joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ebc0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x40ed83
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
cmp ebx, 1
jne 0x40ebfe
push 1
call fcn.0040eb70
mov eax, dword [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040ed90
mov dword [ebp], eax
jmp 0x40ec8c
cmp ebx, 2
jne 0x40ec15
push 1
mov ecx, esi
call fcn.0040eb70
mov ecx, esi
call fcn.0040f820
jmp 0x40ec85
cmp ebx, 0x111
jne 0x40ec4f
cmp di, 0x6b
jne 0x40ec36
mov ecx, esi
call fcn.0041c3c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x6c
jne 0x40eca3
mov ecx, esi
call fcn.0040ede0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x113
jne 0x40ec6a
push 1
mov ecx, esi
call fcn.0040eb70
push edi
mov ecx, esi
call fcn.0040f250
jmp 0x40ec85
cmp ebx, 0x18
jne 0x40eca3
push 1
mov ecx, esi
call fcn.0040eb70
mov ecx, dword [esp + 0x20]
push ecx
push edi
mov ecx, esi
call fcn.0040ff60
mov dword [ebp], 0
mov ecx, esi
call fcn.0040eb60
test eax, eax
je 0x40eca3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 5
lea eax, [esi + 0x84]
jne 0x40ed25
test eax, eax
je 0x40ecba
lea esi, [eax - 0x84]
jmp 0x40ecbc
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x40ecf1
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x40ece2
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40ecf6
test edi, edi
jne 0x40ecf1
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40ecf6
cmp edi, 1
je 0x40ed49
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x10
movsx edx, cx
movsx eax, ax
push edx
push eax
lea ecx, [esi + 0x84]
call fcn.004104c0
pop edi
mov dword [ebp], 0
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x40ed5c
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x40ed49
cmp dword [eax + 0x18], ecx
je 0x40ed49
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ecx + 0x1c], eax
pop edi
mov dword [ebp], 0
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push 0
push ebp
push ecx
push edi
push ebx
push edx
lea ecx, [esi + 0x20]
call fcn.00420570
test eax, eax
je 0x40ed83
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x411f30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x412120
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x3ac
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x4f0]
test eax, eax
je 0x412139
xor edi, edi
jmp 0x412140
mov edi, dword [esp + 0x3bc]
mov eax, dword [0x491818]
push 0xca
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [esp + 0x3c4]
mov edx, dword [esi + 4]
neg ecx
sbb ecx, ecx
mov dword [esp + 0x10], 0x3a8
and ecx, 0xc
mov dword [esp + 0x18], 0x81
add ecx, 7
mov dword [esp + 0x3b4], 0
test edi, edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], 0x7e9
mov dword [esp + 0x330], 0x1388
je 0x412314
mov esi, dword [esp + 0x3c0]
test esi, esi
je 0x412314
push ebx
push 0x100
lea eax, [esp + 0x138]
push esi
push eax
call fcn.0044aebd
push 0x80
lea ecx, [esp + 0x3c]
push esi
push ecx
call fcn.0044aebd
mov edx, dword [0x4881a0]
add esp, 0x18
mov ecx, 0x4917e8
mov dword [esp + 0x10], edx
call fcn.00409d80
mov ecx, eax
call fcn.0041ef20
mov edi, eax
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add edi, 4
mov esi, dword [edi]
cmp eax, esi
je 0x4122ae
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
mov edx, dword [0x4881a4]
jge 0x412228
lea ebx, [eax - 0xc]
cmp ebx, edx
jne 0x41222f
mov ebx, dword [esi - 0xc]
test ebx, ebx
jge 0x412272
mov ebx, dword [esi - 8]
lea ecx, [esp + 0x10]
push ebx
call fcn.00403900
test eax, eax
je 0x4122aa
lea eax, [ebx + ebx]
lea ecx, [ebx + ebx + 2]
cmp ecx, eax
jb 0x41225f
mov edi, dword [esp + 0x10]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], ebx
mov edx, dword [esp + 0x10]
mov word [eax + edx], 0
jmp 0x4122aa
add eax, 0xfffffff4
cmp eax, edx
je 0x41229a
push ecx
call ebp
test eax, eax
jg 0x412290
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004472d3
add esp, 4
mov ecx, dword [0x4881a0]
mov dword [esp + 0x10], ecx
mov edi, dword [edi]
mov dword [esp + 0x10], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
push 0x40
lea edx, [esp + 0x33c]
push eax
push edx
call fcn.0044aebd
mov esi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 1
call esi
test eax, eax
pop ebx
jne 0x4122dd
lea ecx, [esp + 0x10]
push ecx
push eax
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4881a4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x412321
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x412321
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.004472d3
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x3ac
ret 0xc
lea ecx, [esp + 0x10]
push ecx
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop edi
pop esi
pop ebp
add esp, 0x3ac
ret 0xc
Function at 0x412b00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x4917e8
mov dword [esi + 0x4e8], 1
call fcn.00420130
mov ecx, eax
call fcn.0040e6e0
test eax, eax
jne 0x412b38
push 1
push eax
push eax
mov ecx, esi
call fcn.00412120
push 2
mov ecx, esi
call fcn.00411ad0
pop esi
ret
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x4917e8
call fcn.00409d80
mov ecx, eax
call fcn.0041ef20
mov ecx, dword [eax + 4]
add eax, 4
push 0
push ecx
push 1
mov ecx, esi
call fcn.00412120
mov ecx, esi
call fcn.00412810
pop esi
ret
Function at 0x4130e0
Capabilities:
Hide graphical window

Disassembly:
push esi
push 5
mov esi, ecx
push 0
push 0
push 0xffffd8f0
mov eax, dword [esi + 4]
push 0xffffd8f0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x4163a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x41654f
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ebx, 1
jne 0x4163f3
push 1
call fcn.0040a6e0
push ebp
mov ecx, esi
call fcn.00416560
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0040a6d0
test eax, eax
je 0x416474
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x18
jne 0x41642b
push 1
mov ecx, esi
call fcn.0040a6e0
push ebp
push edi
mov ecx, esi
call fcn.00416780
mov edx, dword [esp + 0x24]
mov ecx, esi
mov dword [edx], 0
call fcn.0040a6d0
test eax, eax
je 0x416474
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x111
jne 0x416474
cmp di, 0x6a
jne 0x41644c
mov ecx, esi
call fcn.00417280
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x27d8
jb 0x416474
cmp di, 0x289f
ja 0x416474
and edi, 0xffff
mov ecx, esi
push edi
call fcn.00416ee0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 5
lea eax, [esi + 0x80]
jne 0x4164f2
test eax, eax
je 0x416488
lea esi, [eax - 0x80]
jmp 0x41648a
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x4164bf
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x4164b0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4164c4
test edi, edi
jne 0x4164bf
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4164c4
cmp edi, 1
je 0x416512
mov ecx, ebp
shr ecx, 0x10
movsx edx, cx
movsx eax, bp
push edx
push eax
lea ecx, [esi + 0x80]
call fcn.0041c8a0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x416528
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x416512
cmp dword [eax + 0x18], ecx
je 0x416512
mov edx, dword [eax + 0x14]
mov dword [ebp + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ebp + 0x1c], eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0x18
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
push 0
push edx
push ebp
push edi
push ebx
push eax
lea ecx, [esi + 0x20]
call fcn.00420570
test eax, eax
je 0x41654f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x417eb0
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x410
mov edx, dword [eax]
mov eax, dword [edx - 8]
test eax, eax
jne 0x417ecc
add esp, 0x410
ret 4
cmp eax, 0x104
jle 0x417ede
xor eax, eax
add esp, 0x410
ret 4
push edi
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
push 0x2710
push 0x489afc
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [esp + 4], 0
pop edi
jne 0x417f16
xor eax, eax
add esp, 0x410
ret 4
lea edx, [esp]
push 0x489af8
push edx
call fcn.0044c4c5
add esp, 8
test eax, eax
jne 0x417f35
add esp, 0x410
ret 4
push eax
call fcn.0044c2de
add esp, 4
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
add esp, 0x410
ret 4

Function at 0x419bd0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x419d34
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp edi, 1
jne 0x419c1f
push 1
call fcn.0040a6e0
push ebp
mov ecx, esi
call fcn.00419d40
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0040a6d0
test eax, eax
je 0x419c59
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x111
jne 0x419c59
cmp bx, 0x71
jne 0x419c40
mov ecx, esi
call fcn.0041a220
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp bx, 0x6a
jne 0x419c59
mov ecx, esi
call fcn.0041a230
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 5
lea eax, [esi + 0x80]
jne 0x419cd7
test eax, eax
je 0x419c6d
lea esi, [eax - 0x80]
jmp 0x419c6f
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x419ca4
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp ebx, 2
jne 0x419c95
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x419ca9
test ebx, ebx
jne 0x419ca4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x419ca9
cmp ebx, 1
je 0x419cf7
mov eax, ebp
shr eax, 0x10
movsx ecx, ax
movsx edx, bp
push ecx
push edx
lea ecx, [esi + 0x80]
call fcn.0041c8a0
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x24
jne 0x419d0d
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x419cf7
cmp dword [eax + 0x18], ecx
je 0x419cf7
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push edi
push edx
lea ecx, [esi + 0x20]
call fcn.00420570
test eax, eax
je 0x419d34
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x41aa30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x41ab94
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp edi, 1
jne 0x41aa7f
push 1
call fcn.0040a6e0
push ebp
mov ecx, esi
call fcn.0041aba0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0040a6d0
test eax, eax
je 0x41aab9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x111
jne 0x41aab9
cmp bx, 0x6f
jne 0x41aaa0
mov ecx, esi
call fcn.0041c370
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp bx, 0x6d
jne 0x41aab9
mov ecx, esi
call fcn.0041c3c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 5
lea eax, [esi + 0x80]
jne 0x41ab37
test eax, eax
je 0x41aacd
lea esi, [eax - 0x80]
jmp 0x41aacf
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x41ab04
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp ebx, 2
jne 0x41aaf5
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41ab09
test ebx, ebx
jne 0x41ab04
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41ab09
cmp ebx, 1
je 0x41ab57
mov eax, ebp
shr eax, 0x10
movsx ecx, ax
movsx edx, bp
push ecx
push edx
lea ecx, [esi + 0x80]
call fcn.0041c8a0
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x24
jne 0x41ab6d
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x41ab57
cmp dword [eax + 0x18], ecx
je 0x41ab57
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push edi
push edx
lea ecx, [esi + 0x20]
call fcn.00420570
test eax, eax
je 0x41ab94
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x41f640
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, dword [ecx + 0xec]
sub esp, 0x40c
push ebp
lea ebp, [ecx + 0xec]
mov ecx, dword [eax - 8]
push edi
test ecx, ecx
jne 0x41f807
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x26
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41f807
mov edx, dword [0x4881a0]
mov eax, dword [0x4917e0]
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push esi
lea ecx, [esp + 0x21c]
mov dword [esp + 0x10], edx
mov eax, dword [eax + 8]
push 0x100
push ecx
push 0x96
push eax
call ebx
test eax, eax
jne 0x41f6be
mov word [esp + 0x21c], ax
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x41f6f7
lea eax, [esp + 0x21c]
test eax, eax
je 0x41f6e3
lea ecx, [esp + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x21c]
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.00403710
jmp 0x41f756
push 0x1ff
lea ecx, [esp + 0x14]
mov edi, 0x200
call fcn.004034f0
mov esi, eax
test esi, esi
je 0x41f74b
mov eax, dword [0x4917e0]
push edi
push esi
push 0x96
mov eax, dword [eax + 8]
push eax
call ebx
test eax, eax
jne 0x41f729
mov word [esi], ax
mov ecx, edi
sub ecx, eax
cmp ecx, 1
jg 0x41f74b
add edi, 0x100
lea ecx, [esp + 0x10]
lea edx, [edi - 1]
push edx
call fcn.004034f0
mov esi, eax
test esi, esi
jne 0x41f710
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004035b0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x14]
test eax, eax
jne 0x41f777
xor ebx, ebx
jmp 0x41f784
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov eax, dword [ebp]
cmp dword [eax - 0xc], 1
jg 0x41f792
cmp ebx, dword [eax - 4]
jle 0x41f7a5
mov ecx, ebp
call fcn.004039a0
push ebx
mov ecx, ebp
call fcn.004036b0
test eax, eax
je 0x41f7d6
lea eax, [ebx + ebx]
lea edx, [ebx + ebx + 2]
cmp edx, eax
jb 0x41f7c7
mov edi, dword [ebp]
mov ecx, eax
mov edx, ecx
lea esi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp]
mov dword [ecx - 8], ebx
mov edx, dword [ebp]
mov word [edx + eax], 0
mov eax, dword [esp + 0x10]
mov edx, dword [0x4881a4]
pop esi
pop ebx
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41f807
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41f807
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.004472d3
add esp, 4
mov eax, ebp
pop edi
pop ebp
add esp, 0x40c
ret
Function at 0x41f820
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0044c0a0
mov eax, dword [0x4881a0]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1010]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push edi
test eax, eax
je 0x41f8d8
lea ecx, [esp + 0x14]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x14]
test edx, edx
jne 0x41f868
xor ebx, ebx
jmp 0x41f875
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov edi, dword [esp + 0x10]
cmp dword [edi - 0xc], 1
jg 0x41f884
cmp ebx, dword [edi - 4]
jle 0x41f8a3
lea ecx, [esp + 0x10]
call fcn.004039a0
push ebx
lea ecx, [esp + 0x14]
call fcn.004036b0
test eax, eax
je 0x41f97e
mov edi, dword [esp + 0x10]
lea eax, [ebx + ebx]
lea ecx, [ebx + ebx + 2]
cmp ecx, eax
jb 0x41f8c6
mov ecx, eax
lea esi, [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov dword [edi - 8], ebx
mov ecx, dword [esp + 0x10]
mov word [eax + ecx], 0
jmp 0x41f97e
call fcn.0041fa30
mov esi, eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esi]
cmp eax, ebx
je 0x41f982
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
mov edx, dword [0x4881a4]
jge 0x41f904
lea edi, [eax - 0xc]
cmp edi, edx
jne 0x41f90b
mov edi, dword [ebx - 0xc]
test edi, edi
jge 0x41f946
mov esi, dword [ebx - 8]
lea ecx, [esp + 0x10]
push esi
call fcn.00403900
test eax, eax
je 0x41f97e
mov eax, dword [esp + 0x10]
lea edi, [esi + esi]
push edi
lea edx, [esi + esi + 2]
push ebx
push edx
push eax
call fcn.004029e0
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov dword [ecx - 8], esi
mov edx, dword [esp + 0x10]
mov word [edi + edx], 0
jmp 0x41f97e
add eax, 0xfffffff4
cmp eax, edx
je 0x41f972
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41f968
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004472d3
add esp, 4
mov ecx, dword [0x4881a0]
mov dword [esp + 0x10], ecx
mov eax, dword [esi]
mov dword [esp + 0x10], eax
add eax, 0xfffffff4
push eax
call ebp
mov eax, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
mov esi, dword [esp + 0x1018]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x41f99a
push ecx
mov dword [esi], eax
call ebp
jmp 0x41f9e3
mov edx, dword [0x4881a0]
mov ebp, eax
test eax, eax
mov dword [esi], edx
jne 0x41f9ac
xor edi, edi
jmp 0x41f9b5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
mov ecx, esi
call fcn.00403900
test eax, eax
je 0x41f9e3
mov ecx, dword [esi]
lea ebx, [edi + edi]
push ebx
lea eax, [edi + edi + 2]
push ebp
push eax
push ecx
call fcn.004029e0
mov edx, dword [esi]
add esp, 0x10
mov dword [edx - 8], edi
mov eax, dword [esi]
mov word [eax + ebx], 0
mov eax, dword [esp + 0x10]
mov edx, dword [0x4881a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41fa12
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41fa12
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004472d3
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
Function at 0x4213b0
Capabilities:
Get file version info

Disassembly:
mov eax, 0x400c
call fcn.0044c0a0
mov ax, word [0x491808]
push esi
push edi
mov word [esp + 0x14], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [esp + 0x4020], 0x30
jb 0x42146c
mov esi, dword [esp + 0x4018]
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x42146c
lea edx, [esp + 0x14]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42146c
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x4886c0
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42146c
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
mov eax, dword [esp + 0x4024]
shr edx, 0x10
push ecx
push edx
push str._d._d._d._d
push eax
call fcn.0044b699
add esp, 0x18
mov eax, 1
pop edi
pop esi
add esp, 0x400c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400c
ret
Function at 0x421b70
Capabilities:
Check if file exists
Delete file
Get file attributes
Get file size
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov eax, dword [ebx + 4]
push edi
test eax, eax
jne 0x421b87
mov eax, 0x47ca58
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x421bb0
test al, 0x10
jne 0x421bb0
mov eax, dword [ebx + 4]
mov ebp, 1
test eax, eax
jne 0x421ba8
mov eax, 0x47ca58
push 0
push 0
push 3
jmp 0x421bc4
mov eax, dword [ebx + 4]
xor ebp, ebp
test eax, eax
jne 0x421bbe
mov eax, 0x47ca58
push 0
push 0
push 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 0xc0000000
push eax
call edi
mov esi, dword [esp + 0x1c]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x421c2d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 4]
test ebp, ebp
je 0x421c01
test eax, eax
jne 0x421bf9
mov eax, 0x47ca58
push 0
push 0
push 3
jmp 0x421c10
test eax, eax
jne 0x421c0a
mov eax, 0x47ca58
push 0
push 0
push 1
push 0
push 0
push 0xc0000000
push eax
call edi
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x421c2d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
test ebp, ebp
jne 0x421c6c
lea ecx, [esp + 0x20]
push ebp
push ecx
lea edx, [esp + 0x24]
push 2
push edx
push eax
mov byte [esp + 0x30], 0xff
mov byte [esp + 0x31], 0xfe
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x421c6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test eax, eax
ja 0x421c8b
cmp ecx, 2
jb 0x421c97
test eax, eax
ja 0x421c97
cmp ecx, 0x1e000
jbe 0x421ccb
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 4]
test eax, eax
jne 0x421cac
mov eax, 0x47ca58
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x421ccb
push ebx
push esi
call fcn.00421b70
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret