joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404320
Capabilities:
Enumerate processes
Get file system object information
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4fc
mov eax, dword [0x448370]
push ebx
push esi
push edi
push str.Game5178.exe
lea ecx, [esp + 0x10]
mov dword [esp + 0x508], eax
call fcn.00401990
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jne 0x40438f
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40437a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
mov ecx, dword [esp + 0x504]
call fcn.00418507
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x20], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40442e
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x101
xor eax, eax
mov ecx, 0xad
lea edi, [esp + 0x24c]
push 0x2b4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x250]
push ecx
push eax
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x3c]
push eax
push ecx
call fcn.0041874d
add esp, 8
test eax, eax
jne 0x40441f
mov edx, dword [esp + 0x20]
push edx
push eax
push 0x1f0fff
call ebx
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4043b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404453
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x504]
mov eax, 1
call fcn.00418507
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406020
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 0x34]
call fcn.004075b0
mov byte [esi + 0x30], 0
mov ecx, esi
pop esi
jmp 0x407640
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x407667
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4075f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
je 0x407671
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 8]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4060a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43588a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x4383a8
mov dword [esp + 0x10], 6
mov byte [esi + 0x30], 1
call fcn.004075b0
mov eax, dword [esi + 0x44]
sub eax, 0x10
mov byte [esp + 0x10], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x2c]
sub eax, 0x10
mov byte [esp + 0x10], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406118
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x24]
sub eax, 0x10
mov byte [esp + 0x10], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40613a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x20]
sub eax, 0x10
mov byte [esp + 0x10], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40615c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x1c]
sub eax, 0x10
mov byte [esp + 0x10], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40617e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x10]
sub eax, 0x10
mov byte [esp + 0x10], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4061a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.00407590
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x406b28
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43588a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00407560
lea edi, [esi + 0x10]
xor ebx, ebx
push 0x4377f0
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], 0x4383a8
call fcn.00401990
push 0x4377f0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x20], 1
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], 2
call fcn.00401990
push 0x4377f0
lea ecx, [esi + 0x20]
mov byte [esp + 0x20], 2
call fcn.00401990
push 0x4377f0
lea ecx, [esi + 0x24]
mov byte [esp + 0x20], 3
call fcn.00401990
push 0x4377f0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x20], 4
mov dword [esi + 0x28], ebx
call fcn.00401990
mov byte [esp + 0x1c], 5
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
lea ebp, [esi + 0x44]
call fcn.00427348
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp], eax
push 0x4377f0
mov byte [esp + 0x20], 6
mov byte [esi + 0x40], bl
mov byte [esi + 0x41], bl
mov byte [esi + 0x42], bl
mov byte [esi + 0x43], bl
call fcn.00417cae
add esp, 4
push eax
push 0x4377f0
mov ecx, ebp
call fcn.004016a0
push 0x4383b0
call fcn.00417cae
add esp, 4
push eax
push 0x4383b0
mov ecx, edi
call fcn.004016a0
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x824
mov eax, dword [0x448370]
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x824], ecx
jne 0x407c62
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x438604
push eax
push edi
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x407ade
push 0x441e14
lea ecx, [ebp - 0x830]
push ecx
mov dword [ebp - 0x830], ebx
call fcn.00419017
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x81c], eax
jne 0x407b07
push 0x441e14
lea edx, [ebp - 0x820]
push edx
mov dword [ebp - 0x820], ebx
call fcn.00419017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 0x818]
push eax
push 1
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 0x818]
cmp eax, edi
jne 0x407b4d
push 0x441e14
lea ecx, [ebp - 0x82c]
push ecx
mov dword [ebp - 0x82c], edi
call fcn.00419017
mov edx, dword [eax]
push edi
push esi
push ebx
push eax
call dword [edx + 0x10]
mov ebx, dword [ebp - 0x818]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, edi
je 0x407b80
lea eax, [esi + 4]
push eax
push ebx
mov dword [esi], 0x43834c
mov dword [eax], edi
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [esi + 8], eax
jmp 0x407b82
xor esi, esi
cmp esi, edi
mov eax, dword [ebp - 0x824]
mov dword [eax + 4], esi
je 0x407bbd
mov eax, dword [esi + 8]
cmp eax, edi
mov dword [esi + 8], edi
jne 0x407bbd
mov eax, dword [ebp - 0x818]
cmp eax, edi
je 0x407ba9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
jmp 0x407c64
push 0x441e14
lea eax, [ebp - 0x828]
push eax
mov dword [ebp - 0x828], edi
call fcn.00419017
lea ecx, [ebp + 8]
call fcn.00402ab0
mov word [ebp - 0x814], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x812]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4385d0
lea edx, [ebp - 0x814]
push 0x400
push edx
mov byte [ebp - 4], 2
stosw word es:[edi], ax
call fcn.00418d45
add esp, 0x10
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp + 8]
call fcn.004062b0
mov ecx, dword [ebp + 8]
push 0
push 0
push ecx
call fcn.0042f440
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x407c43
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x81c]
test eax, eax
je 0x407c54
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp + 8]
call fcn.00401270
mov eax, 0x407c62
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00418507
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40911b
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x409213
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x439a78]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x409136
test edi, edi
je 0x409232
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x439a78]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x409217
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret

Function at 0x409240
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [edx]
xor eax, eax
mov al, byte [esp + 8]
push esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x439a78]
shr ecx, 8
xor eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov esi, dword [eax*4 + 0x439a78]
shr ecx, 8
xor ecx, esi
mov dword [edx + 8], ecx
pop esi
ret

Function at 0x4092a0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi + 8]
mov eax, edx
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov al, byte [esp + 0xc]
shr ecx, 8
xor al, cl
xor ecx, ecx
push edi
mov edi, dword [esi]
mov cl, al
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x439a78]
shr edi, 8
xor ecx, edi
mov edi, dword [esi + 4]
mov dword [esi], ecx
and ecx, 0xff
add ecx, edi
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
mov edi, dword [ecx*4 + 0x439a78]
shr edx, 8
xor edx, edi
pop edi
mov dword [esi + 8], edx
pop esi
ret
Function at 0x409730
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov cl, byte [ebx]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x409771
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409766
mov byte [ebx + 8], 1
mov eax, dword [esp + 0x10]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
lea esi, [edx + eax]
cmp esi, ecx
push edi
jbe 0x409784
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
add esi, edx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
xor edx, edx
div ebp
pop ebp
mov dword [ebx + 0x1c], ecx
pop ebx
ret

Function at 0x40a870
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x448370]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [esp + 0x424], eax
je 0x40a8f6
push 0x104
lea eax, [esp + 0x21c]
push edi
push eax
call fcn.0041926f
lea ecx, [esp + 0x224]
push ecx
call fcn.00417cae
add esp, 0x10
cmp eax, esi
jbe 0x40a8d4
lea ecx, [esp + eax*2 + 0x216]
mov ax, word [ecx]
cmp ax, 0x2f
je 0x40a8d1
cmp ax, 0x5c
jne 0x40a8d4
mov word [ecx], si
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40a8f6
push esi
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [ebx]
cmp ax, si
je 0x40a9d8
mov ecx, ebx
mov edx, ebx
jmp 0x40a910
cmp ax, 0x2f
je 0x40a91c
cmp ax, 0x5c
jne 0x40a91e
mov ecx, edx
mov ax, word [edx + 2]
add edx, 2
cmp ax, si
jne 0x40a910
cmp ecx, ebx
je 0x40a970
sub ecx, ebx
sar ecx, 1
shl ecx, 1
mov eax, ecx
mov edx, ecx
shr ecx, 2
mov esi, ebx
lea edi, [esp + 0x218]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov word [esp + eax + 0x218], 0
lea eax, [esp + 0x218]
push eax
push ecx
call fcn.0040a870
mov edi, dword [ebp + 8]
add esp, 8
xor esi, esi
cmp edi, esi
mov word [esp + 0x10], si
je 0x40a98c
push 0x104
lea edx, [esp + 0x14]
push edi
push edx
call fcn.0041926f
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov word [esp + 0x21a], si
call fcn.00417cae
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax*2 + 0x18]
push ebx
push edx
call fcn.0041926f
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov word [esp + 0x21a], si
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40a9d8
push esi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x424]
call fcn.00418507
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x40c394
cmp dword [edi + 0x18], ebx
jne 0x40c39f
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x40c3ad
push edi
call fcn.0040a1a0
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
call fcn.00409fa0
add esp, 0x10
test eax, eax
je 0x40c3d4
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
push 0x84
call fcn.004186ae
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40c415
push 0x4000
call fcn.004186ae
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x40c421
push esi
call fcn.004186c0
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x40c46f
lea eax, [esi + 4]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00409520
add esp, 4
test eax, eax
jne 0x40c46f
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x40c499
mov dl, byte [edi + 0x39]
mov byte [esi + 0x80], dl
jmp 0x40c4a2
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
neg cl
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
mov dword [ebx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb ecx, ecx
and ecx, 0xc
test ebp, ebp
mov dword [esi + 0x7c], ecx
je 0x40c4e6
nop
xor eax, eax
mov al, byte [ebp]
test al, al
je 0x40c4e6
push eax
push ebx
call fcn.00409240
add esp, 8
inc ebp
jne 0x40c4d0
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x1e]
pop ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x40c7d0
Capabilities:
Get common file path

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x40c897
cmp dword [edi + 4], 0xffffffff
jne 0x40c897
push esi
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call fcn.00417cae
mov cx, word [edi + eax*2 + 0x242]
lea eax, [edi + eax*2 + 0x242]
add esp, 4
cmp cx, 0x5c
je 0x40c829
cmp cx, 0x2f
je 0x40c829
mov word [eax + 2], 0x2f
mov word [eax + 4], 0
mov esi, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x40c854
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40c854
pop ebx
pop esi
mov eax, 0x2000000
pop edi
ret 0xc
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push esi
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x40c876
mov eax, dword [esp + 0x18]
pop ebx
pop esi
pop edi
ret 0xc
push eax
call fcn.0040c180
add esp, 4
xor edx, edx
test eax, eax
setne dl
pop ebx
mov dword [edi], eax
pop esi
pop edi
dec edx
and edx, 0x200
mov eax, edx
ret 0xc
mov eax, 0x1000000
pop edi
ret 0xc
Function at 0x40d010
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push edi
mov ebx, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x40d05f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40d03d
call esi
jmp 0x40d049
call esi
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x40d13b
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 8
ret 8
lea ecx, [esi + esi]
push ebp
push ecx
call fcn.00427448
mov edx, dword [esp + 0x20]
add esp, 4
mov ebp, eax
push ebp
push esi
push edx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40d0b2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40d08f
call esi
jmp 0x40d09b
call esi
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x40d13a
pop ebp
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 8
ret 8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x43a188
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40d0dc
mov ecx, ebx
call fcn.0040cd50
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 8
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x20]
mov ecx, 0xd
push ebp
rep movsd dword es:[edi], dword [esi]
call fcn.0042744d
movzx edx, word [ebx + 0x14]
movzx eax, word [ebx + 0x16]
movzx ecx, word [ebx + 0x10]
push edx
movzx edx, word [ebx + 0x12]
push eax
push ecx
push edx
lea eax, [ebx + 0x4c]
push 0x43a170
push eax
call fcn.00402f40
movzx ecx, word [ebx + 0x1c]
movzx edx, word [ebx + 0x1e]
movzx eax, word [ebx + 0x18]
push ecx
movzx ecx, word [ebx + 0x1a]
push edx
push eax
push ecx
push 0x43a170
add ebx, 0x50
push ebx
call fcn.00402f40
add esp, 0x34
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x40d830
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esi], 0x43a1bc
call fcn.0040d650
mov dword [edi + 4], eax
lea eax, [esi + 0x10]
push eax
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00427348
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push 0x208
lea edi, [esi + 0x28]
push edi
add eax, 0x10
push 0
mov dword [esi + 0x640], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push edi
call fcn.0041937c
add esp, 8
test eax, eax
je 0x40d892
mov word [eax], 0
push 0x208
lea eax, [esi + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x208
lea ecx, [esi + 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
mov eax, esi
pop esi
ret
Function at 0x40ea32
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x40ea85
call fcn.00432ad1
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x40ea85
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40ea7b
xor eax, eax
jmp 0x40eb9e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x40eab5
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x40eab5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x40eb9b
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x40eae2
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0041023a
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x40eb9b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40eb2b
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x40eb2b
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x40eb25
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0041023a
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40eb8b
and dword [ebp + 0xc], 0
jmp 0x40eb8b
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x40eb8b
push 0xc
call fcn.0042741d
mov esi, eax
test esi, esi
pop ecx
je 0x40eb6d
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40eb6f
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x40eb86
push dword [ebp - 8]
call fcn.00426ab9
jmp 0x40eb8b
call fcn.00426a90
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x40eaf0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc