joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406470
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x1074
call fcn.00412270
mov eax, dword [esp + 0x1078]
push ebp
xor ebp, ebp
push esi
push ebp
push 0x80
push 3
push ebp
push 7
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4064ae
pop esi
xor eax, eax
pop ebp
add esp, 0x1074
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4064d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x1074
ret
push ebx
push edi
lea edx, [esp + 0x1c]
push ebp
push edx
mov dword [esp + 0x18], ebp
call fcn.00408450
mov eax, dword [esp + 0x20]
add esp, 8
cmp eax, ebp
ja 0x4064ff
cmp dword [esp + 0x14], 0x200000
jbe 0x4065d0
cmp dword [esp + 0x1090], ebp
jne 0x4065d0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
xor edi, edi
mov ebp, 1
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x8c]
push 0x1000
push ecx
push esi
call ebx
test eax, eax
je 0x4065cc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4065cc
push eax
lea edx, [esp + 0x88]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004084b0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add edi, ecx
cmp edi, 0x100000
jb 0x406519
push 2
push 0
push 0xfff00000
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40662f
xor edi, edi
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x8c]
push 0x1000
push edx
push esi
call ebx
test eax, eax
je 0x4065cc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4065cc
push eax
lea eax, [esp + 0x88]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.004084b0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add edi, ecx
cmp edi, 0x100000
jb 0x406583
jmp 0x40662f
xor ebp, ebp
jmp 0x40662f
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x10]
push ebp
push edx
lea eax, [esp + 0x8c]
push 0x1000
push eax
push esi
call edi
test eax, eax
je 0x40662f
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40662a
lea ecx, [esp + 0x84]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.004084b0
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x84]
push ebp
push eax
push 0x1000
push ecx
push esi
call edi
test eax, eax
jne 0x4065f0
jmp 0x40662f
mov ebp, 1
lea edx, [esp + 0x1c]
push edx
call fcn.00408ef0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
test ebp, ebp
jne 0x406654
pop esi
xor eax, eax
pop ebp
add esp, 0x1074
ret
mov eax, dword [esp + 0x1084]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
pop esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x70]
pop ebp
mov dword [eax + 4], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, 1
add esp, 0x1074
ret
Function at 0x406690
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x412f08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [esp]
push esi
push eax
call fcn.00406800
add esp, 4
mov ecx, dword [esp + 4]
mov dword [esp + 0x24], 0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4066f0
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
xor edx, edx
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], edx
lea eax, [esp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
push edx
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.00406470
add esp, 0xc
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call fcn.00406870
mov eax, dword [eax]
push str.dfa18e9b38fb73f25cc53efa61d6221e
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x406766
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x406798
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push str.CreateInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4067cb
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
call eax
xor edx, edx
lea ecx, [esp + 4]
test eax, eax
setne dl
mov dword [0x41aae8], eax
mov esi, edx
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x407b50
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x413250
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
add ecx, 0xc
push esi
push ecx
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_2
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0xc]
mov edx, dword [ecx - 8]
test edx, edx
je 0x407ba4
push eax
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator_2
push 0x5c
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator
mov edx, dword [esp + 4]
push edx
call fcn.004046a0
add esp, 4
test eax, eax
jne 0x407bf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 8]
push eax
push str.NewTempFile___Create_directory__s_failed_with_error_0x_08x.
call fcn.00401f00
add esp, 0xc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_2
push esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call sub.MFC42u.DLL_CString::operator_2
lea edx, [esp + 8]
lea ecx, [esi + 0x18]
push edx
call fcn.00412004
mov ecx, dword [esp + 8]
mov eax, dword [esi + 0x10]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x407c82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esi + 0x10]
push edx
push eax
push str.NewTempFile___Copy_file__s_to__s_failed_with_error_0x_08x._n
call fcn.00401f00
add esp, 0x10
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x407ec0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
push 0x80
mov ecx, esi
call sub.MFC42u.DLL_CString::GetBufferSetLength
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
push ebx
push 0x80
push eax
push 0x41a6c4
push 0x419b40
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov eax, dword [esi]
push 4
push eax
mov ecx, edi
call fcn.00406d20
test eax, eax
jne 0x407f2a
mov eax, dword [esi]
push ebx
push ebp
push eax
push str.GetFileVersionFromConfigFile___The_version__s__format_of_the_file__s_in_config_file__s_is_invalid._n
call fcn.00401f00
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x407f40
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x407f75
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 4

Function at 0x408050
Capabilities:
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x413298
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
mov edx, dword [eax - 8]
test edx, edx
je 0x4080d3
add ecx, 4
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString_2
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0
call sub.MFC42u.DLL_CString::operator_2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004046a0
add esp, 4
mov dword [esp + 0x10], 0xffffffff
test eax, eax
lea ecx, [esp + 0x18]
jne 0x4080ce
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x408118
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [esi + 0x18]
push edx
push eax
push str.UpdateFile___Move_file__s_to__s_failed_with_error_0x_08x._n
call fcn.00401f00
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 8]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x40eaa0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
mov ebp, ecx
je 0x40eb22
call fcn.0040d130
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
or eax, 0xffffffff
push 0
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
add esp, 0x1c
test edi, edi
jg 0x40eaf8
push 0
push 0
push 0
push 0xc
mov ecx, ebp
call fcn.0040a5b0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
lea eax, [edi + 1]
push eax
call sub.MFC42u.DLL_operatornew
push ebx
mov esi, eax
push 1
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x40eb3a
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebp
call fcn.0040a5b0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [esi + edi], 0
mov dl, byte [esi]
test dl, dl
mov eax, esi
mov ecx, esi
je 0x40eb67
mov dl, byte [eax]
cmp dl, 0xd
jne 0x40eb5e
mov byte [ecx], 0xa
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, 0xa
jne 0x40eb62
jmp 0x40eb61
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x40eb48
mov eax, dword [esp + 0x18]
mov byte [ecx], 0
mov edx, dword [ebp]
push eax
push 0
push esi
mov ecx, ebp
call dword [edx + 8]
push esi
call sub.MFC42u.DLL_operatordelete
mov cl, byte [ebp + 0x38]
add esp, 4
xor eax, eax
pop edi
pop esi
test cl, cl
pop ebp
pop ebx
sete al
ret 8
Function at 0x72c154
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 8
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
not esi
mov edx, 0xff
jb 0x72c22e
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [ecx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, edx
mov esi, dword [ebx*4 + 0x68cd1eb8]
xor ebx, ebx
xor esi, edi
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + 0x68cd1eb8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc ecx
mov bl, byte [ecx]
xor ebx, edi
and ebx, edx
mov esi, dword [ebx*4 + 0x68cd1eb8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + 0x68cd1eb8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc ecx
mov bl, byte [ecx]
xor ebx, edi
and ebx, edx
mov esi, dword [ebx*4 + 0x68cd1eb8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + 0x68cd1eb8]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc ecx
mov bl, byte [ecx]
xor ebx, edi
and ebx, edx
mov esi, dword [ebx*4 + 0x68cd1eb8]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + 0x68cd1eb8]
shr esi, 8
xor esi, edi
inc ecx
dec eax
jne 0x72c177
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x72c24e
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, edx
mov eax, dword [eax*4 + 0x68cd1eb8]
shr esi, 8
xor esi, eax
inc ecx
dec dword [ebp + 0x10]
jne 0x72c234
mov eax, esi
not eax
pop esi
pop ebp
ret 0xc

Function at 0x72c257
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x58]
add dword [esi + 0x5c], ecx
test ecx, ecx
not eax
jbe 0x72c29b
push ebx
push edi
mov edi, dword [esp + 0x14]
mov edx, ecx
mov ecx, dword [esp + 0x18]
mov bl, byte [ecx]
mov byte [edi], bl
xor ebx, ebx
mov bl, byte [ecx]
inc edi
xor ebx, eax
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x68cd1eb8]
shr eax, 8
xor eax, ebx
inc ecx
dec edx
jne 0x72c278
pop edi
pop ebx
not eax
mov dword [esi + 0x58], eax
pop esi
ret 0x10
Function at 0x409d4d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x38
mov eax, 0x20
dec eax
lea ebp, [0xcc58]
dec eax
lea edi, [0xc9b9]
dec ecx
mov esp, ecx
mov word [esp + 0x20], ax
dec eax
lea esi, [0xc9ab]
call fcn.0041387d
dec eax
mov edx, dword [0x131f6]
dec eax
lea ecx, [eax*8 + 8]
dec eax
lea ebx, [0xc99d]
call fcn.0040bc0d
dec esp
lea ebx, [0xc98d]
inc ebp
xor ecx, ecx
inc ebp
xor edx, edx
nop dword [eax + eax]
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
je 0x409e43
inc ecx
cmp ch, 0x87
je 0x409f5d
jg 0x409e6d
inc ecx
cmp ch, 0x83
je 0x409f31
jg 0x409ed1
inc ecx
cmp ch, 0x81
je 0x409f4d
inc ecx
cmp ch, 0x82
jne 0x409eed
inc ebp
movsx edx, byte [esp + 1]
dec ebp
lea eax, [esp + 2]
mov edx, 0x24
inc esp
mov ecx, edx
and ecx, 0xf
cmp cl, 0xa
dec esp
mov ecx, ebx
dec eax
cmovne ecx, ebx
dec eax
add ecx, 1
dec ebp
mov esp, eax
nop
dec eax
add eax, 1
dec eax
add ecx, 1
mov byte [eax - 1], dl
movzx edx, byte [ecx - 1]
test dl, dl
jne 0x409e1d
