joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0840
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x4a0857
xor ebx, ebx
jmp 0x4a086f
cmp byte [ebp], 0
je 0x4a0866
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x4a0860
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4a092e
jmp 0x4a0894
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x4a089c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4a08bc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.0047afb0
test eax, eax
jne 0x4a091b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x4a0905
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x4a08ff
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4f0d80]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x4a08e0
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x4a0907
xor edx, edx
push ebp
call fcn.0047bbb0
add esp, 4
test eax, eax
je 0x4a0938
mov edi, dword [eax + 8]
test edi, edi
jne 0x4a092e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x4a0890
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x4a091b

Function at 0x4a09d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x4a09e6
xor ebx, ebx
jmp 0x4a09ff
cmp byte [edi], 0
je 0x4a09f6
jmp 0x4a09f0
inc eax
cmp byte [eax], 0
jne 0x4a09f0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x4a0abc
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x4a0a24
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x4a0a2c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x4a0a4c
mov edx, dword [eax]
call fcn.0047afb0
test eax, eax
jne 0x4a0a9b
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x4a0a85
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x4a0a7f
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x4f0d80]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x4a0a60
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x4a0a87
xor edx, edx
push edi
call fcn.0047bbb0
add esp, 4
test eax, eax
je 0x4a0ab8
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x4a0aae
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x4a0a20
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x4a0a9b
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4a5750
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x4a5770
mov al, byte [ebp + 0x4f14d4]
mov byte [esp + 0x10], al
test edi, edi
je 0x4a57f5
cmp byte [edi], 0
mov eax, edi
je 0x4a578b
inc eax
cmp byte [eax], 0
jne 0x4a5785
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x180
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x4a57dd
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x4a57d3
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x4f0d80]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x4a57b0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x4a57df
xor edx, edx
push edi
call fcn.0047bbb0
add esp, 4
test eax, eax
je 0x4a57f1
mov eax, dword [eax + 8]
jmp 0x4a57fc
xor eax, eax
jmp 0x4a57fc
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x4a580c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x4a582d
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x4a5770
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4c0130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x1b4
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [eax + 0x18]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [edx]
xor ebx, ebx
xor ecx, ecx
cmp eax, ebx
mov dword [esp + 0x38], esi
jle 0x4c0170
add edx, 4
lea esp, [esp]
cmp dword [edx], esi
je 0x4c0228
inc ecx
add edx, 4
cmp ecx, eax
jl 0x4c0160
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x1c]
lea ecx, [eax + eax*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], esi
cmp esi, eax
jae 0x4c0322
mov ebx, dword [ebp + 0x18]
jmp 0x4c01a0
fldz
mov edx, 0x100
cmp word [esi + 0x10], dx
jne 0x4c030f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
not eax
and eax, dword [esi + 0x20]
not ecx
and ecx, dword [esi + 0x24]
and eax, dword [ebp + 0x14]
and ecx, ebx
or eax, ecx
jne 0x4c030f
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x160]
mov edx, dword [ecx + 0x164]
and eax, dword [esp + 0x10]
and edx, dword [esp + 0x14]
or eax, edx
je 0x4c030f
