joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d190
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x5b3ef4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x56d28b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x56d28b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x56d1ea
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x56d1c8
jmp 0x56d28b
cmp edx, 0x200
jae 0x56d2f1
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x56d28b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x56d28a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x56d28a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x56d2d3
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x56d270
pop edi
mov eax, dword [0x5b95dc]
test eax, eax
jne 0x56d2b1
push str.setlocale
call fcn.0056e3d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x56d2ac
or eax, 0xffffffff
mov dword [0x5b95dc], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x56d2df
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053287b
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x56d28a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0053287b
mov esp, ebp
pop ebp
ret
call fcn.00532b05
int3

Function at 0x401756
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401795
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401795
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401795
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401795
cmp dword [ecx + 0x74], 0xe
jbe 0x401795
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c01d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c01d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4057b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x46a14c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x4057d2
push 0
push 0
call edi
mov eax, dword [0x46a14c]
cmp esi, 0x845013
jne 0x4057e9
mov eax, dword [0x423930]
add eax, 0xa231
mov dword [0x46a14c], eax
cmp eax, 0x141
jne 0x405804
mov dword [0x424fe8], 0xec58acac
mov dword [0x424fec], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x4057c0
call fcn.00405530
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40140b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401442
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40143e
jmp 0x401430
cmp esi, eax
jae 0x401442
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401430
cmp esi, eax
jb 0x401449
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401cf0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b4300]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x24], 0x10
lea eax, [ebx + 0x10]
jb 0x401d0b
mov eax, dword [eax]
push esi
push edi
push eax
mov eax, dword [ebx + 4]
push 0x2712
push eax
call fcn.0051a4b0
add esp, 0xc
mov edi, 0x53
mov eax, str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10.6__rv:2.0.1__Gecko_20100101_Firefox_4.0.1
lea esi, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
call fcn.00402030
mov eax, dword [ebp - 0x20]
mov esi, 0x10
cmp dword [ebp - 0xc], esi
jae 0x401d53
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 4]
push eax
push 0x2722
push ecx
call fcn.0051a4b0
mov edx, dword [ebx + 4]
push 5
push 0x44
push edx
call fcn.0051a4b0
mov eax, dword [ebx + 4]
push 1
push 0x34
push eax
call fcn.0051a4b0
mov ecx, dword [ebx + 4]
push 1
push 0x63
push ecx
call fcn.0051a4b0
mov edx, dword [ebx + 4]
push 0
push 0x2f
push edx
call fcn.0051a4b0
mov eax, dword [ebx + 4]
push 0x401ef0
push 0x4e2b
push eax
call fcn.0051a4b0
mov ecx, dword [ebx + 4]
add esp, 0x48
push ebx
push 0x2711
push ecx
call fcn.0051a4b0
mov edx, dword [ebx + 4]
push 0
push 0x40
push edx
call fcn.0051a4b0
mov eax, dword [ebx + 4]
push 0
push 0x51
push eax
call fcn.0051a4b0
add esp, 0x24
cmp dword [ebp - 0xc], esi
pop edi
pop esi
jb 0x401deb
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00407df1
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
Function at 0x402c50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor esi, esi
push esi
push str.D___Vtfst__Qvcmjd__fo_ebu
call fcn.00552eb8
mov eax, dword [ebp + 8]
add esp, 8
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c70
sub eax, edx
push 0x5946d4
push str.D___Vtfst__Qvcmjd__fo_ebu
mov dword [ebp - 8], eax
call fcn.0050062e
push 0x594544
push str.D___Vtfst__Qvcmjd__ef_ebu
mov edi, eax
call fcn.0050062e
push edi
mov ebx, eax
call fcn.00500a76
add esp, 0x14
test eax, eax
jne 0x402cf9
jmp 0x402cb0
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.00500d10
push edi
call fcn.00500a76
add esp, 0x14
test eax, eax
jne 0x402cec
mov eax, esi
cdq
idiv dword [ebp - 8]
mov ecx, dword [ebp + 8]
push ebx
push 1
lea eax, [ebp - 1]
push 1
push eax
mov dl, byte [edx + ecx]
xor byte [ebp - 1], dl
call fcn.0050079c
add esp, 0x10
inc esi
push edi
call fcn.00500a76
add esp, 4
test eax, eax
je 0x402cb0
push edi
call fcn.005004fe
push ebx
call fcn.005004fe
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402d10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5b4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00407bc0
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x402d7d
call fcn.00407cf0
test eax, eax
je 0x402d90
cmp dword [ebx], 1
je 0x402d5e
mov dword [0x5bc1cc], 0x80000
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
call fcn.00407b60
mov dword [0x5bc1cc], eax
cmp esi, edi
je 0x402d74
call fcn.00407ca0
push ebx
call fcn.00407df1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], al
mov dword [ebp - 0x10], edi
cmp dword [ebx], 1
je 0x402dca
mov edi, ebx
mov dword [0x5bc1cc], 0x80000
call fcn.00407d60
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 4]
mov ecx, dword [esi]
or edx, 0xffffffff
cmp dword [ecx + 4], edx
jg 0x402dde
mov ecx, 0x10000
jmp 0x402e21
cmp dword [esi + 4], edx
je 0x402def
mov edi, ecx
call fcn.00406f00
xor edi, edi
or edx, 0xffffffff
mov eax, dword [esi]
mov dword [esi + 4], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov dword [0x5bc1cc], ecx
cmp ecx, edi
je 0x402e45
mov edi, ebx
call fcn.00407d60
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [ebp - 0x13c], eax
cmp eax, edi
jle 0x402ec3
jmp 0x402e60
mov dword [ebp - 0x138], edi
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x10], edi
cmp dword [ebx], 1
je 0x402e81
mov dword [0x5bc1cc], 0x80000
jmp 0x402e95
mov ecx, dword [ebx + 4]
push esi
lea edx, [ebp - 0x138]
call fcn.004070f0
mov dword [0x5bc1cc], eax
cmp dword [ebx], 1
je 0x402ea6
mov dword [0x5bc1cc], 0x80000
jmp 0x402eba
mov ecx, dword [ebx + 4]
push esi
lea edx, [ebp - 0x134]
call fcn.00407820
mov dword [0x5bc1cc], eax
inc esi
cmp esi, dword [ebp - 0x13c]
jl 0x402e60
cmp dword [ebx], 1
je 0x402ed4
mov dword [0x5bc1cc], 0x80000
jmp 0x402ef3
mov esi, dword [ebx + 4]
call fcn.00407b60
mov dword [0x5bc1cc], eax
cmp esi, edi
je 0x402eea
call fcn.00407ca0
push ebx
call fcn.00407df1
add esp, 4
push str.D___Vtfst__Qvcmjd__ef_ebu
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
Function at 0x4055a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4055a7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40567d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x595f10]
add ecx, 8
sub edx, 8
dec esi
jne 0x4055c0
pop edi
test edx, edx
je 0x40569a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x595f10]
inc ecx
dec edx
jne 0x405681
not eax
pop esi
ret

Function at 0x4056a0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x595f10]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x595f10]
mov dword [edx + 8], ecx
ret

Function at 0x4056f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x595f10]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x595f10]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x405e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ebx
imul esi, dword [ebp + 0xc]
cmp byte [edi], 0
je 0x405e96
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405e8c
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ebx
pop esi
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x405ea7
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.00502740
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop esi
pop ebp
ret
Function at 0x405ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x405f03
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405efe
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x405f2e
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x405f15
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [ebp - 1]
push eax
call fcn.00502740
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x405f43
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x405f3d
cmp byte [esi + 8], 0
je 0x405f3d
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x405ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [esi], 0
je 0x406037
cmp byte [esi + 1], 0
je 0x40603f
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x406052
cmp byte [esi + 1], 0
je 0x406046
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
jmp 0x40605a
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x406011
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x40605a
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 8], edi
cmp ebx, edi
jae 0x40606c
mov dword [ebp - 8], ebx
mov edi, ebx
push 0x404
call fcn.00500f6e
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x406089
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], 0xffffffff
cmp edi, eax
jbe 0x40619d
jmp 0x4060a9
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, edi
ja 0x4060b8
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], eax
cmp ebx, 0x404
jbe 0x4060cf
mov ebx, 0x404
cmp byte [esi], 0
je 0x4060f4
cmp byte [esi + 1], 0
je 0x40619d
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4060f7
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebx
je 0x406120
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40611b
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x406149
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x406131
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x10]
push edi
add ecx, eax
push ecx
push edx
call fcn.00502740
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x40619d
lea eax, [ebx - 3]
test eax, eax
js 0x40618b
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x40617f
cmp byte [eax + ecx + 1], 0x4b
jne 0x40617f
cmp byte [eax + ecx + 2], 5
jne 0x40617f
cmp byte [eax + ecx + 3], 6
je 0x406185
test eax, eax
jns 0x406160
jmp 0x40618b
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40619d
mov edx, dword [ebp - 8]
cmp dword [ebp - 0xc], edx
jb 0x4060a0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00500f34
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi], 0
push edi
jne 0x4070e3
cmp dword [esi + 4], 0xffffffff
jne 0x4070e3
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407087
sub eax, edx
mov al, byte [eax + esi + 0x13f]
cmp al, 0x5c
je 0x4070b1
cmp al, 0x2f
je 0x4070b1
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4070a0
mov ax, word [0x594a34]
mov word [edi], ax
lea ecx, [ebp - 4]
push ecx
call fcn.00405dc0
add esp, 4
test eax, eax
jne 0x4070c9
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
call fcn.004061c0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x407720
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5b4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x407754
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407754
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x40780e
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x40776b
cmp al, 0x5c
jne 0x40776d
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x407763
cmp esi, ebx
je 0x4077a1
sub esi, ebx
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00502740
lea ecx, [ebp - 0x20c]
push ecx
push edi
mov byte [ebp + esi - 0x20c], 0
call fcn.00407720
add esp, 0x14
mov byte [ebp - 0x108], 0
test edi, edi
je 0x4077c0
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4077b6
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4077c4
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4077d4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x40780e
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ffc05
mov esp, ebp
pop ebp
ret
Function at 0x41f827
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x41f841
call fcn.00432973
mov esi, dword [eax + 0xc]
push dword [0x5b66b0]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41f85f
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x41f857
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x41f88c
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x41f859
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0041f755
mov esi, eax
jmp 0x41f87e

Function at 0x42953a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x554ae4
call fcn.005017b4
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x42955f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4295b1
call fcn.00407e7d
push eax
lea ecx, [ebp - 0x10]
call fcn.00401a20
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00501ade
push eax
call fcn.00408708
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a50
mov eax, esi
call fcn.0050188c
ret 8

Function at 0x43973a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x439781
call fcn.00432973
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x439781
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43979d
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043923f
mov esi, eax
test edi, edi
je 0x43979b
test ebx, ebx
je 0x43979b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x445120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00432973
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x445159
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00444d62
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4451b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4451db
cmp dword [edi + 0x74], 0
jne 0x4451db
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00432973
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00445178
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4470ab
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00446d6a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4470f5
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040d2f6
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040bda7
jmp 0x447100
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0045050d
pop edi
pop esi
pop ebp
ret 0xc