joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x436abb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x436aca
pop dword [ebp - 0x34]
mov eax, 0x436aca
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x869bd94
sub dword [ebp - 0x44], 0xba177849
mov dword [ebp - 0x40], 0x18da8522
sub dword [ebp - 0x40], 0xe6a738dd
mov dword [ebp - 0x3c], 0xf72d7290
sub dword [ebp - 0x3c], 0xaae12e62
mov dword [ebp - 0x38], 0x8bdb623
add dword [ebp - 0x38], 0xf74249dd
lea eax, [ebp - 0x44]
push eax
mov eax, 0x8ac5e486
add eax, 0x757ddda6
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4e632d7c
add dword [ebp - 0x44], 0x260f3bda
mov dword [ebp - 0x40], 0x3e8a9c85
add dword [ebp - 0x40], 0x2e1c4f0
mov dword [ebp - 0x3c], 0x8066742f
sub dword [ebp - 0x3c], 0x1cf707c3
mov dword [ebp - 0x38], 0x84700e42
add dword [ebp - 0x38], 0x7b8ff1be
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4b26d
push 0
call eax
mov ecx, 0x5cb4
xor edi, edi
add edi, eax
mov edx, 0x2c539052
sub edx, 0x2c0c3a52
add edx, dword [ebp - 0x34]
mov esi, 0x2af84c6
mov dword [ebp - 0x24], 0x890ab800
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0x3c25f4f3
add ebx, esi
xor dword [ebp - 0xc], esi
mov dword [edi], ebx
add dword [ebp - 0x30], edx
add edi, 0xed885095
add edi, 0x1277af6f
add edx, 0x3aacc00d
add edx, 0xc5533ff7
loop 0x436bd8
add eax, 0x939ba6f
sub eax, 0x93854cc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1b259cae
add ecx, 0xe51a6352
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x406b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406b49

Function at 0x413690
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x20c
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x52b020]
test eax, eax
jne 0x413786
lea esi, [ebp - 0x214]
push 0x208
push 0
push esi
call fcn.00497b10
add esp, 0xc
push 0x104
push esi
push 0x50b940
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x4136ec
mov eax, dword [0x52b020]
jmp 0x4136fc
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x52b020], eax
test eax, eax
jne 0x413786
mov word [ebp - 0x214], 0
push 0x104
push esi
push str._SYSTEMROOT__system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x413731
mov eax, dword [0x52b020]
jmp 0x413741
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x52b020], eax
test eax, eax
jne 0x413786
mov word [ebp - 0x214], 0
push 0x104
push esi
push str.C:Windows_system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x413772
mov eax, dword [0x52b020]
jmp 0x413782
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x52b020], eax
test eax, eax
je 0x4137bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
mov dword [0x52b014], eax
push str.FDIDestroy
push dword [0x52b020]
call esi
mov dword [0x52b018], eax
push str.FDICopy
push dword [0x52b020]
call esi
mov dword [0x52b01c], eax
xor ebx, ebx
cmp dword [0x52b014], 0
je 0x4137db
cmp dword [0x52b018], 0
je 0x4137db
cmp dword [0x52b01c], 0
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
pop ebp
ret
Function at 0x4142f0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov edi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x414870
push eax
push eax
call fcn.004a2a30
add esp, 0x18
mov esi, eax
cmp dword [edi + 0x3c], eax
je 0x414353
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi + 0x3c]
inc eax
cmp eax, 2
jae 0x4143ce
lea eax, [esi + 1]
cmp eax, 2
jb 0x414349
mov dword [edi + 0x3c], esi
call fcn.00471300
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [edi + 0x3c]
inc esi
cmp esi, 1
jbe 0x414374
cmp esi, 2
setae bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004c2100
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0xa0
push str.InitializeThread
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x50ba96
push str.Failed_to_create_thread_for_async_install_tasks
call fcn.004be8c0
mov ecx, edi
call fcn.004c1f40
cmp byte [ebx + 0xb], 0
jns 0x414359
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
jmp 0x414359
call fcn.00471300
push dword [edi + 0x3c]
call fcn.00474440
add esp, 4
mov dword [edi + 0x3c], 0
jmp 0x414339
Function at 0x41af10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x68], eax
mov dword [ecx], fcn.00422a80
cmp dword [ecx + 0xc4], 0
je 0x41af60
push dword [esi + 0xc8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41b074
cmp byte [esi + 0x137], 0
jns 0x41af77
push dword [esi + 0x12c]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0x12b], 0
jns 0x41af8e
push dword [esi + 0x120]
call fcn.00493d6d
add esp, 4
mov ecx, dword [esi + 0x118]
mov dword [esi + 0x118], 0
test ecx, ecx
je 0x41afa9
push 1
call fcn.00422ab0
cmp byte [esi + 0x113], 0
jns 0x41afc0
push dword [esi + 0x108]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0xbf], 0
jns 0x41afd7
push dword [esi + 0xb4]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0xb3], 0
jns 0x41afee
push dword [esi + 0xa8]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0xa7], 0
jns 0x41b005
push dword [esi + 0x9c]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0x9b], 0
jns 0x41b01c
push dword [esi + 0x90]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0x8f], 0
jns 0x41b033
push dword [esi + 0x84]
call fcn.00493d6d
add esp, 4
cmp byte [esi + 0x83], 0
jns 0x41b047
push dword [esi + 0x78]
call fcn.00493d6d
add esp, 4
lea ecx, [esi + 0x64]
call fcn.004dd0d0
cmp byte [esi + 8], 0
je 0x41b061
lea ecx, [esi + 0xc]
call fcn.004143f0
mov byte [esi + 8], 0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004948c8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004c2100
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x1d4
push str.Installer
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x50c7cd
push str.Failed_to_wait_for_install_async_exit._Terminate_install_thread_
call fcn.004be8c0
mov ecx, edi
call fcn.004c1f40
cmp byte [ebx + 0xb], 0
jns 0x41b0cc
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
push 0
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x41af60

Function at 0x41b120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ecx + 0xc8]
call edi
push dword [esi + 0xcc]
call edi
xor eax, eax
push eax
push eax
push esi
push 0x41b160
push eax
push eax
call fcn.004a2a30
add esp, 0x18
mov dword [esi + 0xc4], eax
pop esi
pop edi
pop ebp
ret
Function at 0x421bd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x70], eax
call fcn.00410430
test al, al
je 0x421c59
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0x50d600
push str.BROWSER_SETUP_RESOURCE
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x421c59
mov ebx, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor ebx, ebx
test edi, edi
je 0x421c5b
mov esi, eax
test eax, eax
je 0x421c5b
mov eax, dword [ebp + 8]
lea ebx, [esp + 0x6c]
mov dword [ebx], 0xffffffff
push edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], esi
jne 0x421c72
mov bl, 1
jmp 0x421c5b
xor ebx, ebx
mov ecx, dword [esp + 0x70]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004c2100
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x508
push str.ExtractBrowserSetupResource
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x50ce06
push str.Write_failed._Roll_back_write_operation.
call fcn.004be8c0
mov ecx, esi
call fcn.004c1f40
cmp byte [edi + 0xb], 0
jns 0x421cca
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x421c5b

Function at 0x4221f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [ecx], fcn.00422260
cmp dword [ecx + 4], 0
je 0x42221a
cmp byte [esi + 0x14], 0
jne 0x422211
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, esi
pop esi
pop ebp
jmp fcn.00422280
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42222f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x422244
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x422259
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
pop esi
pop ebp
ret
Function at 0x422280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x68], eax
push 0x7530
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x422315
mov eax, dword [esi + 4]
test eax, eax
je 0x4222c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4222d8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4222ed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x422302
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004948c8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x15], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004c2100
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x6c0
push str.EnsureProcessFinished
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x50d17d
push str.The_elevated_installer_hangs_and_must_be_forcibly_terminated.
call fcn.004be8c0
mov ecx, edi
call fcn.004c1f40
cmp byte [ebx + 0xb], 0
jns 0x422371
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4222ae
Function at 0x423240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
call fcn.00473ed0
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
call fcn.00473ed0
lea ecx, [esi + 0x14]
mov eax, dword [ebp + 0x18]
cmp byte [eax + 0xb], 0
js 0x42327c
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x423286
push dword [eax + 4]
push dword [eax]
call fcn.0046e530
lea edi, [ebp + 8]
mov byte [esi + 0x20], 1
mov ebx, dword [esi + 8]
cmp ebx, dword [esi + 0xc]
je 0x4232a5
mov ecx, ebx
push edi
call fcn.00427ed0
add ebx, 0x10
mov dword [esi + 8], ebx
jmp 0x4232ae
lea ecx, [esi + 4]
push edi
call fcn.00423a10
xor eax, eax
push eax
push eax
push esi
push 0x4233c0
push eax
push eax
call fcn.004a2a30
add esp, 0x18
mov ecx, edi
call fcn.00427e90
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x423930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea edi, [esp + 0x10]
mov dword [edi + 0x64], eax
mov dword [edi + 0x60], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x50], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ecx, edi
call fcn.004dbe40
cmp byte [ebx + 0xb], 0
jns 0x42398c
mov ebx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov ecx, edi
push eax
push ebx
call fcn.004dc160
test al, al
je 0x4239ea
mov edi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
call fcn.004dc5d0
mov ebx, eax
test edi, edi
je 0x4239ca
test ebx, ebx
je 0x4239ca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xc]
cmp eax, edi
ja 0x4239ea
mov al, byte [esi + 0x20]
test ebx, ebx
je 0x4239d7
test al, al
jne 0x4239a9
jmp 0x4239ea
test al, al
je 0x4239ea
lea ecx, [esp + 0x10]
push 0
call fcn.004dc850
mov ebx, eax
jmp 0x4239ec
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.0044cf40
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4280e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx esi, cx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0xa
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
test eax, eax
je 0x42817f
mov ebx, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42817d
mov esi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x42817d
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x428176
push ebx
push esi
push eax
call fcn.00497010
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
push esi
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, dword [esi]
jmp 0x42817f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x428890
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
mov ecx, edi
push eax
call fcn.004bf2f0
mov eax, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [edi]
mov edi, dword [edi + 4]
add edi, 0xfffffffe
mov eax, edi
mov dword [ebp - 0x20], ecx
sub eax, ecx
js 0x428965
mov ebx, eax
sar ebx, 1
cmp eax, 9
ja 0x4288fa
mov byte [esi + 0xb], bl
mov eax, esi
jmp 0x428921
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x42896c
lea eax, [esi + esi]
push eax
call fcn.00493d3d
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov dword [ecx + 8], esi
mov esi, ecx
mov dword [ecx + 4], ebx
mov ebx, dword [ebp - 0x20]
cmp ebx, edi
je 0x42893a
mov ecx, ebx
movzx edx, word [ecx]
mov word [eax], dx
add ecx, 2
add eax, 2
cmp ecx, edi
jne 0x42892a
mov word [eax], 0
test ebx, ebx
je 0x428951
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x1c]
call fcn.00493d6d
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.004d5dc0
call fcn.004a7bd0
int3
Function at 0x42b330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
movzx ebx, word [ebp + 0x10]
mov esi, dword [ebp + 0xc]
shr esi, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
inc esi
movzx eax, si
push ebx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x42b39d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42b39d