mov edi, dword [ecx + 0x1c]
fld st(0)
mov ecx, dword [ecx + 0x14]
fst qword [esp + 0x30]
lea eax, [ecx + ecx*4]
fxch st(1)
lea eax, [edi + eax*8]
fst qword [esp + 0x20]
mov dword [esp + 0x2c], eax
cmp edi, eax
jae 0x4c02c7
mov ecx, 0x200
cmp word [edi + 0x10], cx
jne 0x4c0241
mov edx, dword [ebp + 0x14]
push ebx
push edx
mov edx, dword [edi + 0xc]
jmp 0x4c0277
mov eax, 1
xor edx, edx
call fcn.004e3140
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jmp 0x4c0178
mov ecx, dword [esp + 0x38]
cmp dword [edi + 8], ecx
jne 0x4c02bc
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x14]
push ebx
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], eax
mov byte [esp + 0x74], 0x43
mov dword [esp + 0x80], edi
mov dword [esp + 0x78], 1
push ecx
lea edx, [esp + 0x68]
mov eax, dword [ebp + 0x10]
fstp st(1)
mov esi, dword [ebp + 8]
fstp st(0)
lea ecx, [esp + 0x48]
call fcn.004c0f40
fld qword [esp + 0x58]
fadd qword [esp + 0x38]
mov ecx, dword [ebp + 0x20]
mov esi, dword [esp + 0x24]
add esp, 8
fst qword [esp + 0x30]
fld qword [esp + 0x58]
fadd qword [esp + 0x20]
fst qword [esp + 0x20]
fld qword [ecx + 0x10]
fcomp st(2)
fnstsw ax
test ah, 0x41
jnp 0x4c02ca
mov eax, dword [esp + 0x2c]
add edi, 0x28
cmp edi, eax
jb 0x4c0213
mov ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0
je 0x4c02ee
fstp st(1)
sub esp, 8
fstp qword [esp]
call fcn.004c00f0
fld qword [esp + 0x28]
add esp, 8
fmul st(1), st(0)
fxch st(1)
fadd qword [esp + 0x30]
fxch st(1)
fld qword [ecx + 0x10]
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x4c030d
fxch st(1)
mov dword [ecx], 0x10000000
fstp qword [ecx + 0x10]
mov dword [ecx + 8], esi
fstp qword [ecx + 0x18]
jmp 0x4c0311
fstp st(1)
fstp st(0)
add esi, 0x28
mov dword [esp + 0x1c], esi
cmp esi, dword [esp + 0x3c]
jb 0x4c01a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c89cc
Capabilities:
Create directory

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x4c89f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4c89f1
xor eax, eax
inc eax
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x4c8aca
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x512054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x20]
push edi
mov dword [ebp - 0x828], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004cc620
movzx eax, byte [ebp + 0x14]
add esp, 0xc
sub eax, 0x20
mov edi, 0x103
je 0x4c8b3e
dec eax
jne 0x4c8b63
cmp ax, word [0x518f80]
je 0x4c8b63
push 0x518f80
jmp 0x4c8b4e
xor eax, eax
cmp ax, word [0x519188]
je 0x4c8b63
push 0x519188
push 0x4f6964
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004cc4e5
add esp, 0x10
xor eax, eax
cmp ax, word [ebp - 0x414]
je 0x4c8c95
push esi
mov word [ebp - 0x61c], ax
xor ebx, ebx
lea eax, [ebp - 0x61a]
push ebx
push eax
call fcn.004cc620
push ebx
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004c88c3
xor eax, eax
push esi
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push ebx
push eax
call fcn.004cc620
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004cc620
add esp, 0x30
push 0x104
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.004c892f
lea eax, [ebp - 0x20c]
push eax
call fcn.004c89f5
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc5b8
xor ecx, ecx
add esp, 0x10
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [ebp - 0x20c]
push eax
cmp dword [ebp + 8], ebx
je 0x4c8c4e
push 0x4f6964
push edi
push dword [ebp - 0x828]
call fcn.004cc4e5
jmp 0x4c8c8e
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4c8c60
xor eax, eax
jmp 0x4c8c7c
lea esi, [eax + eax]
mov eax, esi
call fcn.004cc750
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.00415c60
push eax
push 0x4fc568
push edi
push dword [ebp - 0x828]
call fcn.004cc69a
add esp, 0x10
xor eax, eax
jmp 0x4c8caf
push dword [ebp - 0x828]
push dword [ebp + 0x1c]
push dword [ebp - 0x82c]
push dword [ebp + 0x14]
push dword [ebp - 0x830]
call ebx
lea esp, [ebp - 0x83c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c961b
leave
ret 0x1c
Function at 0x4c928c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x519600], 0
push esi
jne 0x4c91ff
call fcn.004c9125
test eax, eax
je 0x4c9242
mov eax, dword [0x519600]
cmp eax, 1
jne 0x4c9220
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4c9242
pop esi
ret
push eax
call dword [0x519608]
test eax, eax
jne 0x4c928a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4c9246
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x519600]
call dword [0x519608]
mov edi, eax
test edi, edi
je 0x4c926b
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4c9287
mov edi, esi
add esi, 0xff0
push edi
push dword [0x519600]
call dword [0x519604]
add edi, 0x10
cmp edi, esi
jb 0x4c9273
mov eax, edi
pop edi
pop esi
ret
jmp 0x4c91ec

Function at 0x4c961b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x512054]
jne 0x4c9625
repz ret
jmp fcn.004cdcef

Function at 0x4cb610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4cb641
call fcn.004ce0b1
mov dword [eax], esi
call fcn.004ce09e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004ca36f
add esp, 0x14
push 0x16
pop eax
jmp 0x4cb696
test dword [ebp + 0xc], 0xfffffff9
jne 0x4cb61d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4cb66e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ce0c4
pop ecx
call fcn.004ce09e
mov eax, dword [eax]
jmp 0x4cb696
test al, 0x10
jne 0x4cb694
test al, 1
je 0x4cb694
test byte [ebp + 0xc], 2
je 0x4cb694
call fcn.004ce0b1
mov dword [eax], 5
call fcn.004ce09e
mov dword [eax], 0xd
jmp 0x4cb665
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4dd270
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004cffc3
and dword [ebp - 4], 0
cmp dword [0x51a1f8], 0
mov ebx, eax
jne 0x4dd321
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4dd3d2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4dd3d2
push eax
call fcn.004cff51
mov dword [esp], 0x4efa88
push edi
mov dword [0x51a1f8], eax
call esi
push eax
call fcn.004cff51
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x51a1fc], eax
call esi
push eax
call fcn.004cff51
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x51a200], eax
call esi
push eax
call fcn.004cff51
pop ecx
mov dword [0x51a208], eax
test eax, eax
je 0x4dd321
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004cff51
pop ecx
mov dword [0x51a204], eax
mov eax, dword [0x51a204]
cmp eax, ebx
je 0x4dd379
cmp dword [0x51a208], ebx
je 0x4dd379
push eax
call fcn.004cffcc
push dword [0x51a208]
mov esi, eax
call fcn.004cffcc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4dd379
test edi, edi
je 0x4dd379
call esi
test eax, eax
je 0x4dd370
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4dd370
test byte [ebp - 0xc], 1
jne 0x4dd379
or dword [ebp + 0x10], 0x200000
jmp 0x4dd3b2
mov eax, dword [0x51a1fc]
cmp eax, ebx
je 0x4dd3b2
push eax
call fcn.004cffcc
pop ecx
test eax, eax
je 0x4dd3b2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4dd3b2
mov eax, dword [0x51a200]
cmp eax, ebx
je 0x4dd3b2
push eax
call fcn.004cffcc
pop ecx
test eax, eax
je 0x4dd3b2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x51a1f8]
call fcn.004cffcc
pop ecx
test eax, eax
je 0x4dd3d2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4dd3d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push str.CICEApp::EnsureValidPath___n
push 2
push 0x45a150
call fcn.004018d0
mov ebx, dword [esp + 0x124]
add esp, 0xc
test ebx, ebx
je 0x402c40
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jb 0x402c40
cmp byte [ebx], 0x22
jne 0x402b79
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call fcn.00428f82
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebx - 1]
mov cl, byte [ecx + ebx - 1]
cmp cl, 0x22
jne 0x402b95
mov byte [eax], 0
mov ebp, dword [esp + 0x11c]
test ebp, ebp
je 0x402c1c
mov al, byte [0x469cb0]
mov ecx, 0x40
mov byte [esp + 0x10], al
xor eax, eax
lea edi, [esp + 0x11]
push 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
stosw word es:[edi], ax
push ecx
push 0x104
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edx, eax
test edx, edx
je 0x402c09
cmp edx, 0x104
ja 0x402c09
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x402c09
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402c1c
push ebp
jmp 0x402c48
push str.CICEApp::EnsureValidPath___n
push 4
push 0x45a150
call fcn.004018d0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov ecx, dword [esp + 0x11c]
