joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f340
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ca3d1
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x60], eax
push ebp
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ebp
call fcn.00431e40
mov dword [esp + 0x78], ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
call fcn.004513c0
push ebp
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x80], 1
call fcn.004035c0
push eax
call fcn.0048d490
add esp, 0xc
test eax, eax
je 0x48f518
lea ecx, [esp + 0xc]
call fcn.0042bb40
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.00451440
mov edx, dword [eax]
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
call fcn.00451480
push eax
lea ecx, [esp + 0x10]
call fcn.00451600
test al, al
je 0x48f50c
lea ebp, [ebx + 0x40]
lea ecx, [esp + 0xc]
call fcn.00451510
push eax
lea ecx, [esp + 0x38]
call fcn.004096c0
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x54]
mov byte [esp + 0x7c], 2
call fcn.0048b5f0
mov ecx, ebp
mov byte [esp + 0x78], 3
call fcn.004636c0
mov esi, eax
push esi
call fcn.00401c00
add esp, 4
push eax
push esi
lea eax, [esp + 0x58]
push eax
call fcn.00482b00
test eax, eax
jne 0x48f4c5
add dword [esp + 0x14], 1
mov ecx, edi
call fcn.00471d00
test al, al
je 0x48f474
lea ecx, [esp + 0x34]
push ecx
jmp 0x48f48b
lea edx, [esp + 0x34]
push edi
push edx
call fcn.00443460
add esp, 8
test al, al
je 0x48f492
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00431ea0
lea esi, [ebx + 0x24]
mov ecx, esi
call fcn.00471d00
test al, al
je 0x48f4a7
lea ecx, [esp + 0x34]
push ecx
jmp 0x48f4be
lea edx, [esp + 0x34]
push edx
push esi
call fcn.00443460
add esp, 8
test al, al
je 0x48f4c5
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.00431ea0
lea ecx, [esp + 0x50]
call fcn.004069c0
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 1
call fcn.004069c0
lea ecx, [esp + 0xc]
call fcn.00451540
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00451480
push eax
lea ecx, [esp + 0x10]
call fcn.00451600
test al, al
jne 0x48f410
cmp dword [esp + 0x14], 3
jge 0x48f518
push 0x4dfaac
mov ecx, edi
call fcn.00431ed0
lea ecx, [esp + 0x18]
call fcn.00451410
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004a1723
add esp, 0x70
ret
Function at 0x48f730
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4ca370
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
cmp dword [ebp + 4], 0
je 0x48f800
lea esi, [esp + 0x30]
call fcn.0048e1e0
mov edi, esi
mov dword [esp + 0x58], 0
call fcn.0048be70
lea edi, [ebp + 8]
push edi
lea ecx, [esp + 0x18]
call fcn.0048b5f0
mov ecx, esi
push ecx
mov ebx, eax
mov byte [esp + 0x5c], 1
call fcn.0048bfb0
xor ebx, ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], bl
call fcn.004069c0
mov ecx, esi
call fcn.004035c0
push eax
mov ecx, edi
call fcn.004035c0
push eax
push str.Copy_File___s______s_
mov esi, 0x4f8948
call fcn.0048a930
add esp, 0xc
call fcn.0048a6e0
push 1
lea ecx, [esp + 0x34]
call fcn.004035c0
push eax
mov ecx, edi
call fcn.004035c0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x30]
mov dword [ebp + 4], ebx
call fcn.004069c0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004a1723
add esp, 0x48
ret 4

Function at 0x48f8e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 0x80
mov esi, edx
push esi
push eax
push 0xc0000000
push ecx
mov ecx, ebx
call fcn.00477020
xor ecx, ecx
cmp eax, ecx
jl 0x48fa24
cmp edi, 0xffffffff
jne 0x48f9b3
cmp esi, 4
jne 0x48f9ae
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea esi, [esp + 0x10]
mov ecx, ebx
xor edi, edi
call fcn.0048fbe0
cmp dword [esp + 0x14], edi
ja 0x48f94a
cmp dword [esp + 0x10], 2
jb 0x48f9b3
lea ecx, [esp + 0x18]
call fcn.0040f790
mov eax, dword [ebx]
lea esi, [esp + 0x18]
call fcn.0048fb40
test eax, eax
jl 0x48f9a3
mov ecx, esi
call fcn.004636c0
test eax, eax
je 0x48f9a3
mov ecx, esi
call fcn.004636c0
