joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4474e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x447513
push esi
call fcn.00455890
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44750c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x447599
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x447582
mov eax, dword [esi + 8]
test eax, eax
je 0x447537
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44757e
cmp eax, 2
je 0x447582
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44752a
cmp eax, 3
je 0x44755d
cmp eax, 1
jne 0x44752a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44752a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44752a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004475c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4475a8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004475c0
add esp, 4
pop esi
ret

Function at 0x447e30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x447e51
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x447e51
mov eax, dword [eax + 0x44]
test eax, eax
je 0x447e51
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x466200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4e9600]
xor edx, edx
cmp eax, edx
jne 0x466226
xor eax, eax
mov byte [eax + 0x4e9500], al
inc eax
cmp eax, 0x100
jl 0x46620e
mov dword [0x4e9600], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4e9500
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4662b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46628a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x466258
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x466330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x466383
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46636a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46cd40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499c3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0046d660
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4a77b4
call fcn.0048b259
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x46cdd3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048b259
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46cdcc
push 0
mov ecx, eax
call fcn.00463e40
mov dword [esi + 0xc], eax
jmp 0x46cdd5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x46cdd5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x48d8bc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48d8f4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048b973
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048b94b
jmp 0x48d900
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48efb1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48eff3
call fcn.00494a66
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48eff3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48efea
xor eax, eax
jmp 0x48effb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048f001
pop edi
pop esi
pop ebx
ret 4
Function at 0x494f96
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x494fc4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x494fe2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00494efc
jmp 0x494fe2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x494fe2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00494efc
test edi, edi
mov eax, edi
jne 0x494fcc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402274
Capabilities:
Delete directory

Disassembly:
push ebx
xor eax, eax
push eax
mov eax, dword [esp + 0xc]
mov dword [0x413a50], eax
mov edx, dword [0x41353c]
xor ecx, ecx
call fcn.0040f0c0
jne 0x4022b0
mov edx, dword [0x41353c]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 4]
push eax
call fcn.0040f040
jmp 0x40242c
push 0xc80001
push dword [0x413538]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.0040ab60
push dword [0x4134bc]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00409d43
push 0x20
push 0x41201e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00409f1c
push 0x412053
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.0040a229
push 4
push 0xd
push 0
call fcn.0040ab83
push 2
call fcn.0040a249
call fcn.0040ad87
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x402390
push dword [0x413544]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4017ab
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4023dc
call fcn.0040d19d
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4023d9
push dword [0x413a50]
push dword [0x413a50]
push 2
call fcn.0040a284
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push 0
call fcn.0040a723
add esp, 8
jmp 0x40242c
pop eax
jmp 0x402426
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x402426
call fcn.0040d1ac
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x402425
push dword [0x413a50]
push dword [0x413a50]
push 2
call fcn.0040a284
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push 0
call fcn.0040a723
add esp, 8
jmp 0x40242c
pop eax
pop eax
jmp 0x402366
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.004052c0
push eax
mov eax, dword [esp + 0xc]
push eax
call fcn.0040d890
inc dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413474]
push dword [0x413460]
call fcn.0040c210
pop edx
pop ecx
mov dword [0x413a50], ecx
add ecx, dword [0x412324]
add edx, dword [0x412324]
call fcn.0040f0c0
jne 0x4024b5
push 0x10
push dword [0x413520]
push dword [0x413548]
call fcn.004080d0
push dword [0x413544]
call sub.KERNEL32.dll_RemoveDirectoryA
push 1
jmp 0x4017ab
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
pop eax
add eax, dword [0x412324]
jmp 0x4024da
push dword [esp]
call fcn.0040f0f0
add esp, 4
pop ebx
ret
Function at 0x402a04
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402a0b
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00405060
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00405060
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00405060
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, 0x412037
push eax
pop eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
push eax
pop eax
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call fcn.0040a702
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x402aba
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x402aba
jmp 0x402abc
jmp 0x402a8d
mov eax, dword [esp + 0x4c]
jmp 0x402ac4
push dword [esp]
call fcn.0040f0f0
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp + 8]
call fcn.0040f0f0
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x402ae6
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x412035
push dword [0x4134cc]
call fcn.004033e3
and eax, eax
je 0x402c3c
push 0x400
call fcn.0040c1d0
mov dword [esp], eax
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c4ad
lea eax, [esp + 8]
push eax
call fcn.0040f040
push dword [esp]
push 0
push 0x41201e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.0040c280
lea eax, [0x413540]
push eax
call fcn.0040f040
push dword [esp]
call fcn.0040c2d0
push dword [0x413540]
call fcn.0040c53c
push dword [0x413540]
call fcn.0040c437
push dword [0x413540]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [0x413540]
push dword [0x413a50]
call fcn.0040f120
mov edx, dword [0x413508]
call fcn.0040f120
mov edx, dword [0x4134dc]
call fcn.0040f120
lea eax, [0x4134d0]
push eax
call fcn.0040f040
push dword [0x4134d0]
push 0
call fcn.0040c930
push dword [0x413474]
push dword [0x413460]
push 0
call fcn.0040cab0
push 0
call fcn.0040c710
mov edx, dword [0x4134d0]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push dword [esp + 8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [esp + 8]
push dword [0x4134b4]
call fcn.004085cd
push dword [0x4134ac]
push dword [0x413508]
call fcn.004085cd
mov dword [0x413470], 1
xor eax, eax
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp + 8]
call fcn.0040f0f0
add esp, 0xc
ret
Function at 0x402c54
Capabilities:
Delete directory

Disassembly:
xor eax, eax
push eax
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c54a
inc dword [0x413a50]
push dword [0x413514]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.00408143
lea eax, [esp + 4]
push eax
call fcn.0040f040
mov edx, dword [esp]
xor ecx, ecx
call fcn.0040f0c0
jne 0x402d12
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
lea eax, [0x4134d8]
push eax
call fcn.0040f040
push dword [0x4134d8]
call fcn.0040c58a
mov edx, dword [0x413484]
xor ecx, ecx
call fcn.0040f0c0
jne 0x402ce4
push dword [0x413484]
call fcn.00402faa
push dword [0x4134e4]
push 1
call fcn.0040c930
and eax, eax
je 0x402d12
push dword [0x4134e0]
push 1
call fcn.0040cb10
push 1
call fcn.0040c710
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.00408450
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c59c
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c58a
pop dword [0x413a50]
push dword [0x413544]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x4017ab

Function at 0x402d7a
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.0040c1d0
mov dword [esp], eax
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c4ad
lea eax, [esp + 8]
push eax
call fcn.0040f040
push dword [esp]
push 0
push 0x41201e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.0040c280
lea eax, [0x413544]
push eax
call fcn.0040f040
push dword [esp]
call fcn.0040c2d0
push dword [0x413544]
call fcn.0040c53c
push dword [0x413544]
call fcn.0040c437
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c54a
lea eax, [0x4134d8]
push eax
call fcn.0040f040
push dword [esp + 0x14]
pop eax
call fcn.0040c1f0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x402e53
mov edx, dword [0x413544]
push dword [0x413a50]
call fcn.0040f120
lea eax, [0x4134d8]
push eax
call fcn.0040f040
mov dword [esp + 0xc], 2
jmp 0x402e65
mov ebx, 1
cmp ebx, dword [esp]
jne 0x402e65
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.0040c1f0
mov dword [0x41350c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.0040c1f0
mov dword [0x41345c], eax
mov eax, 1
jmp 0x402e98
push dword [esp + 4]
call fcn.0040f0f0
add esp, 0xc
pop ebx
ret 4
Function at 0x402ea8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x1c]
mov dword [0x413a50], eax
push dword [0x413a50]
push dword [0x413a50]
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.0040c280
lea eax, [esp + 4]
push eax
call fcn.0040f040
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 8]
push eax
call fcn.0040f040
mov eax, dword [esp + 4]
push eax
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov dword [esp + 8], eax
push dword [esp + 4]
call fcn.004052c0
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jle 0x402f65
push dword [0x413a50]
mov edx, str.__BFINOPSX
call fcn.0040f120
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
mov ebx, dword [esp + 0x20]
inc ebx
push ebx
push dword [esp + 0x18]
call fcn.004055a0
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.00405190
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0040f040
mov edx, dword [esp + 0x10]
push dword [0x413a50]
call fcn.0040f120
pop eax
add eax, dword [0x412324]
jmp 0x402f8b
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp]
call fcn.0040f0f0
push dword [esp + 0x10]
call fcn.0040f0f0
add esp, 0x14
pop ebx
ret
Function at 0x4033af
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033b5
lea eax, [esp]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
lea ebp, [esp]
cmp word [ebp], 0
je 0x4033dc
mov eax, 1
jmp 0x4033de
xor eax, eax
add esp, 0x24
pop ebp
ret

Function at 0x4033e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033e9
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00405060
push 0x21
call fcn.0040c1d0
mov dword [esp + 4], eax
push 0x21
push dword [esp + 8]
call fcn.0040c2f0
push 0x20
push dword [esp + 8]
mov eax, dword [0x41355c]
push eax
call fcn.0040c310
push 1
push dword [esp + 4]
mov ebx, dword [esp + 0xc]
add ebx, 0x20
push ebx
call fcn.0040c340
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push 0x21
push dword [esp + 0x18]
call fcn.0040d890
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.00405af0
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push dword [esp + 4]
call fcn.0040c2d0
push 0xa
push dword [esp + 0xc]
push dword [esp + 0x34]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4035ce
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.dll_LoadResource
mov dword [0x413460], eax
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x413474], eax
push dword [esp]
mov edx, 0x412027
pop ecx
call fcn.0040f0c0
jne 0x403516
push dword [esp]
mov edx, 0x41202b
pop ecx
call fcn.0040f0c0
jne 0x403516
push dword [esp]
mov edx, 0x41202d
pop ecx
call fcn.0040f0c0
jne 0x403516
push dword [esp]
mov edx, 0x412035
pop ecx
call fcn.0040f0c0
jne 0x403516
jmp 0x40351d
mov eax, 1
jmp 0x40351f
xor eax, eax
and eax, eax
je 0x4035ce
push dword [0x413474]
call fcn.0040c1d0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov ebx, dword [0x413474]
dec ebx
cmp ebx, dword [esp + 0x14]
jl 0x403584
mov ebx, dword [0x413460]
add ebx, dword [esp + 0x14]
push ebx
pop eax
call fcn.0040c1f0
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
imul ebx, ebx, 0xffffffff
mov dword [esp + 0x1c], ebx
push dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x18]
push ebx
pop eax
call fcn.0040c200
inc dword [esp + 0x14]
jno 0x40353e
push dword [0x41355c]
push dword [0x413474]
push dword [esp + 0x18]
call fcn.00402000
push dword [esp + 0x10]
pop eax
mov dword [0x413460], eax
push dword [0x413474]
push dword [esp + 0x14]
call fcn.0040419e
mov dword [esp + 0x20], eax
push dword [esp + 0x20]
pop eax
mov dword [0x413460], eax
push dword [esp + 0x20]
call fcn.0040c380
mov dword [0x413474], eax
mov eax, dword [esp + 0xc]
jmp 0x4035d6
push dword [esp + 8]
call fcn.0040f0f0
push dword [esp]
call fcn.0040f0f0
add esp, 0x24
pop ebx
ret 8
Function at 0x4035ee
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
push eax
push eax
push 0x400
call fcn.0040c1d0
mov dword [esp], eax
push dword [0x413a50]
push dword [0x413a50]
call fcn.0040c4ad
lea eax, [esp + 8]
push eax
call fcn.0040f040
push dword [esp]
push 0
push 0x41201e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 8]
call fcn.0040c280
lea eax, [0x413554]
push eax
call fcn.0040f040
push dword [0x413a50]
push dword [0x413a50]
push 0x800
call fcn.00405b50
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push dword [0x413a50]
push 0x800
push dword [esp + 0x10]
push dword [0x413a50]
push dword [0x413a50]
call fcn.00408450
inc dword [0x413a50]
mov edx, dword [0x412324]
add dword [esp], edx
call sub.KERNEL32.dll_GetShortPathNameA
pop dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.00408450
inc dword [0x413a50]
push dword [0x413480]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.004085cd
pop dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.00408450
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c6ba
inc dword [0x413a50]
push dword [0x4134c4]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.004085cd
pop dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
call fcn.00408450
mov edx, dword [0x412324]
add dword [esp], edx
call fcn.0040c59c
inc dword [0x413a50]
push dword [0x41354c]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.004085cd
pop dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [esp + 0x14]
call fcn.00405190
inc dword [0x413a50]
push dword [0x41348c]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.004085cd
pop dword [0x413a50]
mov edx, dword [0x4134d8]
push dword [0x413a50]
call fcn.0040f120
lea eax, [esp + 0x10]
push eax
call fcn.0040f040
push dword [esp + 0xc]
call sub.SHLWAPI.DLL_PathAddBackslashA
push dword [esp + 0xc]
push dword [0x413558]
call fcn.004085cd
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
mov eax, dword [0x413478]
cdq
push edx
push eax
call fcn.00405860
inc dword [0x413a50]
push dword [0x413518]
mov edx, dword [0x412324]
add dword [esp + 4], edx
call fcn.004085cd
pop dword [0x413a50]
push dword [0x413554]
push dword [0x4134c8]
call fcn.004085cd
xor eax, eax
push dword [esp + 8]
call fcn.0040f0f0
push dword [esp + 4]
call fcn.0040f0f0
push dword [esp + 0xc]
call fcn.0040f0f0
add esp, 0x10
ret
Function at 0x403b17
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x1c]
mov dword [0x413a50], eax
call fcn.004033af
and eax, eax
je 0x403b44
call fcn.0040a60f
mov ebx, eax
cmp ebx, 0x41
je 0x403b44
mov eax, 1
jmp 0x403b46
xor eax, eax
and eax, eax
je 0x403c9f
push dword [0x413a50]
push dword [0x413a50]
push 0x800
call fcn.00405b50
lea eax, [esp + 4]
push eax
call fcn.0040f040
push 0x800
push dword [esp + 4]
call sub.KERNEL32.dll_GetWindowsDirectoryA
push dword [esp]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
mov edx, str.sysnative
call fcn.0040f120
lea eax, [esp + 4]
push eax
call fcn.0040f040
push dword [esp]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
mov edx, dword [0x4134c0]
call fcn.0040f120
lea eax, [esp + 8]
push eax
call fcn.0040f040
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
mov edx, dword [0x4134c0]
call fcn.0040f120
mov edx, dword [0x4134dc]
call fcn.0040f120
lea eax, [esp + 0xc]
push eax
call fcn.0040f040
push dword [esp + 4]
push 0
call fcn.0040ca00
and eax, eax
je 0x403c25
mov dword [esp + 0xc], 1
push 0
call fcn.0040c710
jmp 0x403c2d
mov dword [esp + 0xc], 0
push dword [esp + 8]
push 0
call fcn.0040ca00
and eax, eax
je 0x403c53
mov dword [esp + 0x10], 1
push 0
call fcn.0040c710
jmp 0x403c5b
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0xc]
add ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x403c9d
push dword [0x413a50]
push dword [0x413a50]
push 0x800
call fcn.00405b50
lea eax, [esp + 4]
push eax
call fcn.0040f040
push 0x800
push dword [esp + 4]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [esp]
call sub.SHLWAPI.DLL_PathAddBackslashA
jmp 0x403cd5
push dword [0x413a50]
push dword [0x413a50]
push 0x800
call fcn.00405b50
lea eax, [esp + 4]
push eax
call fcn.0040f040
push 0x800
push dword [esp + 4]
call sub.KERNEL32.dll_GetSystemDirectoryA
push dword [esp]
call sub.SHLWAPI.DLL_PathAddBackslashA
mov edx, dword [esp]
push dword [0x413a50]
call fcn.0040f120
pop eax
add eax, dword [0x412324]
jmp 0x403cfa
push dword [esp + 8]
call fcn.0040f0f0
push dword [esp]
call fcn.0040f0f0
push dword [esp + 4]
call fcn.0040f0f0
add esp, 0x14
pop ebx
ret