mov edi, eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xf
xor eax, eax
mov esi, dword [ebp + 8]
movzx ebx, word [edi]
test ebx, ebx
je 0x42b390
cmp ecx, eax
je 0x42b3b1
add edi, 2
lea edi, [edi + ebx*2]
jmp 0x42b393
add edi, 2
inc eax
cmp eax, 0x10
jne 0x42b37d
xor eax, eax
jmp 0x42b3a2
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
cmp bx, 4
ja 0x42b3be
mov byte [esi + 0xb], bl
mov eax, esi
jmp 0x42b3e7
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.00493d3d
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], esi
mov esi, dword [ebp + 8]
mov dword [esi + 4], ebx
add ebx, ebx
xor ecx, ecx
movzx edx, word [edi + ecx + 2]
mov word [eax + ecx], dx
add ecx, 2
cmp ebx, ecx
jne 0x42b3eb
mov word [eax + ecx], 0
jmp 0x42b3aa

Function at 0x42b410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push 0x50d600
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42b46d
mov esi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42b46d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x42b46d
mov ebx, eax
cmp eax, 0xfffffff0
jae 0x42b4b6
cmp ebx, 0xa
ja 0x42b47c
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov eax, esi
jmp 0x42b49e
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x42b4af
lea esi, [ebx + 0x10]
and esi, 0xfffffff0
push esi
call fcn.00493d3d
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov dword [ecx + 8], esi
mov esi, ecx
mov dword [ecx + 4], ebx
xor ecx, ecx
mov dl, byte [edi + ecx]
mov byte [eax + ecx], dl
inc ecx
cmp ebx, ecx
jne 0x42b4a0
mov byte [eax + ecx], 0
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004d5dc0
int3
Function at 0x42b910
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movsx ecx, ax
cmp ecx, 0x41e
jg 0x42b94c
add eax, 0xfffffbfc
cmp ax, 0x15
ja case.0x42b93b.2
mov edx, 0x50d62a
movzx eax, ax
jmp dword [eax*4 + 0x50de7c]
mov edx, str.zh_TW
jmp case.0x42b93b.21
movzx eax, ax
cmp ecx, 0x442
jle 0x42b974
cmp ecx, 0x815
jg 0x42b990
cmp eax, 0x443
je 0x42b9d6
cmp eax, 0x804
jne case.0x42b93b.2
mov edx, str.zh_CN
jmp case.0x42b93b.21
cmp eax, 0x41f
je 0x42b9dd
cmp eax, 0x422
je 0x42b9e4
cmp eax, 0x43f
jne case.0x42b93b.2
mov edx, 0x50d65a
jmp case.0x42b93b.21
cmp eax, 0x816
je 0x42b9eb
cmp eax, 0xc0a
jne case.0x42b93b.2
mov edx, 0x50d636
jmp case.0x42b93b.21
mov edx, 0x50d663
jmp case.0x42b93b.21
mov edx, 0x50d660
jmp case.0x42b93b.21
mov edx, 0x50d633
jmp case.0x42b93b.21
mov edx, 0x50d639
jmp case.0x42b93b.21
mov edx, 0x50d63c
jmp case.0x42b93b.21
mov edx, 0x50d63f
jmp case.0x42b93b.21
mov edx, str.pt_BR
jmp case.0x42b93b.21
mov edx, 0x50d65d
jmp case.0x42b93b.21
mov edx, 0x50d630
jmp case.0x42b93b.21
mov edx, 0x50d62d
jmp case.0x42b93b.21
mov edx, str.pt_PT
mov ecx, esi
push edx
call fcn.004be760
mov eax, esi
pop esi
pop ebp
ret

Function at 0x42c0b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov esi, 0x208
push esi
call fcn.00493d3d
add esp, 4
mov edi, eax
push esi
push 0
push eax
call fcn.00497b10
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x42c10d
mov ecx, esi
add ecx, esi
js 0x42c185
mov ebx, ecx
sar ebx, 1
cmp ecx, 9
ja 0x42c119
mov eax, dword [ebp + 8]
mov byte [eax + 0xb], bl
mov ebx, eax
mov edx, eax
jmp 0x42c14e
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
jmp 0x42c16e
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x42c18d
lea eax, [esi + esi]
push eax
call fcn.00493d3d
add esp, 4
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
or esi, 0x80000000
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
mov ebx, eax
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea eax, [edi + esi*2]
cmp eax, edi
je 0x42c169
push ecx
push edi
push edx
mov dword [ebp - 0x10], edx
call fcn.00497010
mov edx, dword [ebp - 0x10]
add esp, 0xc
lea edx, [edx + esi*2]
mov word [edx], 0
test edi, edi
je 0x42c17b
push edi
call fcn.00493d6d
add esp, 4
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004d5dc0
call fcn.004a7bd0
int3