joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cb3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404ba2
and dword [ebp - 4], 0
cmp dword [0x40e268], 0
mov ebx, eax
jne 0x405d64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405e15
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405e15
push eax
call fcn.00404b30
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e268], eax
call esi
push eax
call fcn.00404b30
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e26c], eax
call esi
push eax
call fcn.00404b30
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e270], eax
call esi
push eax
call fcn.00404b30
pop ecx
mov dword [0x40e278], eax
test eax, eax
je 0x405d64
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b30
pop ecx
mov dword [0x40e274], eax
mov eax, dword [0x40e274]
cmp eax, ebx
je 0x405dbc
cmp dword [0x40e278], ebx
je 0x405dbc
push eax
call fcn.00404bab
push dword [0x40e278]
mov esi, eax
call fcn.00404bab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405dbc
test edi, edi
je 0x405dbc
call esi
test eax, eax
je 0x405db3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405db3
test byte [ebp - 0xc], 1
jne 0x405dbc
or dword [ebp + 0x10], 0x200000
jmp 0x405df5
mov eax, dword [0x40e26c]
cmp eax, ebx
je 0x405df5
push eax
call fcn.00404bab
pop ecx
test eax, eax
je 0x405df5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405df5
mov eax, dword [0x40e270]
cmp eax, ebx
je 0x405df5
push eax
call fcn.00404bab
pop ecx
test eax, eax
je 0x405df5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e268]
call fcn.00404bab
pop ecx
test eax, eax
je 0x405e15
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405e17
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4077b9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40da08]
jne 0x4077c3
repz ret
jmp fcn.00408cb5
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x2c9e4dc7
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x13546841
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402c40
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40b034], eax
mov dword [0x40a6d8], edx
call fcn.004043e0
xor eax, eax
mov dword [0x40b664], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x40a945], al
shr eax, 0x10
mov word [0x40a947], ax
xor eax, eax
mov ax, word [0x40a947]
and edx, 0xffff
mov dword [0x40a949], eax
xor eax, eax
sar edx, 8
mov al, byte [0x40a945]
and edx, 0xff
mov dword [0x40a94d], eax
xor eax, eax
mov al, dl
mov byte [0x40a946], dl
mov dword [0x40a951], eax
mov eax, dword [0x40a94d]
mov edx, dword [0x40a951]
shl eax, 8
or eax, edx
mov dword [0x40a955], eax
cmp byte [0x40a945], 4
jae 0x402d67
mov eax, 0x402bd8
push eax
xor edx, edx
push 0x402c05
mov dword [0x40a941], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x402cfa
call edx
mov dword [0x40a941], eax
push 0x104
push 0x40b038
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40b13c
xor eax, eax
mov dword [0x40a910], 0x40b038
call fcn.00404520
mov dword [0x40a91c], 0x40b13c
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.004045c0
mov edx, eax
mov bl, byte [eax]
mov dword [0x40b02c], eax
cmp bl, 0x22
je 0x402d71
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x404601], 2
je 0x402d89
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x404601], 2
je 0x402d90
inc eax
jmp 0x402d57
mov eax, 0x402bee
jmp 0x402cd2
inc eax
cmp bl, byte [eax]
je 0x402d81
cmp byte [eax], 0
je 0x402d81
inc eax
cmp byte [eax], 0x22
jne 0x402d76
cmp byte [eax], 0
je 0x402d57
inc eax
jmp 0x402d57
test dl, dl
je 0x402d57
inc eax
jmp 0x402d4a
mov dword [0x40a90c], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x402e06
call fcn.00404701
mov edx, eax
mov bx, word [eax]
mov dword [0x40b030], eax
cmp bx, 0x22
je 0x402dd9
xor eax, eax
mov ax, word [edx]
call fcn.00404728
test eax, eax
je 0x402dfb
xor eax, eax
mov ax, word [edx]
call fcn.00404728
test eax, eax
je 0x402e0b
add edx, 2
jmp 0x402dc6
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x402df0
cmp word [edx], 0
je 0x402df0
add edx, 2
cmp word [edx], 0x22
jne 0x402de1
cmp word [edx], 0
je 0x402dc6
add edx, 2
jmp 0x402dc6
cmp word [edx], 0
je 0x402dc6
add edx, 2
jmp 0x402db8
mov edx, 0x402c12
mov dword [0x40a918], edx
test edi, edi
jne 0x402e1e
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40b344
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40b448
mov eax, esi
mov dword [0x40a914], 0x40b344
call fcn.00404520
mov dword [0x40a920], 0x40b448
mov eax, 1
pop edi
pop esi
pop ecx
ret

Function at 0x403270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
push 0x40
push 0x1000
mov edx, dword [eax]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop edx
pop ecx
ret
Function at 0x403320
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x4033b4
cmp eax, dword [0x40a970]
jae 0x4033b4
call fcn.00404310
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.004056b0
test al, 0x80
je 0x403378
mov eax, esi
call dword [0x40a698]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x4033c8
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4033d2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x4033a5
mov eax, esi
call dword [0x40a69c]
mov eax, edx
call fcn.004056f0
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
call dword [0x40a6dc]
mov dword [eax + 4], 4
mov eax, 0xffffffff
jmp 0x4033ac
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x40339d
cmp edi, dword [esp]
je 0x4033e4
call dword [0x40a6dc]
mov dword [eax + 4], 0xc
cmp ebx, 1
jne 0x4033f1
mov eax, esi
call dword [0x40a69c]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x403b80
Capabilities:
Read file on windows

Disassembly:
push ecx
sub esp, 4
test eax, eax
jl 0x403bb1
cmp eax, dword [0x40a970]
jae 0x403bb1
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push edx
call fcn.00404310
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x403bc8
mov eax, dword [esp]
add esp, 4
pop ecx
ret
call dword [0x40a6dc]
mov dword [eax + 4], 4
mov eax, 0xffffffff
add esp, 4
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
call fcn.004056f0
cmp edx, 0x6d
jne 0x403be0
cmp dword [esp], 0
je 0x403ba9
mov eax, 0xffffffff
add esp, 4
pop ecx
ret

Function at 0x4068d0
Capabilities:
Terminate process

Disassembly:
push edx
push ebp
mov ebp, esp
mov eax, dword [0x40a92c]
add eax, 3
and al, 0xfc
mov edx, dword [0x40a92c]
sub esp, eax
mov eax, esp
add eax, edx
mov dword [0x40a930], eax
call fcn.00407580
mov edx, dword [0x40b67c]
mov eax, dword [0x40b678]
call fcn.00401e90
jmp 0x407582
mov ecx, eax
call dword [0x40ab58]
cmp dword [0x40b034], 0
je 0x4075bf
cmp dword [0x40a6d4], 0
je 0x4075ac
mov edx, 0xff
mov eax, 0x10
call dword [0x40a6d4]
call dword [0x40ab58]
call dword [0x40ab5c]
mov eax, ecx
jmp fcn.00402f40
mov edx, 0xff
mov eax, 0x10
call fcn.00405590
jmp 0x4075ac
Function at 0x40d650
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x424030]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x222]
xor ebx, ebx
push ecx
mov dword [esp + 0x20], ebx
mov word [esp + 0x224], ax
call fcn.00411760
add esp, 0xc
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.00411760
xor ecx, ecx
xor edx, edx
add esp, 0xc
mov word [esp + 0x10], cx
mov word [esp + 0x12], dx
test esi, esi
je 0x40d821
call fcn.0040d570
test al, al
je 0x40d6e6
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0040ee17
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x21c]
push 0x104
push eax
call fcn.0040efcc
lea eax, [esp + 0x224]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d706
sub eax, edx
sar eax, 1
lea ecx, [esp + eax*2 + 0x216]
movzx eax, word [ecx]
cmp ax, 0x5c
je 0x40d72b
cmp ax, 0x2f
jne 0x40d730
xor edx, edx
mov word [ecx], dx
lea eax, [esp + 0x218]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d740
sub eax, edx
sar eax, 1
push 0x100
mov edi, eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00411760
add esp, 0xc
xor esi, esi
test edi, edi
jle 0x40d80f
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40d780
movzx eax, word [esp + esi*2 + 0x218]
cmp ax, 0x5c
jne 0x40d7b7
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40d7af
push 0x80
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ax, word [esp + esi*2 + 0x218]
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x14], ax
lea eax, [esp + 0x1c]
push 0x100
xor ecx, ecx
push eax
mov word [esp + 0x1e], cx
call fcn.0040f399
lea eax, [edi - 1]
add esp, 0xc
cmp esi, eax
jne 0x40d802
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40d802
push 0x80
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, edi
jl 0x40d780