push ecx
push ebx
push str.EnsureValidPath__s._d__failed_n
push 8
push 0x45a150
call fcn.004018d0
add esp, 0x14
push str.CICEApp::EnsureValidPath___n
push 4
push 0x45a150
call fcn.004018d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x40d710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442a30
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
push edi
mov edi, dword [esp + 0x48]
push edi
push ebx
push str.SaveTransform__d___s_
push 2
push 0x45a150
call fcn.004018d0
add esp, 0x14
push str.Transform
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40d77a
push ebx
push str.Could_not_find__d_resource
push 8
push 0x45a150
call fcn.004018d0
add esp, 0x10
xor al, al
jmp 0x40d8dc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
ja 0x40d7a5
push ebp
push str.Size_of_resource_is__d
push 8
push 0x45a150
call fcn.004018d0
add esp, 0x10
xor al, al
jmp 0x40d8dc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40d7b9
push str.Could_not_load_resource
jmp 0x40d7cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40d7e1
push str.LockResource_failed
push 8
push 0x45a150
call fcn.004018d0
add esp, 0xc
xor al, al
jmp 0x40d8dc
lea ecx, [esp + 0x10]
call fcn.0043c05b
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0
call fcn.0043bc34
mov eax, dword [0x456404]
mov dword [esp + 0x30], eax
push 0
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 2
mov dword [esp + 0x24], vtable.CFileException.0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xffffffff
call fcn.0043baf2
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 3
push ecx
push 0x1001
push edi
lea ecx, [esp + 0x1c]
call fcn.0043c16d
test eax, eax
jne 0x40d889
push edi
push str.__s__could_not_be_opened_for_writing
push 8
push 0x45a150
call fcn.004018d0
add esp, 0x10
mov dword [esp + 0x20], vtable.CFileException.0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 4
call fcn.0043ba49
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0043c0b0
xor al, al
jmp 0x40d8dc
push ebp
push esi
lea ecx, [esp + 0x18]
call fcn.0043c2c4
lea ecx, [esp + 0x10]
call fcn.0043c388
push edi
push ebx
push str.SaveTransform__d___s_
push 4
push 0x45a150
call fcn.004018d0
add esp, 0x14
mov dword [esp + 0x20], vtable.CFileException.0
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 5
call fcn.0043ba49
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0043c0b0
mov al, 1
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 8
Function at 0x41a971
Capabilities:
Identify system language via api

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x41a9c2
call fcn.0041b615
mov eax, dword [edi + 0x114]
mov ecx, dword [edi + 0x108]
mov esi, dword [eax]
mov ebx, dword [ecx]
cmp esi, eax
je 0x41a9c2
push dword [esp + 0x10]
call fcn.0042a0c0
pop ecx
push eax
lea ecx, [esi + 8]
push dword [esp + 0x14]
push dword [ecx + 8]
push 0
call fcn.00403c10
test eax, eax
je 0x41a9ce
mov esi, dword [esi]
mov ebx, dword [ebx]
cmp esi, dword [edi + 0x114]
jne 0x41a996
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
pop edi
pop esi
pop ebx
ret 4
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x41a9da
mov ebx, 0x445318
push 0x10
push 0
push ebx
call fcn.0042b2b1
add esp, 0xc
jmp 0x41a9c8
Function at 0x41b045
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x469cb0]
push esi
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0
mov esi, 0x104
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, eax
test edi, edi
je 0x41b0ab
cmp edi, esi
ja 0x41b0ab
push dword [ebp + 8]
call fcn.0042a0c0
cmp edi, eax
pop ecx
jae 0x41b0ab
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.0042b340
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
pop esi
leave
ret
Function at 0x420927
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x469cb0]
push esi
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 4]
test eax, eax
jne 0x42095c
mov eax, 0x445318
lea ecx, [ebp - 0x104]
push 0
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x104]
push eax
call fcn.0042a0c0
pop ecx
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, esi
call fcn.00403ab0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
pop esi
leave
ret