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
jne 0x409dc0
inc ecx
and ecx, 1
je 0x409e50
mov byte [eax], 0x22
dec eax
add eax, 1
mov byte [eax], 0
dec eax
mov dword [0x13123], eax
dec eax
add esp, 0x38
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
ret
inc ecx
cmp ch, 0x24
je 0x409f78
jle 0x409efd
inc ecx
cmp ch, 0x3d
jne 0x409f91
inc ebp
test edx, edx
je 0x409fac
inc esp
mov edx, edx
inc ebx
lea ecx, [ecx + ecx]
and edx, 0xf
cmp edx, 1
dec eax
arpl dx, dx
inc esp
cmovne ecx, ecx
inc ecx
test dl, 0x10
dec eax
lea ecx, [ebp + edx*4]
je 0x409fb4
mov byte [eax], 0x3a
movzx edx, byte [ecx]
dec eax
add eax, 1
dec eax
add ecx, 1
test dl, dl
dec ebp
mov esp, eax
jne 0x409e1d
jmp 0x409dad
inc ecx
cmp ch, 0x84
je 0x409f1d
inc ecx
cmp ch, 0x86
mov edx, 0x24
dec eax
lea ecx, [0xc841]
je 0x409e14
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x409dad
inc ecx
cmp ch, 0x88
jne 0x409f6e
inc ecx
xor ecx, 1
dec ebp
mov esp, eax
inc ecx
mov ebp, 0x22
inc esp
mov byte [eax], ch
dec eax
add eax, 1
jmp 0x409dad
dec eax
lea ecx, [0xc813]
dec ebp
mov esp, eax
mov edx, 0x24
jmp 0x409e1d
inc ecx
test cl, 1
dec eax
mov ecx, esi
dec eax
cmovne ecx, edi
inc ecx
sar ecx, 1
inc ebp
xor edx, edx
movzx edx, byte [ecx]
jmp 0x409ebd
inc ebp
movzx ebp, byte [esp + 1]
dec ecx
add esp, 2
jmp 0x409f10
mov edx, 0x29
dec eax
lea ecx, [0xc7c3]
jmp 0x409e14
inc ecx
cmp ch, 0x22
jne 0x409eed
mov byte [eax], 0x5c
inc esp
mov byte [esp + 0x20], ch
inc esp
mov edx, ebp
dec eax
add eax, 1
dec eax
lea ecx, [esp + 0x20]
jmp 0x409e14
inc ecx
cmp ch, 0x5c
je 0x409f78
inc ecx
cmp ch, 0x27
je 0x409f78
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x409dad
dec ebp
mov esp, eax
jmp 0x409f10
movzx edx, byte [ecx]
jmp 0x409ebd
Function at 0x406c70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
lea edi, [ebp - 0x248]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], 0
je 0x406d28
cmp dword [ebp + 0xc], 0
ja 0x406d28
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x200
lea eax, [ebp - 0x208]
push eax
call fcn.00421400
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x200
jb 0x406cf1
push str.nBuf___sizeof_szBuffer_
push 0
push 0x142
push str.d:progra2micros1_vc98_atlinclude_atlbase.h
push 2
call fcn.00420070
add esp, 0x14
cmp eax, 1
jne 0x406cf1
int3
xor ecx, ecx
test ecx, ecx
jne 0x406cc7
mov esi, esp
push str.ATL:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 4], 0
pop edi
pop esi
pop ebx
add esp, 0x248
cmp ebp, esp
call fcn.0041fa50
mov esp, ebp
pop ebp
ret
Function at 0x406ec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
lea edi, [ebp - 0x60]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.004078d0
mov esi, esp
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 4], eax
mov esi, esp
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 8], 0
je 0x406f63
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0xc], eax
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x407014
mov esi, esp
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0x18], eax
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00407050
add esp, 8
mov dword [ebp - 0x20], eax
mov esi, esp
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x1c]
je 0x407001
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, esp
call fcn.0041fa50
cmp dword [ebp - 0x10], 0
je 0x407033
cmp dword [ebp - 8], 0
je 0x407033
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, esp
call fcn.0041fa50
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0x60
cmp ebp, esp
call fcn.0041fa50
mov esp, ebp
pop ebp
ret 0x14
Function at 0x416b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push str.CDownloadTracker::Initialize_n
call fcn.00416ce0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xbc2
mov ecx, 0x444080
call fcn.00407a20
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov esi, esp
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp esi, esp
call fcn.0041fa50
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
mov esi, esp
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp esi, esp
call fcn.0041fa50
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
mov esi, esp
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp esi, esp
call fcn.0041fa50
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], eax
call fcn.0041a110
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], eax
mov esi, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4178a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.0041fa50
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, esp
call fcn.0041fa50
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
add esp, 0x48
cmp ebp, esp
call fcn.0041fa50
mov esp, ebp
pop ebp
ret 4

Function at 0x416ce0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
lea edi, [ebp - 0x248]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x200
lea eax, [ebp - 0x208]
push eax
call fcn.00421400
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x200
jb 0x416d4d
push str.nBuf___sizeof_szBuffer_
push 0
push 0x132
push str.d:progra2micros1_vc98_atlinclude_atlbase.h
push 2
call fcn.00420070
add esp, 0x14
cmp eax, 1
jne 0x416d4d
int3
xor ecx, ecx
test ecx, ecx
jne 0x416d23
mov esi, esp
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.0041fa50
mov dword [ebp - 4], 0
pop edi
pop esi
pop ebx
add esp, 0x248
cmp ebp, esp
call fcn.0041fa50
mov esp, ebp
pop ebp
ret