joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100891d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x100891e1
jmp dword [eax*4 + 0x100bc7c8]
cmp dword [0x100ccbdc], 0
je 0x100892f0
push 0x100ccbe0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x100ccbf8]
test edi, edi
je 0x100892e5
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1008922b
mov edi, dword [edi + 8]
test edi, edi
je 0x100892e5
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x10089220
test esi, esi
je 0x10089220
mov ecx, dword [edi + 4]
call dword [0x100c2544]
push esi
call ecx
add esp, 4
jmp 0x10089220
call fcn.100b04a0
jmp case.default.0x100891e1
cmp dword [0x100ccbdc], 0
je case.default.0x100891e1
push 0x100ccbe0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x100ccbf8]
test edi, edi
je 0x100892d8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10089297
mov edi, dword [edi + 8]
test edi, edi
je 0x100892d8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x10089290
test esi, esi
je 0x10089290
mov ecx, dword [edi + 4]
call dword [0x100c2544]
push esi
call ecx
add esp, 4
jmp 0x10089290
cmp dword [0x100ccbdc], 0
jne 0x100892cc
push 0x100ccbe0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x100ccbdc], 1
jmp case.default.0x100891e1
push 0x100ccbe0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x100891e1
push 0x100ccbe0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x100ccbdc]
cmp eax, 1
jne case.default.0x100891e1
mov eax, dword [0x100ccbf8]
test eax, eax
je 0x10089322
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.100b3ef8
add esp, 4
mov eax, esi
test esi, esi
jne 0x10089310
mov dword [0x100ccbf8], 0
mov dword [0x100ccbdc], 0
push 0x100ccbe0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10089450
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x100bb548]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x100894b6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x100894b6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x100894b6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x100894b6
mov edx, dword [esp + 0xc]
sub edx, dword [0x100bb548]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x100894a6
add esi, 0x28
dec ecx
je 0x100894b6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x100894a0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x100894a0
mov eax, esi
pop esi
pop edi
ret

Function at 0x100896f8
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [sym.imp.msvcrt.dll__iob]
shl eax, 5
add eax, dword [ecx]
ret
Function at 0x10089700
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x100cde9f], 1
jne 0x1008971f
cmp byte [0x100cde9e], 0
jne 0x1008973e
jmp 0x1008976b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x1008976b
mov ebx, dword [fcn.100896f0]
push 2
call ebx
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.10081be0
add esp, 0x10
push 2
call ebx
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov dword [esi], 0x100bcb24
mov dword [esi + 4], 0x100cdc78
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.1008ab80
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x100897c0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x100cde9f], 1
jne 0x100897d4
cmp byte [0x100cde9e], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x100cde9e]
mov byte [0x100cde9f], 1
ret

