joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1c8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004079cb
mov dword [ebp - 0x14], eax
cmp dword [0x4ab580], esi
jne 0x40c2bb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c248
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c39b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c39b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c39b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ab580], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ab584], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ab588], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab590], eax
test eax, eax
je 0x40c2b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab58c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c2f5
push 4
pop eax
jmp 0x40c39d
cmp dword [ebp - 0x14], esi
je 0x40c2f5
push dword [0x4ab580]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2da
mov eax, dword [0x4ab58c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c353
cmp dword [0x4ab590], edi
je 0x40c353
push eax
call ebx
push dword [0x4ab590]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c353
test eax, eax
je 0x40c353
call ecx
test eax, eax
je 0x40c348
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c348
test byte [ebp - 8], 1
jne 0x40c353
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c383
mov eax, dword [0x4ab584]
cmp eax, edi
je 0x40c380
push eax
call ebx
test eax, eax
je 0x40c380
call eax
mov esi, eax
test esi, esi
je 0x40c380
mov eax, dword [0x4ab588]
cmp eax, edi
je 0x40c380
push eax
call ebx
test eax, eax
je 0x40c380
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ab580]
call ebx
test eax, eax
je 0x40c39b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c39d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b35
mov esp, ebp
pop ebp
ret
Function at 0x408900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul eax, edx, 0x2064e241
cmp eax, 0x49ff313e

Function at 0x408cd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [edx + 0x26]
mov esi, dword [edx + 0x28]
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x408cca
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x408cc1
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x408d2f
add eax, edx
mov ecx, dword [eax + 0x18]
push eax
mov ebx, dword [eax + 0x20]
add ebx, edx
test ecx, ecx
je 0x408d2e
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x408cfa
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x408cee
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x408cb8
Function at 0x401040
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c1fb
mov eax, dword fs:[0]
push eax
mov eax, 0x13ac
call fcn.00406e50
mov eax, dword [0x411024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor edi, edi
lea esi, [ebp - 0x13b4]
mov dword [ebp - 0x13a0], 0xf
mov dword [ebp - 0x13a4], ebx
mov byte [ebp - 0x13b4], bl
call fcn.00401b50
mov dword [ebp - 4], ebx
call fcn.00407106
or esi, 0xffffffff
mov dword [ebp - 4], esi
cmp dword [ebp - 0x13a0], 0x10
jb 0x4010bd
mov eax, dword [ebp - 0x13b4]
push eax
call fcn.004021f9
add esp, 4
mov dword [ebp - 0x13a0], 0xf
mov dword [ebp - 0x13a4], ebx
mov byte [ebp - 0x13b4], bl
call fcn.00407106
mov dword [ebp - 0x1394], eax
mov ecx, eax
mov dword [ebp - 0x14], esi
mov eax, 1
mov edx, ecx
shr edx, 0x1e
xor ecx, edx
imul ecx, ecx, 0x6c078965
add ecx, eax
mov dword [ebp + eax*4 - 0x1394], ecx
inc eax
cmp eax, 0x270
jl 0x4010e8
fld1
sub esp, 8
xor eax, eax
fstp qword [esp]
lea ecx, [ebp - 0x1398]
mov dword [ebp - 0x1398], 0x270
call fcn.00401f50
fmul qword [0x40f160]
add esp, 8
fsub qword [0x40f158]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402204
mov esp, ebp
pop ebp
ret

Function at 0x401150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c1fb
mov eax, dword fs:[0]
push eax
mov eax, 0x13ac
call fcn.00406e50
mov eax, dword [0x411024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor edi, edi
lea esi, [ebp - 0x13b4]
mov dword [ebp - 0x13a0], 0xf
mov dword [ebp - 0x13a4], ebx
mov byte [ebp - 0x13b4], bl
call fcn.00401b50
mov dword [ebp - 4], ebx
call fcn.00407106
or esi, 0xffffffff
mov dword [ebp - 4], esi
cmp dword [ebp - 0x13a0], 0x10
jb 0x4011cd
mov eax, dword [ebp - 0x13b4]
push eax
call fcn.004021f9
add esp, 4
mov dword [ebp - 0x13a0], 0xf
mov dword [ebp - 0x13a4], ebx
mov byte [ebp - 0x13b4], bl
call fcn.00407106
mov dword [ebp - 0x1394], eax
mov ecx, eax
mov dword [ebp - 0x14], esi
mov eax, 1
mov edx, ecx
shr edx, 0x1e
xor ecx, edx
imul ecx, ecx, 0x6c078965
add ecx, eax
mov dword [ebp + eax*4 - 0x1394], ecx
inc eax
cmp eax, 0x270
jl 0x4011f8
fld1
sub esp, 8
xor eax, eax
fstp qword [esp]
lea ecx, [ebp - 0x1398]
mov dword [ebp - 0x1398], 0x270
call fcn.00401f50
fld qword [0x40f150]
fldz
add esp, 8
fsub st(1), st(0)
fxch st(2)
fmulp st(1)
faddp st(1)
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402204
mov esp, ebp
pop ebp
ret
Function at 0x4013b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [esi]
push edi
mov dword [ebp - 8], eax
