joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5614c6
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b18c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0058c704
lea edi, [esi + 0x48]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov dword [edi], 0x4bfb70
call fcn.005609de
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 1
call fcn.005609de
lea ecx, [edi + 0x64]
mov byte [esp + 0x18], 2
call fcn.005609de
lea ecx, [edi + 0x78]
mov byte [esp + 0x18], 3
call fcn.005609de
mov dword [edi], 0x4bfb68
lea ecx, [esi + 0xd4]
mov byte [esp + 0x18], 4
call fcn.00561d2e
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x4bfab0
mov dword [esi + 0x34c], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x5615fe
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b1934
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x4bfab0
lea ecx, [esi + 0xd4]
mov dword [esp + 0x18], 1
call fcn.005621ae
lea edi, [esi + 0x48]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x78]
mov byte [esp + 0x18], 4
mov dword [ecx], sym.imp.gdi32.dll_MoveToEx
call fcn.00560bde
lea ecx, [edi + 0x64]
mov byte [esp + 0x18], 3
mov dword [ecx], sym.imp.gdi32.dll_MoveToEx
call fcn.00560bde
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 2
mov dword [ecx], sym.imp.gdi32.dll_MoveToEx
call fcn.00560bde
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 0
mov dword [ecx], sym.imp.gdi32.dll_MoveToEx
call fcn.00560bde
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0058d1bd
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x56ccfe
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b2500
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x56cea5
mov ecx, dword [0x4e2540]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x56cdfa
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0056ba1e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0058b206
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0058b119
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4df674
call fcn.0058b187
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.0056bdde
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0058b206
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0058b119
lea ecx, [esp + 0xc]
call fcn.0058b5e1
mov ecx, dword [esp + 0xc]
push 0x4e00b4
push ecx
call fcn.00579262
add esp, 8
test eax, eax
je 0x56ce22
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x56cd5b
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0058b119
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0058b119
jmp 0x56cea9
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.0056ca9e
test eax, eax
push 0
je 0x56ce8d
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.0056b13e
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x56ce73
cmp eax, 0x64
jg 0x56ce61
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [fcn.004b4310]
mov esi, eax
jmp 0x56cdfe
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [fcn.004b4310]
mov esi, eax
jmp 0x56cdfe
cmp eax, 0x64
jge 0x56cdfa
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [fcn.004b4310]
mov esi, eax
jmp 0x56cdfe
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.0056b13e
mov esi, eax
jmp 0x56cdfe
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x56ceb3
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x71f629
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0071f6a8
jae 0x71f635
xor ecx, ecx
call fcn.0071f6a8
jae 0x71f65f
xor eax, eax
call fcn.0071f6a8
jae 0x71f670
mov al, 0x10
call fcn.0071f6a8
adc al, al
jae 0x71f651
jne 0x71f69d
stosb byte es:[edi], al
jmp 0x71f636
call fcn.0071f6b4
dec ecx
loop 0x71f67c
mov eax, ebp
call fcn.0071f6b2
jmp 0x71f69e
lodsb al, byte [esi]
shr eax, 1
je 0x71f6c4
adc ecx, 2
mov ebp, eax
jmp 0x71f69e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0071f6b2
cmp eax, 0x7d00
jae 0x71f69c
cmp eax, 0x500
jae 0x71f69d
cmp eax, 0x7f
ja 0x71f69e
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x71f636
pop ebp
ret 8
Function at 0x41c2c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c319
lea eax, [ebp - 8]
push eax
push 0x4dc9a0
push 0
push 0
push 0x4b1820
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c310
mov byte [0x4de9a4], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x41ce3b
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x52]
push edi
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], 0
call fcn.0041c696
test al, al
je 0x41ce61
mov ax, word [edi]
mov byte [esi + 0xc], 1
mov word [esi + 0x50], ax
jmp 0x41ceda
mov ax, word [esp + 0xc]
test ax, ax
jne 0x41ce7d
cmp dword [esi + 0x4c], 4
jne 0x41ce7d
mov ecx, esi
lea edi, [esi + 0x50]
call fcn.0041cbd4
jmp 0x41ce80
lea edi, [esi + 0x50]
push edi
mov ecx, esi
mov word [edi], ax
call fcn.0041c696
test al, al
je 0x41ce95
mov byte [esi + 0xd], 1
jmp 0x41ceda
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov ecx, esi
mov word [edi], ax
call fcn.0041c696
test al, al
jne 0x41ceda
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push edi
mov ecx, esi
mov word [edi], ax
call fcn.0041c696
test al, al
jne 0x41ceda
call fcn.004488a7
push edi
mov ecx, esi
mov word [edi], ax
call fcn.0041c696
test al, al
jne 0x41ceda
mov ax, word [esi + 0x54]
mov word [edi], ax
pop edi
pop esi
ret 4
Function at 0x41e69f
Capabilities:
Hide graphical window

Disassembly:
push dword [0x4dea20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e6cf
push 0
push dword [0x4dea20]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4dea28]
mov ecx, dword [eax + 0x298]
push 0
call fcn.0043fb76
ret

Function at 0x41e6d0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
push edi
lea eax, [ebp - 0x2c]
push eax
push dword [0x4dea20]
call esi
lea eax, [ebp - 0x6c]
push eax
xor ebx, ebx
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 8], eax
call fcn.00435df5
cmp dword [eax], 1
je 0x41e73a
cmp dword [eax + 4], ebx
je 0x41e78f
push ebx
push 0x4b1da0
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e78f
lea eax, [ebp - 0x3c]
push eax
push edi
mov dword [ebp - 4], 0x46
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
sub esi, ebx
mov eax, esi
cdq
idiv dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x4dea20]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x420311
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x100c]
mov eax, 0x100c
call fcn.004688f0
push 0xffffffffffffffff
push 0x4a4147
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x202c
call fcn.004688f0
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x1008], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x1018]
or dword [ebp - 0x18], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x4203c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp + 0x1020], bl
je 0x4203a5
cmp eax, 0x20
je 0x42039e
cmp eax, 0x21
jne 0x4203a5
xor eax, eax
jmp 0x4204d0
cmp eax, ebx
jle 0x4203b5
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x4203c8
mov dword [ebp - 0x30], eax
push 0x4ca3c8
lea eax, [ebp - 0x30]
push eax
call fcn.004675aa
mov esi, 0x2800
push esi
call fcn.00445da6
pop ecx
mov edi, eax
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 0x101c]
push dword [ebp + 0x1014]
call fcn.004455f7
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x42042f
push 0x1004
push ebx
push eax
lea ecx, [ebp - 0x203c]
call fcn.0041f8f1
push eax
lea eax, [ebp - 0x1038]
push eax
call fcn.00468920
add esp, 0xc
push 0x4ca3b8
lea eax, [ebp - 0x1038]
jmp 0x4203c2
cmp dword [ebp - 0x14], ebx
je 0x4204a2
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x420472
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x420460
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x420472
mov dword [ebp - 0x24], eax
push 0x4ca3c8
lea eax, [ebp - 0x24]
jmp 0x4203c2
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
je 0x4204a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x420490
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x4204a2
mov dword [ebp - 0x34], eax
push 0x4ca3c8
lea eax, [ebp - 0x34]
jmp 0x4203c2
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
cmp eax, ebx
ja 0x4203e0
mov byte [ebp - 4], bl
push edi
call fcn.00466cfb
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0xffffffff
je 0x4204cd
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1008]
xor ecx, ebp
call fcn.00467491
add ebp, 0x100c
leave
ret
Function at 0x4428a9
Capabilities:
Read file on windows

Disassembly:
push 0x48
mov eax, 0x4aa741
call fcn.00467509
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x50], eax
push 1
lea eax, [ebp - 0x41]
lea edi, [esi + 4]
push eax
mov ecx, edi
mov dword [ebp - 0x54], esi
mov dword [esi], 0x4b6454
call fcn.00401f10
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [esi + 0x4c], 0xffffffff
lea ecx, [esi + 0x58]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], 1
mov byte [esi + 0x41], 1
mov byte [esi + 0x42], 1
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], 0x2e
mov dword [esi + 0x54], 0x138
call fcn.00442880
mov byte [ebp - 4], 1
push dword [ebp - 0x50]
mov ecx, edi
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
call fcn.00401f50
cmp dword [esi + 0x20], 8
jb 0x442929
mov eax, dword [esi + 0xc]
jmp 0x44292c
lea eax, [esi + 0xc]
xor edi, edi
inc edi
push edi
push eax
call fcn.004407e9
pop ecx
mov dword [esi + 0x44], eax
cmp dword [esi + 0x20], 8
pop ecx
jb 0x442946
mov eax, dword [esi + 0xc]
jmp 0x442949
lea eax, [esi + 0xc]
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x38], eax
cmp eax, 0xffffffff
jne 0x442976
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
jmp 0x442a9f
push 0x2e
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [esi + 0x3c], edi
call fcn.00468830
add esp, 0xc
push ebx
push ebx
push dword [esi + 0x44]
mov ecx, esi
push dword [esi + 0x38]
call fcn.0043ff4e
test eax, eax
je 0x442a9f
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 0x48]
push eax
push 0x2e
lea eax, [ebp - 0x40]
push eax
push dword [esi + 0x38]
call edi
mov dword [ebp - 0x4c], eax
cmp eax, ebx
je 0x442a8a
cmp dword [ebp - 0x48], ebx
je 0x442a8a
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00441e51
test eax, eax
je 0x4429de
cmp word [ebp - 0x32], bx
jne 0x442a4c
cmp dword [esi + 0x20], 8
jb 0x4429e9
mov eax, dword [esi + 0xc]
jmp 0x4429ec
lea eax, [esi + 0xc]
push ebx
push eax
call fcn.004407e9
pop ecx
pop ecx
cmp eax, dword [esi + 0x44]
jbe 0x4429fd
mov dword [esi + 0x44], eax
push ebx
push ebx
push dword [esi + 0x44]
mov ecx, esi
push dword [esi + 0x38]
call fcn.0043ff4e
test eax, eax
je 0x442a9f
push ebx
lea eax, [ebp - 0x4c]
push eax
push 0x2e
lea eax, [ebp - 0x40]
push eax
push dword [esi + 0x38]
call edi
mov dword [ebp - 0x4c], eax
cmp eax, ebx
je 0x442a9f
cmp dword [ebp - 0x48], ebx
je 0x442a9f
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00441e51
test eax, eax
je 0x442a45
cmp word [ebp - 0x32], bx
jne 0x442a4c
mov dword [esi + 0x78], 3
mov eax, dword [esi + 0x78]
cmp eax, 1
je 0x442a65
add eax, 0xfffffffe
cmp eax, 1
ja 0x442a73
mov dword [esi + 0x54], 0x18
jmp 0x442a6c
mov dword [esi + 0x54], 0x138
mov dword [esi + 0x50], 0x2e
mov ecx, esi
call fcn.0043fefe
test al, al
je 0x442a9f
movzx eax, word [ebp - 0x32]
push eax
call fcn.004424e5
jmp 0x442a9f
mov dword [esi + 0x78], 3
mov dword [esi + 0x50], 0x2e
mov dword [esi + 0x54], 0x18
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0046758c
ret 4
Function at 0x78e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x78e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x78e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x78e06a
add dl, dl
jne 0x78e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x78e0dc
xor eax, eax
add dl, dl
jne 0x78e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x78e17d
add dl, dl
jne 0x78e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x78e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x78e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x78e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x78e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x78e075
mov eax, 1
add dl, dl
jne 0x78e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x78e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x78e0e1
sub eax, ebx
mov ebx, 1
jne 0x78e128
mov ecx, 1
add dl, dl
jne 0x78e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x78e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x78e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x78e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x78e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x78e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x78e136
cmp eax, 0x7d00
jae 0x78e16d
cmp eax, 0x500
jb 0x78e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x78e075
cmp eax, 0x7f
ja 0x78e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x78e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x78e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x78e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403320
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4723af
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4934a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esi], vtable.boost::detail::thread_data_base.0
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffff
mov dword [esp + 0x30], ebx
lea edi, [esi + 0x10]
mov dword [esi + 0xc], ebx
push 0x20
mov dword [esp + 0x1c], edi
mov dword [edi + 8], ebx
call fcn.0041dc7d
add esp, 4
cmp eax, ebx
je 0x4033f4
mov dword [edi + 4], eax
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov eax, dword [edi + 4]
mov byte [eax + 0x1c], 1
mov ecx, dword [edi + 4]
mov byte [ecx + 0x1d], 1
mov byte [esp + 0x30], 4
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esp + 0x30], 5
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esp + 0x30], 6
push ebx
push 1
call fcn.00403200
add esp, 8
mov dword [esi + 0x44], eax
mov byte [esp + 0x30], 7
mov byte [esi + 0x48], 1
mov dword [esp + 0x30], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], ebx
call fcn.0043b650
mov byte [esp + 0x30], 1
mov dword [esp + 0x1c], vtable.std::bad_alloc.0
mov byte [esp + 0x30], bl
push 0x48aa78
lea eax, [esp + 0x20]
push eax
call fcn.0043d2b9
int3

Function at 0x407230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x470f5f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4934a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
xor edi, edi
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x24]
push eax
mov ecx, esi
call fcn.00407ae0
mov ecx, 1
mov dword [esp + 0x1c], ecx
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esp + 0x1c], 2
lea eax, [esi + 0x30]
mov dword [eax], vtable.boost::exception.0
mov dword [esp + 0x10], eax
mov dword [eax + 4], edi
mov byte [esp + 0x1c], 3
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], 0xffffffff
mov byte [esp + 0x1c], 4
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [eax], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], ecx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4072e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x470a46
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4934a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov ecx, dword [esi + 0x44]
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::thread_resource_error__.2.0
mov dword [esi + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::thread_resource_error__.1.0
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::thread_resource_error__.0
mov ecx, dword [esi + 0x44]
mov ecx, dword [ecx + 4]
lea edx, [ecx - 8]
mov dword [ecx + esi + 0x40], edx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov ecx, 1
mov dword [esp + 0x1c], ecx
lea edi, [esi + 0x30]
mov dword [esp + 0x10], edi
mov dword [edi], vtable.boost::exception.0
mov byte [esp + 0x1c], cl
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40737b
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test al, al
je 0x40737b
mov dword [edi + 4], 0
mov dword [esp + 0x1c], 0xffffffff
mov ecx, esi
call fcn.00408ae0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x407910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x470e2e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4934a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x30]
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], edi
mov dword [edi], vtable.boost::exception.0
mov byte [esp + 0x1c], 0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40797a
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test al, al
je 0x40797a
mov dword [edi + 4], 0
mov dword [esp + 0x1c], 0xffffffff
mov ecx, esi
call fcn.00408ae0
test byte [esp + 0x24], 1
je 0x407999
push esi
call fcn.0041dcac
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x409240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409259
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409292
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40928e
lea ebx, [ebx]
cmp esi, eax
jae 0x409292
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x409280
cmp esi, eax
jb 0x409298
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret