joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ca47
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1007dff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x1007f3c8]
push 0
lea ecx, [esp + 0x20]
call fcn.00552283
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0051c3a7
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.005521b1
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0054ea8c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0054ea8c
push 1
push 0
push 0
mov ecx, esi
call fcn.0054ea34
push 1
push 0
push 1
mov ecx, esi
call fcn.0054ea34
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005522f5
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x51cbc7
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1007e018
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00552283
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0051c3a7
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.005521b1
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x1007f3c8]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x51cc8b
cmp dword [esp + 0x40], 1
jne 0x51cc89
cmp ecx, eax
jge 0x51cc8b
mov eax, ecx
cmp eax, 0xc8
jge 0x51cc97
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0051ca47
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x1007f3cc]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005522f5
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x51d487
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1007e0c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0054cec3
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x1009bd90
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x1009bcd8
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x1007f0b0]
push eax
mov ecx, edi
call fcn.0055252b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00553a47
test eax, eax
je 0x51d5a3
mov ecx, dword [esp + 0x3c]
call fcn.00552558
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x1007f3a0]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x51d567
push edi
mov ecx, esi
call fcn.0054fba2
mov ecx, esi
call fcn.0051d747
cmp dword [esp + 0x38], 1
jne 0x51d59c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0054fcdd
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x51f797
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x51f7ca
push esi
call fcn.0052db47
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x51f7c3
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x51f850
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x51f839
mov eax, dword [esi + 8]
test eax, eax
je 0x51f7ee
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x51f835
cmp eax, 2
je 0x51f839
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x51f7e1
cmp eax, 3
je 0x51f814
cmp eax, 1
jne 0x51f7e1
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x51f7e1
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x51f7e1
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0051f877
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x51f85f
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0051f877
add esp, 4
pop esi
ret
Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x405091

Function at 0x40507d
Capabilities:
Read file on windows

Disassembly:
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4063a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
or eax, 0xffffffff
lea ecx, [ebp - 0x28]
push edi
invalid
invalid
inc ebp
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
dec esp
and al, 4
push esi
push edi
test al, 1
je 0x40b536
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420ff6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b68a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x40a10a
or eax, 1
mov dword [0x4c7488], 0
push 0x43b83c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422f80
add esp, 4
jmp 0x40a01f
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x40a064

Function at 0x40fe40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
fst dword [edi - 0x75]
jge 0x40fe67
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
Function at 0x45eb07
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
call dword [0x48f1b4]
mov dword [ebp - 0xc], eax
xor ecx, ecx
push 2
add eax, 6
pop ebx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
pop ecx
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, ebx
mov ebx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0x7c
cmp dword [ebp - 0xc], ecx
jle 0x45ec8b
push 0x20
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0x28
jmp 0x45eb69
inc ecx
cmp word [edi + ecx*2], dx
je 0x45eb68
movzx edx, word [edi + ecx*2]
cmp dx, word [ebp - 0x10]
je 0x45eb91
mov eax, dword [esi + 4]
inc ecx
push 0x20
mov word [eax + ebx*2], dx
inc ebx
movzx edx, word [edi + ecx*2]
pop eax
cmp dx, ax
jne 0x45eb79
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0x7c
pop edx
push 0x20
mov word [eax + ebx*2], dx
inc ebx
pop eax
jmp 0x45eba6
inc ecx
cmp word [edi + ecx*2], ax
je 0x45eba5
jmp 0x45ebc0
cmp dx, word [ebp - 0x14]
je 0x45ebc9
mov eax, dword [esi + 4]
inc ecx
push 0x20
mov word [eax + ebx*2], dx
inc ebx
pop eax
movzx edx, word [edi + ecx*2]
cmp dx, ax
jne 0x45ebae
mov eax, dword [esi + 4]
push 0x3b
pop edx
push 0x20
mov word [eax + ebx*2], dx
inc ebx
pop eax
jmp 0x45ebda
inc ecx
cmp word [edi + ecx*2], ax
je 0x45ebd9
mov edx, dword [ebp - 0x14]
cmp word [edi + ecx*2], dx
jne 0x45ebea
inc ecx
cmp word [edi + ecx*2], ax
je 0x45ebe9
xor edx, edx
inc edx
jmp 0x45ebf9
pop eax
jmp 0x45ebf9
inc ecx
cmp word [edi + ecx*2], ax
je 0x45ebf8
jmp 0x45ec2c
cmp ax, word [ebp - 0x10]
jne 0x45ec11
push 0x20
pop eax
inc ecx
cmp word [edi + ecx*2], ax
je 0x45ec0a
movzx eax, word [edi + ecx*2]
mov dword [ebp - 0x2c], eax
cmp eax, 0x29
je 0x45ec3d
mov eax, dword [esi + 4]
inc ecx
mov edi, dword [ebp - 0x2c]
mov word [eax + ebx*2], di
inc ebx
mov edi, dword [ebp + 8]
movzx eax, word [edi + ecx*2]
push 0x3b
pop edi
cmp ax, di
mov edi, dword [ebp + 8]
jne 0x45ec01
jmp 0x45ec42
xor eax, eax
inc ecx
mov edx, eax
push 0x20
pop eax
jmp 0x45ec48
inc ecx
cmp word [edi + ecx*2], ax
je 0x45ec47
mov eax, dword [esi + 4]
test edx, edx
jne 0x45ec59
push 0xa
jmp 0x45ec5b
push 0x3b
pop edi
mov word [eax + ebx*2], di
inc ebx
mov edi, dword [ebp + 8]
push 0x3b
pop eax
cmp word [edi + ecx*2], ax
jne 0x45ec6e
inc ecx
xor eax, eax
inc eax
push 0x20
cmp edx, eax
je 0x45ebf5
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
pop edx
cmp ecx, dword [ebp - 0xc]
jl 0x45eb69
xor ecx, ecx
push 3
pop edx
cmp dword [esi + 0x24], ecx
je 0x45ec9a
add eax, edx
mov dword [ebp - 8], eax
xor ecx, ecx
push 4
pop edi
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
mov dword [esi + 8], eax
xor ecx, ecx
mov eax, dword [ebp - 8]
push 0x1c
pop edx
mul edx

Function at 0x469393
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
std
call [esi + 0x3d]
add byte [ecx - 0x7b], bl
sar byte [ebp + eax - 0x48], 0
lea eax, [ebp + 0x18b57f0]
Function at 0x486656
Capabilities:
Encode data using xor

Disassembly:
add al, byte [eax]
or eax, 0x7d8b2810
add byte [0x7d8b2810], cl
push eax
mov eax, dword [0x8d4c6824]
push 0xb8048bf0
mov eax, dword [eax]
push dword [eax]
ja 0x486655
adc ch, dh
test byte [eax], ah
pop edi
adc al, 4
mov dword [eax], ecx
add bh, bh
mov dword [esp + ebp + 0x49], esi
sub byte [ebx + 0x375fff8], al
push 2
pop eax
cmp eax, 0x10
jge 0x48668d
or eax, 2
mov ecx, dword [ebp + 0x20]
push esi
mov esi, 0x8d0c5196
mov edi, ecx
push dword [ebp + 2]
push eax
mov ecx, dword [ebx - 0x57cdbab]
push dword [ebp + 2]
push eax
salc
cmp dword [ebp + 0x30], 0
jge 0x4866b1
xor al, al
jmp 0x48671f
push ebx
pop edi
ja 0x4866cc
adc al, 0xf
invalid
push 0x4bb80c
push ebx
push eax
call 0xb6c54ee0
test dword [esi + 0xc], 0xfff1f80c
adc eax, 0x57384689
push ebx
mov ebx, dword [0x2084f688]
push 0x467
push eax
call ebx
push eax
call 0xff9f94af
adc eax, 0xebfffa28
test eax, eax
je 0x486724
sal byte [edx - 1], 0x75
xor byte [eax + 0x68], dl
add al, 0
add bh, bh
call ebx
push dword [ebp + 0x30]
push eax
push 0x467
push dword [esi]
call ebx
push eax
call 0x374778cb
ja 0x4866ff
cmp al, 0xf6
test byte [eax], ah
xor al, al
invalid
pop edi
pop ebx
xor esi, ebp
clc
sub al, 0
cmp dword [0x4c67b8], 0
jne 0x486739
mov eax, 0x110a75
mov word [esi - 0x74f7ff7a], ax
mov al, 1
jmp 0x48671d

Function at 0x4869fa
Capabilities:
Encode data using xor

Disassembly:
push dword [edi]
call esi
cmp dword [0x4c67b8], ebx
jne 0x486a12
mov ecx, 0x110275
mov word [edi - 0x74f7ff7a], cx
mov al, 1
pop edi
xor eax, eax
cmc
clc
sub byte [eax], al
dec dword [ecx + 0x7d835174]
adc al, 0xff
clc
xor esi, dword [ebp + 0x3f]
mov ecx, dword [ebx + 0xc7d8b56]
cmp dword [esi + 0x50107da0], 0
jne 0xc2487be7
ja 0x486a24
adc bh, dh
dec eax
add dword [ecx + 0x107da086], ecx
push eax
mov dword [esi + 0x50107da4], eax
mov dword [edi + 0xc], eax
cmp dword [esi + 0x50107da0], 0
jne 0x474bd4e7
xor al, al
pop edi
xor ecx, dword [ebx + 0x10890440]
xor ecx, dword [ebp - 0x4f4603bb]
dec esp
add byte [eax + 0x10], dl
xor ebx, ebx
push eax
dec eax
add al, 0x14
call 0x58402423
push 0x8bdd74b8
dec ebp
or byte [ecx - 0x72b397f0], ah
mov esi, dword [ebp - 4]
push ds
add al, 0x88
mov edi, dword [0xa1144589]
and al, 0x68
dec esp
lea ecx, [ebx + 0x88bb004]
mov al, byte [ecx + 0x28100290]
cmp al, 0xe
je 0x486a5c
cmp al, 0xf
je 0x486a5c
cmp al, 2
je 0x486a5c
cmp al, 3
je 0x486a5c
cmp dword [ecx + 0xc], 0
jne 0x486a5c
ja 0x486aa2
adc bh, dh
dec eax
add eax, edi
jle 0x486ac3
mov ecx, dword [ebp + 0x14]
mov dword [edi + 0xc], eax
mov dword [ecx + 0x50107da4], eax
mov eax, dword [0x8d4c6824]
mov eax, dword [eax + esi*4]
invalid
adc al, 0x89
inc edi
or al, 0x89
and dword [ebp + edi*2 + 0x24a15010], 0x8b8d4c68
add al, 0xb0
invalid
mov ecx, dword [eax]
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
cmp dword [edi + 0xc], 0
xor eax, dword [ebp + esi*2 - 0x3900af10]
Function at 0x48e485
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or dword [ecx], ecx
or dword [0xf8050505], eax
sbb al, 0xf
test dword [0xb010505], eax
or ecx, dword [ebx]
or ecx, dword [edx + eax]
dec dword [ecx - 0x768b768c]
mov dword [ecx + 0x1018989], ecx
add dword [ecx], eax
add dword [ecx + 0x10d8989], ecx
or eax, 0xd010d01
add dword [edx - 0x47], edx
mov al, 1
add eax, 0x73ff0974
push ebx
call 0x1942be1f
cli
mov esi, dword [ebx]
cmp esi, edi
ja 0x894f736b
or al, 0xc
cld
and byte [eax], 0xc
dec ebp
adc dh, al
mov ecx, 0x4d0c2080
cdq
idiv ecx
clc
add al, 0x80
inc eax
cmp ecx, dword [ebx]
shl eax, 7
add eax, edx
movzx ecx, word [eax*2 + 0x2e4a5840]
movzx eax, byte [ecx*8 + 0x4a2f53]
push dword [edi + 0x75]
pushal
mov ecx, dword [ecx*8 + 0x4a2f54]
add ecx, esi
sbb al, 0xff
jne 0x48e524
inc esi
cmp esi, edi
jbe 0x48e4d5
cmp esi, edi
ja 0x48e56b
add byte [ebp + 8], 0x89
or bl, ch
xor dword [ebx + 0x7df799c6], ecx
cld
mov eax, esi
cdq
idiv dword [ebp - 4]
clc
add al, 0x80
inc eax
cmp ecx, dword [ebx]
shl eax, 7
add byte [eax + 0x3b], 0x4b
add cl, al
loopne 0x48e533
add eax, edx
movzx eax, word [eax*2 + 0x2e4a5840]
cmp byte [eax*8 + 0x4a2f53], 0
pop eax
dec edx
cmp byte cs:[eax*8 + 0x4a2f53], 0
jne 0x48e553
mov eax, dword [eax*8 + 0x4a2f54]
add eax, esi
cmp eax, ecx
jne 0x48e553
inc ecx
inc esi
cmp esi, edi
jbe 0x48e51c
sub esp, 0x53
dec ecx
mov dword [ebx], esi
mov dword [eax], ecx
xor eax, eax
jmp 0x48e56e
add cl, ch
call [edi + 0x7b]
inc esp
pop edi
jnp 0x48e5b5
add byte [ebx + 0x974c303], cl
inc dword [ebx - 0x17acaf14]
je 0x48e5e7
stc
mov ebx, edx
mov dword [ebp - 8], edi
mov esi, dword [edi]
add esi, 2
movzx eax, word [esi]
mov cx, word [ecx]
je 0x48e5c8
xor edx, edx
mov dword [ebx], edx
cmp eax, 0x7b
jne 0x48e5e5
cmp word [esi + 2], 0x5e
jne 0x48e5ab
mov dword [ebx], 0xe847002c
sub al, dh
add cl, byte [ebx + 0x2c683c2]
mov eax, edx
add esi, 2
movzx ecx, word [esi]
test cx, cx
leave
je 0x48e5c8
cmp ecx, 0x7d
je 0x48e5dc
mov word [ebp + eax*2 - 0x50], cx
inc eax
cmp eax, 0x1f
jl 0x48e5ad
jmp 0x48e5fc
xor ecx, ecx
mov word [ebp + eax*2 - 0x50], cx
jmp 0x48e5ef
mov word [ebp - 0x50], ax
mov word [esi - 0x474dba7a], ax
inc ebp
mov al, 0x66
mov dword [esi - 0x474dba7a], eax
mov eax, 0x1b0ec
mov dword [edi], esi
add al, 0
push 0x8d100c04
inc ebp
mov al, 0xd1
stc
in al, dx
mov al, 1
add byte [ecx + 0x68000437], cl
add al, 0xc
adc byte [ebp - 0x62e4fbb], cl
lea eax, [ebp - 0x50]
sar ecx, 1
js 0x48e66b
imul eax, ecx, 6
movzx ebx, word [eax + 0x4b8f80]
add ebx, 0xb84b8a20
int3
Function at 0x7c12317d
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x7c123188
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x7c127623
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x7c12765e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x7c127645
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x7c127656
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x7c127660
inc edi
add eax, 0x28
cmp edi, esi
jb 0x7c12763b
xor eax, eax
pop edi
pop esi
ret

Function at 0x7c129efc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
call sym.ATL71.DLL_AtlAxWinInit
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push dword [esp + 0x24]
xor ebp, ebp
push esi
mov dword [esp + 0x1c], ebp
call edi
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x7c129fcc
push ebx
push 0xf0
push dword [esp + 0x28]
push esi
call edi
cmp eax, ebp
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [sym.imp.KERNEL32.dll_LockResource]
je 0x7c129f52
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x7c129fb0
push eax
call ebx
mov edi, eax
test edi, edi
je 0x7c129fb0
push ebp
push edi
call fcn.7c124114
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x7c129f9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x7c129fba
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x7c129fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop ebx
je 0x7c129fcc
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x7c129fd7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
call sym.ATL71.DLL_AtlAxWinInit
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 5
push dword [esp + 0x24]
xor ebp, ebp
push esi
mov dword [esp + 0x1c], ebp
call edi
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x7c12a0a7
push ebx
push 0xf0
push dword [esp + 0x28]
push esi
call edi
cmp eax, ebp
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [sym.imp.KERNEL32.dll_LockResource]
je 0x7c12a02d
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x7c12a08b
push eax
call ebx
mov edi, eax
test edi, edi
je 0x7c12a08b
push ebp
push edi
call fcn.7c124114
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x7c12a077
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x7c12a095
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x7c12a095
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop ebx
je 0x7c12a0a7
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x7c12c7ea
Capabilities:
Terminate process

Disassembly:
push 0x11c
push 0x7c12fd78
call fcn.7c12c9a0
mov eax, dword [0x7c133774]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x7c133b54]
test eax, eax
je 0x7c12c82a
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x7c12c934
mov eax, dword [ebp + 8]
dec eax
je 0x7c12c846
mov ebx, str.Unknown_security_failure_detected_
mov dword [ebp - 0x12c], str.A_security_error_of_unknown_cause_has_been_detected_which_has_ncorrupted_the_programs_internal_state.__The_program_cannot_safely_ncontinue_execution_and_must_now_be_terminated._n
mov edi, 0xd4
jmp 0x7c12c85a
mov ebx, str.Buffer_overrun_detected_
mov dword [ebp - 0x12c], str.A_buffer_overrun_has_been_detected_which_has_corrupted_the_programs_ninternal_state.__The_program_cannot_safely_continue_execution_and_must_nnow_be_terminated._n
mov edi, 0xb9
mov byte [ebp - 0x20], 0
push 0x104
lea eax, [ebp - 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c12c889
push str._program_name_unknown_
lea eax, [ebp - 0x124]
push eax
call fcn.7c12d010
pop ecx
pop ecx
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], eax
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 0xb
cmp eax, 0x3c
jbe 0x7c12c8d0
lea eax, [ebp - 0x124]
push eax
call esi
lea ecx, [ebp - 0x124]
sub ecx, 0x31
add eax, ecx
mov dword [ebp - 0x128], eax
push 3
push 0x7c12fbc4
push eax
call fcn.7c12cb00
add esp, 0xc
push dword [ebp - 0x128]
call esi
lea eax, [eax + edi + 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.7c12ce40
mov dword [ebp - 0x18], esp
mov edi, esp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x7c12fbc0
push ebx
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push str.Program:
push edi
call esi
push dword [ebp - 0x128]
push edi
call esi
push ebx
push edi
call esi
push dword [ebp - 0x12c]
push edi
call esi
push 0x12010
push 0x7c12fb8c
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]