call fcn.00401040
fstp st(0)
mov edi, 0xf4240
lea esp, [esp]
inc bl
movzx ebx, bl
mov eax, dword [esi + ebx*4 + 8]
mov cl, al
add cl, byte [ebp - 8]
mov dword [ebp - 0x14], eax
movzx ecx, cl
mov edx, dword [esi + ecx*4 + 8]
mov dword [esi + ebx*4 + 8], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [esi + ecx*4 + 8], eax
call fcn.00401150
mov cl, byte [esi + ebx*4 + 8]
mov edx, dword [ebp - 8]
fstp st(0)
mov al, byte [esi + edx*4 + 8]
xor edx, edx
test al, al
sete dl
mov byte [ebp - 1], cl
movzx eax, al
movzx ecx, cl
add edx, dword [esi + ecx*4 + 8]
lea ecx, [esi + ecx*4 + 8]
mov dword [esi + ebx*4 + 8], edx
lea edx, [esi + eax*4 + 8]
xor eax, eax
cmp byte [ebp - 1], al
mov dword [ebp - 0xc], edx
mov edx, dword [edx]
sete al
inc edi
add edx, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [esi + eax*4 + 8], edx
lea edx, [eax + ebx]
mov al, byte [ebp - 0x10]
movzx edx, dl
add al, dl
add al, byte [ebp - 0x14]
movzx eax, al
mov dl, byte [esi + eax*4 + 8]
lea eax, [esi + eax*4 + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
xor byte [edi + eax - 1], dl
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
xor dword [ecx], edx
mov ecx, dword [esi + ebx*4 + 8]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
xor dword [eax], ecx
cmp edi, 0x34ae58
jl 0x4013d0
mov edx, dword [ebp - 8]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401ff0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
lea ecx, [esi + 0x9c4]
mov edi, 0xe3
lea esp, [esp]
mov eax, dword [ecx + 4]
xor eax, dword [ecx]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx + 0x634]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x402000
lea ecx, [esi + 0xd50]
mov edi, 0x18c
nop
mov eax, dword [ecx]
xor eax, dword [ecx + 4]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx - 0xd4c]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x402040
mov eax, dword [esi + 0x1380]
xor eax, dword [esi + 4]
and eax, 0x7fffffff
xor eax, dword [esi + 0x1380]
mov ecx, eax
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [esi + 0x634]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9c0], edx
mov dword [esi], edi
pop edi
ret
Function at 0x4020b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
add eax, 0x638
mov edx, 0x68
push edi
lea ecx, [ecx]
mov esi, dword [eax - 0x630]
mov ecx, dword [eax - 0x634]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, dword [eax - 0x634]
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, ecx
xor edi, dword [eax]
mov dword [eax + 0x38c], edi
mov edi, dword [eax - 0x62c]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 4]
xor esi, ecx
mov dword [eax + 0x390], esi
mov esi, dword [eax - 0x628]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, dword [eax + 8]
xor edi, ecx
mov dword [eax + 0x394], edi
mov edi, dword [eax - 0x624]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 0xc]
xor esi, ecx
mov dword [eax + 0x398], esi
mov esi, dword [eax - 0x620]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
and edi, 0x9908b0df
xor edi, dword [eax + 0x10]
shr ecx, 1
xor edi, ecx
mov ecx, dword [eax - 0x61c]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
mov dword [eax + 0x39c], edi
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x14]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x3a0], esi
add eax, 0x18
dec edx
jne 0x4020c0
pop edi
pop esi
pop ebx
ret

Function at 0x402204
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411024]
jne 0x40220e
repz ret
jmp fcn.0040297c
Function at 0x40596c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402fdb
and dword [ebp - 0x14], 0
cmp dword [0x412de8], 0
mov dword [ebp - 0x18], eax
jne 0x405a1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405ac7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405ac7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x412de8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x412dec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x412df0], eax
call edi
push eax
call esi
mov dword [0x412df8], eax
test eax, eax
je 0x405a1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x412df4], eax
mov eax, dword [0x412df4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405a78
cmp dword [0x412df8], ecx
je 0x405a78
push eax
call esi
push dword [0x412df8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405a78
test ebx, ebx
je 0x405a78
call edi
test eax, eax
je 0x405a6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405a6f
test byte [ebp - 8], 1
jne 0x405a78
or dword [ebp + 0x10], 0x200000
jmp 0x405aab
mov eax, dword [0x412dec]
cmp eax, dword [ebp - 0x18]
je 0x405aab
push eax
call esi
test eax, eax
je 0x405aab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405aab
mov eax, dword [0x412df0]
cmp eax, dword [ebp - 0x18]
je 0x405aab
push eax
call esi
test eax, eax
je 0x405aab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412de8]
call esi
test eax, eax
je 0x405ac7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405ac9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402204
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x4b239fec
add eax, 0xb51c7c7a
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xf82ccc18
sub dword [ebp - 0x2c], 0xa9da86cd
mov dword [ebp - 0x28], 0x1d757a40
sub dword [ebp - 0x28], 0xeb422dfb
mov dword [ebp - 0x24], 0x985f995c
sub dword [ebp - 0x24], 0x4c13552e
mov dword [ebp - 0x20], 0x8ff504bd
sub dword [ebp - 0x20], 0x8ff504bd
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1185cc26
sub dword [ebp - 0x2c], 0x9d1362d0
mov dword [ebp - 0x28], 0x75dfaf18
add dword [ebp - 0x28], 0xcb8cb25d
mov dword [ebp - 0x24], 0xd7ab4b7d
add dword [ebp - 0x24], 0x8bc420ef
mov dword [ebp - 0x20], 0xe76b9338
sub dword [ebp - 0x20], 0xe76b9338
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34296
push 0
call eax
mov ecx, FormatMessageW
xor ebx, ebx
add ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x1c]
mov edi, 0x9d5b3735
add edi, 0x2890dbc1
sub dword [ebp - 0x18], esi
mov edx, dword [esi]
xor dword [ebp - 4], 0x26bf7b51
xor edx, edi
add dword [ebp - 4], edi
mov dword [ebx], edx
add dword [ebp - 8], esi
add ebx, 0x4d86bb0b
sub ebx, 0x4d86bb07
add esi, 0xbe83e141
sub esi, 0xbe83e13d
loop 0x401d74
add eax, 0xf5b16f97
add eax, 0xa4f7e20
xor ebx, ebx
add ebx, eax
add eax, 0x3c36dc1b
add eax, 0xc3c923ea
mov ecx, 0xbf03ce95
add ecx, 0x413c316b
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40173b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401774
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401770
jmp 0x401760
cmp esi, eax
jae 0x401774
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401760
cmp esi, eax
jb 0x40177b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f799
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d1614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00447edb
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40398a
push 0x80004005
call fcn.00401fc0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp edi, ebx
je 0x403a2a
push 0x20a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x403a2a
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push ebx
push esi
call fcn.005440c0
add esp, 0xc
push 1
push 0x23
push esi
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x403a0e
lea edi, [ebp - 0x10]
mov ecx, 0x105
mov edx, esi
call fcn.00403650
cmp eax, ebx
jge 0x403a03
xor ecx, ecx
jmp 0x403a06
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x403a17
cmp ecx, ebx
je 0x403a17
mov ecx, dword [ebp + 8]
push esi
call fcn.004019e0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x403a2a
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp + 8]
mov edx, dword [esi]
cmp dword [edx - 0xc], ebx
je 0x403a42
push 0xc
push str.EPSONRYOGA
mov ecx, esi
call fcn.00403ec0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ead0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5d1614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
movzx eax, word [ebp + 0xc]
push 0x5a0afc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4043cf
push 0x5c2874
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x5a04b4
call fcn.00543d86
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x4043f3
push 0x5c2874
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 0x5a04d0
call fcn.00543d86
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x40441e
push 0x5c2874
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 0x5a04e8
call fcn.00543d86
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x404449
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x5c2874
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x5a0508
call fcn.00543d86
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x404491
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x5c2874
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x5a052c
call fcn.00543d86
mov eax, 0x40447d
ret
push edi
push ebx
push eax
call fcn.00546940
add esp, 0xc
lea edx, [ebp + 0xc]
push edx
push 0
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4044c0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.00404cd0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x406ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d920
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d1614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
xor esi, esi
cmp dword [eax - 0xc], ecx
mov dword [ebp - 0x18], esi
jg 0x406f3d
mov dword [ebp - 0x14], ecx
push 0x5c2820
lea ecx, [ebp - 0x14]
push ecx
call fcn.00543d86
mov eax, 0x406f26
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406f52
test al, 0x10
jne 0x406f52
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d900
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d1614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
xor esi, esi
cmp dword [eax - 0xc], ecx
mov dword [ebp - 0x18], esi
jg 0x406fdd
mov dword [ebp - 0x14], ecx
push 0x5c2820
lea ecx, [ebp - 0x14]
push ecx
call fcn.00543d86
mov eax, 0x406fc6
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406ff2
test al, 0x10
je 0x406ff2
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret