joyce8/EMBER2024-capa huggingface dataset:
Function at 0x724010
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x75d995
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x79de74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0070d5f0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x724092
mov byte [esi + 4], 0
jmp 0x72414f
cmp dword [edi + 8], 0xfffffff
je 0x724167
lea eax, [edi + 4]
mov dword [ebp - 0x24], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.0072b264
mov ecx, dword [ebx]
add esp, 4
mov edx, dword [ebx + 4]
mov dword [ebp - 0x20], eax
add eax, 8
mov dword [ebp - 0x1c], eax
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x65a2a0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x65a2a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
seta al
test al, al
je 0x724139
mov ecx, edi
call fcn.00726b30
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push ebx
push dword [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0070d5f0
mov ecx, dword [eax]
jmp 0x72413f
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x20]
push ecx
push ebx
mov ecx, edi
call fcn.00726ad0
mov byte [esi + 4], 1
mov dword [esi], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x664a10
call fcn.0072c7fa
int3
Function at 0x725990
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x75dbe5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x79de74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.0070d5f0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x725abb
cmp dword [esi + 8], 0xfffffff
je 0x725ad2
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0072b264
mov dword [ebp - 0x18], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x20], ecx
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x65a2a0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x65a2a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x725aac
mov ecx, esi
call fcn.00726b30
push ebx
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.0070d5f0
mov ecx, dword [eax]
jmp 0x725aaf
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, esi
call fcn.00726ad0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x664a10
call fcn.0072c7fa
int3
Function at 0x7267c0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x18]
cmp ecx, eax
ja 0x726915
lea eax, [ecx - 1]
or eax, edi
bsr ecx, eax
push ebp
push esi
mov esi, dword [ebx + 4]
lea ebp, [ebx + 0xc]
push esi
lea ecx, [ecx + 1]
mov dword [esp + 0x14], ebp
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.00715470
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x7268ef
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebp]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x14], eax
cmp ebx, esi
jne 0x726877
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x7268e1
mov eax, dword [eax + 4]
mov ebp, dword [ecx + 8]
cmp ebp, dword [eax + 8]
jne 0x7268a9
mov ebp, dword [eax]
cmp ebp, ecx
je 0x7268a0
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
jmp 0x7268dd
mov edi, eax
cmp ebx, eax
je 0x7268be
nop
mov eax, dword [eax + 4]
mov edi, eax
cmp ebp, dword [eax + 8]
je 0x7268f9
cmp ebx, edi
jne 0x7268b0
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ecx, edx
cmp edx, esi
jne 0x726825
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x7268dd
push 0x664a2c
call fcn.0072c7fa
int3
Function at 0x726920
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x75e910
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x79de74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x726ab8
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0x14], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00715470
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x726a80
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 0x18], eax
cmp ebx, esi
jne 0x7269f2
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x726a69
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x726a2c
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp eax, ecx
je 0x726a24
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x14]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], ecx
jmp 0x726a69
mov edi, eax
cmp ebx, eax
je 0x726a46
mov eax, dword [eax + 4]
mov edi, eax
mov esi, dword [ecx + 8]
cmp esi, dword [eax + 8]
mov esi, dword [ebp - 0x14]
je 0x726a94
cmp ebx, edi
jne 0x726a32
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 0x10]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x1c]
mov ecx, edx
cmp edx, esi
jne 0x7269a1
nop word [eax + eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x14]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x726a69