movzx eax, word [eax]
cmp eax, 0xfeff
je 0x48f99e
cmp eax, 0xfffe
je 0x48f99e
mov ecx, esi
call fcn.004636c0
mov ebx, dword [esp + 0x1c]
mov ecx, eax
call fcn.0048f830
test eax, eax
mov ebx, dword [ebp + 8]
je 0x48f9a3
mov edi, 1
lea ecx, [esp + 0x18]
call fcn.0040f7c0
jmp 0x48f9b3
mov edi, 1
cmp edi, 1
mov dword [ebx + 4], edi
jne 0x48f9fd
mov eax, dword [ebx]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x48f9df
call fcn.0040a130
test eax, eax
jl 0x48f9e5
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
jne 0x48f9fd
push 0
push 2
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 0xfeff
call fcn.004770a0
push 2
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x48fa22
call fcn.0040a130
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48fb40
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x48fb7a
call fcn.0040a130
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x48fbcf
call fcn.0040a130
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret

Function at 0x48fbe0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
mov edx, dword [ecx]
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x48fc05
call fcn.0040a130
test eax, eax
jl 0x48fc10
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
xor eax, eax
add esp, 0xc
ret

Function at 0x490010
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp dword [0x4f8a10], 0
jne 0x4900a3
push esi
push 0x208
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.004a1d00
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
push 0x4e298c
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.004a163d
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4900a2
push str.GetLocaleInfoEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
add eax, 2
push esi
mov dword [0x4f8a10], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [esp + 0x20c]
xor eax, eax
cmp dword [0x4f8a10], 1
sete al
xor ecx, esp
call fcn.004a1723
add esp, 0x210
ret
Function at 0x4900d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x118
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004a1d00
add esp, 0xc
test esi, esi
mov dword [esp + 4], 0x11c
je 0x490129
lea ecx, [esp + 4]
push ecx
call esi
test eax, eax
je 0x490149
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [esp + 4]
push edx
call esi
test eax, eax
jne 0x490149
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x114
call esi
cmp dword [esp + 8], 0xa
pop esi
jne 0x490172
cmp dword [esp + 8], 0
jne 0x490172
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004a1723
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
xor eax, eax
call fcn.004a1723
add esp, 0x120
ret
Function at 0x490190
Capabilities:
Check os version

Disassembly:
sub esp, 0x124
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x120], eax
push edi
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004a1d00
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esi], 0
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x490203
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call edi
test eax, eax
jne 0x490203
xor eax, eax
pop edi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.004a1723
add esp, 0x124
ret
push 0x80
lea eax, [esp + 0x20]
push str.Service_Pack_1
push eax
call fcn.004a7f40
add esp, 0xc
test eax, eax
jne 0x490223
or dword [esi], 1
jmp 0x490281
push 0x80
lea ecx, [esp + 0x20]
push str.Service_Pack_2
push ecx
call fcn.004a7f40
add esp, 0xc
test eax, eax
jne 0x490243
or dword [esi], 2
jmp 0x490281
push 0x80
lea edx, [esp + 0x20]
push str.Service_Pack_3
push edx
call fcn.004a7f40
add esp, 0xc
test eax, eax
jne 0x490263
or dword [esi], 3
jmp 0x490281
push 0x80
lea eax, [esp + 0x20]
push str.Service_Pack_4
push eax
call fcn.004a7f40
add esp, 0xc
test eax, eax
jne 0x490281
or dword [esi], 4
shl dword [esi], 0x10
call fcn.004900d0
test eax, eax
je 0x490295
or dword [esi], 0xb
jmp 0x4903c3
call fcn.00490010
test eax, eax
je 0x4902da
cmp dword [esp + 0x18], 2
jne 0x4901eb
cmp dword [esp + 0xc], 6
jne 0x4901eb
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x4902c5
or dword [esi], 0xa
jmp 0x4903c3
cmp eax, 1
je 0x490310
test eax, eax
jne 0x4901eb
or dword [esi], 8
jmp 0x4903c3
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x4903c3
sub eax, 1
je 0x49039d
sub eax, 1
jne 0x4903c3
mov eax, dword [esp + 0xc]
cmp eax, 6
jne 0x490328
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x4902bd
cmp eax, 1
jne 0x490318
or dword [esi], 9
jmp 0x4903c3
test eax, eax
jne 0x4903c3
or dword [esi], 8
jmp 0x4903c3
cmp eax, 5
jne 0x490351
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x49033e
or dword [esi], 7
jmp 0x4903c3
cmp eax, 1
jne 0x490348
or dword [esi], 6
jmp 0x4903c3
test eax, eax
jne 0x4903c3
or dword [esi], 5
jmp 0x4903c3
cmp eax, 4
ja 0x4903c3
or dword [esi], 4
cmp eax, 4
jne 0x4903c3
lea ecx, [esp + 0x1c]
push str.Service_Pack_6
push ecx
call fcn.004a35b4
add esp, 8
test eax, eax
jne 0x4903c3
lea edx, [esp + 4]
push edx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4903c3
cmp dword [esp + 0xc], 4
jne 0x4903c3
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4903b1
or dword [esi], 1
jmp 0x4903c3
cmp eax, 0xa
jne 0x4903bb
or dword [esi], 2
jmp 0x4903c3
cmp eax, 0x5a
jne 0x4903c3
or dword [esi], 3
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004a1723
add esp, 0x124
ret
Function at 0x4939d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c5fee
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or eax, 0xffffffff
xor ebp, ebp
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebp
lea edi, [esi + 0x14]
mov dword [esp + 0x1c], ebp
mov ecx, edi
mov dword [esi], vtable.TiXmlAttribute.0
call fcn.004032a0
lea ebx, [esi + 0x30]
mov ecx, ebx
call fcn.004032a0
mov eax, dword [esp + 0x28]
push eax
mov ecx, edi
mov byte [esp + 0x20], 2
call fcn.00418420
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, ebx
call fcn.00418420
mov dword [esi + 0x10], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x4c], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x493fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c5fb3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea ebx, [esi + 0x20]
xor ebp, ebp
mov ecx, ebx
mov dword [esi + 0xc], ebp
mov dword [esi], vtable.TiXmlNode.0
call fcn.004032a0
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
mov dword [esp + 0x1c], ebp
lea edi, [esi + 0x44]
mov dword [esi], vtable.TiXmlElement.0
or eax, 0xffffffff
mov dword [edi + 8], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0x14]
mov dword [edi + 0xc], ebp
mov dword [edi], vtable.TiXmlAttribute.0
call fcn.004032a0
lea ecx, [edi + 0x30]
call fcn.004032a0
mov dword [edi + 0x10], ebp
mov dword [edi + 0x50], edi
mov dword [edi + 0x4c], edi
mov eax, dword [esp + 0x28]
mov byte [esp + 0x1c], 1
push eax
mov ecx, ebx
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x18], ebp
call fcn.00418420
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x494810
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c75a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, edx
test esi, esi
mov edi, ecx
jne 0x494878
cmp byte [edi + 0x44], dl
jne 0x494871
mov byte [edi + 0x44], 1
mov dword [edi + 0x48], 2
mov eax, dword [str.Failed_to_open_file]
push eax
lea ecx, [edi + 0x4c]
call fcn.00418420
or eax, 0xffffffff
mov dword [edi + 0x70], eax
mov dword [edi + 0x6c], eax
xor al, al
jmp 0x494a29
call fcn.00493d00
push 2
or ebp, 0xffffffff
push 0
push esi
mov dword [edi + 8], ebp
mov dword [edi + 4], ebp
call fcn.004a79a5
push esi
call fcn.004a7bc2
push 0
push 0
push esi
mov ebx, eax
call fcn.004a79a5
add esp, 0x1c
test ebx, ebx
jg 0x4948d6
cmp byte [edi + 0x44], 0
jne 0x4948cf
mov byte [edi + 0x44], 1
mov dword [edi + 0x48], 0xd
mov ecx, dword [str.Error_document_empty.]
push ecx
lea ecx, [edi + 0x4c]
call fcn.00418420
mov dword [edi + 0x70], ebp
mov dword [edi + 0x6c], ebp
xor al, al
jmp 0x494a29
lea ecx, [esp + 0x14]
call fcn.004032a0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x28]
cmp eax, ebx
ja 0x494911
cmp dword [esp + 0x2c], ebx
je 0x494911
push 1
push ebx
lea ecx, [esp + 0x1c]
mov ebp, eax
call fcn.00404960
test al, al
je 0x494911
push ebp
lea ecx, [esp + 0x18]
call fcn.00404910
lea edx, [ebx + 1]
push edx
call fcn.004a0665
push esi
push 1
mov ebp, eax
push ebx
push ebp
mov byte [ebp], 0
call fcn.004a83f6
add esp, 0x14
cmp eax, 1
je 0x494973
push ebp
call fcn.004a171e
add esp, 4
cmp byte [edi + 0x44], 0
jne 0x494963
mov byte [edi + 0x44], 1
mov dword [edi + 0x48], 2
mov eax, dword [str.Failed_to_open_file]
push eax
lea ecx, [edi + 0x4c]
call fcn.00418420
or eax, 0xffffffff
mov dword [edi + 0x70], eax
mov dword [edi + 0x6c], eax
lea ecx, [esp + 0x14]
call fcn.004033a0
xor al, al
jmp 0x494a29
mov byte [ebx + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x4949db
mov ebx, 0xa
mov cl, byte [esi]
cmp cl, bl
jne 0x4949a5
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0043e980
add esi, 1
mov eax, esi
jmp 0x4949d6
cmp cl, 0xd
jne 0x4949d3
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x4949bd
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0043e980
push ebx
lea ecx, [esp + 0x18]
call fcn.00471cd0
cmp byte [esi + 1], bl
jne 0x49499e
add esi, 2
mov eax, esi
jmp 0x4949d6
add esi, 1
cmp byte [esi], 0
jne 0x494986
sub esi, eax
je 0x4949ea
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0043e980
push ebp
call fcn.004a171e
mov edx, dword [esp + 0x48]
mov esi, dword [edi]
add esp, 4
push edx
push 0
lea ecx, [esp + 0x1c]
add esi, 8
call fcn.004033d0
push eax
mov eax, dword [esi]
mov ecx, edi
call eax
mov ecx, edi
call fcn.00402120
test al, al
lea ecx, [esp + 0x14]
jne 0x494967
call fcn.004033a0
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a1723
add esp, 0x2c
ret 4
Function at 0x495ca0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c8008
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ebx
call fcn.004955d0
mov dword [esp + 0x2c], ebx
mov ebp, dword [0x4f732c]
mov dword [esp + 0x20], ebp
mov byte [esp + 0x2c], 1
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
mov edi, dword [esp + 0x14]
jne 0x495d05
lea ebx, [eax - 0xf]
jmp 0x495e56
mov eax, dword [edi - 8]
movzx eax, word [edi + eax*2 - 2]
cmp ax, 0x5c
je 0x495d32
push 0x4e1d00
push 0x4e1d00
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esp + 0x18]
call fcn.00495a50
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 8]
cmp eax, ebx
jge 0x495d3e
or eax, 0xffffffff
jmp 0x495d59
push 0x4e1d00
push edi
call fcn.004a5a09
add esp, 8
cmp eax, ebx
jne 0x495d55
or eax, 0xffffffff
jmp 0x495d59
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
je 0x495e4a
lea ebp, [eax + 1]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
lea ebx, [esp + 0x18]
call fcn.00495680
mov byte [esp + 0x2c], 2
mov eax, dword [eax]
mov esi, dword [eax - 8]
push eax
lea eax, [esp + 0x24]
call fcn.00495a50
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4f731c
je 0x495dbb
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x495dbb
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff4
push edx
call fcn.004a171e
add esp, 4
mov esi, dword [edi - 8]
mov ebx, ebp
test ebx, ebx
jle 0x495dfe
test esi, esi
jle 0x495dfe
cmp ebx, esi
jle 0x495dce
mov ebx, esi
lea edi, [esp + 0x14]
call fcn.00495ae0
mov edi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
lea ecx, [eax + eax + 2]
mov eax, dword [edi - 4]
push ecx
lea edx, [edi + ebx*2]
push edx
lea ecx, [eax + eax + 2]
push ecx
push edi
call fcn.0041db70
add esp, 0x10
sub esi, ebx
mov dword [edi - 8], esi
mov ebp, dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x495e1b
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x495e52
cmp dword [edi - 8], 0
jge 0x495e26
or eax, 0xffffffff
jmp 0x495e41
push 0x4e1d00
push edi
call fcn.004a5a09
add esp, 8
test eax, eax
jne 0x495e3d
or eax, 0xffffffff
jmp 0x495e41
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jne 0x495d62
mov dword [esp + 0x18], 1
mov ebx, dword [esp + 0x18]
lea edx, [ebp - 0xc]
cmp edx, 0x4f731c
je 0x495e78
lea esi, [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x495e78
push esi
call fcn.004a171e
add esp, 4
lea eax, [edi - 0xc]
cmp eax, 0x4f731c
je 0x495e99
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x495e99
push edi
call fcn.004a171e
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4963f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ca308
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xc]
call fcn.00408320
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.004034f0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.004034c0
call fcn.0049d100
push edi
mov dword [edi + 0x1c], 0
call fcn.004964a0
cmp dword [edi + 0x1c], 0
je 0x49646c
push edi
call fcn.004967c0
push edi
call fcn.00496ee0
push edi
call fcn.00497730
push edi
call fcn.00497510
mov ecx, edi
call fcn.004971c0
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4964a0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c9378
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80]
xor ebx, ebx
lea esi, [esp + 0x50]
mov byte [esp + 0x17], bl
call fcn.0049d340
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], ebx
call fcn.00403420
mov bl, 1
mov ecx, ebp
mov byte [esp + 0x78], bl
call fcn.00471d00
test al, al
je 0x496530
mov eax, esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0049cfb0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 2
call fcn.004034f0
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], bl
call fcn.004034c0
jmp 0x49653a
push ebp
lea ecx, [esp + 0x38]
call fcn.004034f0
lea edi, [esp + 0x34]
call fcn.0049d100
push 0x4e2e58
lea ecx, [esp + 0x1c]
call fcn.00408320
lea ecx, [esp + 0x18]
push ecx
mov ebx, edi
mov byte [esp + 0x7c], 3
call fcn.0049d1f0
mov ebx, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], bl
call fcn.004034c0
mov ecx, edi
call fcn.004035c0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x496595
mov dword [ebp + 0x1c], 0
jmp 0x49664a
lea ecx, [esp + 0x50]
mov dword [ebp + 0x1c], ebx
call fcn.0049cde0
push 0x4e2e70
lea ecx, [esp + 0x1c]
call fcn.00408320
lea ebx, [esp + 0x18]
lea esi, [esp + 0x50]
mov byte [esp + 0x78], 4
call fcn.0049d160
mov bl, 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], bl
call fcn.004034c0
mov ecx, esi
call fcn.004035c0
push eax
call edi
cmp eax, 0xffffffff
je 0x4965ef
mov edx, esi
push edx
lea ecx, [ebp + 0x80]
call fcn.004034f0
jmp 0x496646
mov eax, dword [0x4f7388]
push str.SKIN
push str.QMUIRES.dat
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x49664a
mov ecx, dword [0x4f7388]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49664a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x49664a
mov edx, dword [0x4f7388]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
lea edi, [ebp + 0xb0]
mov esi, eax
call fcn.004955b0
mov byte [esp + 0x17], bl
lea ecx, [esp + 0x34]
call fcn.004034c0
lea ecx, [esp + 0x50]
call fcn.004034c0
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004a1723
add esp, 0x68
ret 4