joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1b00
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4b1b17
add esp, 0xfffffff0
call fcn.004052dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043e470
mov eax, dword [0x4c0018]
cmp byte [eax], 0
jne 0x4b1b44
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4c02a8]
cmp word [eax + 2], 0
jne 0x4b1b5e
mov eax, dword [0x4c02a8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b3bf8
mov eax, dword [0x4c0394]
cmp word [eax + 2], 0
jne 0x4b1b78
mov eax, dword [0x4c0394]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b3e08
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x448e0c]
call fcn.0044f0e0
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b43b8
mov dl, 1
mov eax, dword [0x427af0]
call fcn.00404d78
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x427af0]
call fcn.00404d78
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44d2a4]
call fcn.00458550
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4b1d58
mov eax, dword [0x4c018c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004589e4
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4b46a0
mov dl, 1
mov eax, dword [0x427af0]
call fcn.00404d78
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4c018c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00412ebc
test eax, eax
je 0x4b1c89
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00412ca0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00412ea0
test eax, eax
je 0x4b1ca1
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406a60
push ebx
push 0x4b35c8
call fcn.004a7810
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4c0018]
cmp byte [eax], 0
jne 0x4b1cf2
mov eax, ebx
call fcn.004b1ecc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004b48cc
mov eax, ebx
call fcn.004b5500
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4b1d4f
call fcn.00405334
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b21a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b2242
cmp dword [ebx + 0x94], 0
jne 0x4b223c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b20ec
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b223c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b2202
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b223c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004328c4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b2211
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b2460
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4c6280]
cmp dword [eax + 0x170], 0
je 0x4b25c5
test bl, bl
jne 0x4b2513
cmp dword [esi + 0x9c], 0
jne 0x4b2508
mov eax, esi
call fcn.004b5350
push eax
push 0x4b236c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b24d9
mov eax, dword [0x4c6280]
cmp byte [eax + 0xd3], 0
je 0x4b24d9
mov eax, dword [esi + 0xd8]
call fcn.00407e84
mov edi, eax
cmp edi, 0
jl 0x4b24d9
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b24c2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b2508
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004328c4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b24e8
inc dword [esi + 0x9c]
jmp 0x4b25c5
cmp dword [esi + 0x9c], 0
jle 0x4b25c5
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b25c5
cmp dword [esi + 0x44], 0
je 0x4b2570
mov eax, dword [0x4c6280]
cmp byte [eax + 0xd3], 0
je 0x4b2570
mov eax, dword [esi + 0xd8]
call fcn.00407e84
mov edi, eax
cmp edi, 0
jl 0x4b2570
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b2559
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b259f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004328c4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b257f
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a56e8]
call fcn.00408044
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b3214
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b327f
cmp byte [ebx + 0xd3], 0
jne 0x4b327f
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004069b4
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b326c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b328c
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406878
jmp 0x4b328c
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406878
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b4ab4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b4b22
mov eax, esi
call fcn.0048d018
test al, al
je 0x4b4b22
mov eax, dword [ebx + 0x84]
call fcn.0048cc6c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b4b22
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b4b16
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048cc6c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00483c40
jmp 0x4b4b22
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b48ec
pop esi
pop ebx
ret
Function at 0x4b6d70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b6d78
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6eb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00406878
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00404548
mov eax, dword [ebp - 0x14]
call fcn.00406904
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x4b6e9b
mov eax, esi
call fcn.004041d4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00404548
mov eax, dword [ebp - 0x18]
call fcn.00406904
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b6ec4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.004123f4
push dword [ebx]
push 0x4b6ed4
mov eax, dword [edi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.004123f4
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.00406e18
push dword [ebx]
push 0x4b6ed4
mov eax, dword [edi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004123f4
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.00406e18
push dword [ebx]
push 0x4b6ed4
mov eax, dword [edi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004123f4
push dword [ebp - 0x24]
mov eax, ebx
mov edx, 3
call fcn.00406e18
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004041f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6ebd
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00406870
ret

Function at 0x414efb
Capabilities:
Terminate process

Disassembly:
add dh, byte [eax]
mov dword [0x30022510], edx
mov dword [0x30022504], edi
call fcn.00414e16
mov dword [ebp - 0x20], eax
push 1
call fcn.00416da7
pop ecx
test eax, eax
jne 0x414f25
push 0x1c
call fcn.00414df0
pop ecx
call fcn.00416bc8
test eax, eax
jne 0x414f36
push 0x10
call fcn.00414df0
pop ecx
call fcn.004167cd
and dword [ebp - 4], 0
call fcn.0041658d
test eax, eax
jge 0x414f50
push 0x1b
call fcn.00415adb
pop ecx
call dword [0x30001058]
mov dword [0x30024094], eax
call fcn.00416458
mov dword [0x300224e0], eax
call fcn.0041639f
test eax, eax
jge 0x414f76
push 8
call fcn.00415adb
pop ecx
call fcn.0041612c
test eax, eax
jge 0x414f87
push 9
call fcn.00415adb
pop ecx
push 1
call fcn.00415bf7
pop ecx
test eax, eax
je 0x414f9a
push eax
call fcn.00415adb
pop ecx
mov eax, dword [0x3002251c]
mov dword [0x30022520], eax
push eax
push dword [0x30022518]
push dword [0x30022514]
call fcn.00414d5f
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x414fc8
push eax
call fcn.00415d57
call fcn.00415d79
jmp 0x414ffd
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.00416e46
ret
Function at 0x416b48
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x416b4e
ret
Function at 0x448488
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4484b6
mov eax, ebx
call fcn.00448f2c
cmp dword [ebx + 0x3c], 0
je 0x4484af
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x448527
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x448519
cmp dword [ebx + 8], 0
je 0x4484d8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4484ea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x448519
cmp dword [ebx + 8], 0
je 0x4484cb
cmp eax, 3
je 0x4484fd
dec eax
jne 0x4484cb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4484cb
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4484cb
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x448545
cmp dword [ebx + 0x10], 0xcc
je 0x448545
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00448550
pop ebx
ret
Function at 0x470124
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dl, 1
mov eax, dword [0x45cc64]
call fcn.0045cd08
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47018d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0045cda8
mov cl, 1
mov edx, 0x4701a4
mov eax, dword [ebp - 8]
call fcn.0045ce0c
mov edx, dword [ebx + 0x2f0]
mov eax, dword [ebp - 8]
call fcn.0045cf80
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470194
mov eax, dword [ebp - 8]
call fcn.00402e48
ret
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2984326c
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2984326c
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2984326c
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2984326c
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2984326c
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2984326c
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2984326c
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x2984326c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2984327b
pop dword [ebp - 0x2c]
mov eax, 0x2984327b
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbb7bfff6
sub dword [ebp - 0x3c], 0x6d29baab
mov dword [ebp - 0x38], 0x864be4cc
add dword [ebp - 0x38], 0xabe76779
mov dword [ebp - 0x34], 0x38afac33
add dword [ebp - 0x34], 0x139c97fb
mov dword [ebp - 0x30], 0x4374dd7d
sub dword [ebp - 0x30], 0x4374dd7d
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xc57a08d5
sub eax, 0x9bf49815
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd4b597a1
sub dword [ebp - 0x3c], 0x60432e4b
mov dword [ebp - 0x38], 0xa298b9b7
sub dword [ebp - 0x38], 0x612c5842
mov dword [ebp - 0x34], 0x5044460f
sub dword [ebp - 0x34], 0xecd4d9a3
mov dword [ebp - 0x30], 0x93351919
sub dword [ebp - 0x30], 0x93351919
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xf35ac0b
add eax, 0x1a4fc4ad
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x447c5
push 0
call eax
mov ecx, 0xa6a5a020
add ecx, 0x595a99ec
xor esi, esi
add esi, eax
mov edi, 0x29896400
add edi, dword [ebp - 0x2c]
mov edx, 0xfdf0a435
sub edx, 0xb0895d9
add dword [ebp - 4], 0x95384d8a
mov ebx, dword [edi]
xor dword [ebp - 0x20], edi
add ebx, edx
add dword [ebp - 0x24], 0x5d88d41c
mov dword [esi], ebx
add esi, 0x8f6974f5
sub esi, 0x8f6974f1
add edi, 0x569c65ae
sub edi, 0x569c65aa
loop 0x29843394
add eax, 0xdb03
mov ebx, eax
add eax, 0xc1fede6e
add eax, 0x3e012197
mov ecx, 0x3bf8d1ae
sub ecx, 0x1278d1ae
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44055f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x452040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.00408894
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x402001
push eax
push esi
call fcn.00409701
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00408aa1
int3
Function at 0x402d80
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x452040]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
lea ecx, [esp + 0x10]
push esi
mov esi, dword [esp + 0x228]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402f69
cmp eax, 0x104
je 0x402f69
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00405300
push esi
lea ecx, [esp + 0x1c]
push ecx
push str.Unable_to_open_module_file__S___err_d
push 0xae
push str.C:packagesIGOProxydev_774277_sourceHelpers.cpp
push eax
call fcn.004047c0
add esp, 0x18
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00421ea0
add esp, 0x21c
ret
lea eax, [esp + 0x10]
mov byte [esp + 0xb], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x402f1c
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push ebp
call fcn.00421964
push ebp
mov ebx, eax
push 0
push ebx
call fcn.00423140
add esp, 0x10
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 0
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402ec4
mov eax, dword [esp + 0x14]
cmp eax, ebp
jne 0x402ec4
push esi
push eax
push ebx
call fcn.00407cb0
add esp, 0xc
mov byte [esp + 0x13], 1
push ebx
call fcn.0042196d
add esp, 4
pop ebp
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xb]
pop edi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00421ea0
add esp, 0x21c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00405300
push esi
push ebp
push dword [esp + 0x1c]
push str.Failed_to_retrieve_the_module_content_for_MD5___d__lld____err_d
push 0xc6
push str.C:packagesIGOProxydev_774277_sourceHelpers.cpp
push eax
call fcn.004047c0
add esp, 0x1c
push ebx
call fcn.0042196d
add esp, 4
pop ebp
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xb]
pop edi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00421ea0
add esp, 0x21c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00405300
push esi
lea ecx, [esp + 0x1c]
push ecx
push str.Failed_to_retrieve_the_module_file_size__S___err_d
push 0xcf
push str.C:packagesIGOProxydev_774277_sourceHelpers.cpp
push eax
call fcn.004047c0
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xb]
pop edi
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00421ea0
add esp, 0x21c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00405300
push esi
push str.Unable_to_retrieve_the_module_file_name___err_d
push 0xa6
push str.C:packagesIGOProxydev_774277_sourceHelpers.cpp
push eax
call fcn.004047c0
mov ecx, dword [esp + 0x230]
add esp, 0x14
xor al, al
pop esi
xor ecx, esp
call fcn.00421ea0
add esp, 0x21c
ret