Function at 0x10089800
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x100cde9f], 1
jne 0x10089824
cmp byte [0x100cde9e], 0
jne 0x10089843
jmp 0x10089871
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089871
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.10081be0
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x100898a4
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100898b0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x100cde9f], 1
jne 0x100898d7
cmp byte [0x100cde9e], 0
jne 0x100898f6
jmp 0x10089924
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089924
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.10081be0
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push ebx
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x100899b8
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push ebp
push ebx
call edi
xor eax, eax
cmp ebx, 0xffffffff
jne 0x100899b8
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x100c2544]
mov eax, esp
mov ecx, esi
push eax
call edi
mov eax, dword [esi]
mov edi, dword [eax + 0x34]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push 0
call edi
cmp dword [esp + 0x10], 0
je 0x100899b6
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push 0xfffffffffffffffe
call edi
mov edi, eax
add edi, dword [esp + 0x10]
mov eax, dword [esi]
mov ebx, dword [eax + 0x10]
mov ecx, ebx
call dword [0x100c2544]
mov ecx, esi
push edi
push 0xfffffffffffffffe
call ebx
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10089b50
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x100cde9f], 1
jne 0x10089b6a
cmp byte [0x100cde9e], 0
jne 0x10089b89
jmp 0x10089bb5
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089bb5
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.10081be0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x10089bd0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x100cde9f], 1
jne 0x10089bea
cmp byte [0x100cde9e], 0
jne 0x10089c09
jmp 0x10089c35
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089c35
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.10081be0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x10089c50
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x100cde9f], 1
jne 0x10089c6f
cmp byte [0x100cde9e], 0
jne 0x10089c8e
jmp 0x10089cbb
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089cbb
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.10081be0
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x10089ce0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x100cde9f], 1
jne 0x10089cfa
cmp byte [0x100cde9e], 0
jne 0x10089d19
jmp 0x10089d45
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089d45
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.10081be0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x10089d60
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x100cde9f], 1
jne 0x10089d84
cmp byte [0x100cde9e], 0
jne 0x10089da3
jmp 0x10089dd1
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9f], 1
test eax, eax
setne byte [0x100cde9e]
je 0x10089dd1
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.10081be0
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [0x100c2544]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1008a7f0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x100cde9d], 1
jne 0x1008a804
cmp byte [0x100cde9c], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x100cde9c]
mov byte [0x100cde9d], 1
ret
Function at 0x1008da80
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1014
call fcn.10088fc4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1008dbbe
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x1008dc2b
shr ecx, 2
mov dword [esp + 8], ecx
jmp 0x1008dae3
mov edx, dword [esp + 0xc]
inc edx
xor eax, eax
mov ecx, dword [esp + 8]
cmp edx, ecx
je 0x1008dc2b
mov dword [esp + 0xc], edx
mov esi, dword [esp + edx*4 + 0x14]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x102c]
mov dword [edx], esi
mov dword [esp + 4], esi
movzx ebx, word [esi + eax + 6]
test ebx, ebx
je 0x1008dad0
add eax, dword [esp + 4]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp], 0
xor ecx, ecx
jmp 0x1008db5e
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1028]
cmp eax, ecx
mov eax, esi
movzx esi, al
mov eax, esi
mov edx, 1
cmova eax, edx
cmp edi, ecx
mov ecx, eax
cmova ecx, esi
test cl, 1
je 0x1008db54
mov eax, dword [esp]
and al, 1
jne 0x1008dbda
add ebp, 0x28
dec ebx
je 0x1008dad0
mov esi, ecx
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 4]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x1008db20
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x1008dba0
mov ecx, esi
test cl, 1
jne 0x1008db49
jmp 0x1008db54
mov ecx, dword [esp + 0x102c]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp], eax
mov ecx, esi
test cl, 1
jne 0x1008db49
jmp 0x1008db54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x100cde9d], 1
jne 0x1008dbde
cmp byte [0x100cde9c], 0
jne 0x1008dbfd
jmp 0x1008dc29
mov al, 1
jmp 0x1008dc2b
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100cde9d], 1
test eax, eax
setne byte [0x100cde9c]
je 0x1008dc29
mov edi, dword [fcn.100896f0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.10081be0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
xor eax, eax
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x408090
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x6c]
lea eax, [esi + 0x6c]
test ecx, ecx
jne 0x4080c8
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0
push esi
push 0x4079d0
push 0
push 0
mov dword [esi + 0x7c], 3
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x40a560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4eddf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString_4
push 0x2e
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::ReverseFind
mov esi, eax
push 0x2e
lea ecx, [esp + 0x30]
dec esi
call sub.MFC42.DLL_CString::ReverseFind
mov edi, eax
dec edi
test esi, esi
jge 0x40a5c6
or esi, 0xffffffff
jmp 0x40a68c
test edi, edi
jge 0x40a5d4
mov esi, 1
jmp 0x40a68c
mov eax, dword [esp + 0x28]
mov al, byte [esi + eax]
cmp al, 0x39
mov byte [esp + 0x10], al
jg 0x40a61b
cmp al, 0x30
jl 0x40a61b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString
dec esi
jns 0x40a5d4
mov ecx, dword [esp + 0x2c]
mov al, byte [edi + ecx]
cmp al, 0x39
mov byte [esp + 0x10], al
jg 0x40a662
cmp al, 0x30
jl 0x40a662
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString
dec edi
jns 0x40a61b
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push edx
call edi
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call edi
add esp, 8
cmp esi, eax
jle 0x40a686
mov esi, 1
jmp 0x40a68c
sub esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40be50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push esi
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], dl
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push 5
push eax
push edx
mov dword [esp + 0x18], edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [esp + 0x114]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret

Function at 0x40c1a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x40c1da
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x1c]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
jne 0x40c1ff
pop edi
pop esi
pop ebx
pop ecx
ret
lea ecx, [esp + 0xc]
push 0
push ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c221
pop edi
pop esi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x40ca40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ee257
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], 1
mov ebp, dword [eax - 8]
lea edi, [ebp + ebp + 2]
push edi
call sub.MFC42.DLL_operatornew
mov esi, eax
lea eax, [ebp*4]
mov dword [esp + 0x14], eax
add eax, 2
push eax
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov edi, ebx
push ebp
push 0
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0x10]
push 0
push 0
push eax
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
push esi
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_operatordelete
push ebx
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x34]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40d950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ee457
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], 1
mov eax, dword [eax - 8]
inc eax
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], eax
mov ebp, eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0xc]
mov edi, eax
call sub.MFC42.DLL_CString::CString_4
mov al, byte [edi]
mov byte [esp + 0x24], 2
test al, al
je 0x40da11
cmp al, 0x26
jne 0x40da05
mov cl, byte [edi + 1]
lea esi, [edi + 1]
cmp cl, 0x23
jne 0x40da05
xor ecx, ecx
test esi, esi
je 0x40d9dd
cmp byte [esi], 0x3b
je 0x40d9d8
inc esi
inc ecx
cmp ecx, 4
jge 0x40da05
test esi, esi
jne 0x40d9c8
cmp ecx, 4
jge 0x40da05
lea ecx, [esp + 0x10]
add edi, 2
push ecx
push 0x5231b8
push edi
call dword [sym.imp.MSVCRT.dll_sscanf]
mov dl, byte [esp + 0x1c]
lea edi, [esi + 1]
mov byte [ebp], dl
add esp, 0xc
mov al, byte [edi]
inc ebp
test al, al
je 0x40da11
mov byte [ebp], al
mov al, byte [edi + 1]
inc ebp
inc edi
test al, al
jne 0x40d9b3
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push esi
mov byte [ebp], 0
call sub.MFC42.DLL_CString::operator_3
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x30]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5234a4
push str.quot_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x524438
push str.lt_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x52442c
push str.gt_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x5238f8
push str.nbsp_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0x52364c
push str.amp_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret