joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x118
mov rax, qword [0x0046ea40]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x130], rsi
mov rsi, rcx
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x402819
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x40280e
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x138], rdi
xor eax, eax
mov qword [rsi + 0x20], SafeArrayGetDim
lea rbx, [rsi + 8]
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
mov qword [rsi + 0x18], 0
mov byte [rbx], 0
mov rdx, qword [rsi + 0x20]
repne scasb al, byte [rdi]
cmp rdx, 0x10
not rcx
lea rdi, [rcx - 1]
jb 0x402866
mov rax, qword [rbx]
jmp 0x402869
mov rax, rbx
lea rcx, [rsp + 0x30]
cmp rcx, rax
jb 0x4028b0
cmp rdx, 0x10
jb 0x40287e
mov rcx, qword [rbx]
jmp 0x402881
mov rcx, rbx
add rcx, qword [rsi + 0x18]
lea rax, [rsp + 0x30]
cmp rcx, rax
jbe 0x4028b0
cmp rdx, 0x10
jb 0x402898
mov rbx, qword [rbx]
lea r8, [rsp + 0x30]
mov r9, rdi
mov rdx, rsi
sub r8, rbx
mov rcx, rsi
call fcn.00403fb0
jmp 0x402920
cmp rdi, 0xfffffffffffffffe
jbe 0x4028bb
call fcn.0044f5b0
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x4028e7
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.00405250
test rdi, rdi
je 0x402920
mov rdx, qword [rsi + 0x20]
cmp rdx, 0x10
jb 0x4028fe
mov rcx, qword [rbx]
jmp 0x402901
test rdi, rdi
jne 0x4028d3
cmp rax, 0x10
mov qword [rsi + 0x18], rdi
jb 0x4028f9
mov rbx, qword [rbx]
mov byte [rbx], 0
jmp 0x402920
mov rcx, rbx
lea r8, [rsp + 0x30]
mov r9, rdi
call fcn.00434700
cmp qword [rsi + 0x20], 0x10
mov qword [rsi + 0x18], rdi
jb 0x40291c
mov rbx, qword [rbx]
mov byte [rbx + rdi], 0
mov rdi, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x128]
mov rax, rsi
mov rsi, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.004346e0
add rsp, 0x118
ret
Function at 0x405750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov eax, r8d
mov rbp, rdx
mov qword [rsp + 0x40], rsi
shr eax, 4
add ax, 1
mov ebx, r8d
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov r12, rax
je 0x4058b5
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x4058b5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x4058b5
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x4057f6
nop
cmp rdi, r11
jae 0x4058b5
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x4057e0
cmp rdi, r11
jae 0x4058b5
movzx eax, word [rdi]
test ax, ax
je 0x4058b5
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x40582c
mov edx, ebx
mov rcx, rsi
call fcn.00405ab0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x40584c
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.00434700
test eax, eax
je 0x40588b
cmp eax, 0xc
je 0x405885
cmp eax, 0x16
je 0x40587f
cmp eax, 0x22
je 0x40587f
cmp eax, 0x50
je 0x40588b
call fcn.0040c9a8
int3
call fcn.0040c9a8
int3
call fcn.0040c960
int3
test ebx, ebx
js 0x4058aa
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x4058aa
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x4058b7
mov ecx, 0x80070057
call fcn.00406ba0
int3
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x4060a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x4060db
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x40611f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x40611a
cmp rbx, r11
jae 0x40611f
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x406108
cmp rbx, r11
jb 0x406123
xor eax, eax
jmp 0x40612f
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x406350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov eax, r8d
mov qword [rsp + 0x70], rsi
mov rsi, rdx
shr eax, 4
add ax, 1
mov ebx, r8d
mov rbp, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov r12, rax
je 0x4064c5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x4064c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x4064c5
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x4063f6
nop
cmp rdi, r11
jae 0x4064c5
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x4063e0
cmp rdi, r11
jae 0x4064c5
movzx eax, word [rdi]
test ax, ax
je 0x4064c5
mov qword [rsp + 0x48], r13
movzx ebx, ax
call qword [0x00470330]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x406466
mov edx, esi
mov rcx, rbp
call fcn.004065e0
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x00470330]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x48]
js 0x4064ba
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x4064ba
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x4064c7
mov ecx, 0x80070057
call fcn.00406ba0
int3
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x4090e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rdx, rdx
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
jne 0x4090f1
xor eax, eax
ret
cmp r11d, 8
mov qword [rsp + 0x20], rdi
not r9d
lea rdi, [0x0045be00]
jb 0x4091da
mov qword [rsp + 0x18], rbx
mov rbx, r11
shr rbx, 3
nop
nop
nop
movzx ecx, byte [r10]
add r10, 8
add r11d, 0xfffffff8
xor cl, r9b
shr r9d, 8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
xor cl, dl
shr edx, 8
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x409120
mov rbx, qword [rsp + 0x18]
test r11d, r11d
je 0x409201
nop
movzx ecx, byte [r10]
mov eax, r9d
add r10, 1
xor cl, r9b
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x4091e0
mov rdi, qword [rsp + 0x20]
not r9d
mov eax, r9d
ret

Function at 0x409a50
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov qword [rsp + 0x68], rdi
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
mov rdi, r9
je 0x409aa4
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov r8d, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409a9e
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x30]
jmp 0x409ad5
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x409ab7
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov r8d, esi
mov rcx, r10
mov qword [rsp + 0x50], rbx
call fcn.004385a0
add dword [rdi + 0x2c], esi
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x409af0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
xor esi, esi
cmp byte [rcx], sil
mov ebp, 1
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov rbx, rcx
mov edi, ebp
mov r14, rdx
je 0x409b4f
mov rcx, qword [rcx + 8]
lea r9, [rax - 0x34]
lea rdx, [rax - 0x38]
mov r8d, ebp
mov qword [rax - 0x48], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409b48
mov byte [rbx + 0x10], dil
mov r13d, dword [rsp + 0x34]
jmp 0x409b83
mov r12d, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [r12 + 1]
cmp eax, ecx
jbe 0x409b64
mov edi, ecx
sub edi, r12d
mov rdx, r12
lea rcx, [rsp + 0x30]
mov r8d, edi
add rdx, qword [rbx + 0x20]
mov r13d, edi
call fcn.004385a0
lea r11d, [r12 + rdi]
mov dword [rbx + 0x2c], r11d
cmp r13d, ebp
jne 0x409b91
movzx edi, byte [rsp + 0x30]
mov eax, esi
jmp 0x409bad
cmp byte [rbx], sil
je 0x409ba7
cmp byte [rbx + 0x10], sil
je 0x409ba7
mov edi, dword [rsp + 0x34]
mov eax, 0xffffffff
jmp 0x409bad
mov edi, dword [rsp + 0x34]
mov eax, esi
test eax, eax
mov qword [rsp + 0x48], r15
mov r15d, edi
jne 0x409c49
cmp byte [rbx], sil
je 0x409bed
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov r8d, ebp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409be6
mov byte [rbx + 0x10], bpl
mov r12d, dword [rsp + 0x34]
jmp 0x409c21
mov r13d, dword [rbx + 0x2c]
mov ecx, dword [rbx + 0x28]
lea eax, [r13 + 1]
cmp eax, ecx
jbe 0x409c01
mov ebp, ecx
sub ebp, r13d
mov rdx, r13
lea rcx, [rsp + 0x30]
mov r8d, ebp
add rdx, qword [rbx + 0x20]
mov r12d, ebp
call fcn.004385a0
lea r11d, [r13 + rbp]
mov dword [rbx + 0x2c], r11d
cmp r12d, 1
jne 0x409c39
movzx edi, byte [rsp + 0x30]
shl edi, 8
mov eax, esi
add edi, r15d
mov dword [r14], edi
jmp 0x409c4c
cmp byte [rbx], sil
je 0x409c2c
cmp byte [rbx + 0x10], sil
je 0x409c2c
mov eax, 0xffffffff
mov dword [r14], esi
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x409f80
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x68
cmp byte [rcx], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x48], r15
mov rsi, rcx
je 0x409fcd
cmp byte [rcx + 1], 0
je 0x409fb6
mov rcx, qword [rcx + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x409fd3
mov eax, 0xffffffff
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x68
ret
mov eax, dword [rcx + 0x28]
mov dword [rcx + 0x2c], eax
cmp byte [rsi], 0
mov qword [rsp + 0x60], r12
je 0x40a010
cmp byte [rsi + 1], 0
je 0x40a006
mov rcx, qword [rsi + 8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r12d, eax
sub r12d, dword [rsi + 0x14]
mov dword [rsp + 0x30], r12d
jmp 0x40a019
xor r12d, r12d
mov dword [rsp + 0x30], r12d
jmp 0x40a019
mov r12d, dword [rsi + 0x2c]
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x78], rbp
mov ebp, 0xffff
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x58], r13
cmp r12d, ebp
mov r13d, 0x404
cmovb ebp, r12d
mov rcx, r13
mov dword [rsp + 0x3c], ebp
call fcn.00435cf0
test rax, rax
mov rdi, rax
jne 0x40a05b
mov eax, 0xffffffff
jmp 0x40a1ae
mov qword [rsp + 0x70], rbx
mov ebx, 4
mov r15d, 0xffffffff
cmp ebp, ebx
jbe 0x40a19e
mov qword [rsp + 0x50], r14
nop
nop
lea eax, [rbx + 0x400]
mov r14d, r12d
cmp eax, ebp
mov ebx, eax
cmova ebx, ebp
sub r14d, ebx
sub r12d, r14d
cmp r12d, r13d
cmova r12d, r13d
cmp byte [rsi], 0
je 0x40a0c5
cmp byte [rsi + 1], 0
je 0x40a199
mov eax, dword [rsi + 0x14]
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea edx, [r14 + rax]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40a0c9
mov dword [rsi + 0x2c], r14d
cmp byte [rsi], 0
mov ebp, r12d
mov r13d, r12d
je 0x40a105
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x34]
mov r8d, ebp
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a0fa
mov byte [rsi + 0x10], 1
mov eax, dword [rsp + 0x34]
xor edx, edx
div rbp
jmp 0x40a137
mov ecx, dword [rsi + 0x2c]
mov edx, dword [rsi + 0x28]
lea eax, [rcx + r12]
cmp eax, edx
jbe 0x40a119
mov r13d, edx
sub r13d, ecx
mov rdx, rcx
mov r8d, r13d
mov rcx, rdi
add rdx, qword [rsi + 0x20]
call fcn.004385a0
add dword [rsi + 0x2c], r13d
xor edx, edx
mov eax, r13d
div rbp
cmp rax, 1
jne 0x40a199
lea ecx, [r12 - 3]
test ecx, ecx
movsxd rax, ecx
js 0x40a17d
nop
nop
sub rax, 1
sub ecx, 1
cmp byte [rax + rdi], 0x50
jne 0x40a172
cmp byte [rax + rdi + 1], 0x4b
jne 0x40a172
cmp byte [rax + rdi + 2], 5
jne 0x40a172
cmp byte [rax + rdi + 3], 6
je 0x40a179
test rax, rax
jns 0x40a150
jmp 0x40a17d
lea r15d, [rcx + r14]
test r15d, r15d
jne 0x40a199
mov ebp, dword [rsp + 0x3c]
mov r12d, dword [rsp + 0x30]
mov r13d, 0x404
cmp ebx, ebp
jb 0x40a080
mov r14, qword [rsp + 0x50]
mov rcx, rdi
call fcn.00434a80
mov rbx, qword [rsp + 0x70]
mov eax, r15d
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x68
ret
Function at 0x40a8f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rdi, rcx
mov rsi, rdx
jne 0x40a91d
mov eax, 0xffffff9a
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
cmp dword [rcx + 0x1c], 0
je 0x40a909
cmp qword [rcx + 0x80], 0
je 0x40a932
call fcn.0040aec0
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040a6e0
test eax, eax
je 0x40a961
mov eax, 0xffffff99
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
mov ecx, 0xb0
mov qword [rsp + 0x40], rbx
call fcn.00435cf0
test rax, rax
mov rbx, rax
jne 0x40a98f
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
mov ecx, 0x4000
mov qword [rsp + 0x48], rbp
call fcn.00435cf0
mov ecx, dword [rsp + 0x20]
xor ebp, ebp
test rax, rax
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x24]
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
mov dword [rbx + 0x6c], ecx
jne 0x40a9c9
mov rcx, rbx
call fcn.00434a80
lea eax, [rbp - 0x68]
jmp 0x40ab1e
mov dword [rbx + 0x64], ebp
mov eax, dword [rdi + 0x40]
cmp dword [rdi + 0x38], ebp
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov ecx, ebp
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
sete cl
test ecx, ecx
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x94], eax
jne 0x40aa20
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.004094c0
test eax, eax
jne 0x40aa20
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x40aa51
movzx eax, byte [rdi + 0x3d]
mov byte [rbx + 0xac], al
jmp 0x40aa5b
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
neg al
mov dword [rbx + 0xa4], 0x34567890
sbb ecx, ecx
and ecx, 0xc
test rsi, rsi
mov dword [rbx + 0xa8], ecx
je 0x40ab04
lea r8, [0x0045be00]
nop
nop
movzx eax, byte [rsi]
test al, al
je 0x40ab04
mov edx, dword [rbx + 0x9c]
movzx ecx, dl
shr edx, 8
xor cl, al
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0xa4]
movzx eax, cl
mov dword [rbx + 0x9c], ecx
movzx ecx, dl
add eax, dword [rbx + 0xa0]
shr edx, 8
imul eax, eax, 0x8088405
add eax, 1
mov dword [rbx + 0xa0], eax
movzx eax, byte [rbx + 0xa3]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, edx
add rsi, 1
mov dword [rbx + 0xa4], eax
jne 0x40aaa0
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x28]
mov dword [rbx + 0x10], ebp
lea ecx, [rcx + rax + 0x1e]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x40b030
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x68
cmp qword [rcx], 0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov rbp, rdx
mov rbx, rcx
jne 0x40b187
cmp dword [rcx + 8], 0xffffffff
jne 0x40b187
lea rdx, [rcx + 0x150]
mov ecx, 0x104
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
lea rdi, [rbx + 0x150]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
movzx eax, byte [rcx + rbx + 0x14e]
cmp al, 0x5c
je 0x40b0b6
cmp al, 0x2f
je 0x40b0b6
xor eax, eax
lea rdi, [rbx + 0x150]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x0045c450]
mov word [rdi - 1], ax
xor esi, esi
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x40b180
lea r9d, [rsi + 1]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [rsi + 0x30]
cmp eax, 0xffffffff
setne dil
call fcn.0040c5bc
test dil, dil
mov byte [rax], 1
mov byte [rax + 0x18], 1
mov byte [rax + 1], dil
mov qword [rax + 8], rbp
mov byte [rax + 0x10], sil
mov dword [rax + 0x14], esi
mov r12, rax
je 0x40b14a
lea r9d, [rsi + 1]
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [r12 + 0x14], eax
mov rcx, r12
call fcn.0040a1e0
mov r12, qword [rsp + 0x40]
mov ecx, 0x200
test rax, rax
mov qword [rbx], rax
cmove esi, ecx
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, 0x200
jmp 0x40b167
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov eax, 0x1000000
add rsp, 0x68
ret
Function at 0x40b830
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x258
mov rax, qword [0x0046ea40]
xor rax, rsp
mov qword [rsp + 0x240], rax
test rcx, rcx
mov qword [r11 + 0x18], rbx
mov qword [r11 - 8], rdi
mov rdi, rcx
mov rbx, rdx
je 0x40b875
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b875
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, byte [rbx]
test al, al
je 0x40b95d
mov qword [rsp + 0x278], rsi
mov rcx, rbx
mov rsi, rbx
nop
cmp al, 0x2f
je 0x40b898
cmp al, 0x5c
jne 0x40b89b
mov rsi, rcx
mov al, byte [rcx + 1]
add rcx, 1
test al, al
jne 0x40b890
cmp rsi, rbx
je 0x40b8d9
sub rsi, rbx
lea rcx, [rsp + 0x130]
mov rdx, rbx
mov r8, rsi
call fcn.004385a0
lea rdx, [rsp + 0x130]
mov rcx, rdi
mov byte [rsp + rsi + 0x130], 0
call fcn.0040b830
test rdi, rdi
mov rsi, qword [rsp + 0x278]
mov byte [rsp + 0x20], 0
je 0x40b90f
lea rcx, [rsp + 0x20]
sub rcx, rdi
nop
nop
nop
nop
movzx eax, byte [rdi]
add rdi, 1
test al, al
mov byte [rcx + rdi - 1], al
jne 0x40b900
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rbx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x40b930
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b95d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdi, qword [rsp + 0x250]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.004346e0
add rsp, 0x258
ret
Function at 0x41b5cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x41b626
call fcn.00413c68
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x41b626
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x41b648
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0041b04c
test rdi, rdi
mov esi, eax
je 0x41b646
test rbx, rbx
je 0x41b646
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x41ccf4
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x41cd2a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41cde1
call fcn.0040d788
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x41cd49
mov ecx, 0x80004005
call fcn.00406ba0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.00436770
test eax, eax
je 0x41cdb4
cmp eax, 0xc
je 0x41cdae
cmp eax, 0x16
je 0x41cda8
cmp eax, 0x22
je 0x41cda8
cmp eax, 0x50
je 0x41cdb4
call fcn.0040c9a8
int3
call fcn.0040c9a8
int3
call fcn.0040c960
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x41cddf
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x435710
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x435739
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x435739
mov ecx, eax
call fcn.004373a0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret