joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100270d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1002712d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100270d4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100270e3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042cd86
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10027134
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000dfaa
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100271d3
add edi, 4
add eax, 2
dec ecx
jne 0x10027119
call 0x10027180
loope 0x10027176
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100271d0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100271e1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10027194
cmp eax, ecx
ja 0x10027194
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1002721e
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10027214
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000e489
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x100270e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1002712d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100270d4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100270e3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042cd86
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10027134
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000dfaa
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100271d3
add edi, 4
add eax, 2
dec ecx
jne 0x10027119
call 0x10027180
loope 0x10027176
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100271d0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100271e1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10027194
cmp eax, ecx
ja 0x10027194
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1002721e
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10027214
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000e489
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x415e48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x550
push 0x47f0b0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415e83
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x4791de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47fdf0]
jne 0x4791e8
repz ret
jmp fcn.004797d5
Function at 0x40bc63
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x34]
mov dword [ebp - 0x38], 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 3
mov ecx, dword [ebp - 0x2c]
pop eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push 0x4000000
push 0x30363165
mov dword [ebp - 0x14], esi
call fcn.0040c831
add esp, 0x14
push esi
push 0x202
call fcn.0040d6a2
push dword [ebp - 0x2c]
push 0x203
call fcn.0040d6a2
pop edi
pop esi
leave
ret 4

Function at 0x40ca03
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x46
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
mov dword [ebp - 0x11c], ebx
push 0x412f80
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 8]
push 1
pop esi
mov dword [0x412f98], eax
push esi
call fcn.0040b800
cmp eax, ebx
mov dword [0x412fa4], eax
je 0x40ca5a
push 4
call fcn.0040b800
test eax, eax
mov dword [0x412fa8], esi
je 0x40ca60
mov dword [0x412fa8], ebx
cmp dword [0x412fa4], ebx
mov dword [ebp - 0x11c], 0x11c
je 0x40caa2
cmp dword [0x412fa8], ebx
jne 0x40caa2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40caa2
cmp dword [ebp - 0x114], esi
jae 0x40ca9c
cmp dword [ebp - 0x118], 6
jb 0x40caa2
mov dword [0x412fa0], esi
push 4
call fcn.0040b800
test eax, eax
je 0x40cac2
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov dword [0x412fac], esi
jne 0x40cac8
mov dword [0x412fac], ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x412fb0], eax
call fcn.0040c9d1
push dword [ebp + 0xc]
call fcn.0040d4cc
push dword [ebp + 0xc]
call fcn.0040e01d
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x42910b23
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x73797
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401ac2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
imul esi, esi, 0xba120
xor eax, eax
cmp dword [esi + 0x4f64a8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
jle 0x401b8c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [esi + 0x43cdc8]
push edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x9454], 0
je 0x401b6d
push str.DVS_COLOR_PAGE_COUNTING
push eax
call fcn.00417b19
test eax, eax
pop ecx
pop ecx
jne 0x401b6d
push str.____DVS_COLOR_PAGE_COUNTING_n
call ebp
call fcn.00401ce7
mov ebx, eax
push ebx
push str.nSize___d_n
call fcn.004039f4
test ebx, ebx
pop ecx
pop ecx
jle 0x401b6d
push ebx
call fcn.00418195
mov edi, eax
test edi, edi
pop ecx
je 0x401b6d
push ebx
push edi
call fcn.00401d5c
test eax, eax
jle 0x401b66
or dword [edi + 0x10], 0x60
push eax
push edi
call fcn.00401de8
push str.____Registry_entry_successfully_set_n
call ebp
mov dword [esp + 0x18], 1
push edi
call fcn.00417e0e
pop ecx
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add dword [esp + 0x10], 0x9458
cmp eax, dword [esi + 0x4f64a8]
jl 0x401af7
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 0xc]
pop esi
add esp, 0xc
ret
Function at 0x4039f4
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0xb94]
sub esp, 0xc14
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp + 0xb90], eax
cmp byte [0x4360e0], 0
jne 0x403a25
cmp byte [0x4360e1], 0
je 0x403af0
push dword [ebp + 0xb9c]
lea eax, [ebp + 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0xba0]
push eax
lea eax, [ebp + 0x390]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
movzx eax, word [ebp - 0x80]
push eax
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
lea eax, [ebp + 0x790]
push str._02i__02i__02i__02i:_02i:_02i:_03i
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x790]
push eax
call fcn.00417c50
add esp, 0x2c
cmp byte [0x4360e0], 0
je 0x403ab8
lea eax, [ebp + 0x790]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x4360e1], 0
je 0x403af0
push esi
push 0x42dadc
push str.KxAdmSvc.log
call fcn.00418a13
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x403aef
lea eax, [ebp + 0x790]
push esi
push eax
call fcn.00418c01
push esi
call fcn.00418b85
add esp, 0xc
pop esi
mov ecx, dword [ebp + 0xb90]
xor ecx, ebp
call fcn.004175dc
add ebp, 0xb94
leave
ret

Function at 0x403b05
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0xf94]
mov eax, 0x1014
call fcn.004244b0
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp + 0xf90], eax
cmp byte [0x4360e0], 0
je 0x403b9e
lea eax, [ebp + 0xfa0]
push eax
push dword [ebp + 0xf9c]
lea eax, [ebp + 0x790]
push 0x400
push eax
call fcn.00418af8
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp + 0x790]
push eax
movzx eax, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
movzx eax, word [ebp - 0x80]
push eax
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
lea eax, [ebp - 0x70]
push str._02i__02i__02i__02i:_02i:_02i:_03i__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 0xf90]
xor ecx, ebp
call fcn.004175dc
add ebp, 0xf94
leave
ret
Function at 0x404499
Capabilities:
Get file size

Disassembly:
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push dword [esp + 0x20]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x4044db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadIniFileA___File_Open_failed____ld_n
call fcn.004039f4
pop ecx
pop ecx
jmp 0x404517
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x1e
mov dword [esi + 0x14], eax
jae 0x4044f2
push str.LoadIniFileA___File_size_is_too_small_n
jmp 0x404508
add eax, 4
push eax
call fcn.00417923
cmp eax, edi
pop ecx
mov dword [esi + 0x18], eax
jne 0x404517
push str.LoadIniFileA___Memory_allocation_error._n
call fcn.004039f4
pop ecx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
ret 4

Function at 0x40451d
Capabilities:
Get file size

Disassembly:
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push dword [esp + 0x20]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x404564
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadIniFileW___File_Open_failed____ld____s__n
call fcn.00403b05
add esp, 0xc
jmp 0x4045a0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x1e
mov dword [esi + 0x14], eax
jae 0x40457b
push str.LoadIniFileW___File_size_is_too_small_n
jmp 0x404591
add eax, 4
push eax
call fcn.00417923
cmp eax, edi
pop ecx
mov dword [esi + 0x18], eax
jne 0x4045a0
push str.LoadIniFileW___Memory_allocation_error._n
call fcn.00403b05
pop ecx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
ret 4

Function at 0x404baf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.IsIniUnicodeA_n
call fcn.004039f4
pop ecx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404c10
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsIniUnicodeA___File_Open_failed____ld____s__n
call fcn.004039f4
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004175dc
leave
ret
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push esi
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xc], 0xfd
jbe 0x404c00
cmp byte [ebp - 0xb], 0xfd
jbe 0x404c00
mov al, 1
jmp 0x404c02
Function at 0x404c42
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.IsIniUnicodeW_n
call fcn.004039f4
pop ecx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404ca3
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsIniUnicodeW___File_Open_failed____ld____s__n
call fcn.00403b05
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004175dc
leave
ret
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push esi
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xc], 0xfd
jbe 0x404c93
cmp byte [ebp - 0xb], 0xfd
jbe 0x404c93
mov al, 1
jmp 0x404c95
Function at 0x4067bb
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa90
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
test ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa8c], eax
push edi
mov dword [ebp - 0xa88], ecx
mov dword [ebp - 0xa84], esi
lea eax, [ebp - 0x41c]
je 0x4067f9
push ebx
jmp 0x4067fe
push 0x42e2d4
push eax
call fcn.00417615
pop ecx
pop ecx
lea eax, [ebp - 0x41c]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x42d34c
lea eax, [ebp - 0x82c]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xa80], eax
je 0x406924
lea eax, [ebp - 0xa50]
push eax
push dword [ebp - 0xa84]
lea eax, [ebp - 0x624]
push edi
push eax
call esi
lea eax, [ebp - 0xa50]
push eax
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x214]
push edi
push eax
call esi
add esp, 0x20
test byte [ebp - 0xa7c], 0x10
je 0x4068e8
cmp dword [ebp + 0x14], 0
je 0x4068fd
lea eax, [ebp - 0xa50]
push 0x42dbc4
push eax
call fcn.004175aa
test eax, eax
pop ecx
pop ecx
je 0x4068fd
lea eax, [ebp - 0xa50]
push 0x42e2dc
push eax
call fcn.004175aa
test eax, eax
pop ecx
pop ecx
je 0x4068fd
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0xa88]
push ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x214]
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x624]
push eax
call fcn.004067bb
jmp 0x4068fd
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x624]
call fcn.0040648e
lea eax, [ebp - 0xa7c]
push eax
push dword [ebp - 0xa80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406849
push dword [ebp - 0xa80]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004175dc
leave
ret 0x14
Function at 0x406937
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x418
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00417615
push 2
lea eax, [ebp - 0x78]
xor ebx, ebx
push 0x42e30c
push eax
mov byte [ebp - 0x79], bl
mov byte [ebp - 0x7a], bl
call fcn.00419456
add esp, 0x14
test eax, eax
jne 0x406987
mov byte [ebp - 0x7a], 1
lea eax, [ebp - 0x78]
push 0x5c
push eax
call fcn.00417631
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x406a44
lea eax, [ebp - 0x78]
push eax
mov word [esi], bx
call fcn.00417e13
cmp eax, 2
pop ecx
jbe 0x4069ff
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4069ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 5
je 0x4069ee
sub ecx, 0x76
je 0x4069e7
sub ecx, 0x3c
je 0x4069ff
push eax
push str.KXAPI::CreateDirectory___failed__ld_n
call fcn.004039f4
pop ecx
pop ecx
xor eax, eax
jmp 0x406a47
cmp byte [ebp - 0x7a], bl
je 0x4069e3
jmp 0x4069ff
lea eax, [ebp - 0x78]
push 0x5c
push eax
call fcn.00417631
test eax, eax
pop ecx
pop ecx
jne 0x4069e3
mov word [esi], 0x5c
inc esi
inc esi
cmp word [esi], bx
je 0x406a0f
mov byte [ebp - 0x79], 1
push 0x5c
push esi
call fcn.00417631
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x40699e
cmp byte [ebp - 0x79], bl
je 0x406a44
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406a44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4069e3
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x398]
pop esi
xor ecx, ebp
pop ebx
call fcn.004175dc
add ebp, 0x39c
leave
ret 4

Function at 0x406bda
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.00417990
push esi
lea eax, [ebp - 0x412]
push edi
push eax
mov word [ebp - 0x414], di
call fcn.00417990
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x406c51
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x414]
push eax
push edi
push 0x42e334
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x406c86
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call fcn.00417615
pop ecx
xor edi, edi
pop ecx
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004175dc
leave
ret 4
Function at 0x406c98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20e]
mov edi, ecx
mov ebx, edx
push esi
push eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x214], esi
mov word [ebp - 0x210], si
call fcn.00417990
add esp, 0xc
push edi
call fcn.00406773
test al, al
lea eax, [ebp - 0x210]
je 0x406e00
push edi
push eax
call fcn.00417615
pop ecx
pop ecx
cmp ebx, esi
mov dword [ebp - 0x224], esi
je 0x406d0b
mov dword [ebx], esi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
jbe 0x406dd9
push edi
call fcn.00417923
mov ebx, eax
cmp ebx, esi
pop ecx
mov dword [ebp - 0x220], ebx
je 0x406dd9
push ebx
push edi
push esi
lea eax, [ebp - 0x210]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x406dcd
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x42dda4
push ebx
mov dword [ebp - 0x218], esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x218]
mov si, word [eax + 0xe]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
push dword [ebp - 0x228]
movzx eax, word [eax + 0xc]
push eax
movzx edi, si
movzx ebx, dx
push edi
movzx esi, cx
push ebx
push esi
push str.GetFileVersion____d__d__d__d___s__n
mov dword [ebp - 0x22c], eax
call fcn.00403b05
mov eax, dword [ebp - 0x21c]
shl esi, 0x10
or esi, ebx
add esp, 0x18
test eax, eax
mov dword [ebp - 0x214], esi
je 0x406dcd
shl edi, 0x10
or edi, dword [ebp - 0x22c]
mov dword [eax], edi
push dword [ebp - 0x220]
call fcn.00417e0e
pop ecx
push dword [ebp - 0x214]
push str.GetFileVersion_returns_0x_08x_n
call fcn.004039f4
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004175dc
leave
ret
push eax
call fcn.00406bda
test eax, eax
je 0x406cff
push esi
lea eax, [ebp - 0x210]
push eax
mov ecx, edi
call fcn.0040648e
test eax, eax
jne 0x406cff
jmp 0x406df1