joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d5bb202
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d5c3fd0]
jne 0x6d5bb20c
repz ret
jmp fcn.6d5bb8f0

Function at 0x6d5bbf21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x6d5bbf30
pop dword [ebp - 0x28]
mov eax, 0x6d5bbf30
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xb35791ec
sub dword [ebp - 0x38], 0x65054ca1
mov dword [ebp - 0x34], 0xc3a5d1f3
sub dword [ebp - 0x34], 0x917285ae
mov dword [ebp - 0x30], 0xc48c38de
sub dword [ebp - 0x30], 0x783ff4b0
mov dword [ebp - 0x2c], 0xd38a2a79
sub dword [ebp - 0x2c], 0xd38a2a79
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xbe6ffa49
add dword [ebp - 0x38], 0xb6026f0d
mov dword [ebp - 0x34], 0xfa0d7b2
sub dword [ebp - 0x34], 0xce34763d
mov dword [ebp - 0x30], 0x4a6c6bdc
sub dword [ebp - 0x30], 0xe6fcff70
mov dword [ebp - 0x2c], 0xe9e2f177
sub dword [ebp - 0x2c], 0xe9e2f177
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x309461f9
sub eax, 0xc33891c5
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac70
push 0
call eax
mov ecx, 0x5926dccc
add ecx, 0xa6d9783e
xor edi, edi
add edi, eax
mov edx, 0xc4b9eef8
add edx, 0xa8a28f08
add edx, dword [ebp - 0x28]
mov esi, 0xfea0fd18
sub esi, 0xd468d24
add dword [ebp - 8], 0x93b88923
mov ebx, dword [edx]
xor ebx, esi
add dword [ebp - 0xc], 0x912f7a66
mov dword [edi], ebx
xor dword [ebp - 0x24], ecx
add edi, 0x2b4c18d1
sub edi, 0x2b4c18cd
add edx, 0x2ecc4092
add edx, 0xd133bf72
loop 0x6d5bc04a
add eax, 0x4aa3cdb4
add eax, 0xb55d7947
xor ebx, ebx
add ebx, eax
add eax, 0x4cc8a0b2
add eax, 0xb3375f53
mov ecx, 0xaa521c9e
sub ecx, 0x3cf71c9e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x101343e3
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1011ace3
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1011acfd
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1011acec
pop esi
jmp 0x1011ad08
ret 4
pushal
call fcn.101343c3
jmp 0x101343fe
push esp
lea esp, [esp + 4]
jmp 0x1011acd6

Function at 0x10155554
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
rdtsc
rdtsc
mov ax, bx
jmp 0x10155400
lea edx, [ecx*4]
push esi
mov dx, word [esp]
mov esi, eax
jmp 0x101553c4
pushal
call fcn.101553ea
neg eax
xchg ecx, eax
jmp 0x10155486
mov edx, ebx
bsf edx, eax
rol dl, cl
mov edx, 0x731c67aa
sub esp, 0x414
jmp 0x101553da
lea ecx, reloc.MFC80.DLL_Ordinal_1671
call fcn.10155454
cmpsb byte [esi], byte es:[edi]
cmp ebp, dword [ebx - reloc.MFC80.DLL_Ordinal_1671]
sbb al, 0xb2
aad 0x24
xchg esi, eax
jmp 0x8dd7ff8e
lea eax, reloc.MFC80.DLL_Ordinal_1671
push dword [ebp + 0xc]
mov cx, word [esp]
mov ecx, edi
jmp 0x1015546a
lea esp, [esp + 4]
jmp 0x10155508
mov edx, ebp
add edx, 0xc
mov ecx, dword [edx]
pop edx
jmp 0x10155440
push dword [ebp + 0xc]
mov ecx, dword [esp]
jmp 0x10155535
bswap eax
lea eax, reloc.MFC80.DLL_Ordinal_1671
mov cl, 0x61
jmp 0x101554d5
call fcn.1013411b
push dword [ebp + 0x18]
not ax
mov cx, sp
lea eax, [esi*4]
jmp 0x101554eb
lea ecx, reloc.MFC80.DLL_Ordinal_1671
call fcn.1015551f
add dword [ebp + reloc.MFC80.DLL_Ordinal_1671], ebx
jno 0x10155536
invalid
jl 0x10155565
test byte [ecx + 3], 0x93
test byte [0x55f146b6], 0x8b
in al, dx
push edx
jmp 0x101554c8
and al, 4

Function at 0x1016ac91
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1016acae
lea esp, [esp + 8]
dec dword [ebp - 4]
jmp 0x1016b124
mov edx, dword [ebp - 4]
jne 0x1016ab6f
je 0x1016ab85
Function at 0x1016b17c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor esi, esi
call 0x1016b3be
mov ah, 0x20
mov dh, 0xd1
and dh, ah
retf 0xcd5d
mov eax, dword [reloc.MFC80.DLL_Ordinal_1671]
xor ah, byte [eax - 0x4c7ccd39]
stosb byte es:[edi], al
lds esi, [eax + ebp*8 - 0x54]
add eax, 0xeb7d0000
call 0x1016b3b6
jge 0x1016adf7
jnp 0x1016ae2c
in eax, dx
pop ebp
xchg ebp, eax
or al, 0x82
in eax, 0x14
mov dword [reloc.MFC80.DLL_Ordinal_1671], eax
lodsd eax, dword [esi]
push eax
mov byte [esp], dl
jmp 0x1016b37b
and esi, 0x15
mov eax, dword [reloc.MFC80.DLL_Ordinal_1671]
lea edx, [eax + ecx]
setnp ah
setbe ah
jmp 0x1016b173
jmp 0x1016b42d
js 0x1016add9
jns 0x1016aedd
or eax, dword [ecx + reloc.MFC80.DLL_Ordinal_1671]
rol byte [ebx - 0x76a6eac6], 0x45
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
mov dword [ebp - 0x14], eax
pushfd
lea esp, [esp + 4]
jmp 0x1016b133
mov eax, dword [ebp - 4]
call 0x1016b17c
inc edx
xchg dword [esp], edi
add eax, ebx
lea edx, [esi*4]
jmp 0x1016b205
cmc
mov eax, dword [ebp - 0x10]
mov dl, 0x75
mov dx, word [esp]
mov edx, eax
jmp 0x1016b1ec
mov edx, dword [eax + edi*4]
push bp
mov eax, dword [esp]
xchg word [esp], ax
lea esp, [esp + 2]
jmp 0x1016b1d6
sub eax, edx
dec dl
mov edi, eax
mov ax, 0x3377
jmp 0x1016b1a3
add edx, dword [ebp + 8]
pushal
xchg word [esp + 0xb], ax
xchg dword [esp], eax
jmp 0x1016b215
sar edi, 1
mov dx, ax
bt dx, bp
jmp 0x1016b1b1
mov dx, 0xda45
clc
lea esp, [esp + 4]
cdq
mov di, 0xaa64
jmp 0x1016b1ca
mov eax, dword [ebp + 0xc]
lea esp, [esp + 0x20]
call fcn.10134429
push ebp
jmp 0x1016b26e
mov ecx, dword [ebp - 0x14]
jmp 0x1016b30c
pop word [esp]
add esp, 0
lea esp, [esp + 2]
test eax, eax
call fcn.1016b248
movzx eax, word [eax + edi*2]
stc
add ch, bh
jmp 0x1016b258
shr ecx, 0x14
jmp 0x1016b2e4
mov dword [ebp - 0xc], eax
cmp eax, esi
jb 0x1016ae1b
rol ecx, cl
jmp 0x1016b2bf
push esi
mov esi, ebp
add esi, 0xffffffe8
jmp 0x1016b2f3
mov ecx, dword [esi]
pop esi
add ecx, esi
jmp 0x1016b3d4
mov eax, dword [ecx + eax*4]
add eax, dword [ebp + 8]
clc
jmp 0x1016b2d5
lea esp, [esp + 4]
test eax, eax
call fcn.1016b32b
cmp eax, ecx
jb 0x1016ae05
jae 0x1016ae1b
add esp, 1
lea esp, [esp + 3]
test ebx, ebx
jl fcn.1016aeb6
jge 0x1016af13
xchg ebp, eax
adc byte [esi + 0x5af10e1], al
lea ebx, reloc.MFC80.DLL_Ordinal_1671
out dx, eax
test byte [edi], 0x85
stosb byte es:[edi], al
cli
invalid
mov esi, ebp
add esi, 0xfffffff0
mov eax, dword [esi]
pop esi
mov dh, byte [esp]
jmp 0x1016b435
rdtsc
rdtsc
stc
push esi
jmp 0x1016b412
mov dh, byte [esp]
not dx
mov edx, dword [eax + esi*4]
sub esp, 0xa
lea eax, [eax + ebx]
jmp 0x1016b534
mov eax, dword [edi]
pop edi
call fcn.10134361
call fcn.1016b483
mov word [esp + 2], bx
add esp, 9
lea esp, [esp + 2]
jmp 0x1016b4dc
lea esp, [esp + 4]
inc esi
cmp esi, ebx
call fcn.1016b51a
pushfd
adc eax, dword [ebx + reloc.MFC80.DLL_Ordinal_1671]
xchg esp, eax
or ch, byte [ebp - 0x64]
and dl, byte [ecx + eax - 0x48fc0f6f]
inc eax
add edx, dword [edi - 0x75]
std
push edi
mov edi, ebp
lea edi, [edi + 0xc]
jmp 0x1016b49d
xchg byte [esp + 2], al
lea esp, [esp + 2]
lea esp, [esp + 8]
add edx, dword [ebp + 8]
mov eax, dword [esp]
jmp 0x1016b4fc
Function at 0x1016b248
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dword [ebp - 4], ebx
jmp 0x1016b34c
inc edi
pushfd
call fcn.1016b386
pushal
in eax, 0x75
sbb al, 0xef
sub al, 0x92
push ss
test bl, ah
push ds
lodsb al, byte [esi]
pop es
scasb al, byte es:[edi]
mov ecx, 0x8dd2fb98
and al, 2
jmp 0x1016b296
mov eax, dword [ebp - 8]
mov cl, byte [esp]
bswap ecx
mov cx, 0x64dc
jmp 0x1016b280
lea esp, [esp + 4]
jne 0x1016ae51
je 0x1016b24a
mov cl, 0x2a
mov eax, 0xd19b2adf
dec edi
fistp qword [edx - 0x629d1eb7]
in al, dx
dec dword [ecx + reloc.MFC80.DLL_Ordinal_1671]
sbb al, 3
stc
je 0x1016ae67
call 0x1016b336
lea esp, [esp + 4]
test eax, eax
jle 0x1016ae93
setbe bh
jmp 0x1016b39f
setae bl
lea ebx, [edi - 1]
jmp 0x1016ae7d

Function at 0x1016b51a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jle 0x1016af13
jmp fcn.1016aeb6
jmp 0x1016b504
Function at 0x10003670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000367f
pop dword [ebp - 0x44]
mov eax, 0x1000367f
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3a87c
push 0
mov eax, 0x600fea82
add eax, 0xaff06586
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x5813
xor edx, edx
add edx, eax
mov ebx, 0x6bc9336b
add ebx, 0xa4374095
add ebx, dword [ebp - 0x44]
mov esi, 0x91990b46
add esi, 0x6532e5e0
sub dword [ebp - 0x24], 0x19b21b81
mov edi, dword [ebx]
xor dword [ebp - 0x34], 0xe8a5a844
sub edi, esi
xor dword [ebp - 0x24], 0x2166e6f6
mov dword [edx], edi
mov dword [ebp - 0x28], 0x7126033c
add edx, 0x6ecb67c6
add edx, 0x9134983e
add ebx, 0x14ef9713
add ebx, 0xeb1068f1
loop 0x100036d5
add eax, 0xf3916191
add eax, 0xc6ff18e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbf87dde4
add ecx, 0x5078221c
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x10003ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 4]
sub ecx, 1
js 0x10003b0b
mov eax, dword [esi + 8]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
movzx eax, word [eax + 6]
cmp eax, 4
je 0x10003b1e
cmp eax, 0xd
je 0x10003b1e
sub edx, 4
sub ecx, 1
jns 0x10003af3
mov eax, dword [esi]
sub eax, 1
je 0x10003b2c
sub eax, 2
je 0x10003b25
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
mov edx, 0x100040e0
jmp 0x10003b31
mov edx, 0x10004020
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
sub edx, eax
sub edx, 0xa
mov dword [ecx + 1], eax
mov eax, dword [esp + 0x10]
mov byte [ecx], 0xb8
mov byte [ecx + 5], 0xe9
mov dword [ecx + 6], edx
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x14], eax
xor eax, eax
pop esi
ret
Function at 0x405000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x40500e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405022
test al, 0x10
jne 0x405022
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x40a160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bec6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42dc88]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], 0
mov dword [ebp - 4], 0
mov byte [esi + 0x38], 0
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.0040a0e0
mov dword [esi + 0xe8], 0xf
mov dword [esi + 0xe4], 0
mov byte [esi + 0xd4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x4000
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xd0], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a2a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bf03
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42dc88]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
mov byte [esi + 0x18], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp byte [eax], 0
jne 0x40a305
xor edx, edx
jmp 0x40a319
mov edx, eax
lea ebx, [edx + 1]
lea ebx, [ebx]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x40a310
sub edx, ebx
push edx
push eax
lea ecx, [esi + 0x18]
call fcn.00407cc0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b4e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [edi]
push 1
push dword [edi + 8]
push esi
call dword [sym.imp.MSVCR110.dll_fread]
mov ecx, dword [edi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [edi + 0x18]
mov byte [ebp - 1], bl
mov dword [edi + 0x1c], eax
test bl, bl
je 0x40b63c
add dword [edi + 0x14], ecx
cmp dword [edi + 0x4c], 0x10
push 0xffffffffffffffff
push eax
push 0x18
lea eax, [edi + 0x38]
push ecx
mov ecx, esp
jb 0x40b532
mov eax, dword [eax]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [edi + 0x20]
push eax
call fcn.0040ee90
mov edx, dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
add esp, 0x18
xor ebx, ebx
xor ecx, ecx
cmp edx, 1
sete byte [ebp - 2]
test eax, eax
je 0x40b5f2
dec eax
mov dword [ebp - 8], eax
xor eax, eax
cmp byte [ebp - 2], al
je 0x40b571
cmp byte [esi], al
jmp 0x40b574
cmp word [esi], ax
sete al
test eax, eax
je 0x40b59f
test ecx, ecx
je 0x40b598
cmp esi, ecx
je 0x40b598
imul edx, ebx
mov eax, esi
sub eax, ecx
push eax
push ecx
sub ecx, edx
push ecx
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
mov edx, dword [edi + 0x18]
inc ebx
lea ecx, [edx + esi]
mov eax, dword [ebp - 8]
add esi, edx
test eax, eax
jne 0x40b562
test ecx, ecx
je 0x40b5c6
cmp esi, ecx
je 0x40b5c6
mov eax, dword [edi + 0x18]
imul eax, ebx
sub esi, ecx
push esi
push ecx
sub ecx, eax
push ecx
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
lea esi, [edi + 0x20]
test ebx, ebx
je 0x40b5f5
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push esi
mov dword [eax], str.nulls_removed
call fcn.0040ee90
add esp, 0x18
sub dword [edi + 0x1c], ebx
jmp 0x40b5f5
lea esi, [edi + 0x20]
cmp dword [edi + 0x18], 1
jle 0x40b630
test byte [edi + 4], 0x80
je 0x40b630
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.0040f3e0
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push ecx
mov dword [ecx], 0
mov ecx, esp
push esi
mov dword [ecx], str.endian_swap
call fcn.0040ee90
add esp, 0x18
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call fcn.0040ae50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40bf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x18]
imul eax, dword [esi + 0x1c]
test ebx, ebx
cmove ebx, edx
xor edi, edi
test byte [esi + 4], 0x80
mov dword [esi + 8], eax
je 0x40c026
test edx, edx
jne 0x40bfe8
mov eax, dword [esi + 0x1c]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041aa3c
mov ecx, dword [esi + 0x1c]
add ecx, ecx
push ecx
mov edi, eax
push ebx
push edi
call sub.MSVCR110.dll_memcpy
add esp, 0x10
mov edx, edi
mov ebx, edi
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x40c002
nop
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x40bff0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
lea eax, [esi + 0x20]
push eax
call fcn.0040ee90
add esp, 0x18
push dword [esi]
push 1
push dword [esi + 8]
push ebx
call dword [sym.imp.MSVCR110.dll_fwrite]
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x40c04a
push edi
call sub.MSVCR110.dll_void___cdecl_operator_delete___void__
add esp, 4
test bl, bl
je 0x40c089
mov eax, dword [esi + 8]
add dword [esi + 0x14], eax
cmp dword [esi + 0x4c], 0x10
push 0xffffffffffffffff
push dword [esi + 0x1c]
lea eax, [esi + 0x38]
push 0x18
push ecx
mov ecx, esp
jb 0x40c069
mov eax, dword [eax]
push ecx
mov dword [ecx], eax
mov ecx, esp
mov dword [ecx], str.write
lea ecx, [esi + 0x20]
push ecx
call fcn.0040ee90
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.0040ae50
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x413620
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c87b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x42dc88]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
push 0xff
lea eax, [ebp - 0x10f]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0
mov byte [ebp - 0x110], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4137d3
push esi
call fcn.0041aa3c
push esi
mov ebx, eax
push 0
push ebx
call sub.MSVCR110.dll_memset
add esp, 0x10
lea eax, [ebp - 0x110]
push ebx
push esi
push dword [ebp - 0x234]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4137ca
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x238]
push eax
push str.VarFileInfoTranslation
push ebx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x238], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4137ca
mov eax, dword [ebp - 0x238]
push 0xff
movzx esi, word [eax]
movzx eax, word [eax + 2]
shl esi, 0x10
or esi, eax
lea eax, [ebp - 0x20f]
push 0
push eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 0
mov byte [ebp - 0x210], 0
call sub.MSVCR110.dll_memset
push 0x423290
push esi
push str.StringFileInfo_08lx_s
lea eax, [ebp - 0x210]
push 0x100
push eax
call dword [sym.imp.MSVCR110.dll_sprintf_s]
add esp, 0x20
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4137ca
push dword [ebp - 0x230]
lea ecx, [ebp - 0x228]
call fcn.00402420
push ebx
call sub.MSVCR110.dll_void___cdecl_operator_delete___void__
add esp, 4
lea eax, [ebp - 0x228]
push eax
mov ecx, edi
call fcn.00402070
cmp dword [ebp - 0x214], 0x10
jb 0x4137f8
push dword [ebp - 0x228]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041abd2
mov esp, ebp
pop ebp
ret 4
Function at 0x41b7e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x41b80a
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
push ebp
push esi
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0041aa3c
mov ecx, dword [esp + 0x14]
add esp, 4
mov ebp, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], 0
test ecx, ecx
jle 0x41b8ab
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov ebx, dword [eax + ebp]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.0041aa3c
add esp, 4
mov edi, eax
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
mov dword [ebp], edi
mov ecx, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
cmp eax, ecx
mov eax, dword [esp + 0x1c]
lea ebp, [ebp + 4]
jl 0x41b850
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push ebx
mov dword [ebp + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push dword [esp + 0x14]
call fcn.004117e0
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [esp + 0x10], esi
jle 0x41b8e9
mov ecx, dword [ebp + esi*4]
test ecx, ecx
je 0x41b8e9
push ecx
call sub.MSVCR110.dll_void___cdecl_operator_delete___void__
inc esi
add esp, 4
cmp esi, dword [esp + 0x10]
jl 0x41b8d1
push ebp
call sub.MSVCR110.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x30008ccd
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x1c
push 0x3001e2a8
call fcn.3000aac1
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.kernel32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x30008b52
push 0x12
call fcn.30008ab0
pop ecx
mov eax, 0xff
jmp 0x30008cc7
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x30008b6d
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x30008b48
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x30008b9f
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x30022500], esi
mov dword [0x30022508], eax
mov dword [0x3002250c], ecx
mov dword [0x30022510], edx
mov dword [0x30022504], edi
call fcn.30008ad6
mov dword [ebp - 0x20], eax
push 1
call fcn.3000aa67
pop ecx
test eax, eax
jne 0x30008be5
push 0x1c
call fcn.30008ab0
pop ecx
call fcn.3000a888
test eax, eax
jne 0x30008bf6
push 0x10
call fcn.30008ab0
pop ecx
call fcn.3000a48d
and dword [ebp - 4], 0
call fcn.3000a24d
test eax, eax
jge 0x30008c10
push 0x1b
call fcn.3000979b
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x30024094], eax
call fcn.3000a118
mov dword [0x300224e0], eax
call fcn.3000eff7
test eax, eax
jge 0x30008c36
push 8
call fcn.3000979b
pop ecx
call fcn.30009dec
test eax, eax
jge 0x30008c47
push 9
call fcn.3000979b
pop ecx
push 1
call fcn.300098b7
pop ecx
test eax, eax
je 0x30008c5a
push eax
call fcn.3000979b
pop ecx
mov eax, dword [0x3002251c]
mov dword [0x30022520], eax
push eax
push dword [0x30022518]
push dword [0x30022514]
call main
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x30008c88
push eax
call fcn.30009a17
call fcn.30009a39
jmp 0x30008cbd
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.3000ab06
ret
call fcn.3000eff7
jmp 0x30008b17