joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a624
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00434372
xor ebx, ebx
cmp dword [0x4567a8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43a6fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43a7da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43a7da
push eax
call fcn.00434304
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4567a8], eax
call esi
push eax
call fcn.00434304
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4567ac], eax
call esi
push eax
call fcn.00434304
mov dword [0x4567b0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00434b10
test eax, eax
pop ecx
pop ecx
je 0x43a6c8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004321e5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43a6fa
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00434304
cmp eax, ebx
pop ecx
mov dword [0x4567b8], eax
je 0x43a6fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00434304
pop ecx
mov dword [0x4567b4], eax
mov eax, dword [0x4567b4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43a77f
cmp dword [0x4567b8], ecx
je 0x43a77f
push eax
call fcn.0043437b
push dword [0x4567b8]
mov esi, eax
call fcn.0043437b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43a77f
cmp edi, ebx
je 0x43a77f
call esi
cmp eax, ebx
je 0x43a74c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43a74c
test byte [ebp - 0x18], 1
jne 0x43a77f
lea eax, [ebp - 0x10]
push eax
call fcn.00434b47
test eax, eax
pop ecx
je 0x43a767
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004321e5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43a776
or dword [ebp + 0x10], 0x200000
jmp 0x43a7ba
or dword [ebp + 0x10], 0x40000
jmp 0x43a7ba
mov eax, dword [0x4567ac]
cmp eax, dword [ebp - 8]
je 0x43a7ba
push eax
call fcn.0043437b
cmp eax, ebx
pop ecx
je 0x43a7ba
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43a7ba
mov eax, dword [0x4567b0]
cmp eax, dword [ebp - 8]
je 0x43a7ba
push eax
call fcn.0043437b
cmp eax, ebx
pop ecx
je 0x43a7ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4567a8]
call fcn.0043437b
cmp eax, ebx
pop ecx
je 0x43a7da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43a7dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404fb8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
jle 0x404fef
push esi
inc ecx
mov edx, dword [ebp + 8]
movzx esi, byte [eax]
and edx, 0xff
xor edx, esi
mov esi, dword [ebp + 8]
shr esi, 8
mov edx, dword [edx*4 + 0x5bc214]
xor edx, esi
inc eax
dec ecx
mov dword [ebp + 8], edx
jne 0x404fca
pop esi
mov eax, dword [ebp + 8]
pop ebp
ret
Function at 0x4055cf
Capabilities:
Get session user name

Disassembly:
mov eax, 0x565dfc
call fcn.00524444
sub esp, 0x148
mov ecx, dword [ebp + 8]
push esi
mov esi, str.__USERNAME__
push esi
call fcn.0053aa84
test eax, eax
jl 0x40561e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x100
push eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40561e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x154]
push eax
push esi
call fcn.0053a701
mov ecx, dword [ebp + 8]
push ebx
mov ebx, str.__GUID__
push edi
push ebx
call fcn.0053aa84
test eax, eax
jl 0x405681
push 0x10
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00524810
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0040789b
pop ecx
pop ecx
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
call fcn.0053a701
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0053eb4f
mov ecx, dword [ebp + 8]
mov ebx, str.__INCGUID__
push ebx
call fcn.0053aa84
test eax, eax
jl 0x4056f9
push 0x10
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00524810
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0040789b
pop ecx
pop ecx
push 0x5f
push 0x2d
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0053a6c4
lea ecx, [ebp - 0x10]
call fcn.0053f071
push dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
push ebx
call fcn.0053a701
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0053eb4f
mov ecx, dword [ebp + 8]
push str.__CURSOR__
call fcn.0053aa84
mov esi, eax
pop edi
test esi, esi
pop ebx
jl 0x40571b
mov ecx, dword [ebp + 8]
push 0xa
push esi
call fcn.0053a533
jmp 0x40571d
xor esi, esi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40581c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x18]
push eax
xor esi, esi
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40584d
xor eax, eax
jmp 0x405877
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x1c]
push dword [ebp + 0x14]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40586c
push 1
pop esi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x405a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x565e8c
call fcn.00524444
sub esp, 0x4c
push ebx
push esi
push edi
xor edi, edi
push dword [ebp + 8]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x10], edi
call fcn.0040207d
push edi
lea ecx, [ebp - 0x58]
call fcn.004020bb
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x405aea
lea ecx, [ebp - 0x20]
call fcn.0053f16c
push edi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.0053f31e
test eax, eax
je 0x405ad5
lea ecx, [ebp - 0x20]
call fcn.0053f618
mov ebx, eax
cmp ebx, edi
je 0x405ad5
push ebx
mov ecx, esi
call fcn.00402042
test eax, eax
je 0x405ad5
push ebx
lea ecx, [ebp - 0x20]
push dword [esi]
call fcn.0053f43b
mov ecx, dword [esi]
push edi
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0054b0d6
mov dword [ebp - 0x10], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0053f261
cmp dword [ebp - 0x10], edi
jne 0x405b6f
call fcn.0055c7c5
mov eax, dword [eax + 0xc]
push str.CFGFILES
push 0xdb
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
cmp ebx, edi
je 0x405b6f
call fcn.0055c7c5
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x405b6f
call fcn.0055c7c5
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x405b6f
push ebx
mov ecx, esi
call fcn.00402042
test eax, eax
je 0x405b6f
push ebx
push dword [ebp + 8]
push dword [esi]
call fcn.005244d0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push edi
push ebx
push dword [esi]
call fcn.0054b0d6
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40b703
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x40b805
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40b805
cmp dword [esi + 4], 0
je 0x40b805
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x40b805
lea eax, [ebp - 0x14]
push 0x10
push eax
push 0
push dword [esi + 4]
mov edi, reloc.WS2_32.dll_accept
mov ecx, esi
push edi
call fcn.0040b84c
test eax, eax
je 0x40b805
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
je 0x40b800
push 0xfffffffffffffff4
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
mov dword [ebp - 4], eax
je 0x40b7b8
cmp eax, 0xffffffff
je 0x40b7b8
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push ebx
call fcn.0040b80c
test eax, eax
je 0x40b7f8
lea eax, [ebp - 0x14]
push 0x10
push eax
push 0x10
push 0x668fc0
push dword [ebp - 4]
call fcn.005255a0
add esp, 0xc
jmp 0x40b7e8
cmp dword [esi + 8], 0
je 0x40b7f8
lea eax, [ebp - 0x44]
push 0x30
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x40b7f8
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push ebx
call fcn.0040b80c
test eax, eax
je 0x40b7f8
lea eax, [ebp - 0x14]
push 0x10
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
push dword [esi + 4]
push edi
call fcn.0040b84c
test eax, eax
je 0x40b805
push 2
push ebx
jmp 0x40b769
push 1
pop eax
jmp 0x40b807
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b84c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push edi
mov esi, 0x20006
push eax
xor edi, edi
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b891
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40b891
xor eax, eax
jmp 0x40b8b8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40b8ad
push 1
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x414594
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [ecx + 0x968]
push esi
mov dword [ecx + 1], eax
lea edx, [eax + 0xa]
mov dword [ecx + 0x970], edx
cmp word [eax], 0x5a4d
je 0x4145b5
push 2
jmp 0x4146d0
mov esi, dword [ecx + 0x96c]
lea edx, [eax + 0x3c]
add esi, eax
mov dword [ecx + 0x970], edx
cmp edx, esi
jae 0x414611
mov edx, dword [edx]
add eax, edx
cmp eax, esi
mov dword [ecx + 0x970], eax
jae 0x414611
add dword [ecx + 0x970], 4
lea edx, [ecx + 0x974]
mov dword [edx], eax
mov edx, dword [edx]
mov eax, dword [ecx + 0x970]
cmp dword [edx], 0x4550
jne 0x414611
add dword [ecx + 0x970], 0x14
mov dword [ecx + 5], eax
mov edx, dword [ecx + 5]
mov eax, dword [ecx + 0x970]
cmp word [edx], 0x14c
je 0x414618
push 3
jmp 0x4146d0
add dword [ecx + 0x970], 0x18
mov dword [ecx + 9], eax
movzx eax, word [eax]
cmp eax, 0x10b
je 0x41463c
cmp eax, 0x20b
jne 0x4146d5
mov byte [ecx], 1
jmp 0x41463f
and byte [ecx], 0
cmp byte [ecx], 0
mov eax, dword [ecx + 0x970]
jne 0x414666
add dword [ecx + 0x970], 4
mov dword [ecx + 0xd], eax
mov eax, dword [ecx + 0x970]
add dword [ecx + 0x970], 0x44
mov dword [ecx + 0x11], eax
jmp 0x414670
add dword [ecx + 0x970], 0x58
mov dword [ecx + 0x15], eax
mov eax, dword [ecx + 0x970]
add dword [ecx + 0x970], 0x80
mov dword [ecx + 0x19], eax
cmp dword [eax + 0x70], 0
jne 0x41468d
push 4
jmp 0x4146d0
xor esi, esi
cmp word [edx + 2], si
jbe 0x4146b6
lea eax, [ecx + 0x1d]
mov edx, dword [ecx + 0x970]
mov dword [eax], edx
mov edx, dword [ecx + 5]
add dword [ecx + 0x970], 0x28
inc esi
movzx edx, word [edx + 2]
add eax, 4
cmp esi, edx
jl 0x414698
mov eax, dword [ecx + 0x96c]
add eax, dword [ecx + 0x968]
cmp dword [ecx + 0x970], eax
ja 0x4146ce
mov al, 1
pop esi
ret
push 9
call fcn.00415a51
xor al, al
pop esi
ret
Function at 0x418379
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x567bbf
call fcn.00524444
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x674]
mov dword [ebp - 4], 0x26
call fcn.0053eb4f
lea ecx, [esi + 0x670]
mov byte [ebp - 4], 0x25
call fcn.0053eb4f
lea ecx, [esi + 0x66c]
mov byte [ebp - 4], 0x24
call fcn.0053eb4f
lea ecx, [esi + 0x668]
mov byte [ebp - 4], 0x23
call fcn.0053eb4f
lea ecx, [esi + 0x664]
mov byte [ebp - 4], 0x22
call fcn.0053eb4f
lea ecx, [esi + 0x65c]
mov byte [ebp - 4], 0x21
call fcn.0053eb4f
lea ecx, [esi + 0x658]
mov byte [ebp - 4], 0x20
call fcn.0053eb4f
lea ecx, [esi + 0x650]
mov byte [ebp - 4], 0x1f
call fcn.0053eb4f
lea ecx, [esi + 0x64c]
mov byte [ebp - 4], 0x1e
call fcn.0053eb4f
lea ecx, [esi + 0x648]
mov byte [ebp - 4], 0x1d
call fcn.0053eb4f
lea ecx, [esi + 0x644]
mov byte [ebp - 4], 0x1c
call fcn.0053eb4f
lea ecx, [esi + 0x640]
mov byte [ebp - 4], 0x1b
call fcn.0053eb4f
lea ecx, [esi + 0x604]
mov byte [ebp - 4], 0x1a
call fcn.00554740
lea ecx, [esi + 0x5c8]
mov byte [ebp - 4], 0x19
call fcn.00554740
lea ecx, [esi + 0x58c]
mov byte [ebp - 4], 0x18
call fcn.00554740
lea ecx, [esi + 0x550]
mov byte [ebp - 4], 0x17
call fcn.00554740
lea ecx, [esi + 0x514]
mov byte [ebp - 4], 0x16
call fcn.00554740
lea ecx, [esi + 0x4d8]
mov byte [ebp - 4], 0x15
call fcn.00554740
lea ecx, [esi + 0x49c]
mov byte [ebp - 4], 0x14
call fcn.00554740
lea ecx, [esi + 0x460]
mov byte [ebp - 4], 0x13
call fcn.00554740
lea ecx, [esi + 0x424]
mov byte [ebp - 4], 0x12
call fcn.00554740
lea ecx, [esi + 0x3e8]
mov byte [ebp - 4], 0x11
call fcn.00554740
lea ecx, [esi + 0x3ac]
mov byte [ebp - 4], 0x10
call fcn.00554740
lea ecx, [esi + 0x370]
mov byte [ebp - 4], 0xf
call fcn.00554740
lea ecx, [esi + 0x334]
mov byte [ebp - 4], 0xe
call fcn.00554740
lea ecx, [esi + 0x2f8]
mov byte [ebp - 4], 0xd
call fcn.0055493f
lea ecx, [esi + 0x2bc]
mov byte [ebp - 4], 0xc
call fcn.0055493f
lea ecx, [esi + 0x280]
mov byte [ebp - 4], 0xb
call fcn.0055493f
lea ecx, [esi + 0x244]
mov byte [ebp - 4], 0xa
call fcn.0055493f
lea ecx, [esi + 0x208]
mov byte [ebp - 4], 9
call fcn.0055493f
lea ecx, [esi + 0x1cc]
mov byte [ebp - 4], 8
call fcn.0055493f
lea ecx, [esi + 0x190]
mov byte [ebp - 4], 7
call fcn.0055493f
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 6
call fcn.0055493f
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 5
call fcn.0055493f
lea ecx, [esi + 0xdc]
mov byte [ebp - 4], 4
call fcn.0055493f
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.0055493f
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 2
call fcn.0055493f
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 1
call fcn.0053eb4f
and byte [ebp - 4], 0
lea ecx, [esi + 0x5c]
call fcn.0053eb4f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00544fa4
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41f382
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x568b7f
call fcn.00524444
sub esp, 0x22c
push ebx
push edi
mov edi, ecx
lea ecx, [edi + 4]
call fcn.0053dab1
mov eax, dword [edi + 0xd8]
xor ebx, ebx
cmp dword [eax - 8], ebx
je 0x41f53d
lea eax, [ebp - 0x238]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x41f3cb
mov byte [ebp - 0x238], bl
push esi
mov eax, dword [0x61d784]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0xd8]
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [eax - 8], ebx
jle 0x41f41a
movsx eax, byte [eax + esi]
push eax
call fcn.005273ff
test eax, eax
pop ecx
je 0x41f40e
mov eax, dword [edi + 0xd8]
lea ecx, [ebp - 0x1c]
mov al, byte [eax + esi]
mov byte [ebp - 0x10], al
push dword [ebp - 0x10]
call fcn.0053ef52
mov eax, dword [edi + 0xd8]
inc esi
cmp esi, dword [eax - 8]
jl 0x41f3e8
mov eax, dword [0x61d784]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
call fcn.0055c7c5
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x14]
push ecx
push ebx
push ebx
mov ecx, eax
call fcn.00431f6a
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [eax - 8], ebx
je 0x41f51c
push str.GNUAspell_
lea ecx, [ebp - 0x14]
call fcn.0053ef2b
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x41f46a
cmp byte [eax], bl
je 0x41f46a
push eax
call esi
jmp 0x41f46c
xor eax, eax
cmp eax, ebx
je 0x41f51c
lea ecx, [ebp - 0x30]
call fcn.00540041
mov eax, dword [0x61d784]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
call fcn.00401e47
cmp eax, ebx
jne 0x41f495
xor eax, eax
jmp 0x41f498
mov eax, dword [eax + 0x1c]
push dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push str.ignore__08X__s.csv
push eax
call fcn.0053ae0a
add esp, 0x10
lea ecx, [ebp - 0x30]
push ebx
push ebx
push dword [ebp - 0x10]
call fcn.005400b6
test eax, eax
je 0x41f504
mov eax, dword [0x61d784]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x30]
push eax
call fcn.00540299
test eax, eax
je 0x41f4f0
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], ebx
je 0x41f4ca
lea eax, [ebp - 0x18]
lea ecx, [edi + 4]
push eax
call fcn.0053dbe6
jmp 0x41f4ca
lea ecx, [ebp - 0x30]
call fcn.005403e6
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.0053eb4f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0053eb4f
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00540073
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0053eb4f
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0053eb4f
lea eax, [ebp - 0x238]
push eax
call esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x3c], ebx
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41f54e
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x568bbf
call fcn.00524444
sub esp, 0x22c
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
je 0x41f756
mov eax, dword [edi + 0xd8]
cmp dword [eax - 8], ebx
je 0x41f756
lea eax, [ebp - 0x238]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x41f598
mov byte [ebp - 0x238], bl
push esi
mov eax, dword [0x61d784]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0xd8]
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [eax - 8], ebx
jle 0x41f5e7
movsx eax, byte [eax + esi]
push eax
call fcn.005273ff
test eax, eax
pop ecx
je 0x41f5db
mov eax, dword [edi + 0xd8]
lea ecx, [ebp - 0x18]
mov al, byte [esi + eax]
mov byte [ebp - 0x14], al
push dword [ebp - 0x14]
call fcn.0053ef52
mov eax, dword [edi + 0xd8]
inc esi
cmp esi, dword [eax - 8]
jl 0x41f5b5
mov eax, dword [0x61d784]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
call fcn.0055c7c5
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push ebx
mov ecx, eax
call fcn.00431f6a
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x41f731
push str.GNUAspell_
lea ecx, [ebp - 0x10]
call fcn.0053ef2b
push dword [ebp - 0x10]
call fcn.0041f7de
mov eax, dword [ebp - 0x10]
pop ecx
cmp eax, ebx
je 0x41f63e
cmp byte [eax], bl
je 0x41f63e
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x41f640
xor eax, eax
cmp eax, ebx
je 0x41f731
lea ecx, [ebp - 0x30]
call fcn.00540041
mov eax, dword [0x622d7c]
mov byte [ebp - 4], 3
cmp dword [eax - 8], ebx
jne 0x41f66c
lea eax, [ebp - 0x10]
mov ecx, 0x622d7c
push eax
call fcn.0053ec88
mov eax, dword [0x61d784]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
call fcn.00401e47
cmp eax, ebx
jne 0x41f685
xor eax, eax
jmp 0x41f688
mov eax, dword [eax + 0x1c]
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push str.ignore__08X__s.csv
push eax
call fcn.0053ae0a
add esp, 0x10
lea ecx, [ebp - 0x30]
push ebx
push 0x1001
push dword [ebp - 0x14]
call fcn.005400b6
test eax, eax
je 0x41f719
mov esi, dword [edi + 8]
cmp esi, ebx
je 0x41f6f2
mov eax, esi
mov esi, dword [esi]
add eax, 8
mov ecx, dword [eax]
cmp dword [ecx - 8], ebx
je 0x41f6b5
push 0x5b85a0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0053ede4
push dword [eax]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.00540229
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0053eb4f
jmp 0x41f6b5
lea ecx, [ebp - 0x30]
call fcn.005403be
lea ecx, [ebp - 0x30]
call fcn.005403e6
lea eax, [ebp - 0x14]
mov dword [edi + 0x3c], ebx
push eax
mov ecx, 0x622d68
push dword [0x622d70]
call fcn.0053d7d1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0053eb4f
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00540073
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0053eb4f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0053eb4f
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41f7de
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov eax, 0x568c0b
call fcn.00524444
sub esp, 0x318
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0xf]
mov byte [ebp - 0x10], bl
push 0x40
stosw word es:[edi], ax
pop ecx
lea edi, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.00525034
add esp, 0x14
lea eax, [ebp - 0x324]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x41f845
mov byte [ebp - 0x324], bl
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 4], ebx
call fcn.0053ebbd
push 0x5bc994
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.0053ede4
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, ebx
je 0x41f87c
cmp byte [eax], bl
je 0x41f87c
push eax
call edi
jmp 0x41f87e
xor eax, eax
cmp eax, ebx
lea ecx, [ebp - 0x18]
sete byte [ebp + 0xb]
call fcn.0053eb4f
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0053eb4f
cmp byte [ebp + 0xb], bl
jne 0x41f920
cmp byte [ebp - 0x11c], 0x5c
je 0x41f8b6
cmp byte [ebp - 0x11c], 0x2f
je 0x41f8b6
xor eax, eax
jmp 0x41f8b9
push 1
pop eax
lea esi, [ebp + eax - 0x11c]
cmp byte [esi], bl
je 0x41f91d
push 0x5c
push esi
call fcn.0052540b
pop ecx
cmp eax, ebx
pop ecx
jne 0x41f8e0
push 0x2f
push esi
call fcn.0052540b
pop ecx
cmp eax, ebx
pop ecx
je 0x41f8e2
mov byte [eax], bl
cmp esi, ebx
je 0x41f8ef
cmp byte [esi], bl
je 0x41f8ef
push esi
call edi
jmp 0x41f8f1
xor eax, eax
cmp eax, ebx
jne 0x41f910
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, ebx
je 0x41f90a
cmp byte [esi], bl
je 0x41f90a
push esi
call edi
jmp 0x41f90c
xor eax, eax
cmp eax, ebx
je 0x41f920
push esi
call fcn.00525390
pop ecx
lea esi, [esi + eax + 1]
jmp 0x41f8c0
push 1
pop ebx
lea eax, [ebp - 0x324]
push eax
call edi
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret