joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416020
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4444e0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
push str.Name
lea ecx, [ebp - 0x2c]
mov ebx, edx
push ecx
push ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], eax
call fcn.0041cbb0
mov edi, eax
mov dword [ebp - 4], 0
call fcn.0040ecb0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x41608e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0042ee58
add esp, 4
push str.Value
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.0041cbb0
mov esi, dword [ebp - 0x4c]
add esi, 0x1c
mov edi, eax
mov dword [ebp - 4], 1
call fcn.0040ecb0
or ebx, 0xffffffff
mov edi, 8
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], edi
jb 0x4160cd
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042ee58
add esp, 4
cmp dword [esi + 0x14], edi
jb 0x4160d6
mov eax, dword [esi]
jmp 0x4160d8
mov eax, esi
mov edx, dword [ebp - 0x50]
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.00416d80
mov edi, eax
mov dword [ebp - 4], 2
call fcn.0040ecb0
mov dword [ebp - 4], ebx
mov ebx, 8
cmp dword [ebp - 0x18], ebx
jb 0x41610c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0042ee58
add esp, 4
cmp dword [esi + 0x14], ebx
jb 0x416115
mov eax, dword [esi]
jmp 0x416117
mov eax, esi
push 6
push str.REG:
push eax
call fcn.0042ff5e
add esp, 0xc
test eax, eax
jne 0x416166
cmp dword [esi + 0x14], ebx
jb 0x416134
mov eax, dword [esi]
jmp 0x416136
mov eax, esi
lea edx, [ebp - 0x48]
lea ecx, [eax + 0xc]
push edx
call fcn.004161f0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 3
call fcn.0040ecb0
cmp dword [ebp - 0x34], ebx
jb 0x4161c5
mov eax, dword [ebp - 0x48]
push eax
call fcn.0042ee58
add esp, 4
jmp 0x4161c5
cmp dword [esi + 0x14], ebx
jb 0x41616f
mov eax, dword [esi]
jmp 0x416171
mov eax, esi
push 6
push str.FIL:
push eax
call fcn.0042ff5e
add esp, 0xc
test eax, eax
jne 0x4161c5
cmp dword [esi + 0x14], ebx
jb 0x41618e
mov eax, dword [esi]
jmp 0x416190
mov eax, esi
add eax, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, 0x4493f8
jne 0x4161a8
mov eax, 0x44a650
mov ecx, eax
lea edi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4161b0
sub ecx, edi
sar ecx, 1
push ecx
call fcn.00403fb0
mov ecx, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ecx + 0x2c], eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret 4
Function at 0x4182d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, eax
push esi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4182f0
sub ecx, esi
sar ecx, 1
push ecx
mov esi, 0x457ab8
call fcn.00403fb0
cmp dword [0x457acc], 8
mov eax, dword [0x457ab8]
jae 0x41831a
mov eax, esi
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0042eee3
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0
lea edx, [ebp - 0x214]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x44a650
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
mov ecx, dword [ebp - 8]
add esp, 8
xor ecx, ebp
pop esi
call fcn.0042ee49
mov esp, ebp
pop ebp
ret 4

Function at 0x418380
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x44c35c
push str.Core_version:__s
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
mov edi, dword [0x458dc8]
add esp, 0xc
push str.IIF_SETUPVERSION
add edi, 4
call fcn.00416580
push eax
push str.Setup_version:__s
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.Command_line:__s
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
add esp, 0xc
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00433960
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [ebp - 0x12c]
push edx
mov dword [ebp - 0x12c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x12c], 1
mov eax, str.64_bit
je 0x418457
mov eax, str.32_bit
movzx ecx, byte [ebp - 0xe]
mov edx, dword [ebp - 0x120]
push eax
movzx eax, word [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x124]
push ecx
push edx
push eax
push str.OS_data:__d__d__d__d__s
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push edx
push str.System_up_time:__d_sec
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
mov eax, dword [0x458dc8]
add eax, 0x30
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4184c1
mov eax, dword [eax]
push eax
call fcn.00407d00
add esp, 4
test al, al
mov eax, 0x44c2c0
jne 0x4184d8
mov eax, 0x44c458
push eax
push str.Reboot_pending:__s
push 0x457ab8
mov ecx, 0x449300
call fcn.00418500
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
Function at 0x418500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
push ebx
push esi
push edi
mov esi, ecx
jb 0x418520
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418640
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x4a]
movzx edx, word [ebp - 0x4c]
movzx eax, word [ebp - 0x4e]
push esi
push ecx
movzx ecx, word [ebp - 0x50]
push edx
movzx edx, word [ebp - 0x52]
push eax
movzx eax, word [ebp - 0x56]
push ecx
movzx ecx, word [ebp - 0x58]
push edx
push eax
push ecx
lea edx, [ebp - 0x48]
push str._d:_02d:_02d__02d:_02d:_02d:_03d:__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x48]
add esp, 0x28
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418597
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [eax + eax]
push edx
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edx
call fcn.00430069
lea esi, [eax + 3]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042eb5a
mov ecx, dword [ebp + 0xc]
mov edi, eax
lea eax, [ebp + 0x10]
push eax
push ecx
push esi
push edi
call fcn.004301f4
push 0x44c4d4
push esi
push edi
call fcn.0042fa24
mov eax, edi
add esp, 0x28
lea edx, [eax + 2]
jmp 0x418610
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418610
sub eax, edx
push 0
sar eax, 1
lea edx, [ebp - 0x5c]
push edx
add eax, eax
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.0042ee58
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
Function at 0x418e80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00433960
add esp, 0xc
lea ecx, [ebp - 0x14c]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x14c]
cmp ax, 9
jne 0x418ee3
test ebx, ebx
js 0x418ef0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x418ed2
test ebx, 0x40000000
je 0x418ed2
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 2
mov edx, ebx
shr edx, 8
push 0
and edx, 0xff
push 0
mov dword [ebp - 0x124], edx
call esi
push 3
push 1
movzx ecx, bl
push edx
push eax
mov dword [ebp - 0x120], ecx
call esi
mov ecx, 3
test ebx, 0x10000000
je 0x418f35
mov byte [ebp - 0xe], 1
jmp 0x418f48
test ebx, 0x20000000
je 0x418f42
mov byte [ebp - 0xe], cl
jmp 0x418f48
cmp byte [ebp - 0xe], 0
jbe 0x418f58
push 1
push 0x80
push edx
push eax
call esi
mov ecx, 0x83
push edx
push eax
push ecx
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp eax, 1
jne 0x418ed2
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, al
pop esi
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
Function at 0x41eb20
Capabilities:
Get common file path
Get graphical window text
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4442eb
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4563e4]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
push edi
mov eax, dword [0x4563e4]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov eax, 0x4d8
mov esi, ecx
cmp word [ebp + 0xc], ax
jne 0x41ec87
cmp word [ebp + 8], 0
jne 0x41ec87
xor ecx, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], cx
mov dword [esp + 0x268], ecx
mov edx, dword [esi + 4]
push 0x4d3
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push 0x104
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 4]
xor eax, eax
lea edx, [esp + 0xc]
push edx
push eax
push eax
push 0x11
mov dword [esp + 0x20], eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x208a
mov edx, 0x458de8
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0x41
call fcn.00413990
mov esi, 8
cmp dword [esp + 0x44], esi
jb 0x41ec35
mov edx, dword [esp + 0x30]
mov dword [esp + 0x1c], edx
jmp 0x41ec3d
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0x4c]
push edx
mov dword [esp + 0x28], 0x41ea70
mov dword [esp + 0x2c], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
je 0x41ec74
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [esp + 0x4c]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [esp + 0x44], esi
jb 0x41ec87
mov eax, dword [esp + 0x30]
push eax
call fcn.0042ee58
add esp, 4
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret 8
Function at 0x420e60
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x414]
push eax
push 0x104
mov esi, ecx
mov dword [ebp - 0x418], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x44bf80
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
lea eax, [ebp - 0x20c]
mov word [esi], dx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420ee5
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
call fcn.00403fb0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042ee49
mov esp, ebp
pop ebp
ret

Function at 0x420f20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, edx
push edi
lea edx, [ebp - 0x58]
push edx
push esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x42104d
push ebx
push edi
call fcn.0042eb5a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x421037
push ebx
push edi
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0x449dd4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x48]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
lea ecx, [ebp - 0x44]
push str._d._d._d._d
push ecx
call edi
lea eax, [ebp - 0x44]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420fb6
mov esi, dword [ebp - 0x50]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x44]
call fcn.00403fb0
mov eax, dword [ebp - 0x48]
movzx edx, word [eax + 0x14]
movzx ecx, word [eax + 0x16]
push edx
movzx edx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push edx
push eax
lea ecx, [ebp - 0x44]
push str._d._d._d._d
push ecx
call edi
lea eax, [ebp - 0x44]
add esp, 0x18
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421000
mov esi, dword [ebp - 0x4c]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x44]
call fcn.00403fb0
push ebx
call fcn.0042ee58
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
Function at 0x421070
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4563e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x50]
push ecx
push esi
mov dword [ebp - 0x48], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x421140
push ebx
push edi
call fcn.0042eb5a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42112a
push ebx
push edi
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0x449dd4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax + 0x10]
movzx edx, word [eax + 0x12]
push ecx
push edx
lea eax, [ebp - 0x44]
push str._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x44]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4210f3
mov esi, dword [ebp - 0x48]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x44]
call fcn.00403fb0
push ebx
call fcn.0042ee58
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ee49
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042ee49
mov esp, ebp
pop ebp
ret

Function at 0x421200
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 4], 1
jne 0x421268
push 0xe
push str._ProgramFiles_
push esi
xor eax, eax
call fcn.0040ef10
cmp eax, 0xffffffff
je 0x421268
jmp 0x421240
push 0xe
push str._ProgramW6432_
push eax
mov eax, 0xe
mov ecx, esi
call fcn.0040ed20
push 0xe
push str._ProgramFiles_
push esi
xor eax, eax
call fcn.0040ef10
cmp eax, 0xffffffff
jne 0x421240
cmp dword [esi + 0x14], 8
jb 0x421272
mov eax, dword [esi]
jmp 0x421274
mov eax, esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
mov ebx, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042eb5a
mov edi, eax
add esp, 4
test edi, edi
je 0x4212e0
cmp dword [esi + 0x14], 8
jb 0x4212aa
mov eax, dword [esi]
jmp 0x4212ac
mov eax, esi
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4212c0
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00403fb0
push edi
call fcn.0042ff19
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4212f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4213fe
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ebx, [esi + 2]
push ebx
call fcn.0042eb5a
mov edi, eax
add esp, 4
test edi, edi
jne 0x421356
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + 0xe]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push edi
call fcn.00433960
mov ebx, dword [ebp - 8]
add esp, 0xc
push 0
lea edx, [ebp - 0xc]
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4213e4
cmp byte [edi], 0xff
jne 0x4213a9
cmp byte [edi + 1], 0xfe
jne 0x4213a9
mov ecx, dword [ebp + 8]
lea eax, [edi + 2]
push ecx
call fcn.00402b40
push edi
call fcn.0042ff19
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4213b0
mov esi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00403fb0
push edi
call fcn.0042ff19
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp - 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov esi, eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4214c2
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, 1
jbe 0x4214b6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea edi, [ebx + 2]
push edi
mov dword [ebp - 4], eax
call fcn.0042eb5a
mov esi, eax
add esp, 4
test esi, esi
je 0x4214aa
push edi
push 0
push esi
call fcn.00433960
mov eax, dword [ebp - 4]
push ebx
push eax
push esi
call fcn.00430960
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421485
mov ecx, dword [ebp + 8]
sub eax, edx
push eax
push esi
call fcn.004125b0
push esi
call fcn.0042ee58
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xe
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4214d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov esi, eax
push 0xb
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x42158a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, 1
jbe 0x42157e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea esi, [ebx + 2]
push esi
mov dword [ebp - 4], eax
call fcn.0042eb5a
mov edi, eax
add esp, 4
test edi, edi
je 0x421572
push esi
push 0
push edi
call fcn.00433960
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call fcn.00430960
mov eax, edi
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421546
mov esi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00403fb0
push edi
call fcn.0042ee58
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xe
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret