joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a1f9
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x24], 0x332fa62f
mov eax, 0x332fa62f
mov esi, dword [ebp - 0x28]
cmp eax, 0x332fa62e
jg 0x43a246
cmp eax, 0xe424e6a7
jg 0x43a2a3
cmp eax, 0xc20c471a
jg 0x43a309
cmp eax, 0x81d3d567
je 0x43a37c
cmp eax, 0xa54d3778
je 0x43a40a
jmp 0x43a211
cmp eax, 0x65b57dca
jle 0x43a2e3
cmp eax, 0x7cebae38
jg 0x43a346
cmp eax, 0x65b57dcb
je 0x43a3bc
cmp eax, 0x772dfa9d
jne 0x43a211
mov eax, dword [ebp - 0x14]
shr eax, 8
lea ecx, [eax - 0xd1]
imul ecx, ecx
imul edx, ecx, 0xae5
dec edx
shl eax, 5
add eax, 0xfffff400
shr eax, 1
mov dword [ebp - 0x14], eax
mov eax, 0x24646d8a
cmp ecx, edx
je 0x43a211
jmp 0x43a448
cmp eax, 0x1912bb69
jle 0x43a361
cmp eax, 0x1912bb6a
je 0x43a3c6
cmp eax, 0x24646d8a
jne 0x43a211
shl esi, 8
add esi, 0xfffdda00
mov eax, 0x81d3d567
cmp esi, 0xad
jge 0x43a211
jmp 0x43a47d
cmp eax, 0x332fa62f
je 0x43a3e1
cmp eax, 0x3477fefe
je 0x43a3f3
cmp eax, 0x5652c5ce
je 0x43a452
jmp 0x43a211
cmp eax, 0xc20c471b
je 0x43a46b
cmp eax, 0xcc09dd4c
jne 0x43a211
shl esi, 0xb
and esi, 0x7ff800
or esi, 0x180
call fcn.0043985a
push esi
call fcn.0043a4ba
add esp, 4
mov eax, 0x7cebae39
jmp 0x43a211
cmp eax, 0x7cebae39
je 0x43a475
cmp eax, 0x7e2f7f3a
je 0x43a41d
jmp 0x43a211
cmp eax, 0xe424e6a8
jne 0x43a487
mov eax, dword [ebp + 4]
mov dword [ebp - 0x1c], eax
mov eax, 0x7cebae39
jmp 0x43a211
shl esi, 0xa
lea esi, [esi + esi*2]
or esi, 0x52
push 0x5830
push esi
call fcn.0043a1f9
add esp, 8
push 0x5f30
push 0xa12
push esi
call fcn.00438e2d
add esp, 0xc
mov eax, 0xcc09dd4c
cmp esi, 0x81
jb 0x43a211
jmp 0x43a47d
mov eax, 0x3f46f6d
jmp 0x43a211
mov cl, byte [ebp - 0xd]
mov eax, 0x772dfa9d
cmp cl, 0xcc
je 0x43a211
mov eax, 0x3477fefe
jmp 0x43a211
call fcn.0043985a
mov dword [ebp - 0x18], eax
mov eax, 0xc20c471b
jmp 0x43a211
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
cmp eax, 0xf0b
je 0x43a41d
movzx eax, ax
cmp eax, 0xcd03
jne 0x43a452
mov dword [ebp - 0x20], esi
popal
jmp 0x43a40e
mov ecx, dword [ebp - 0x14]
add ecx, 0x37
imul eax, ecx, 0x134688
imul ecx, ecx
imul edx, ecx, 0x3245
dec edx
add eax, 0xfffffd5d
mov dword [ebp - 0x14], eax
mov eax, 0xe424e6a8
cmp edx, ecx
je 0x43a211
mov eax, 0xa54d3778
jmp 0x43a211
imul eax, dword [ebp - 0x14], 0x6e8000
add eax, 0x419c0000
mov dword [ebp - 0x14], eax
mov eax, 0x65b57dcb
jmp 0x43a211
mov eax, 0xe424e6a8
jmp 0x43a211
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov eax, 0x1912bb6a
jmp 0x43a211
cmp eax, 0x3f46f6d
jne 0x43a211
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.00437da0
add esp, 0xc
push dword [ebp - 0x18]
call dword [0x46f290]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442bf0
Capabilities:
Check for software breakpoints
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 0x55209612
lea ecx, [eax + 0xc]
mov dword [ebp - 0x34], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0x30], ecx
add eax, 8
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x3c]
Function at 0x443e0f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x46f12c]
test eax, eax
je 0x443e4e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x443e4e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x443e4e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x443e4e
cmp dword [ecx + 0x74], 0xe
jbe 0x443e4e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x453850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45387d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45387d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x45d23b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045d246

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x401b82
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
jno 0x401b98
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401bbd
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401ba4
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x401bb5
add edx, ecx
cmp dword [esp + 0xc], edx
push esp
and al, 0xc
jb 0x401bbf
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401b9a
xor eax, eax
pop edi
pop esi
ret

Function at 0x401da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
test eax, 0x58aa45c6
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00401b42
xchg edi, eax
sub eax, 0x458ddde2
test al, 0x50
call fcn.00401b52
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00401b07
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
lea edx, [edi + edi*8 - 1]
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x401e30
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00401b42
dec ecx
mov bh, byte [ebp + eax*4 + 0x50c0458d]
call fcn.00401b52
push eax
push esi
push dword [ebp + 8]
call fcn.00401b07
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00401b42
jbe 0x401edd
xor dword [ebp + ecx*4 + 0x5d88e845], ecx
call 0xe99da703
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
invalid
inc ebp
Function at 0x401e60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401e7a
jmp 0x401ec8
mov eax, dword [0x5c0398]
and eax, 1
jne 0x401ead
mov ecx, dword [0x5c0398]
or ecx, 1
mov dword [0x5c0398], ecx
push 0x574180
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
neg eax
sbb eax, eax
neg eax
mov dword [0x5c039c], eax
cmp dword [0x5c039c], 0
jne 0x401eb8
jmp 0x401ec8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx]
call eax
mov esp, ebp
pop ebp
ret 4
Function at 0x402270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5b3940]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0050bed0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x5741c0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00402920
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
call fcn.00538500
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402df0
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret

Function at 0x403410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00401320
movzx eax, al
test eax, eax
je 0x403430
xor eax, eax
jmp 0x4034c0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x403446
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.004032e0
jmp 0x4034c0
push 0x57434c
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00405840
push eax
mov edx, dword [ebp - 4]
add edx, 8
push edx
call fcn.0050c405
add esp, 0xc
test eax, eax
je 0x40346e
xor eax, eax
jmp 0x4034c0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x40347b
xor eax, eax
jmp 0x4034c0
push 2
push 0xffffffffffffffe0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call fcn.0050c6c6
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
push 1
push 0x20
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
call fcn.0050cf98
add esp, 0x10
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.004032e0
test eax, eax
jne 0x4034bb
xor eax, eax
jmp 0x4034c0
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4034d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00403410
test eax, eax
jne 0x4034e7
xor eax, eax
jmp 0x40351e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004033a0
test eax, eax
jne 0x4034fb
xor eax, eax
jmp 0x40351e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0050cf98
add esp, 0x10
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x403550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00401320
movzx eax, al
test eax, eax
jne 0x40356d
xor eax, eax
jmp 0x403593
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40357f
xor eax, eax
jmp 0x403593
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00402dd0
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4036d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x4036e9
xor eax, eax
jmp 0x40379a
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
je 0x4036fc
mov eax, 1
jmp 0x40379a
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
je 0x40370c
xor eax, eax
jmp 0x40379a
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00405840
push eax
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00405840
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40373e
xor eax, eax
jmp 0x40379a
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x403779
xor eax, eax
jmp 0x40379a
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax + 0x14], 0
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4066f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x18]
call fcn.00401410
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406774
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401800
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407f90
mov eax, dword [ebp + 8]
jmp 0x4068aa
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004dcb1e
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401800
mov edx, dword [ebp - 0x30]
or edx, 1
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407f90
mov eax, dword [ebp + 8]
jmp 0x4068aa
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x406871
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x574190
mov edx, dword [ebp - 0x1c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x406871
cmp dword [ebp - 0x24], 0
je 0x406871
cmp dword [ebp - 0x20], 0
je 0x406871
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._d._d._d._d
lea eax, [ebp - 0x18]
push eax
call fcn.00405fc0
add esp, 0x18
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004dcb13
add esp, 4
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401800
mov ecx, dword [ebp - 0x30]
or ecx, 1
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407f90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x409940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
call fcn.00406ac0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406a20
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call fcn.004dcb1e
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409980
xor eax, eax
jmp 0x4099fd
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00406b40
add esp, 0xc
test eax, eax
je 0x4099e8
mov dword [ebp - 0x10], 0
push 0x57419c
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0050c405
add esp, 0xc
test eax, eax
jne 0x4099e8
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0050c5ba
add esp, 0x10
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
push eax
call fcn.0050c9e7
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004dcb13
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x40e500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.0040e5e0
mov eax, dword [ebp - 0x24]
cmp dword [eax + 8], 0
jne 0x40e521
xor eax, eax
jmp 0x40e5d6
mov ecx, dword [ebp - 0x24]
add ecx, 0xc
call fcn.00405840
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e53e
xor eax, eax
jmp 0x40e5d6
push 0x14
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0050bed0
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0xc
call fcn.00405840
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x14]
push edx
push 0x20a
push 0x803
push 0
call dword [sym.imp.WINMM.dll_mciSendCommandW]
test eax, eax
je 0x40e581
xor eax, eax
jmp 0x40e5d6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx + 4], 0
jne 0x40e597
xor eax, eax
jmp 0x40e5d6
push 0xc
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0050bed0
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x20]
push eax
push 5
push 0x806
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WINMM.dll_mciSendCommandW]
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40ea20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ea4a
xor eax, eax
jmp 0x40eb14
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004dcb1e
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40ea7c
xor eax, eax
jmp 0x40eb14
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40eafd
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x574190
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40eafd
cmp dword [ebp - 0x14], 0
je 0x40eafd
cmp dword [ebp - 0x10], 0
je 0x40eafd
cmp dword [ebp + 0xc], 0
je 0x40eae4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [ebp + 0x10], 0
je 0x40eafd
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004dcb13
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x417800
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406ac0
add esp, 4
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406b00
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00535e90
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004dcb1e
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x417853
xor eax, eax
jmp 0x4178f4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push 0x40
push 0x8000
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.005104eb
add esp, 0x14
test eax, eax
jne 0x4178df
push 0x57434c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0051050b
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4178d3
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050cf98
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406b90
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.0050c9e7
add esp, 4
jmp 0x4178df
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051073b
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004dcb13
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x418ff0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559b7b
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x5b3940]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x820], ecx
xor eax, eax
mov word [ebp - 0x814], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x812]
push ecx
call fcn.0050bed0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x814]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x4190d5
lea ecx, [ebp - 0x818]
call fcn.00401410
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x814]
push edx
mov ecx, dword [ebp - 0x820]
call fcn.00418a80
test eax, eax
je 0x4190c3
lea ecx, [ebp - 0x818]
call fcn.00405840
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0x81c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x818]
call fcn.00407f90
mov eax, dword [ebp - 0x81c]
jmp 0x4190d7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x818]
call fcn.00407f90
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret 4