joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1c30
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
xor ebx, ebx
call sym.RtHDVCpl.exe_bool___cdecl_wvFM::DoesFileExist_class_WTPathType__const_
add esp, 4
test al, al
jne 0x4d1c7c
mov eax, 0xfffffc16
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
push esi
call sym.RtHDVCpl.exe_bool___cdecl_wvFM::IsFile_class_WTPathType__const_
add esp, 4
test al, al
jne 0x4d1ca3
mov eax, 0xfffffc04
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
push edi
call sym.RtHDVCpl.exe_bool___cdecl_wvFM::DoesFileExist_class_WTPathType__const_
add esp, 4
test al, al
je 0x4d1cca
mov eax, 0xfffffc15
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
push edi
push esi
call sym.RtHDVCpl.exe_bool___cdecl_wvFM::IsSamePath_class_WTPathType__const__class_WTPathType__const_
add esp, 8
test al, al
je 0x4d1cf2
mov eax, 0xfffffbfa
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
xor eax, eax
push eax
mov byte [esp + 0x414], al
mov byte [esp + 0x14], al
push ecx
lea eax, [esp + 0x18]
push eax
push edi
call sym.RtHDVCpl.exe_char____cdecl_wvFM::GetNativePathAsString_class_WTPathType__const__struct_wvFM::WTPathString__
add esp, 0xc
push eax
lea ecx, [esp + 0x418]
push ecx
push esi
call sym.RtHDVCpl.exe_char____cdecl_wvFM::GetNativePathAsString_class_WTPathType__const__struct_wvFM::WTPathString__
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4d1d50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.RtHDVCpl.exe_long_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x814]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052944d
mov esp, ebp
pop ebp
ret
Function at 0x4d2640
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x508]
sub esp, 0x508
push 0xffffffffffffffff
push 0x55caa0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5bc9cc]
xor eax, ebp
mov dword [ebp + 0x504], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x510]
mov ebx, dword [ebp + 0x514]
mov esi, dword [ebp + 0x518]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebx], eax
mov dword [esi], eax
mov dword [ebp - 4], eax
push edi
call sym.RtHDVCpl.exe_long_int___cdecl_wvFM::CreateFolder_class_WTPathType__const_
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4d26bb
mov dword [ebp - 0x24], eax
push 0x596ea0
lea eax, [ebp - 0x24]
push eax
call fcn.00530358
mov byte [ebp], 0
lea ecx, [ebp]
push ecx
push edi
call sym.RtHDVCpl.exe_char____cdecl_wvFM::GetNativePathAsString_class_WTPathType__const__struct_wvFM::WTPathString__
add esp, 8
lea edx, [ebp + 0x400]
push edx
push 0
push 0x585488
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4d270b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.RtHDVCpl.exe_long_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
push 0x596ea0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00530358
push esi
lea edx, [ebp + 0x400]
push edx
call sym.RtHDVCpl.exe_long_int___cdecl_wvFM::CreatePathRefFromString_char_const___class_WTPathType___
add esp, 8
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4d2733
mov dword [ebp - 0x18], eax
push 0x596ea0
lea eax, [ebp - 0x18]
push eax
call fcn.00530358
push ebx
push 2
push 2
mov ecx, dword [esi]
push ecx
call sym.RtHDVCpl.exe_long_int___cdecl_wvFM::CreateAFile_class_WTPathType__const__enum_WECreateFlags__enum_WEPermitions__class_WTOpenFileType___
add esp, 0x10
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4d275b
mov dword [ebp - 0x20], eax
push 0x596ea0
lea edx, [ebp - 0x20]
push edx
call fcn.00530358
mov dword [ebp - 4], 0xffffffff
jmp 0x4d279b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x504]
xor ecx, ebp
call fcn.0052944d
add ebp, 0x508
mov esp, ebp
pop ebp
ret
Function at 0x4d3960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55c9d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor ecx, ecx
mov dword [esi], vtable.WUValidatable.0
mov dword [esi + 4], ecx
mov dword [esp + 0x14], ecx
lea eax, [esi + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x30]
mov dword [esi], vtable.WCStNativeRes.0
call fcn.004d4ac0
mov dword [esi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x4ee940
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5522a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
xor ebx, ebx
mov eax, ecx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x4ee990
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0049cf80
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4ee9ff
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4ee9c2
call fcn.0052a951
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x28], 0x10
mov ecx, dword [esp + 0x14]
jae 0x4ee9d1
lea ecx, [esp + 0x14]
cmp byte [ecx + esi], 0x5c
je 0x4ee9f8
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4ee9e3
call fcn.0052a951
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x4ee9f2
lea eax, [esp + 0x14]
cmp byte [eax + esi], 0x2f
jne 0x4ee9ff
mov edx, 0x585864
jmp 0x4eea04
mov edx, 0x585868
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4eea10
sub eax, esi
push eax
push edx
lea eax, [esp + 0x18]
call fcn.004a0860
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x4eea35
lea eax, [esp + 0x14]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp], eax
jne 0x4eea54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4eea54
xor esi, esi
jmp 0x4eea57
lea esi, [edi + 0x2c]
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x4eea73
mov eax, dword [esp + 0x14]
push eax
call fcn.0050364e
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0052944d
add esp, 0x2c
ret

Function at 0x4eefa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 0x10
jb 0x4eefab
mov eax, dword [eax + 4]
jmp 0x4eefae
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4eefe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4eefde
cmp eax, 0x57
je 0x4eefde
cmp eax, 0x15
je 0x4eefde
cmp eax, 3
je 0x4eefde
cmp eax, 0x7b
je 0x4eefde
cmp eax, 0x35
jne 0x4eefe1
xor al, al
ret
mov al, 1
ret
Function at 0x4eeff0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5574a8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004f1ab0
xor ebx, ebx
mov dword [esp + 0x50], ebx
cmp dword [eax + 0x18], 0x10
jb 0x4ef031
mov eax, dword [eax + 4]
jmp 0x4ef034
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x4ef059
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0050364e
add esp, 4
cmp esi, 0xffffffff
mov eax, 0xf
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
jne 0x4ef0b3
push 0x1f
push str.boost::filesystem::is_directory
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0049cf80
mov dword [esp + 0x50], 1
call sub.KERNEL32.dll_GetLastError
push eax
push edi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004f8ec0
mov byte [esp + 0x50], 2
jmp fcn.004ef8e0
mov eax, esi
shr eax, 4
and eax, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x4ef540
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x5597d0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004f1ab0
xor ebx, ebx
mov dword [esp + 0x6c], ebx
cmp dword [eax + 0x18], 0x10
jb 0x4ef584
mov eax, dword [eax + 4]
jmp 0x4ef587
add eax, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov dword [esp + 0x6c], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x4ef5ad
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0050364e
add esp, 4
cmp esi, ebx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
je 0x4ef5d6
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4ef62b
push 0x23
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0049cf80
mov dword [esp + 0x6c], 1
call sub.KERNEL32.dll_GetLastError
push eax
push edi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004f8ec0
mov byte [esp + 0x6c], 2
jmp fcn.004ef8e0
call fcn.004eeff0
test al, al
jne 0x4ef67e
push str.path_exists_and_is_not_a_directory
lea ecx, [esp + 0x14]
call fcn.0049cbc0
mov dword [esp + 0x6c], 3
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x30]
call fcn.0049cbc0
mov byte [esp + 0x6c], 4
push 8
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x58]
push eax
call fcn.004f8da0
mov byte [esp + 0x6c], 5
jmp fcn.004ef8e0
xor al, al
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret
Function at 0x4ef6a0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x559780
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov eax, edi
call fcn.004eefa0
test al, al
je 0x4ef793
call fcn.004eeff0
test al, al
je 0x4ef731
cmp dword [edi + 0x18], 0x10
jb 0x4ef6e9
mov eax, dword [edi + 4]
jmp 0x4ef6ec
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4ef780
push str.boost::filesystem::remove
lea ecx, [esp + 0xc]
call fcn.0049cbc0
mov dword [esp + 0x48], 0
call sub.KERNEL32.dll_GetLastError
push eax
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.004f8ec0
mov byte [esp + 0x48], 1
jmp fcn.004ef8e0
cmp dword [edi + 0x18], 0x10
jb 0x4ef73c
mov eax, dword [edi + 4]
jmp 0x4ef73f
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4ef780
push str.boost::filesystem::remove
lea ecx, [esp + 0xc]
call fcn.0049cbc0
mov dword [esp + 0x48], 2
call sub.KERNEL32.dll_GetLastError
push eax
push edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.004f8ec0
mov byte [esp + 0x48], 3
jmp fcn.004ef8e0
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x44
ret
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x44
ret

Function at 0x4ef7b0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x557380
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, 0x10
cmp dword [esi + 0x18], eax
jb 0x4ef7e2
mov ecx, dword [esi + 4]
jmp 0x4ef7e5
lea ecx, [esi + 4]
cmp dword [edi + 0x18], eax
jb 0x4ef7ef
mov eax, dword [edi + 4]
jmp 0x4ef7f2
lea eax, [edi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4ef847
push 0x19
push str.boost::filesystem::rename
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.0049cf80
mov dword [esp + 0x44], 0
call sub.KERNEL32.dll_GetLastError
push eax
push esi
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.004f8ff0
mov byte [esp + 0x44], 1
jmp fcn.004ef8e0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x44
ret
Function at 0x4efde0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54e9b1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
xor ebx, ebx
mov edi, ecx
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.004f1e10
mov dword [esp + 0x40], 1
lea ecx, [esp + 0xc]
push ecx
or ecx, 0xffffffff
lea edi, [esp + 0x1c]
mov byte [esp + 0x10], 0x2e
call fcn.004eff10
push eax
push esi
xor ecx, ecx
mov edx, edi
call fcn.004efea0
mov dword [esp + 0x10], 1
mov byte [esp + 0x40], bl
cmp dword [esp + 0x30], 0x10
jb 0x4efe6f
mov edx, dword [esp + 0x1c]
push edx
call fcn.0050364e
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0052944d
add esp, 0x38
ret

Function at 0x4f2c00
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x4f2c0f
xor eax, eax
pop edi
ret 4
call fcn.004f2ba0
test al, al
je 0x4f2c09
cmp word [edi], 0x5a4d
jne 0x4f2c09
push esi
mov esi, dword [edi + 0x3c]
add esi, edi
call fcn.004f2ba0
test al, al
jne 0x4f2c35
pop esi
xor eax, eax
pop edi
ret 4
xor eax, eax
cmp dword [esi], 0x4550
setne al
sub eax, 1
and eax, esi
pop esi
pop edi
ret 4

Function at 0x4f2dc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
push DirectSoundCreate
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f2e22
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [esp + 8], eax
call fcn.00503653
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
lea edx, [esp + 8]
push edx
mov dword [ecx], eax
mov ecx, dword [esp + 0xc]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x4f2e30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4f2ece
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
push ebp
push ebp
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4f2ee0
push edi
call fcn.00503653
add esp, 4
push ebp
lea ecx, [esp + 0x18]
push ecx
push edi
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f2ed7
cmp edi, dword [esp + 0x14]
jne 0x4f2ed7
push esi
call sym.RtHDVCpl.exe_struct__IMAGE_NT_HEADERS____stdcall_WUGetModuleHeader_void__
push eax
push str..text
call sym.RtHDVCpl.exe_struct__IMAGE_SECTION_HEADER____stdcall_WUGetSectionHeader_char___struct__IMAGE_NT_HEADERS__
mov ebp, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
push ebp
add edi, esi
call fcn.00503653
mov edx, dword [esp + 0x1c]
push ebp
push edi
push eax
mov dword [edx], eax
call fcn.0052d580
push esi
call fcn.0050364e
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 8
push esi
call fcn.0050364e
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x4f4c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x552168
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
xor edi, edi
call sym.RtHDVCpl.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_wvFM::WCStPath::GetNativePathString_void_
mov dword [esp + 0x30], edi
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x4f4cae
lea eax, [esp + 0xc]
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test eax, eax
mov dword [esi + 0x14], eax
jne 0x4f4cd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.RtHDVCpl.exe_long_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add esp, 4
mov edi, eax
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 0x10
jb 0x4f4ced
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0050364e
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0052944d
add esp, 0x2c
ret
Function at 0x4f4d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx ecx, word [esi + 4]
mov edx, dword [esi]
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
lea edi, [esi + 0xc]
push eax
mov ecx, edi
mov dword [esi + 8], 0
call fcn.004f4db0
mov ebp, eax
test ebp, ebp
jne 0x4f4d98
cmp dword [esp + 0x10], eax
je 0x4f4d98
mov eax, dword [edi]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x10]
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4f4d80
mov eax, 0xfffff05d
pop edi
pop ebp
pop ebx
ret 4
mov edx, dword [edi]
push edx
push eax
push ebx
call fcn.0052d580
add esp, 0xc
mov dword [esi + 8], ebx
mov eax, ebp
pop edi
pop ebp
pop ebx
ret 4
pop edi
pop ebp
mov eax, 0xfffff448
pop ebx
ret 4
Function at 0x4f54c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5571d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], esi
lea ecx, [esp + 0x14]
call fcn.004f5b90
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
lea eax, [esp + 0x14]
push eax
push 0x4f53c0
push edx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
cmp eax, esi
je 0x4f55c7
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, eax
mov ebx, eax
jbe 0x4f554c
call fcn.0052a951
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
cmp esi, eax
jbe 0x4f554c
call fcn.0052a951
mov eax, ebx
sub eax, esi
sar eax, 2
push eax
push ebx
push esi
call fcn.004f5db0
mov ecx, dword [esp + 0x24]
add esp, 0xc
test ecx, ecx
jne 0x4f556a
xor eax, eax
jmp 0x4f5573
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
add eax, eax
add eax, eax
push eax
push 0
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
mov esi, eax
jbe 0x4f55a2
call fcn.0052a951
cmp esi, dword [esp + 0x1c]
jb 0x4f55ad
call fcn.0052a951
mov ecx, dword [ebx]
mov edi, dword [edi + 4]
add ecx, ecx
add ecx, ecx
push ecx
push esi
push edi
call fcn.0052d580
add esp, 0xc
xor esi, esi
mov edi, esi
jmp 0x4f55d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.RtHDVCpl.exe_long_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add esp, 4
mov edi, eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4f55f1
push eax
call fcn.0050364e
add esp, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8