
push edi
mov eax, dword [0x482ad0]
xor eax, esp
push eax
lea eax, [esp + 0x838]
mov dword fs:[0], eax
mov eax, dword [esi + 0xf4]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x413d87
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1e]
push edx
mov edi, eax
mov word [esp + 0x20], cx
call fcn.0044cd10
add esp, 0xc
push 0x104
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0041bb26
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x413c19
push 0x80004005
call fcn.00403120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0xc], edi
lea ecx, [esp + 0x62c]
push ecx
push 0x104
mov dword [esp + 0x848], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x413d60
mov eax, dword [esi + 0xf4]
lea edx, [esp + 0x424]
push edx
lea ecx, [esp + 0x220]
push ecx
push 0
push 0
push eax
call fcn.0044ba8d
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x648]
push ecx
lea edx, [esp + 0x2c]
push str._supdate_s_s
push edx
call fcn.004031f0
mov ebp, dword [esp + 0x34]
mov eax, dword [esi + 0xf4]
add esp, 0x28
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.0041bb26
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x413cc7
push 0x80004005
call fcn.00403120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x840], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esi + 0xf4]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
lea eax, [esp + 0x1c]
push str.__u__p_d___s____s_
push eax
call fcn.004031f0
mov edi, dword [esp + 0x24]
add esp, 0x14
push ebp
call fcn.00413db0
lea eax, [edi - 0x10]
mov byte [esp + 0x840], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x840], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x413d89
lea eax, [edi - 0x10]
mov dword [esp + 0x840], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413d87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x838]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.0044a4f0
add esp, 0x838
ret
Function at 0x413db0
Capabilities:
Create process on windows
Resume thread

Disassembly:
sub esp, 0x58
push ebp
push esi
push 0x44
xor ebp, ebp
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.0044cd10
xor eax, eax
add esp, 0xc
xor esi, esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x44
test edi, edi
je 0x413e13
xor ecx, ecx
mov eax, 0x4000
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041969b
push 0x4000
mov esi, eax
push edi
push esi
call fcn.0044bad9
add esp, 0x10
mov edx, dword [esp + 0x64]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x4000004
push 0
push 0
push 0
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x413e56
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00419690
add esp, 4
pop esi
mov eax, ebp
pop ebp
add esp, 0x58
ret 4

Function at 0x415380
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push esi
push edi
xor ebx, ebx
call fcn.0041969b
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x10]
push esi
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4153da
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push 0x473098
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4153da
cmp dword [esp + 0x10], 0x34
jne 0x4153da
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
push 0x34
push eax
push ecx
call fcn.00453ab0
add esp, 0xc
mov ebx, 1
push esi
call fcn.00419690
add esp, 4
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 8