mov ebx, dword [esp + 0x14]
lea esi, [esp + 0x18]
call fcn.0040d570
test al, al
mov eax, 1
jne 0x40d823
mov eax, ebx
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ee17
mov esp, ebp
pop ebp
ret

Function at 0x40ee17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424030]
jne 0x40ee21
repz ret
jmp fcn.004104f8
Function at 0x417e32
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410b7e
and dword [ebp - 4], 0
cmp dword [0x425d74], 0
mov ebx, eax
jne 0x417ee3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417f94
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x417f94
push eax
call fcn.00410b0c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425d74], eax
call esi
push eax
call fcn.00410b0c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425d78], eax
call esi
push eax
call fcn.00410b0c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425d7c], eax
call esi
push eax
call fcn.00410b0c
pop ecx
mov dword [0x425d84], eax
test eax, eax
je 0x417ee3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410b0c
pop ecx
mov dword [0x425d80], eax
mov eax, dword [0x425d80]
cmp eax, ebx
je 0x417f3b
cmp dword [0x425d84], ebx
je 0x417f3b
push eax
call fcn.00410b87
push dword [0x425d84]
mov esi, eax
call fcn.00410b87
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417f3b
test edi, edi
je 0x417f3b
call esi
test eax, eax
je 0x417f32
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417f32
test byte [ebp - 0xc], 1
jne 0x417f3b
or dword [ebp + 0x10], 0x200000
jmp 0x417f74
mov eax, dword [0x425d78]
cmp eax, ebx
je 0x417f74
push eax
call fcn.00410b87
pop ecx
test eax, eax
je 0x417f74
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417f74
mov eax, dword [0x425d7c]
cmp eax, ebx
je 0x417f74
push eax
call fcn.00410b87
pop ecx
test eax, eax
je 0x417f74
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425d74]
call fcn.00410b87
pop ecx
test eax, eax
je 0x417f94
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417f96
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406976
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c330]
jne 0x406980
repz ret
jmp fcn.0040c55c

Function at 0x4120f2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a9be
and dword [ebp - 4], 0
cmp dword [0x41e818], 0
mov ebx, eax
jne 0x4121a3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412254
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412254
push eax
call fcn.0040a94c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e818], eax
call esi
push eax
call fcn.0040a94c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e81c], eax
call esi
push eax
call fcn.0040a94c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41e820], eax
call esi
push eax
call fcn.0040a94c
pop ecx
mov dword [0x41e828], eax
test eax, eax
je 0x4121a3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a94c
pop ecx
mov dword [0x41e824], eax
mov eax, dword [0x41e824]
cmp eax, ebx
je 0x4121fb
cmp dword [0x41e828], ebx
je 0x4121fb
push eax
call fcn.0040a9c7
push dword [0x41e828]
mov esi, eax
call fcn.0040a9c7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4121fb
test edi, edi
je 0x4121fb
call esi
test eax, eax
je 0x4121f2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4121f2
test byte [ebp - 0xc], 1
jne 0x4121fb
or dword [ebp + 0x10], 0x200000
jmp 0x412234
mov eax, dword [0x41e81c]
cmp eax, ebx
je 0x412234
push eax
call fcn.0040a9c7
pop ecx
test eax, eax
je 0x412234
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412234
mov eax, dword [0x41e820]
cmp eax, ebx
je 0x412234
push eax
call fcn.0040a9c7
pop ecx
test eax, eax
je 0x412234
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e818]
call fcn.0040a9c7
pop ecx
test eax, eax
je 0x412254
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412256
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d74
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040dff0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x431b78], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x402dc4
push 0x4026c8
push 0x4026d8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x4026f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4274a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4274ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00402d6d
mov eax, dword [0x4274b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4274b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x402e03
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x431b78], 0xc
mov dword [ebp - 4], eax
jne 0x402e65
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x104c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x431b78]
cmp eax, 0xfa9
jne 0x402e81
mov dword [0x431114], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402e8e
mov dword [0x430ac0], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x431110], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x431b78], 0x213
mov dword [ebp - 0x18], edx
jne 0x402ece
push 0x402710
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00402d67
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x402e00
cmp dword [0x431b78], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x402f38
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x402f41
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x431b78]
mov ecx, dword [0x430ac8]
sub esp, 0x544
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402fb4
mov edi, ecx
mov ebx, eax
cmp dword [0x431b78], 0x959
jne 0x402fa8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402750
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.00402d74
add edi, 8
dec ebx
jne 0x402f65
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4032ef
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x431b78], 0x400
push edi
jne 0x403341
push esi
push esi
call fcn.004036e6
push esi
push esi
call fcn.004036e6
push esi
push esi
push esi
call fcn.00403f80
add esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402ce2
fstp st(0)
push esi
call fcn.00404005
pop ecx
push esi
call fcn.00403d97
pop ecx
mov eax, dword [0x427b34]
mov dword [0x431b78], eax
mov eax, dword [0x427b0c]
mov dword [0x431b7c], eax
call fcn.00402fd3
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x4033a8
cmp dword [esp + 0x18], 0x785074d5
jne 0x4033b6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x403363
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x402b6c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402ba8
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x4033e5
cmp dword [esp + 0x18], 0x785074d5
jne 0x4033ee
inc edi
cmp edi, 0x11915
jl 0x4033b8
mov eax, dword [0x430ac8]
mov dword [0x43110c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404970
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4260d8]
jne 0x40497a
repz ret
jmp fcn.00408d4a
Function at 0x408a05
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405bcc
and dword [ebp - 4], 0
cmp dword [0x4283b8], 0
mov ebx, eax
jne 0x408ab6
push 0x401b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408b67
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b0c
push edi
call esi
test eax, eax
je 0x408b67
push eax
call fcn.00405b5a
mov dword [esp], 0x401afc
push edi
mov dword [0x4283b8], eax
call esi
push eax
call fcn.00405b5a
mov dword [esp], 0x401ae8
push edi
mov dword [0x4283bc], eax
call esi
push eax
call fcn.00405b5a
mov dword [esp], 0x401acc
push edi
mov dword [0x4283c0], eax
call esi
push eax
call fcn.00405b5a
pop ecx
mov dword [0x4283c8], eax
test eax, eax
je 0x408ab6
push 0x401ab4
push edi
call esi
push eax
call fcn.00405b5a
pop ecx
mov dword [0x4283c4], eax
mov eax, dword [0x4283c4]
cmp eax, ebx
je 0x408b0e
cmp dword [0x4283c8], ebx
je 0x408b0e
push eax
call fcn.00405bd5
push dword [0x4283c8]
mov esi, eax
call fcn.00405bd5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408b0e
test edi, edi
je 0x408b0e
call esi
test eax, eax
je 0x408b05
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408b05
test byte [ebp - 0xc], 1
jne 0x408b0e
or dword [ebp + 0x10], 0x200000
jmp 0x408b47
mov eax, dword [0x4283bc]
cmp eax, ebx
je 0x408b47
push eax
call fcn.00405bd5
pop ecx
test eax, eax
je 0x408b47
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408b47
mov eax, dword [0x4283c0]
cmp eax, ebx
je 0x408b47
push eax
call fcn.00405bd5
pop ecx
test eax, eax
je 0x408b47
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4283b8]
call fcn.00405bd5
pop ecx
test eax, eax
je 0x408b67
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408b69
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret