joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413200
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x447688
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x465d44]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
xor eax, eax
mov esi, ecx
mov ecx, dword [esp + 0x40]
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x413257
sub eax, edi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040376d
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.004127c0
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00412030
mov eax, dword [esp + 0x14]
mov edi, 8
cmp dword [esp + 0x28], edi
jae 0x4132a4
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ecx
push edx
push ebp
push eax
call fcn.0041f340
add esp, 0x10
mov esi, eax
cmp dword [esp + 0x28], edi
jb 0x4132cd
mov eax, dword [esp + 0x14]
push eax
call fcn.00430dfa
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004310bf
add esp, 0x2c
ret 0x10

Function at 0x413b50
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x78]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x74]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
cmp eax, 0x102
jne 0x413b86
mov edx, dword [esi + 0x74]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x7c]
push ecx
call edi
mov edx, dword [esi + 0x78]
push edx
call edi
lea eax, [esi + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esi + 0x74], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], ebx
mov edi, dword [esi + 0xa8]
add esi, 0x98
cmp dword [esi + 0xc], edi
jbe 0x413bca
call fcn.0043143f
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0x413bd9
call fcn.0043143f
mov eax, dword [esi]
push edi
push ebp
push ebx
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00413510
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4144e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xad0
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0xacc], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xce]
push ecx
mov word [esp + 0xd0], ax
call fcn.004310d0
add esp, 0xc
mov dword [esp], 0
call fcn.0040a010
add eax, 0x220
cmp dword [eax + 0x18], 8
jb 0x414530
mov eax, dword [eax + 4]
jmp 0x414533
add eax, 4
push str.ProfilesBindingConfig.ini
push eax
lea edx, [esp + 0xcc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp]
push eax
lea ecx, [esp + 0xc8]
push ecx
call fcn.0041ec20
add esp, 8
cmp dword [esp], 0
je 0x4146a9
push ebx
push esi
push edi
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x5a]
push eax
mov word [esp + 0x5c], dx
call fcn.004310d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
push 0x1f
lea edx, [esp + 0x58]
push edx
push 0x44f5d0
push str.Count
push str.DeleteDir
call ebx
lea eax, [esp + 0x50]
push eax
call fcn.0043294c
mov edi, eax
mov esi, 1
add esp, 4
cmp edi, esi
jl 0x41468f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x2e6]
push edx
mov word [esp + 0x2e8], cx
call fcn.004310d0
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.004310d0
push 0xa
lea edx, [esp + 0xb0]
push edx
push esi
call fcn.004329ed
add esp, 0x24
push str.Path
lea eax, [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0xd4]
push eax
push 0x3ff
lea ecx, [esp + 0x2e4]
push ecx
push 0x44f5d0
lea edx, [esp + 0x24]
push edx
push str.DeleteDir
call ebx
push 1
push 0
lea eax, [esp + 0x2e4]
push 0
push eax
call fcn.00413ae0
mov ecx, eax
call fcn.00413200
inc esi
cmp esi, edi
jle 0x4145c8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xacc]
xor ecx, esp
call fcn.004310bf
add esp, 0xad0
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xacc]
xor ecx, esp
call fcn.004310bf
add esp, 0xad0
ret
mov ecx, dword [esp + 0xacc]
xor ecx, esp
xor eax, eax
call fcn.004310bf
add esp, 0xad0
ret
Function at 0x4146c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xad0
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0xacc], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xce]
push ecx
mov word [esp + 0xd0], ax
call fcn.004310d0
add esp, 0xc
mov dword [esp], 0
call fcn.0040a010
add eax, 0x220
cmp dword [eax + 0x18], 8
jb 0x414710
mov eax, dword [eax + 4]
jmp 0x414713
add eax, 4
push str.ProfilesBindingConfig.ini
push eax
lea edx, [esp + 0xcc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp]
push eax
lea ecx, [esp + 0xc8]
push ecx
call fcn.0041ec20
add esp, 8
cmp dword [esp], 0
je 0x414883
push ebx
push esi
push edi
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x5a]
push eax
mov word [esp + 0x5c], dx
call fcn.004310d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea ecx, [esp + 0xd0]
push ecx
push 0x1f
lea edx, [esp + 0x58]
push edx
push 0x44f5d0
push str.Count
push str.DeleteShortcut
call ebx
lea eax, [esp + 0x50]
push eax
call fcn.0043294c
mov edi, eax
mov esi, 1
add esp, 4
cmp edi, esi
jl 0x414869
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x2e6]
push edx
mov word [esp + 0x2e8], cx
call fcn.004310d0
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.004310d0
push 0xa
lea edx, [esp + 0xb0]
push edx
push esi
call fcn.004329ed
add esp, 0x24
push str.Path
lea eax, [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0xd4]
push eax
push 0x3ff
lea ecx, [esp + 0x2e4]
push ecx
push 0x44f5d0
lea edx, [esp + 0x24]
push edx
push str.DeleteShortcut
call ebx
lea eax, [esp + 0x2dc]
push eax
call fcn.00413ae0
mov ecx, eax
call fcn.00412f20
inc esi
cmp esi, edi
jle 0x4147a8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xacc]
xor ecx, esp
call fcn.004310bf
add esp, 0xad0
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xacc]
xor ecx, esp
call fcn.004310bf
add esp, 0xad0
ret
mov ecx, dword [esp + 0xacc]
xor ecx, esp
xor eax, eax
call fcn.004310bf
add esp, 0xad0
ret
Function at 0x4148a0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1314
call fcn.00432a20
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x1310], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x112]
push ecx
mov word [esp + 0x114], ax
call fcn.004310d0
add esp, 0xc
mov dword [esp], 0
call fcn.0040a010
add eax, 0x220
cmp dword [eax + 0x18], 8
jb 0x4148f4
mov eax, dword [eax + 4]
jmp 0x4148f7
add eax, 4
push str.ProfilesBindingConfig.ini
push eax
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp]
push eax
lea ecx, [esp + 0x10c]
push ecx
call fcn.0041ec20
add esp, 8
cmp dword [esp], 0
je 0x414b17
push esi
push edi
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0xda]
push eax
mov word [esp + 0xdc], dx
call fcn.004310d0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
push 0x1f
lea edx, [esp + 0xd8]
push edx
push 0x44f5d0
push str.Count
push str.UninstallExe
call edi
lea eax, [esp + 0xd0]
push eax
call fcn.0043294c
mov esi, 1
add esp, 4
cmp eax, esi
mov dword [esp + 0xc], eax
jl 0x414afe
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0xb2a]
push edx
mov word [esp + 0xb2c], cx
call fcn.004310d0
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x336]
push ecx
mov word [esp + 0x338], ax
call fcn.004310d0
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x7a]
push eax
mov word [esp + 0x7c], dx
call fcn.004310d0
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x46]
push edx
mov word [esp + 0x48], cx
call fcn.004310d0
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0xd2]
push ecx
mov word [esp + 0xd4], ax
call fcn.004310d0
push 0xa
lea edx, [esp + 0xd8]
push edx
push esi
call fcn.004329ed
add esp, 0x48
push str.Path
lea eax, [esp + 0x5c]
push eax
call ebx
lea ecx, [esp + 0x98]
push ecx
lea edx, [esp + 0x5c]
push edx
call ebp
push str.Param
lea eax, [esp + 0x1c]
push eax
call ebx
lea ecx, [esp + 0x98]
push ecx
lea edx, [esp + 0x1c]
push edx
call ebp
lea eax, [esp + 0x118]
push eax
push 0x3ff
lea ecx, [esp + 0xb28]
push ecx
push 0x44f5d0
lea edx, [esp + 0x68]
push edx
push str.UninstallExe
call edi
lea eax, [esp + 0x118]
push eax
push 0x3ff
lea ecx, [esp + 0x328]
push ecx
push 0x44f5d0
lea edx, [esp + 0x28]
push edx
push str.UninstallExe
call edi
push 0
push 0
push 0
push 0x44f5d0
lea eax, [esp + 0x330]
push eax
lea ecx, [esp + 0xb34]
push ecx
call fcn.00413ae0
mov ecx, eax
call fcn.00413000
inc esi
cmp esi, dword [esp + 0x14]
jle 0x4149a0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1310]
xor ecx, esp
call fcn.004310bf
add esp, 0x1314
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1310]
xor ecx, esp
call fcn.004310bf
add esp, 0x1314
ret
mov ecx, dword [esp + 0x1310]
xor ecx, esp
xor eax, eax
call fcn.004310bf
add esp, 0x1314
ret
Function at 0x4157b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push 0x208
lea eax, [esp + 8]
push 0
push eax
call fcn.004310d0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415800
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0040376d
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004310bf
add esp, 0x20c
ret
Function at 0x415840
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4479f1
mov eax, dword fs:[0]
push eax
sub esp, 0x4b4
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x4b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x465d44]
xor eax, esp
push eax
lea eax, [esp + 0x4c8]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
xor eax, eax
mov edi, 7
push 0x44f5d0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], ax
call fcn.0040376d
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x4d4], ebx
call fcn.004157b0
push 0x458b48
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00404607
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x4dc], 1
call fcn.00403181
mov esi, 8
mov byte [esp + 0x4d0], bl
cmp dword [esp + 0x30], esi
jb 0x4158fc
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00430dfa
add esp, 4
push str..lnk
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00404607
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x41591d
mov eax, dword [eax + 4]
jmp 0x415920
add eax, 4
lea ecx, [esp + 0x6c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp dword [esp + 0x30], esi
jb 0x415941
mov edx, dword [esp + 0x1c]
push edx
call fcn.00430dfa
add esp, 4
xor eax, eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
cmp ebp, 0xffffffff
je 0x415a14
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
nop
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x41596f
lea eax, [esp + 0x38]
lea ecx, [esp + 0x98]
push ecx
push eax
lea edx, [esp + 0x2c4]
push edx
call esi
xor eax, eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], ax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x2c0]
push edx
lea ecx, [esp + 0x1f]
mov byte [esp + 0x4d8], 2
call fcn.0041ea10
push 0x1b
push ebx
push str._freevideoshortcutopentrue
lea ecx, [esp + 0x5c]
call fcn.0040a8b0
cmp eax, 0xffffffff
je 0x4159d9
lea eax, [esp + 0x2bc]
push eax
call fcn.00413ae0
mov ecx, eax
call fcn.00412f20
cmp dword [esp + 0x68], 8
mov byte [esp + 0x4d0], bl
jb 0x4159f4
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00430dfa
add esp, 4
lea edx, [esp + 0x6c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415960
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 8
cmp dword [esp + 0x4c], esi
jb 0x415a27
mov eax, dword [esp + 0x38]
push eax
call fcn.00430dfa
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4b0]
xor ecx, esp
call fcn.004310bf
add esp, 0x4c0
ret
Function at 0x418670
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
je 0x418682
mov eax, 0x80004005
pop edi
ret 4
mov edx, dword [esp + 8]
mov eax, edx
push esi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418690
sub eax, esi
sar eax, 1
push eax
lea esi, [edi + 0x38]
push edx
mov ecx, esi
call fcn.0040376d
cmp dword [edi + 0x54], 0
jne 0x418712
cmp dword [edi + 0x4c], 0
jne 0x4186c1
pop esi
mov eax, 0x8618000d
pop edi
ret 4
lea eax, [esp + 0xc]
push eax
push 0
push edi
push 0x418650
push 0
push 0
mov dword [esp + 0x24], 0
call fcn.00432b4c
add esp, 0x18
mov dword [edi + 0x54], eax
cmp dword [esi + 0x18], 8
jb 0x418702
mov esi, dword [esi + 4]
push esi
call fcn.0040a010
mov ecx, eax
call fcn.0040a0c0
pop esi
xor eax, eax
pop edi
ret 4
add esi, 4
push esi
call fcn.0040a010
mov ecx, eax
call fcn.0040a0c0
pop esi
xor eax, eax
pop edi
ret 4

Function at 0x418880
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, dword [esp + 0x220]
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x16]
push ecx
mov dword [esi], 0
mov word [esp + 0x18], ax
call fcn.004310d0
add esp, 0xc
push ebx
push edi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4188ef
mov eax, 0x8618000a
jmp 0x41890a
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0x79e7fffa
add eax, 0x86180006
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004310bf
add esp, 0x210
ret 0xc
Function at 0x418930
Capabilities:
Get common file path
Link many functions at runtime
Set current directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
push ebp
push esi
push edi
push 0x208
xor ebp, ebp
lea eax, [esp + 0x18]
push ebp
push eax
mov esi, ecx
call fcn.004310d0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea edx, [esp + 0x10]
push edx
push str.XLFSIO.dll
push ebx
mov ecx, esi
mov dword [esp + 0x1c], ebp
call fcn.00418880
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x4189af
push str.XLFS_Init
push eax
call edi
mov dword [esi], eax
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push str.XLGraphic.dll
push ebx
mov ecx, esi
call fcn.00418880
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4189f2
push str.XL_SetFreeTypeEnabled
push ebp
call edi
push str.XL_PrepareGraphicParam
push ebp
mov dword [esi + 0x10], eax
call edi
push str.XL_InitGraphicLib
push ebp
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x10]
push ecx
push str.XLUE.dll
push ebx
mov ecx, esi
call fcn.00418880
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x418a43
push str.XLUE_AddXARSearchPath
push ebx
call edi
push str.XLUE_LoadXAR
push ebx
mov dword [esi + 4], eax
call edi
push str.XLUE_InitLoader
push ebx
mov dword [esi + 8], eax
call edi
push str.XLUE_GetHostWndByID
push ebx
mov dword [esi + 0xc], eax
call edi
push str.XLUE_GetHostWndWindowHandle
push ebx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004310bf
add esp, 0x210
ret 4

Function at 0x41e5e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41e5f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41e634
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x41e630
lea ebx, [ebx]
cmp esi, eax
jae 0x41e634
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x41e620
cmp esi, eax
jb 0x41e63a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x41ec20
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ec49
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41ec49
mov eax, dword [esp + 0xc]
mov dword [eax], 1
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 0xc]
mov dword [ecx], 0
xor eax, eax
pop esi
ret
Function at 0x41ec60
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ec89
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x41ec89
mov eax, dword [esp + 0xc]
mov dword [eax], 1
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 0xc]
mov dword [ecx], 0
xor eax, eax
pop esi
ret

Function at 0x41ecc0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0xc], 0
je 0x41ece9
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ece9
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
ret

Function at 0x41ecf0
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x41ed10
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jg 0x41ed32
pop edi
mov eax, 0x80004005
pop ebx
add esp, 8
ret
lea eax, [edi + 4]
push esi
push eax
call fcn.0042ff98
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41ed78
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x458b48
push esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x41ed91
test esi, esi
je 0x41ed85
push esi
call fcn.00431216
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 0xa]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x20]
and ecx, 0xffff
mov dword [edx], ecx
movzx ecx, word [eax + 0xe]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
and eax, 0xffff
mov dword [ecx], eax
test esi, esi
je 0x41edd3
push esi
call fcn.00431216
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x41ede0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x41ee88
cmp dword [esp + 0xc], 0
je 0x41ee88
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x41ee88
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 7
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41ee2a
pop ebx
mov eax, 0x80004005
pop esi
ret
push ebp
push edi
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea edx, [edi + ecx]
push edx
push ebx
mov dword [esp + 0x28], 0
call ebp
test eax, eax
je 0x41ee70
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x41ee70
sub esi, eax
add edi, eax
test esi, esi
jg 0x41ee41
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41ee7a
mov dword [eax], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
mov eax, 0x86180008
pop esi
ret

Function at 0x41ee90
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 0
push 0x80
push eax
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41eec8
pop edi
mov eax, 0x80004005
pop esi
ret
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
Function at 0x41eef0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov eax, dword [ebx]
push esi
push edi
mov dword [esp + 0xc], ebx
test eax, eax
je 0x41eff6
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x41eff6
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, dword [ebx]
mov edi, dword [esi + 0xc]
mov dword [esp + 0x10], eax
cmp edi, dword [esi + 0x10]
jbe 0x41ef43
call fcn.0043143f
push ebp
mov ebp, dword [esi]
mov esi, dword [ebx]
mov ebx, dword [esi + 0x10]
cmp dword [esi + 0xc], ebx
jbe 0x41ef55
call fcn.0043143f
mov esi, dword [esi]
test ebp, ebp
je 0x41ef5f
cmp ebp, esi
je 0x41ef64
call fcn.0043143f
cmp edi, ebx
je 0x41efc0
test ebp, ebp
jne 0x41efb6
call fcn.0043143f
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41ef7d
call fcn.0043143f
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x41ef88
mov eax, dword [eax]
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x41efec
test ebp, ebp
jne 0x41efbb
call fcn.0043143f
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41efad
call fcn.0043143f
mov ebx, dword [esp + 0x10]
add edi, 0x1c
jmp 0x41ef46
mov eax, dword [ebp]
jmp 0x41ef73
mov eax, dword [ebp]
jmp 0x41efa3
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov esi, dword [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x41efec
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41efec
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4
mov edi, dword [esp + 0x18]
mov esi, dword [ebx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x41efed
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41efed
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
pop ebx
add esp, 8
ret 4