joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x800
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004064ef
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x4065c0
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and word [esi + 0x7fe], 0
test edi, edi
pop edi
jne 0x4065c0
cmp dword [ebp + 0xc], 1
je 0x4065c4
cmp dword [ebp + 0xc], 2
je 0x4065c4
and word [esi], 0
pop esi
leave
ret 0x14
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2b3513a7
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x19a27db6
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405ac9
Capabilities:
Delete file
Set file attributes

Disassembly:
add dword [esi - 0x48], edx
or bh, bh
cwde
aam 0x80
inc eax
add bl, ch
push es
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405ae4
idiv byte [0xf611ed40]
inc esp
and al, 0x10
add al, 0xb3
or bh, cl
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebp, edx
pop edi
and dl, al
aaa
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
test byte [esp + 0x10], 4
mov bl, 8
iretd
pop ds
in al, dx
pop eax
xchg esi, eax
add byte [eax], al
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
jl 0x405b58
cld
call 0x72205dc5
test bl, 8
mov esi, eax
clc
je 0x405b39
retf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b53
test eax, eax
dec ebx
les ebx, [edx]
add dword [eax], eax
add byte [edi - 0x3d], dh
add ch, byte [edx + 0x11184]
add byte [eax + 0x425730], bh
mov eax, 0x425730
push edi
push esi
salc
mov dword [eax], ecx
cmp al, 0
cmp dword [ebp + 8], 0xffffffc9
inc esi
or eax, 0x15a57c68
add byte [esi + 0x4b], dl
xchg esp, eax
or byte [eax], al
add bl, ch
push es
push edi
call 0x4a405cf8
cmp word [edi], 0
jne 0x405bcd
adc word [eax + 0x425730], 0x5c
fimul dword [ebx]
push 0x16a014
push edi
call 0xc7409404
push edi
mov byte [0x865], al
lea ebx, [esp + ebx*4]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [esi]
cmp byte [edi - 0xf748cc0], ah
cmp esi, 0xffffffff
je 0x405c59
add word [esi], 0xffd4
std
invalid
std
invalid
cmp dword [ebp + 0x47], 0
je 0x405c64
add byte [ebp + eax + 0x66], dh
add dword [edi - 0x983ff02], 0x39
add word [edi - 0x983ff02], 0x39
jl 0x405c5c
cmp dword [ebp + 8], esi
jne 0x405c71
je 0x405cb6
jne 0x405c66
jne 0x405c78
inc dword [0xd942a2e8]
add eax, 0xd942a2e8
jmp 0x405cb6
push edi
call 0x81672b
cmp al, al
je 0x405cb6
push edi
cmp dh, byte [0x8b00aa00]
sub al, 0xfc
inc ebp
add dword [eax - 0x2c], edx
call 0xff6a5ab2
test eax, eax
cwde
push ss
cmp dword [ebp - 4], esi
je 0x405c70
push edi
jmp 0x37ec4594
pop edi
pop esi
fldenv [ebx - 0x3e]
push 0xfffffffffffffff8
Function at 0x406348
Capabilities:
Query or enumerate registry value

Disassembly:
jne 0x40632c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc ebx
sbb byte [ebx - 0x49ea0008], cl
clc
call dword [0x4080b6]
outsw dx, word [esi]
cmpsb byte [esi], byte es:[edi]
push es
pop es
add byte [eax], al
add byte [ebx], bh
and dword [edi + 0x75], ebx
or al, 0x83
jge 0x406329
add esi, edi
mov word [ebx + 0x74020c7d], es
add al, 0x66
int1
add byte es:[esi - 0x37], bl
add byte [esi - 0x37], bl
ret 0x14
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 9
push ebx
push esi
cmp word [ecx], 0x2d
test dword [edx], ecx
pop eax
mov dword [esi], 0x1b2
push es
mov dl, 1
add byte [eax], al
add byte [edx + 0x39], ch
pop ebx
jne 0x4062fa
inc ecx
inc ecx
or dword [ebp - 8], 0xffffffff
cmp word [ecx], 0x30
jne 0x40639c
inc ecx
inc ecx
cmp al, 0xa1
cmp edx, 0x30
pushfd
or al, 0x66
cmc
std
aaa
ja 0x406382
push 8
pop eax
push 0x37
pop ebx
movzx edx, dx
sbb ah, dl
fild word [edx - 0x508aa706]
pop eax
jne 0x406346
push 0xffffffffffffffce
inc ecx
pop eax
inc ecx
salc
mov bh, 0xed
mov ah, 0xed
mov ch, 0xfa
xor byte [esp + ecx + 0xf], bh
mov bh, 0xaa
cmp edx, esi
jg 0x4063b2
daa
ljmp 0x1096
xchg si, ax
adc cl, ch
jne 0x4063db
mov esi, edx
and esi, 0xffffffdf
cmp esi, 0xffffffbd
invalid
jl 0x4063db
cmp esi, 0x46
jg 0x4063db
cmp esi, 7