push 0x664a2c
call fcn.0072c7fa
int3
Function at 0x726c80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x75d995
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x79de74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0070d5f0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x726d02
mov dword [edi], eax
xor al, al
jmp 0x726dbf
cmp dword [esi + 8], 0xfffffff
je 0x726dd8
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.0072b264
mov ecx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x20], eax
lea edx, [eax + 8]
mov eax, dword [ebx]
mov dword [edx], eax
mov dword [ebp - 0x1c], edx
mov dword [edx + 4], ecx
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x65a2a0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x65a2a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x726da9
mov ecx, esi
call fcn.00726b30
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push ebx
push dword [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0070d5f0
mov ecx, dword [eax]
jmp 0x726daf
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x20]
push ecx
push ebx
mov ecx, esi
call fcn.00726ad0
mov dword [edi], eax
mov al, 1
mov byte [edi + 4], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x664a10
call fcn.0072c7fa
int3
Function at 0x726df0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x75e930
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x79de74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0xd
push eax
push 0x66649c
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, 0xc
jne 0x726f87
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x38], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x726e52
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00682a40
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
mov edi, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
mov edx, dword [ebp - 0x24]
cmovae eax, edi
cmovae ecx, edi
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
cmp ecx, eax
je 0x726ec0
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, 0x30
jl 0x726f54
cmp al, 0x39
jle 0x726ea6
cmp al, 0x41
jl 0x726f54
cmp al, 0x46
jle 0x726eb2
cmp al, 0x61
jl 0x726f54
cmp al, 0x66
jg 0x726f54
inc ecx
cmp ecx, dword [ebp - 0x48]
jne 0x726e90
xor ecx, ecx
lea eax, [ebp - 0x38]
cmp edx, 0x10
mov dword [ebp - 0x3c], ecx
xorps xmm1, xmm1
cmovae eax, edi
movq qword [ebp - 0x44], xmm1
cmp dword [ebp - 0x28], ecx
jbe 0x726ef6
push dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.007437a0
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
movq xmm1, qword [ebp - 0x44]
mov edx, dword [ebp - 0x24]
mov byte [esi], 0
xorps xmm0, xmm0
movups xmmword [esi + 4], xmm0
movq qword [esi + 0x14], xmm0
mov byte [esi + 0x1c], 0
movq qword [esi + 0x1d], xmm0
mov dword [esi + 0x25], 0
mov byte [esi + 0x1c], 0
movq qword [esi + 0x1d], xmm1
mov dword [esi + 0x25], ecx
mov byte [esi + 0x1c], 1
cmp edx, 0x10
jb 0x726fa6
lea ecx, [edx + 1]
mov eax, edi
mov dword [ebp - 4], 0
cmp ecx, 0x1000
jb 0x726fc3
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x726fcf
jmp 0x726fc3
cmp edx, 0x10
jb 0x726f87
lea ecx, [edx + 1]
mov eax, edi
mov dword [ebp - 4], 1
cmp ecx, 0x1000
jb 0x726f7d
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x726fcf
push ecx
push edi
call fcn.0072b294
add esp, 8
mov byte [esi], 0
xorps xmm0, xmm0
movups xmmword [esi + 4], xmm0
movq qword [esi + 0x14], xmm0
mov byte [esi + 0x1c], 0
movq qword [esi + 0x1d], xmm0
mov dword [esi + 0x25], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0072b7b0
mov esp, ebp
pop ebp
ret
push ecx
push edi
call fcn.0072b294
add esp, 8
jmp 0x726fa6
call fcn.006e7474
int3
Function at 0x72a4d0
Capabilities:
Reference the vmware io port

Disassembly:
push ecx
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
pushal
mov eax, 0x564d5868
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [esp + 0x2c], ebx
popal
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x74d860
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x74d92c
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x74d92b
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
test edi, edi
je 0x74d926
push esi
cmp edi, 0x40
jb 0x74d90b
lea eax, [edi - 1]
lea esi, [edi - 1]
add eax, edx
add esi, ebx
cmp ebx, eax
ja 0x74d8a0
cmp esi, edx
jae 0x74d90b
movaps xmm1, xmmword [0x669d50]
lea esi, [edx + 0x30]
mov eax, edi
mov edi, edx
and eax, 0xffffffc0
sub edi, ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
push ebp
nop dword [eax + eax]
movups xmm0, xmmword [esi - 0x30]
add ecx, 0x40
lea esi, [esi + 0x40]
lea eax, [eax + 0x40]
mov ebp, ecx
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [edi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [esi - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [esi - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp ecx, dword [esp + 0x14]
jb 0x74d8c0
mov edi, dword [esp + 0x1c]
cmp ebp, edi
pop ebp
jae 0x74d925
mov esi, edi
lea eax, [ecx + ebx]
sub edx, ebx
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor cl, 0x67
mov byte [eax - 1], cl
sub esi, 1
jne 0x74d914
pop esi
mov byte [ebx + edi], 0
pop edi
pop ebx
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xba3733a
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x456371bc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402077
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x20], eax
call fcn.004240fc
pop ecx
pop ecx
push ebx
push 0x80000080
push 2
push ebx
push 1
push 0xc0000000
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x14], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x1c], eax
call esi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.kernel32.dll_SetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x18], eax
call esi
push dword [ebp - 0x14]
push 0xfffffffffffffff4
call esi
mov ecx, 0x431440
call fcn.00401a9d
mov edi, eax
cmp edi, ebx
jne 0x40211f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Cant_load_Python_for_pre_install_script___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x10]
push eax
call fcn.00401654
add esp, 0x10
or eax, 0xffffffff
jmp 0x4021f7
push dword [ebp - 0x20]
call fcn.004116e0
pop ecx
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push dword [ebp - 0x1c]
push 0xfffffffffffffff5
call esi
push dword [ebp - 0x18]
push 0xfffffffffffffff4
call esi
cmp dword [ebp - 0x20], ebx
je 0x4021e2
mov eax, str.Running_the_pre_installation_script_failed_r_n
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402151
push ebx
push dword [ebp - 0x14]
sub eax, edx
mov edi, eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x402175
mov dword [ebp - 0x18], 0x1000
mov eax, dword [ebp - 0x18]
lea eax, [eax + edi + 1]
push eax
call fcn.004116e0
mov esi, eax
pop ecx
cmp esi, ebx
je 0x4021d7
mov eax, str.Running_the_pre_installation_script_failed_r_n
mov edx, esi
mov dword [ebp - 0x1c], ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402195
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
lea eax, [esi + edi]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp - 0x1c]
add eax, esi
push esi
mov byte [eax + edi], bl
call fcn.00401654
push esi
call fcn.00407f30
pop ecx
jmp 0x4021e1
push str.Out_of_memory_
call fcn.00401654
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x74
leave
ret
Function at 0x4024ca
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x78], ecx
lea ecx, [edx + eax - 0x16]
sub eax, dword [ecx + 0x10]
push esi
sub eax, dword [ecx + 0xc]
push edi
mov edi, dword [ebp + 0xa0]
sub eax, 0x22
lea esi, [edx + eax]
xor edx, edx
mov dword [edi], edx
mov dword [ebx], edx
cmp dword [ecx], 0x6054b50
mov dword [ebp - 0x80], edi
jne 0x40260f
cmp dword [esi], 0x1234567b
je 0x402534
push edx
mov edi, str.Invalid_cfgdata_magic_number__see_bdist_wininst.py_
call fcn.004116e0
pop ecx
jmp 0x402611
cmp eax, edx
jl 0x40260f
mov ecx, dword [esi + 8]
cmp ecx, edx
je 0x402550
mov edx, esi
sub edx, dword [esi + 4]
sub edx, ecx
mov dword [0x431560], edx
sub eax, dword [esi + 4]
mov ecx, dword [ebp - 0x78]
sub eax, dword [esi + 8]
mov edi, esi
mov dword [ecx], eax
sub edi, dword [esi + 4]
push 0x104
call fcn.004116e0
pop ecx
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x40260f
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x4025fd
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push 0
push 0x4259a8
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x4025fd
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
push eax
push dword [ebp - 0x7c]
push 2
call fcn.004116e0
add esp, 0x1c
mov dword [ebp - 0x78], eax
test eax, eax
je 0x40260f
push dword [esi + 4]
push edi
push eax
call fcn.00408be0
mov eax, dword [ebp - 0x78]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4025d1
sub eax, esi
lea eax, [eax + edi + 1]
push eax
call fcn.004116e0
pop ecx
mov ecx, dword [ebp - 0x80]
push dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
xor eax, eax
inc eax
jmp 0x402611
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
mov edi, str.Could_not_create_temporary_file
call fcn.004116e0
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
xor ecx, ebp
pop esi
call fcn.00407875
add ebp, 0x94
leave
ret