joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51dea0
Capabilities:
Terminate process

Disassembly:
test byte [0x5cc2e8], 0x20
jne 0x51debe
vmovq xmm0, xmm0
vcvttpd2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
mov ecx, esp
add esp, 0xfffffff8
and esp, 0xfffffff8
movsd qword [esp], xmm0
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov esp, ecx
btr edx, 0x1f
sbb ecx, ecx
cmp edx, 0x41e00000
jae 0x51df1e
cvttsd2si eax, xmm0
cdq
ret
mov ecx, edx
bts edx, 0x14
shr ecx, 0x14
and edx, 0x1fffff
sub ecx, 0x433
jge 0x51df18
neg ecx
push ebx
xor ebx, ebx
shrd ebx, eax, cl
je 0x51df11
cvttss2si ebx, dword [0x532bec]
pop ebx
shrd eax, edx, cl
shr edx, cl
ret
shld edx, eax, cl
shl eax, cl
ret
cmp edx, 0x43e00000
jae 0x51df37
test ecx, ecx
je 0x51dee8
call 0x51dee8
neg eax
adc edx, 0
neg edx
ret
jecxz 0x51df3f
ja 0x51df3f
test eax, eax
je 0x51df47
cvttss2si ecx, dword [0x532be8]
mov edx, SysReAllocStringLen
xor eax, eax
ret

Function at 0x51e623
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51e662
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51e662
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51e662
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51e662
cmp dword [ecx + 0x74], 0xe
jbe 0x51e662
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x52adc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52aded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52aded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x5f0523e3
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x5a3b5c2d
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x408a6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x408a90
cmp dword [edi + 0x54], 0
jne 0x408a90
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040ac71
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00408a2d
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4091cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x409214
call fcn.0040ac71
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x409214
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x409257
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x409240
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x409240
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x409254
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x410153
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41019a
call fcn.0040ac71
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41019a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4101b6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040fccd
mov esi, eax
test edi, edi
je 0x4101b4
test ebx, ebx
je 0x4101b4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41411a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x414155
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41413c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x41414d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x414157
inc edi
add eax, 0x28
cmp edi, esi
jb 0x414132
xor eax, eax
pop edi
pop esi
ret
Function at 0x41417f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004140b8
inc ebx

Function at 0x41418c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebx
lcall 0x5eff, 0xffff46e8
jge 0x414211
salc
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.004140da
arpl word [edi + 0x6d], ax
outsd dx, dword [esi]
push esi
push ebx
call fcn.0041411a
pop ecx
test eax, eax
pop ecx
je 0x41426d
push edi
push esi
push ebx
call fcn.0041415a
add esp, 0xc
call fcn.004140da
adc al, 0x4e
pop ebp
xchg esp, eax
mov esi, dword [esi + 0x78]
test esi, esi
je 0x41426d
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.004140da
and edi, dword [eax + 0x58]
mov eax, dword [0x320468b]
invalid
invalid
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414482
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004140ea
push eax
push esi
push dword [ebp + 8]
call fcn.0041409f
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004140ea
push eax
push esi
push dword [ebp + 8]
call fcn.0041409f
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004140ea
push eax
push esi
push dword [ebp + 8]
call fcn.0041409f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004140da
fsubr qword [ebp - 0x60]
aad 0x88
popfd
jl 0x41455f
invalid
invalid
Function at 0x4149a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x3335b], al
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004140ea
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041409f
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9

Function at 0x414ab1
Capabilities:
Encode data using xor

Disassembly:
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.004140ea
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041409f
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004140da
imul edi, dword [ebx], 3
xchg esp, eax
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.004140ea
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041409f
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.004140da
xor dword [edx + 0x5b], edi
jb 0x414b68
movsd dword es:[edi], dword [esi]
pushfd
stc
invalid

Function at 0x422396
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4495f8]
jne 0x4223a0
repz ret
jmp fcn.00428c3c
Function at 0x43321e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042862a
and dword [ebp - 4], 0
cmp dword [0x44d4b8], 0
mov ebx, eax
jne 0x4332cf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x433380
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43f0e8
push edi
call esi
test eax, eax
je 0x433380
push eax
call fcn.004285b8
mov dword [esp], 0x43f0d8
push edi
mov dword [0x44d4b8], eax
call esi
push eax
call fcn.004285b8
mov dword [esp], 0x43f0c4
push edi
mov dword [0x44d4bc], eax
call esi
push eax
call fcn.004285b8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44d4c0], eax
call esi
push eax
call fcn.004285b8
pop ecx
mov dword [0x44d4c8], eax
test eax, eax
je 0x4332cf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004285b8
pop ecx
mov dword [0x44d4c4], eax
mov eax, dword [0x44d4c4]
cmp eax, ebx
je 0x433327
cmp dword [0x44d4c8], ebx
je 0x433327
push eax
call fcn.00428633
push dword [0x44d4c8]
mov esi, eax
call fcn.00428633
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x433327
test edi, edi
je 0x433327
call esi
test eax, eax
je 0x43331e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43331e
test byte [ebp - 0xc], 1
jne 0x433327
or dword [ebp + 0x10], 0x200000
jmp 0x433360
mov eax, dword [0x44d4bc]
cmp eax, ebx
je 0x433360
push eax
call fcn.00428633
pop ecx
test eax, eax
je 0x433360
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x433360
mov eax, dword [0x44d4c0]
cmp eax, ebx
je 0x433360
push eax
call fcn.00428633
pop ecx
test eax, eax
je 0x433360
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44d4b8]
call fcn.00428633
pop ecx
test eax, eax
je 0x433380
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x433382
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x8a900fb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x43b9035d
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x100016bc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100016bc
mov ecx, dword [esi + 0x3cc]
xor edx, edx
div ecx
mov dword [ebp - 4], eax
test edx, edx
jne 0x100016bc
mov edx, dword [ebp + 0x14]
push ebx
push edi
cmp edx, 1
jne 0x10001618
mov edi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x14], edx
mov dword [ebp - 4], edi
mov dword [ebp + 8], ebx
test eax, eax
je 0x100016ba
lea ebx, [esi + 0x3f4]
nop
cmp byte [esi + 4], 0
mov eax, ebx
je 0x100015d5
xor edx, edx
test ecx, ecx
jle 0x100015d5
sub edi, ebx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x100015c0
mov edi, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100016d0
push dword [esi + 0x3cc]
push dword [ebp + 8]
push ebx
call fcn.1002d510
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
add edi, ecx
div ecx
inc dword [ebp + 0x14]
add esp, 0xc
add dword [ebp + 8], ecx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], eax
jb 0x100015b0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 2
jne 0x10001687
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ebx
jbe 0x100016ba
lea eax, [esi + 0x3f4]
push edi
push eax
mov ecx, esi
call fcn.100016d0
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.10001d90
push dword [esi + 0x3cc]
lea eax, [esi + 0x3f4]
push edi
push eax
call fcn.1002d510
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
inc ebx
div ecx
add dword [ebp + 8], ecx
add esp, 0xc
add edi, ecx
cmp ebx, eax
lea eax, [esi + 0x3f4]
jb 0x10001637
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], edi
jbe 0x100016ba
push eax
push ebx
mov ecx, esi
call fcn.100016d0
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
inc edi
div ecx
add dword [ebp + 8], ecx
add ebx, ecx
cmp edi, eax
mov eax, dword [ebp + 8]
jb 0x10001697
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002f80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, dword [ebp + 8]
xor bl, bl
cmp dword [edi + 0x10], 0
je 0x100030ba
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x100030b1
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10002faf
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
test eax, eax
je 0x100030b1
push 0x1007076c
push eax
call fcn.100168ed
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x100030b1
cmp dword [esi + 0x14], 0x10
jb 0x10002fe5
mov esi, dword [esi]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10003097
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10056684
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10003097
mov eax, dword [ebp - 0xc]
push 0x1007076c
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 4], ecx
call fcn.100168ed
mov esi, eax
add esp, 8
test esi, esi
je 0x10003099
cmp dword [edi + 0x14], 0x10
jb 0x10003049
mov edi, dword [edi]
push edi
push dword [ebp - 4]
push str.StringFileInfo_08lx_s
push 0x80
push esi
call fcn.100030f0
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10003093
mov edx, dword [ebp - 0x14]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003080
sub ecx, edi
push ecx
mov ecx, dword [ebp + 0x10]
push edx
call fcn.10001e90
mov bl, 1
jmp 0x10003099
xor esi, esi
push dword [ebp + 8]
call fcn.100168b9
add esp, 4
test esi, esi
je 0x100030b1
push esi
call fcn.100168b9
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004520
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
xor al, al
push esi
mov esi, ecx
mov byte [ebp - 1], al
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10004534
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004555
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
xor ecx, ecx
lea edi, [esi + 1]
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100168b0
add esp, 4
mov ebx, eax
test edi, edi
je 0x1000458d
mov ecx, edi
xor eax, eax
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edi, [esi + 1]
push dword [ebp + 8]
push edi
push ebx
call fcn.10031eff
add esp, 0xc
xor edi, edi
nop dword [eax]
movzx eax, word [ebx + edi*2]
cmp eax, 0x5c
je 0x100045ae
cmp eax, 0x2f
jne 0x100045ef
mov dword [ebp - 0xc], eax
xor eax, eax
push ebx
mov word [ebx + edi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100045e8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10004607
mov eax, dword [ebp + 0xc]
mov byte [ebp - 1], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x100045e8
mov dword [ebp - 8], ebx
lea edx, [ebp - 8]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov eax, dword [ebp - 0xc]
mov word [ebx + edi*2], ax
inc edi
cmp edi, esi
jbe 0x100045a0
push ebx
call fcn.100168b9
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov byte [ebp - 1], 0
call fcn.100168b9
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004720
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1006e090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.1002da90
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
add esp, 0xc
or ecx, 0x8000
cmp byte [ebp + 0x10], 0
cmove ecx, dword [ebp + 0xc]
push eax
push 0
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x100047a0
xor eax, eax
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001689f
mov esp, ebp
pop ebp
ret
xor eax, eax
lea ecx, [ebp - 0x20c]
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100047b0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10002af0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1001689f
mov esp, ebp
pop ebp
ret
Function at 0x10004a60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1006e090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10004aec
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.1002da90
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10004aec
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10004ae5
nop dword [eax]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.10038c0a
add esp, 8
test eax, eax
je 0x10004afe
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10004ac0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001689f
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
xor ecx, ebp
pop edi
pop esi
call fcn.1001689f
mov esp, ebp
pop ebp
ret