adc dword [0xf06c0f09], 0xffffffe7
out 0xaf, eax

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1af62525
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x577a4154
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x40fd50
push 0x402990
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x411050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
call fcn.00401070
test eax, eax
je 0x4011dc
lea edi, [eax + 0x4120c0]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x12800
push 0x4120c0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4011dc
call edi
test eax, eax
je 0x4011c5
lea ecx, [ebp - 0x28]
push ecx
push 6
push 0
call eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 0x12800
push 0x4120c0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x4011fa
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00401552
mov esp, ebp
pop ebp
ret
Function at 0x401220
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x3a0043
push eax
mov dword [ebp - 0x4c], 0x4d005c
mov dword [ebp - 0x48], 0x6c0061
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x790062
mov dword [ebp - 0x38], 0x650074
mov dword [ebp - 0x34], 0x4c0073
mov dword [ebp - 0x30], 0x420041
mov dword [ebp - 0x2c], 0x73
mov dword [ebp - 0x28], 0x650048
mov dword [ebp - 0x24], 0x6c006c
mov dword [ebp - 0x20], 0x2c006f
mov dword [ebp - 0x1c], 0x4d0020
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x650063
mov dword [ebp - 0x10], 0x6f006c
mov dword [ebp - 0xc], 0x3a0020
mov dword [ebp - 8], 0x29
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4012e5
push 0x40
push 0x40fce0
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x4e]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0
mov dword [ebp - 0x7c], 2
mov dword [ebp - 0x78], 5
mov dword [ebp - 0x74], 0x22
mov dword [ebp - 0x70], 3
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x68], 9
mov dword [ebp - 0x64], 0x18
mov dword [ebp - 0x60], 0xa
mov dword [ebp - 0x5c], 0xb
mov dword [ebp - 0x58], 0x13
mov dword [ebp - 0x54], 0xf
call dword [sym.imp.KERNEL32.dll_OpenProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x401351
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
xor edx, edx
jmp 0x401360
movzx ecx, byte [ebp + eax*4 - 0x7c]
inc eax
xor byte [edx + 0x4120c0], cl
xor ecx, ecx
cmp eax, 0xb
cmove eax, ecx
movzx ecx, byte [ebp + eax*4 - 0x7c]
inc eax
xor byte [edx + 0x4120c1], cl
xor ecx, ecx
cmp eax, 0xb
cmove eax, ecx
movzx ecx, byte [ebp + eax*4 - 0x7c]
inc eax
xor byte [edx + 0x4120c2], cl
xor ecx, ecx
cmp eax, 0xb
cmove eax, ecx
movzx ecx, byte [ebp + eax*4 - 0x7c]
inc eax
xor byte [edx + 0x4120c3], cl
xor ecx, ecx
cmp eax, 0xb
cmove eax, ecx
add edx, 4
cmp edx, 0x12800
jb 0x401360
call fcn.00401130
push 0
test eax, eax
jne 0x40134b
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x404d5a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00402ffc
mov dword [ebp - 0x14], eax
cmp dword [0x425610], esi
jne 0x404e4d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x404dda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x404f2d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x404f2d
push 0x40d320
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404f2d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x425610], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x425614], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x425618], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x425620], eax
test eax, eax
je 0x404e4a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42561c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404e72
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404e65
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x404e87
push 4
pop eax
jmp 0x404f2f
cmp dword [ebp - 0x14], esi
je 0x404e87
push dword [0x425610]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x404e6c
mov eax, dword [0x42561c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x404ee5
cmp dword [0x425620], edi
je 0x404ee5
push eax
call ebx
push dword [0x425620]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x404ee5
test eax, eax
je 0x404ee5
call ecx
test eax, eax
je 0x404eda
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x404eda
test byte [ebp - 8], 1
jne 0x404ee5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x404f15
mov eax, dword [0x425614]
cmp eax, edi
je 0x404f12
push eax
call ebx
test eax, eax
je 0x404f12
call eax
mov esi, eax
test esi, esi
je 0x404f12
mov eax, dword [0x425618]
cmp eax, edi
je 0x404f12
push eax
call ebx
test eax, eax
je 0x404f12
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x425610]
call ebx
test eax, eax
je 0x404f2d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x404f2f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401552
mov esp, ebp
pop ebp
ret
Function at 0x40c838
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407077
mov dword [ebp - 0x14], eax
cmp dword [0x446eb4], esi
jne 0x40c92b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c8b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ca0b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ca0b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ca0b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x446eb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x446eb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x446ebc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x446ec4], eax
test eax, eax
je 0x40c928
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x446ec0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c950
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c943
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c965
push 4
pop eax
jmp 0x40ca0d
cmp dword [ebp - 0x14], esi
je 0x40c965
push dword [0x446eb4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c94a
mov eax, dword [0x446ec0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9c3
cmp dword [0x446ec4], edi
je 0x40c9c3
push eax
call ebx
push dword [0x446ec4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9c3
test eax, eax
je 0x40c9c3
call ecx
test eax, eax
je 0x40c9b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c9b8
test byte [ebp - 8], 1
jne 0x40c9c3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9f3
mov eax, dword [0x446eb8]
cmp eax, edi
je 0x40c9f0
push eax
call ebx
test eax, eax
je 0x40c9f0
call eax
mov esi, eax
test esi, esi
je 0x40c9f0
mov eax, dword [0x446ebc]
cmp eax, edi
je 0x40c9f0
push eax
call ebx
test eax, eax
je 0x40c9f0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x446eb4]
call ebx
test eax, eax
je 0x40ca0b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ca0d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f8b
mov esp, ebp
pop ebp
ret
Function at 0x40109e
Capabilities:
Print debug messages

Disassembly:
push esi
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
mov esi, section..data
push esi
call dword [sym.imp.USER32.dll_wvsprintfA]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x200010
push str.TSU_Loader
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret

Function at 0x40112f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x401204
push ebx
call section..text
mov ebx, eax
push ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4011fa
push esi
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push ebx
call esi
test eax, eax
je 0x4011f9
cmp dword [ebp - 4], 4
jb 0x4011f9
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x90]
push str.StringFileInfo_04x_04xArguments
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
call esi
test eax, eax
je 0x4011f9
cmp dword [ebp - 8], edi
je 0x4011f9
mov eax, dword [ebp - 4]
test eax, eax
je 0x4011f9
lea ecx, [eax + eax + 2]
call section..text
push dword [ebp - 4]
mov edi, eax
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 4]
and word [edi + eax*2], 0
pop esi
mov ecx, ebx
call fcn.00401010
mov eax, edi
pop ebx
pop edi
leave
ret 4
Function at 0x401209
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x401236
xor eax, eax
jmp 0x4013d1
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10000
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jae 0x401252
dec ecx
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
push edi
push edi
lea esi, [eax - 0x10000]
push 2
push edi
push dword [ebp - 4]
and esi, 0xffff0000
sub eax, esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], eax
call edi
cmp dword [ebp + 8], 0
je 0x4012a5
push ebx
push esi
push dword [ebp - 8]
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], esi
call edi
test esi, esi
jne 0x4012ac
xor eax, eax
jmp 0x4013cf
lea ecx, [esi + ebx]
push 0x7c
lea eax, [ecx - 2]
pop edx
xor ebx, ebx
cmp byte [eax], dl
lea edi, [ecx - 4]
jne 0x401359
cmp byte [eax + 1], 0x3e
jne 0x401359
mov edi, dword [ebp - 4]
add edi, 2
cmp eax, edi
mov esi, eax
jbe 0x4013c4
lea ecx, [esi - 1]
cmp byte [ecx], dl
jne 0x4012e9
cmp byte [esi - 2], 0x3c
je 0x4012f4
mov esi, ecx
cmp esi, edi
ja 0x4012dc
jmp 0x4013c4
sub eax, esi
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 5
cmp esi, eax
jbe 0x40133a
cmp byte [esi - 5], 0xef
jne 0x40133a
cmp byte [esi - 4], 0xbb
jne 0x40133a
cmp byte [esi - 3], 0xbf
jne 0x40133a
lea ecx, [edi + edi + 2]
call section..text
push edi
mov ebx, eax
push ebx
push edi
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and word [ebx + eax*2], 0
jmp 0x4013c4
lea ecx, [edi + edi + 2]
call section..text
push edi
mov ebx, eax
push ebx
push edi
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [ebx + eax*2], si
jmp 0x4013c4
cmp word [edi], dx
jne 0x4013c4
cmp word [edi + 2], 0x3e
jne 0x4013c4
add esi, 4
cmp edi, esi
mov ecx, edi
mov dword [ebp + 8], ecx
jbe 0x4013c4
jmp 0x401376
mov ecx, dword [ebp + 8]
lea eax, [ecx - 2]
cmp word [eax], dx
jne 0x401385
cmp word [ecx - 4], 0x3c
je 0x40138e
cmp eax, esi
mov dword [ebp + 8], eax
ja 0x401373
jmp 0x4013c4
mov eax, edi
sub eax, ecx
sar eax, 1
lea esi, [eax + eax]
lea ecx, [esi + 2]
call section..text
mov ecx, dword [ebp + 8]
cmp ecx, edi
mov ebx, eax
jae 0x4013c0
add esi, ebx
sub ecx, ebx
cmp eax, esi
jae 0x4013c0
mov dx, word [ecx + eax]
mov word [eax], dx
inc eax
inc eax
lea edx, [ecx + eax]
cmp edx, edi
jb 0x4013ac
and word [eax], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, ebx
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x4013d6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0040112f
test eax, eax
push 2
mov dword [ebp - 4], eax
pop esi
jne 0x4013fe
mov ecx, esi
call section..text
and word [eax], 0
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00401209
mov ebx, eax
test ebx, ebx
mov dword [ebp + 8], ebx
jne 0x40141f
mov ecx, esi
call section..text
mov ebx, eax
and word [ebx], 0
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov edi, eax
pop ecx
jmp 0x40142e
add edi, esi
cmp word [edi], cx
je 0x40142c
cmp word [edi], 0x22
jne 0x40144d
add edi, esi
movzx eax, word [edi]
test ax, ax
je 0x401460
add edi, esi
cmp ax, 0x22
jne 0x40143b
jmp 0x401460
movzx eax, word [edi]
test ax, ax
je 0x401460
add edi, esi
cmp ax, cx
jne 0x40144d
jmp 0x401460
add edi, esi
cmp word [edi], cx
je 0x40145e
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
push ebx
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
push dword [ebp - 4]
lea ebx, [ecx + eax]
call esi
mov ecx, dword [ebp + 0xc]
add eax, ebx
lea eax, [eax + ecx + 0x20]
lea esi, [eax + eax]
mov ecx, esi
call section..text
mov edx, dword [ebp - 4]
mov ebx, eax
lea esi, [esi + ebx - 2]
push esi
call fcn.00401080
mov edx, dword [ebp + 8]
mov word [eax], 0x20
push esi
add eax, 2
call fcn.00401080
mov word [eax], 0x20
push esi
add eax, 2
mov edx, edi
call fcn.00401080
mov ecx, dword [ebp - 4]
call fcn.00401010
mov ecx, dword [ebp + 8]
call fcn.00401010
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8