joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b66c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5128f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00500b38
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.005064e4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0050830a
test eax, eax
je 0x4b67dc
mov ecx, dword [esp + 0x3c]
call fcn.00506511
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4b67a0
push edi
mov ecx, esi
call fcn.00503a89
mov ecx, esi
call fcn.004b6940
cmp dword [esp + 0x38], 1
jne 0x4b67d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00503bf3
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4b91c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4b91f3
push esi
call fcn.004bc2d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4b91ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4b9279
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4b9262
mov eax, dword [esi + 8]
test eax, eax
je 0x4b9217
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4b925e
cmp eax, 2
je 0x4b9262
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b920a
cmp eax, 3
je 0x4b923d
cmp eax, 1
jne 0x4b920a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4b920a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4b920a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004b92a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4b9288
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004b92a0
add esp, 4
pop esi
ret

Function at 0x4c9d20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
mov esi, 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c9d93
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push str.WheelScrollLines
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c9d88
push 0xa
lea edx, [esp + 0x14]
push eax
push edx
call fcn.004efb7d
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x8c
ret
Function at 0x4db950
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5144a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0050623c
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.004db890
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x178]
add ecx, 0x64
add eax, 0x64
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0050616a
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4dba17
cmp dword [esp + 0x40], 1
jne 0x4dba15
cmp ecx, eax
jge 0x4dba17
mov eax, ecx
cmp eax, 0x12c
jge 0x4dba23
mov eax, 0x12c
mov ecx, esi
mov dword [esi + 0x194], eax
mov dword [esi + 0x1dc], 1
call fcn.004dba70
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005062ae
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x4dfc80
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x514996
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x564414]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xb0], ebx
call fcn.0050192e
mov edx, dword [0x564414]
mov dword [esp + 0x3c], edx
cmp esi, ebx
mov byte [esp + 0xac], 1
jne 0x4dfcda
mov dword [esp + 0x1c], ebx
jmp 0x4dfce1
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
push edi
mov ecx, esi
call fcn.00503adf
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov edi, 1
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edx
call fcn.004ff5e1
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x1c], ecx
jne 0x4dfd32
mov dword [esp + 0x14], ebx
jmp 0x4dfd39
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
cmp dword [esi + 0x44], 0xd
jne 0x4dfd54
mov eax, dword [eax + 0x3c4]
cmp eax, edi
je 0x4dfd4e
cmp eax, 2
jne 0x4dfd54
mov dword [esp + 0x18], edi
jmp 0x4dfd58
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x4dfd66
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00500f63
mov edi, eax
cmp edi, ebx
jne 0x4dfd76
xor eax, eax
jmp 0x4dfd79
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4dfda1
mov ecx, esi
call fcn.00503adf
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebx
test eax, eax
pop edi
je 0x4dfdbd
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4dfddc
mov esi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x4dfddc
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0
call fcn.004ff4a8
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.004ff4a8
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x4e0aa0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x514aa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x564414]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
lea ecx, [esp + 8]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xac], ebx
call fcn.0050192e
cmp dword [0x581b64], ebx
je 0x4e0b10
lea ecx, [esp + 8]
mov dword [esp + 0xa8], 0xffffffff
call fcn.004ff4a8
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
add esp, 0xa4
ret
mov edx, dword [0x564414]
push ebp
push edi
mov edi, 1
mov dword [0x581b64], edi
mov dword [esp + 0x40], edx
cmp esi, ebx
mov byte [esp + 0xb0], 1
jne 0x4e0b39
mov dword [esp + 0x20], ebx
jmp 0x4e0b40
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
call fcn.00503adf
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x88]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], 5
mov dword [esp + 0x34], edx
call fcn.004ff5e1
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0x94]
mov edx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x1c], edx
jne 0x4e0b9e
mov dword [esp + 0x14], ebx
jmp 0x4e0ba5
mov ebp, dword [eax + 0x1c]
mov dword [esp + 0x14], ebp
cmp ecx, 0xd
jne 0x4e0bbf
mov eax, dword [eax + 0x3c4]
cmp eax, edi
je 0x4e0bb9
cmp eax, 2
jne 0x4e0bbf
mov dword [esp + 0x18], edi
jmp 0x4e0bc3
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x4e0bd1
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00500f63
mov edi, eax
cmp edi, ebx
jne 0x4e0be1
xor eax, eax
jmp 0x4e0be4
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4e0c0c
mov ecx, esi
call fcn.00503adf
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov esi, dword [esp + 0x1c]
push esi
call ebx
test eax, eax
je 0x4e0c24
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x18]
mov dword [0x581b64], 0
test eax, eax
je 0x4e0c4d
mov esi, dword [esp + 0x14]
push esi
call ebx
test eax, eax
je 0x4e0c4d
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x40]
mov byte [esp + 0xb0], 0
call fcn.004ff4a8
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0xffffffff
call fcn.004ff4a8
mov ecx, dword [esp + 0xa8]
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x4e37a0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4e37e9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4e3c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x514fc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004e3810
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004e3890
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004e3890
lea ecx, [esi + 0xc]
call fcn.004ff433
lea ecx, [esi + 0x10]
call fcn.004ff433
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004e4e20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004e4e20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004e4e20
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004ff4a8
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004ff4a8
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4e5010
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4e5076
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4e5076
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4e5057
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x50192e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x501966
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ff94f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ff927
jmp 0x501972
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5031a3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5031e5
call fcn.00509967
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5031e5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5031dc
xor eax, eax
jmp 0x5031ed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005031f3
pop edi
pop esi
pop ebx
ret 4

Function at 0x509e97
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x509ec5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x509ee3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00509dfd
jmp 0x509ee3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x509ee3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00509dfd
test edi, edi
mov eax, edi
jne 0x509ecd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x50cc34
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x50cc5c
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x50cc6d
push 2
call edi
test ax, ax
jge 0x50cc6d
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00500f63
cmp dword [esi + 0x30], ebx
jne 0x50cd47
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.00500f63
cmp eax, dword [esp + 0x34]
jne 0x50cd47
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x50cce3
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x50cd28
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x50cd47
cmp eax, 0x205
je 0x50cd47
cmp eax, 0x201
je 0x50cd47
cmp eax, 0x204
je 0x50cd47
cmp eax, ebx
jne 0x50cd0e
cmp dword [esp + 0x1c], 0x1b
je 0x50cd47
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x59ef64]
jbe 0x50cd3d
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x50cca0
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x8f5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8f51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8f507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f506a
add dl, dl
jne 0x8f5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f50dc
xor eax, eax
add dl, dl
jne 0x8f5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f517d
add dl, dl
jne 0x8f50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8f50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8f5075
mov eax, 1
add dl, dl
jne 0x8f50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f50e1
sub eax, ebx
mov ebx, 1
jne 0x8f5128
mov ecx, 1
add dl, dl
jne 0x8f510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8f513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f5136
cmp eax, 0x7d00
jae 0x8f516d
cmp eax, 0x500
jb 0x8f5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f5075
cmp eax, 0x7f
ja 0x8f5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8f519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8f5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4052ba
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x468030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x118
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.00428d50
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040526f
mov eax, dword [ebp - 0x11c]
add esp, 0xc
cmp eax, 5
jne 0x405339
cmp dword [ebp - 0x118], ebx
jbe 0x40537f
cmp dword [ebp - 0x118], 1
setne bl
inc ebx
jmp 0x40537f
cmp eax, 6
jne 0x405364
cmp byte [ebp - 6], 1
jne 0x40535f
mov eax, dword [ebp - 0x118]
sub eax, ebx
je 0x40535b
sub eax, 1
je 0x405357
push 7
jmp 0x405361
push 5
jmp 0x405361
push 3
jmp 0x405361
push 4
pop ebx
jmp 0x40537f
push 0xa
pop ecx
cmp eax, ecx
jne 0x40537c
cmp dword [ebp - 0x114], 0x55f0
sbb ebx, ebx
add ebx, 9
jmp 0x40537f
cmova ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00411745
leave
ret

Function at 0x405ba5
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
push 2
mov byte [ebp - 1], dl
pop ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, ebx
cmp ax, dx
jne 0x405bba
push dword [ebp + 8]
sub edi, ecx
sar edi, 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405bdc
mov al, 1
jmp 0x405c6d
push esi
xor ecx, ecx
lea esi, [edi + 1]
mov eax, esi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412085
push esi
mov ebx, eax
push 0
push ebx
call fcn.00403ae8
push dword [ebp + 8]
push esi
push ebx
call fcn.00433d8a
add esp, 0x1c
xor esi, esi
movzx eax, word [ebx + esi*2]
cmp eax, 0x5c
je 0x405c1b
cmp eax, 0x2f
jne 0x405c57
mov dword [ebp - 8], eax
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405c50
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405c5e
mov eax, dword [ebp + 0xc]
mov byte [ebp - 1], 1
cmp dword [eax + 0x24], 0
je 0x405c50
push ebx
mov ecx, eax
call fcn.00405b88
mov eax, dword [ebp - 8]
mov word [ebx + esi*2], ax
inc esi
cmp esi, edi
jbe 0x405c0d
jmp 0x405c62
mov byte [ebp - 1], 0
push ebx
call fcn.0041208e
mov al, byte [ebp - 1]
pop ecx
pop esi
pop edi
pop ebx
leave
ret
Function at 0x405d07
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x468030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
call fcn.00428d50
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x8000
cmp byte [ebp + 0x10], 0
push edi
cmove eax, dword [ebp + 0xc]
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x405d72
xor eax, eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x405d80
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004021e6
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00411745
leave
ret

Function at 0x405de3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [eax + 0x10], ebx
je 0x405ef4
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], ebx
je 0x405ef3
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405e12
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
test eax, eax
je 0x405ef3
push 0x4530ca
push eax
call fcn.004120cd
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x405ef3
cmp dword [esi + 0x14], 0x10
jb 0x405e47
mov esi, dword [esi]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, dword [ebp - 4]
test eax, eax
je 0x405ee1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405ee1
mov eax, dword [ebp - 0x10]
push 0x4530ca
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 8], ecx
call fcn.004120cd
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x405ee1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x405eaa
mov eax, dword [eax]
push eax
push dword [ebp - 8]
push str.StringFileInfo_08lx_s
push 0x80
push edi
call fcn.004047ff
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405edf
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
call fcn.00401cb8
mov bl, 1
push esi
call fcn.0041208e
pop ecx
test edi, edi
je 0x405ef3
push edi
call fcn.0041208e
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
leave
ret

Function at 0x406a34
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret