joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016f430
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10191ea8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x1016f462
call fcn.10168d70
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x1016f473
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x1016f4c8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1016f4ae
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x1016f5f4
cmp dword [esp + 0x18], ebx
jne 0x1016f4c8
cmp dword [esp + 0x14], ebx
je 0x1016f5f4
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x1016f4d9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.10172fd4
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1016f51f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x1016f51f
call fcn.100f53a0
test eax, eax
je 0x1016f51f
push 0x101c23a4
lea ecx, [esp + 0x14]
call fcn.101733fe
push ebx
lea ecx, [esp + 0x14]
call fcn.10173694
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x1016f5ce
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x1016f55b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1016f5ce
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x1016f5a9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1016f5ac
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x1016f5a4
mov dword [esi + 0x10], ebx
jmp 0x1016f5ac
mov dword [esi + 0x10], ecx
jmp 0x1016f5ac
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.10173267
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.10173267
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1016f44a
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10191ea8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x1016f462
call fcn.10168d70
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x1016f473
mov ecx, SysReAllocString
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x1016f4c8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1016f4ae
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x1016f5f4
cmp dword [esp + 0x18], ebx
jne 0x1016f4c8
cmp dword [esp + 0x14], ebx
je 0x1016f5f4
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x1016f4d9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.10172fd4
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1016f51f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x1016f51f
call fcn.100f53a0
test eax, eax
je 0x1016f51f
push 0x101c23a4
lea ecx, [esp + 0x14]
call fcn.101733fe
push ebx
lea ecx, [esp + 0x14]
call fcn.10173694
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x1016f5ce
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x1016f55b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1016f5ce
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x1016f5a9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1016f5ac
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x1016f5a4
mov dword [esi + 0x10], ebx
jmp 0x1016f5ac
mov dword [esi + 0x10], ecx
jmp 0x1016f5ac
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.10173267
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.10173267
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1017466d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x1017468f
cmp dword [edi + 0x3c], 0
jne 0x1017468f
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.1017fa6e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.101746ce
pop edi
pop esi
pop ebx
ret 8

Function at 0x10175dd3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10175e0b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10173725
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.101736fc
jmp 0x10175e17
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10177bd8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10177c1a
call fcn.1017fa6e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x10177c1a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10177c11
xor eax, eax
jmp 0x10177c22
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10177c28
pop edi
pop esi
pop ebx
ret 4

Function at 0xc654d8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub eax, dword [edx + ecx + 0x10]
jmp 0xbd6afd
je 0xd27633
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x837261
je 0xd27633
mov eax, dword [eax + ecx + 0x7c]
cmp cl, 0xc7
clc
cmc
push ebx
push edi
cmc
clc
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
clc
cmc
cmp esi, 0xffff
jmp 0x891b09
mov edi, dword [edx + ecx + 0x18]
jmp 0xc9647b
je 0xd27633
mov eax, 0x5a4d
cmp al, 0xa1
jmp 0xc13037
ja 0x81fcac
mov eax, esi
test ecx, ecx
jmp 0x7a22c7
cmp dword [eax + ecx], 0x4550
jmp 0xbe98bc
mov dword [ebp - 8], eax
jmp 0xd08ac7
jne 0xd27633
mov edx, dword [eax + ecx + 0x78]
cmp ax, di
jmp 0xca3894
add eax, ecx
cmp ah, 0xb
cmp bp, si
xor ebx, ebx
jmp 0xd01ca8
cmp word [ecx], ax
jmp 0xd2762d
push ebp
mov ebp, esp
xor cl, 0xf2
ror cl, cl
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
push esi
clc
test ecx, ecx
jmp 0x7ca930
js 0x8302a4
jmp 0xd16cda
je 0x8302a4
mov eax, dword [edx + ecx + 0x20]
test bx, 0x78ab
cmp ah, dl
jmp 0xbefab2
mov eax, dword [ecx + 0x3c]
jmp 0xbd537c
test edi, edi
jmp 0xc74b18
mov dword [ebp - 4], edx
test edx, edx
jmp 0x81bf06
ret
dec edi
jmp 0xd1b746
jmp 0x8302a4
mov dword [ebp - 0xc], eax
jmp 0xc66898
je 0xc85398
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0xcd1877
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x47aa0fdb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3b3e7e3a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x403280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0x24]
push esi
mov dword [esp + 0x44], 0
call sub.MFC42.DLL_CClientDC::CClientDC
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x48], 1
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x6e0032
push 1
push 0
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CPen::CPen
lea edx, [esp + 0xc]
lea ecx, [esp + 0x24]
push edx
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CDC::SelectObject_1
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CBrush::CBrush
lea ecx, [esp + 4]
mov byte [esp + 0x40], 3
push ecx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 1
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CDC::SetBkMode
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [ecx + 5]
lea ecx, [edx + 0xa]
mov edx, dword [esp + 0x50]
mov esi, dword [edx - 8]
push esi
push edx
push eax
mov eax, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x34]
call dword [eax + 0x64]
mov dword [esp + 4], 0x4045b0
lea ecx, [esp + 4]
mov byte [esp + 0x40], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov esi, 0x40459c
mov dword [esp + 0xc], 0x4045b0
mov dword [esp + 4], esi
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], esi
mov byte [esp + 0x40], 0
call fcn.00402eb2
lea ecx, [esp + 0x50]
mov dword [esp + 0x40], 0xffffffff
call fcn.00402e5e
mov ecx, dword [esp + 0x38]
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5b5820
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0049df14
mov eax, dword [0x626040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x629bb0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x5b59f8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x5b5947
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x5b5947
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x5b5925
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x5b58a9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5b59b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x5b5a18
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x5b59f3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5b5a18
jmp 0x5b5882
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f3cd
mov esp, ebp
pop ebp
ret
Function at 0x5b5ab0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0049df14
mov eax, dword [0x626040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x629bb0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x5b5c9b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x5b5be6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x5b5be6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x5b5bc2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x5b5b39
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5b5c54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5b5cbb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x5b5c96
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x5b5cbb
jmp 0x5b5b12
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f3cd
mov esp, ebp
pop ebp
ret
Function at 0x401b09
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4693ac]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x1c
mov eax, 0x458fd3
call fcn.0040c5d5
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x234]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 7
call fcn.0040113d
lea eax, [ebp - 0x28]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.00407bab
push str.DongFangInfo.ini
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
call fcn.00401a5f
add esp, 0x14
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov byte [ebp - 4], 1
jae 0x401b7d
lea eax, [ebp + 4]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x401bc7
push ebx
push 1
lea ecx, [ebp]
call fcn.0040115a
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040115a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0040c5c6
add ebp, 0x228
leave
ret 8
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x401bd3
lea eax, [ebp + 4]
push eax
push 0x104
lea eax, [ebp + 0x1c]
push eax
push 0x45a510
push str.CfgRootPath
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.004015f8
push str.AllSkin
mov ecx, esi
call fcn.004015db
cmp dword [esi + 0x18], 8
jb 0x401c14
mov esi, dword [esi + 4]
jmp 0x401c17
add esi, 4
push esi
call edi
test eax, eax
jne 0x401c3f
xor bl, bl
push 0
push 1
lea ecx, [ebp]
call fcn.0040115a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040115a
mov al, bl
jmp 0x401ba2
mov bl, 1
jmp 0x401c20
Function at 0x401c43
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
sub esp, 0x464
lea ebp, [esp - 4]
mov eax, dword [0x4693ac]
xor eax, ebp
mov dword [ebp + 0x464], eax
push 0x24
mov eax, 0x45901b
call fcn.0040c5d5
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x474]
mov edi, dword [ebp + 0x470]
push 7
pop ebx
xor esi, esi
push esi
lea ecx, [ebp]
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x18], ebx
call fcn.0040113d
mov ecx, dword [ebp - 0x14]
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00401b09
test al, al
je 0x401d9c
push 0x206
lea eax, [ebp + 0x25e]
push esi
push eax
mov word [ebp + 0x25c], si
call fcn.0040cc40
mov ecx, dword [0x46b21c]
add esp, 0xc
lea eax, [ebp + 0x25c]
push eax
push edi
call fcn.0040192b
mov ecx, eax
call fcn.00401820
push 0x45a5e4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00401a5f
lea ecx, [ebp + 0x25c]
push ecx
push eax
lea eax, [ebp + 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.00401a5f
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040115a
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
jae 0x401d1f
lea eax, [ebp + 0x3c]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
jae 0x401d34
lea eax, [ebp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push esi
je 0x401d92
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], ebx
call fcn.0040113d
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401aa6
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x401d6a
lea eax, [ebp + 0x20]
push edi
push eax
lea eax, [ebp + 0x54]
push str.__s___bindinst__s
push eax
call fcn.0040c70d
lea eax, [ebp + 0x54]
push eax
call fcn.00407629
add esp, 0x14
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.0040115a
push esi
push 1
lea ecx, [ebp + 0x38]
call fcn.0040115a
push esi
push 1
lea ecx, [ebp]
call fcn.0040115a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x464]
xor ecx, ebp
call fcn.0040c5c6
add ebp, 0x468
leave
ret 8

Function at 0x40276c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40277e
xor eax, eax
ret
and al, 0x10
xor cl, cl
cmp cl, al
sbb eax, eax
neg eax
ret