joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012b4
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call sub.ntdll.dll_memset
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
push 0x1c
stosb byte es:[edi], al
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x40130b
push 0x8b
push 0x1b
mov edx, 0x405d44
call fcn.0040295d
mov esi, 0x104
push esi
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4013b5
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401330
push 0x8004
lea ecx, [ebp - 0x14]
sub eax, edx
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00401cce
test eax, eax
je 0x4013b5
xor al, al
lea edi, [ebp - 0x118]
mov ecx, esi
rep stosb byte es:[edi], al
lea eax, [ebp - 0x118]
lea edi, [ebp - 0x14]
call fcn.00401da3
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00402a47
mov ecx, 0x42a570
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401398
push ecx
lea ecx, [ebp - 0x21c]
sub eax, esi
push ecx
call fcn.00402340
test eax, eax
je 0x4013b5
xor ebx, ebx
inc ebx
mov eax, ebx
lea esp, [ebp - 0x228]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4013c2
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push 0x11c
lea eax, [ebp - 0x158]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
mov dword [ebp - 0x158], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401454
cmp dword [ebp - 0x154], 6
jb 0x401454
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00401ff5
cmp eax, 0x2000
jae 0x401454
call fcn.00401902
test eax, eax
jne 0x401454
push 6
push eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x401454
lea eax, [ebp - 0x3c]
jmp loc.0042d910
leave
ret
Function at 0xcd16d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jle 0xd32695
lea ebx, [esi + 1]
xchg ch, cl
mov ecx, dword [ebp + 8]
cmc
cmp ebx, edi
jmp 0xd07de2
inc esi
clc
test cl, cl
jmp 0x860465
test eax, eax
je 0x86046b
cmp eax, edx
jmp 0xd1843d
mov eax, dword [ebp - 0xc]
xor esi, 0x316d13ba
mov edx, dword [ebp + 0x10]
lea esi, [edi + ebx]
sar esi, 1
cmp dh, 0x3f
stc
mov eax, dword [eax + esi*4]
push edx
clc
shld dx, sp, 0xb3
mov edx, dword [ebp + 0xc]
stc
jmp 0xceeb17
jne 0xc7ff50
sub ecx, eax
jmp 0xd0658c
mov esp, ebp
pop ebp
jmp 0xd08d4b
inc edi
inc eax
cmp edi, ecx
jmp 0xcbe6a9
je 0xca4197
mov eax, 0x5a4d
cmp word [ecx], ax
jmp 0xca4191
jmp 0xd326c8
ja 0xd4f962
mov eax, esi
sub eax, dword [edx + ecx + 0x10]
jmp 0xd475ad
pop edi
rol ebx, 0xb8
btc si, dx
pop ebx
or si, si
add eax, ecx
jmp 0xc506b5
jae 0x86046b
xor edi, edi
test ecx, ecx
je 0xcbe6af
lea ebx, [ebp - 0x114]
cmc
sub ebx, eax
mov dl, byte [eax]
test sp, 0xa20
test esi, esi
stc
test dl, dl
je 0xcbe6af
mov byte [ebx + eax], dl
jmp 0x8da8c3
je 0xca4197
mov esi, dword [ebp + 0xc]
test ebx, eax
cmp bp, 0xf99
test esi, esi
jmp 0x8e894d
pop esi
jmp 0x8a431c
jae 0x8fd53b
lea eax, [eax + ecx]
mov cl, byte [eax]
bt esi, 0x3f
mov esi, eax
test cl, cl
je 0x86046b
cmp cl, 0x2e
jmp 0xd07482
mov eax, dword [ecx + 0x3c]
cmp bx, 0x4366
cmc
clc
cmp dword [eax + ecx], 0x4550
jmp 0xd33849
je 0xca2748
sub eax, eax
mov esi, ecx
pop esi
jmp 0xca6140
jb 0xbfc523
lea ecx, [ebp - 0x114]
push ecx
nop
bswap ax
seto al
mov byte [ebp + edi - 0x114], 0
mov eax, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call eax
mov edi, eax
test edi, edi
jmp 0x8c7d81
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x114
push esi
cmp ah, 0xa
test ecx, ecx
jmp 0xc25536
call fcn.008c19fe
add esp, 4
test eax, eax
jns 0x7e8a40
lea edi, [esi - 1]
jmp 0x7e8a4b
jae 0x86046b
mov esi, dword [edx + ecx + 0x1c]
lea eax, [esi + eax*4]
test ecx, 0x5e2d339f
mov eax, dword [eax + ecx]
jmp 0x7fd5ad
add eax, ecx
jmp 0xcd36a5
mov dword [ebp - 0xc], eax
js 0xd326c8
jmp 0x84aa97
cmp ecx, 0x104
jmp 0xbfc50a
je 0xd58505
mov cl, byte [esi + 1]
jmp 0x7f7d52
jle 0x84aa8e
jmp 0xd326c1
ret
jb 0x8fd53b
mov esi, dword [ebp - 0x10]
cmp sp, 0x1cb7
lea esi, [esi + edx]
cmp ebp, 0x5ec451fb
cmp eax, esi
jmp 0xc7ff37
dec edi
jmp 0xcf6d4c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x24]
cmp si, 0x27d6
dec ch
lea ecx, [edx + esi*2]
btr edx, esp
movzx edx, word [ecx + eax]
xor ch, 0x96
movzx ecx, cx
and cx, ax
mov dword [ebp - 8], edx
mov ecx, eax
rcr dx, 1
mov edx, dword [ebp - 4]
bswap eax
sar eax, cl
mov eax, dword [ebp - 8]
cmc
cmp eax, dword [edx + ecx + 0x14]
jmp 0xce1418
jne 0xca4197
mov edx, dword [eax + ecx + 0x78]
test ebp, 0x7ec543c6
mov dword [ebp - 4], edx
test edx, edx
je 0xca4197
mov eax, dword [eax + ecx + 0x7c]
push ebx
stc
cmc
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmc
cmp di, si
cmp esi, 0xffff
jmp 0x8ef549
mov dword [ebp - 8], eax
jmp 0x8eb8c4
mov edi, dword [edx + ecx + 0x18]
cmp di, 0x67f4
test edi, edi
je 0xd326c8
mov eax, dword [edx + ecx + 0x20]
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0xd2c776
mov ecx, esi
jmp 0x870bd5
Function at 0x952058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9521a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x95207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95206a
add dl, dl
jne 0x952089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9520dc
xor eax, eax
add dl, dl
jne 0x952096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95217d
add dl, dl
jne 0x9520a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9520b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9520bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9520c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9520d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x952075
mov eax, 1
add dl, dl
jne 0x9520ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9520f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9520e1
sub eax, ebx
mov ebx, 1
jne 0x952128
mov ecx, 1
add dl, dl
jne 0x95210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x952119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x952105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x952075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x95213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x952136
cmp eax, 0x7d00
jae 0x95216d
cmp eax, 0x500
jb 0x952168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x952075
cmp eax, 0x7f
ja 0x952170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x952075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x95219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x952075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4026d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x402714
push 0x40b5e4
push 0x96
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x40270d
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x40270d
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x40270f
xor eax, eax
mov dword [0x40dbf8], eax
test eax, eax
push esi
mov esi, eax
je 0x40275c
push ebx
mov bl, byte [eax]
jmp 0x40273f
push 2
lea eax, [esi + 1]
push eax
push dword [esp + 0x14]
call sub.msvcrt.dll__memicmp
add esp, 0xc
test eax, eax
movzx eax, bl
je 0x402746
lea esi, [esi + eax + 3]
mov bl, byte [esi]
sub bl, 0x41
jne 0x402720
jmp 0x40275b
push eax
add esi, 3
push esi
push edi
call sub.msvcrt.dll_memcpy
movzx eax, bl
add esp, 0xc
mov byte [eax + edi], 0
pop ebx
cmp byte [edi], 0
pop esi
jne 0x40276e
push dword [esp + 4]
push edi
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
xor eax, eax
inc eax
ret 4

Function at 0x403ab2
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.004038e9
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x403b41
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x403b2a
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x403b2a
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x403b33
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x403b4a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x403d26
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x403ef4
Capabilities:
Get common file path

Disassembly:
cmp byte [0x40dc00], 0
push esi
mov esi, 0x40dc00
jne 0x403f14
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov dword [0x40dd08], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_strcpy
mov eax, dword [0x40dd08]
pop ecx
pop ecx
pop esi
ret

Function at 0x40415b
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40b39c
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret
Function at 0x40504c
Capabilities:
Read .ini file

Disassembly:
push 0x40d860
push dword [esp + 0xc]
mov byte [esi], 0
push esi
push 0x40b39c
push dword [esp + 0x14]
push 0x40d968
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov eax, esi
ret

Function at 0x405070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040af10
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x40d860
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40b39c
push dword [ebp + 8]
push 0x40d968
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
pop esi
je 0x4050dc
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_strcpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4050e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040af10
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x40d860
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x40b39c
push dword [ebp + 8]
mov esi, 0x40d968
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
je 0x405142
cmp dword [ebp + 0x10], 0
jne 0x405142
xor eax, eax
jmp 0x405150
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
pop edi
pop esi
leave
ret

Function at 0x405438
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00403d26
test eax, eax
pop ecx
je 0x4054bf
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x40d860
push edi
call sub.msvcrt.dll_strcpy
push str.general
mov esi, 0x40d968
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
push edi
push 0
push 0x40b768
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x40d9b8
mov dword [0x40d9b0], eax
call fcn.0040504c
push 0x3f
push str.TranslatorName
mov esi, 0x40d9f8
call fcn.0040504c
push 0xff
push str.TranslatorURL
mov esi, 0x40da38
call fcn.0040504c
add esp, 0x18
pop edi
pop esi
ret
Function at 0x4071cd
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
push ebx
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
mov esi, eax
xor eax, eax
cmp dword [esi + 0x1a4], eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x407268
cmp dword [esi + 0x1ac], eax
je 0x407238
push 0x15c
push eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4001
push 0x160
lea eax, [esp + 0x20]
push eax
push 0
push 0x40b39c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [esi + 0x198], eax
push eax
jmp 0x407259
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebx
push 1
push eax
mov dword [esi + 0x198], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x198]
push 1
push 0x1003
push dword [esi + 0x190]
call edi
cmp dword [esi + 0x1a8], 0
je 0x4072a1
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebx
push 1
push eax
mov dword [esi + 0x19c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x19c]
push 0
push 0x1003
push dword [esi + 0x190]
call edi
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0
mov dword [esi + 0x194], eax
call ebx
push 0x1000
push 0x10
push 0x10
push 0
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0
mov dword [esp + 0x14], eax
call ebx
push 0x1000
push 0x10
push 0x10
push 0
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0
push dword [esi + 0x194]
mov dword [esp + 0x14], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push dword [esi + 0x194]
call ebx
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esi + 0x194]
call ebx
push dword [esp + 0x10]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
call ebx
push dword [esp + 0xc]
call ebx
mov eax, dword [esi + 0x194]
mov esi, dword [esi + 0x190]
push eax
push 0
push 0x1208
push esi
call fcn.00402961
pop ecx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407852
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
lea esi, [ebp - 0x108]
call fcn.00403d61
push edi
push str.oui.txt
mov edi, esi
call fcn.004042ea
mov eax, esi
push eax
call fcn.00403d26
add esp, 0x18
test eax, eax
je 0x4078b0
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.004078fa
mov esi, eax
test esi, esi
jne 0x4078f2
push 0x40b5e4
push 0x6d
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x4078d9
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4078d9
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x4078db
xor eax, eax
mov edi, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edi], eax
mov esi, ecx
test esi, esi
je 0x4078f2
call fcn.004076f0
pop edi
mov eax, esi
pop esi
leave
ret 4

Function at 0x4078fa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push dword [ebp + 8]
mov esi, eax
call fcn.004038e9
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x40795f
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
jbe 0x407957
call fcn.004075fb
lea eax, [edi + 1]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push edi
push eax
push ebx
mov dword [esi], eax
call fcn.004042cb
mov eax, dword [esi]
mov byte [edi + eax], 0
add esp, 0x10
mov edi, esi
call fcn.004076f0
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4

Function at 0x40860a
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
jne 0x40863c
push edi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
push 0
push 0x40ba34
lea eax, [ebp - 0x208]
push eax
mov byte [ebp - 0x104], 0
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
mov eax, dword [esi + 0x390]
push 1
push 2
lea ecx, [ebp - 0x104]
push ecx
push eax
call fcn.004085c7
test eax, eax
je 0x4086bb
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x408698
lea eax, [ebp - 0x104]
push eax
call fcn.00403ab2
pop ecx
jmp 0x40869e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x4086ae
push dword [esi + 0x108]
call fcn.0040395f
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
leave
ret
Function at 0x40a14d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040af10
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
mov byte [ebp - 0x2004], al
je 0x40a1a4
push 0x2000
push eax
lea eax, [ebp - 0x2003]
push eax
call sub.msvcrt.dll_memset
push dword [edi]
lea ebx, [ebp - 0x2004]
push dword [ebp + 0x14]
call fcn.00404318
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
mov esi, eax
jmp 0x40a1ef
mov esi, 0x2000
push esi
push eax
lea eax, [ebp - 0x2003]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x2004]
push esi
push eax
push 0x40b39c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea ebx, [ebp - 0x2004]
neg esi
call fcn.00404393
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40a1f5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40a213
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040a101
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [esi], eax
pop ebp
ret
Function at 0x40aa09
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x40abd7
lea eax, [esi + 0x18]
mov dword [ebp - 0x44], eax
mov byte [eax], bl
lea eax, [esi + 0x118]
mov dword [ebp - 0x2c], eax
mov byte [eax], bl
lea eax, [esi + 0x218]
mov dword [ebp - 0x1c], eax
mov byte [eax], bl
lea eax, [esi + 0x318]
mov dword [ebp - 0x34], eax
mov byte [eax], bl
lea eax, [esi + 0x418]
mov dword [ebp - 0x20], eax
mov byte [eax], bl
lea eax, [esi + 0x518]
mov dword [ebp - 0x28], eax
mov byte [eax], bl
lea eax, [esi + 0x618]
push edi
push dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [eax], bl
lea eax, [esi + 0x718]
mov dword [ebp - 0x38], eax
mov byte [eax], bl
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x40b6bc
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40aadd
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x30]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi], ecx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [esi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40ab2c
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x18]
push 0x14
push eax
call sub.msvcrt.dll__snprintf
add esp, 0x14
push 0x40b39c
lea eax, [ebp - 0x18]
push eax
push edi
lea esi, [ebp - 0x144]
call fcn.0040a97f
test eax, eax
jne 0x40ab3c
lea eax, [ebp - 0x18]
push str.040904E4
push eax
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
mov esi, dword [ebp - 0x44]
push 0x40bedc
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x2c]
push 0x40bee8
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x1c]
push 0x40bef8
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x34]
push 0x40bf04
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x20]
push 0x40bf14
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x28]
push 0x40bf20
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x30]
push 0x40bf30
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
mov esi, dword [ebp - 0x38]
push str.OriginalFileName
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040a97f
xor ebx, ebx
push edi
inc ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4