joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503e52
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c7c4e
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
push eax
push 0x52c16c
push 0x17
push 0
push 0x519848
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4c7c38
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4c7c38
mov ecx, dword [eax]
mov edx, dword [ecx + 0xfc]
push 0
push eax
call edx
lea esi, [ebp - 0x2c]
call fcn.00462b00
mov byte [ebp - 4], 3
mov edi, dword [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx]
lea ecx, [ebp - 0x14]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0xe8]
push edx
call ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp word [ebp - 0x14], 0
jne 0x4c7bfe
jmp 0x4c7c38
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4c7c23
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4c7c4e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c7f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5066a0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
movzx eax, word [eax + 0x10]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4c80af
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x4c80af
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4c80af
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x14]
cmp ecx, ebx
je 0x4c80af
cmp dword [eax], 0x2e66622e
jne 0x4c80af
mov edx, 0x10000
cmp dword [eax + 0x3c], edx
jne 0x4c80af
cmp dword [eax + 0x40], edx
jne 0x4c80af
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], eax
mov dword [edi + 0x20], eax
call fcn.004c8840
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push eax
mov edx, edi
call fcn.004c8990
test al, al
je 0x4c8095
mov ecx, dword [esi + 0xc]
cmp dword [ecx - 0xc], ebx
je 0x4c8037
lea edx, [esi + 0x6c]
push edx
push ecx
mov edx, edi
call fcn.004c8990
test al, al
je 0x4c8095
mov ecx, dword [esi + 8]
cmp dword [ecx - 0xc], ebx
je 0x4c804f
lea eax, [esi + 0x70]
push eax
push ecx
mov edx, edi
call fcn.004c8990
test al, al
je 0x4c8095
add esi, 0x60
cmp esi, ebx
je 0x4c8095
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.004c7c70
test al, al
je 0x4c8098
mov byte [ebp - 4], 0
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
mov dword [ebp - 4], 0xffffffff
push edi
call esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 0
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call esi
mov dword [ebp - 4], 0xffffffff
push edi
call esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c8750
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x14]
xor esi, esi
cmp eax, esi
je 0x4c876f
push eax
call fcn.004e4d61
add esp, 4
mov dword [edi + 0x14], esi
mov eax, dword [ebp + 8]
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push eax
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
mov dword [edi + 0x34], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4c87a3
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push eax
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.004e4758
mov edx, dword [ebp - 8]
add esp, 4
push 0
lea ecx, [ebp - 4]
push ecx
push ebx
mov esi, eax
push esi
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c8811
cmp dword [ebp - 4], ebx
jne 0x4c8811
cmp dword [esi], 0x2e66622e
jne 0x4c8811
mov eax, 0x10000
cmp dword [esi + 0x3c], eax
jne 0x4c8811
cmp dword [esi + 0x40], eax
jne 0x4c8811
cmp dword [esi + 0x64], 0
je 0x4c8811
mov dword [edi + 0x14], esi
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], esi
mov dword [edi + 0x20], esi
call fcn.004c8840
mov bl, 1
jmp 0x4c8814
mov bl, byte [ebp + 0xb]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4c882b
push esi
call fcn.004e48a0
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c9cc0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x4c9ce0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4ca7d8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ebx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, ah
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ecx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8]
movzx ecx, ch
xor edx, dword [ebp + ecx*8 + 3]
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
shr eax, 0x18
xor edx, dword [ebp + eax*8 + 1]
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x4ca7f8
mov esi, eax
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, dh
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, ebx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, ah
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, ecx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, bh
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, eax
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
movzx edx, byte [ebp + edx + 0x800]
movzx ecx, ch
movzx ecx, byte [ebp + ecx + 0x800]
shl ecx, 8
xor edx, ecx
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
movzx ebx, byte [ebp + ebx + 0x800]
shl ebx, 0x10
xor edx, ebx
mov ebx, dword [esp + 8]
shr eax, 0x18
movzx eax, byte [ebp + eax + 0x800]
shl eax, 0x18
xor edx, eax
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4cf6b0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004e9110
mov eax, dword [0x5522c0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4cf715
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4cf715
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004e4fff
add eax, 0x40
push eax
call fcn.004ea380
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e4840
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004ea258
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4cf7a4
call fcn.004cf5d0
test eax, eax
je 0x4cf7a4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e4840
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e4840
add esp, 0x108
ret
Function at 0x4e45ab
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x558cf4], 0
push esi
push edi
jne 0x4e4521
call fcn.004e448d
test eax, eax
je 0x4e4566
mov eax, dword [0x558cf4]
cmp eax, 1
jne 0x4e4542
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4e4566
jmp 0x4e45a8
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4e45a8
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4e456a
xor eax, eax
jmp 0x4e45a8
mov eax, dword [esi]
push dword [0x558cf4]
call edi
mov edi, eax
test edi, edi
je 0x4e458c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4e45a8
lea edi, [esi + 0xff0]
push esi
push dword [0x558cf4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4e4592
mov eax, esi
pop edi
pop esi
ret
jmp 0x4e450d

Function at 0x4e4840
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5522c0]
jne 0x4e484a
repz ret
jmp fcn.004ea65b
Function at 0x4f7bbe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5522c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004ed856
and dword [ebp - 0x14], 0
cmp dword [0x559b0c], 0
mov dword [ebp - 0x18], eax
jne 0x4f7c71
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4f7d19
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5197f4
push ebx
call edi
test eax, eax
je 0x4f7d19
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x559b0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x559b10], eax
call edi
push eax
call esi
push 0x5197b4
push ebx
mov dword [0x559b14], eax
call edi
push eax
call esi
mov dword [0x559b1c], eax
test eax, eax
je 0x4f7c71
push 0x51979c
push ebx
call edi
push eax
call esi
mov dword [0x559b18], eax
mov eax, dword [0x559b18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4f7cca
cmp dword [0x559b1c], ecx
je 0x4f7cca
push eax
call esi
push dword [0x559b1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4f7cca
test ebx, ebx
je 0x4f7cca
call edi
test eax, eax
je 0x4f7cc1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4f7cc1
test byte [ebp - 8], 1
jne 0x4f7cca
or dword [ebp + 0x10], 0x200000
jmp 0x4f7cfd
mov eax, dword [0x559b10]
cmp eax, dword [ebp - 0x18]
je 0x4f7cfd
push eax
call esi
test eax, eax
je 0x4f7cfd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4f7cfd
mov eax, dword [0x559b14]
cmp eax, dword [ebp - 0x18]
je 0x4f7cfd
push eax
call esi
test eax, eax
je 0x4f7cfd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x559b0c]
call esi
test eax, eax
je 0x4f7d19
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4f7d1b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4840
leave
ret
Function at 0x4035c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x404c10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00403be0
xor ebx, ebx
push str.Cok_Free_Auto_Clicker_
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::operator
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
call fcn.00403cc0
lea eax, [esp + 0xc]
push str.para.dll
lea ecx, [esp + 0x14]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.00404408
mov edx, dword [esp + 0xc]
push 0x40718c
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
mov edi, eax
push edi
push 1
lea eax, [esi + 0xac]
push 4
push eax
call ebx
push edi
push 1
lea ecx, [esi + 0xa8]
push 4
push ecx
call ebx
push edi
push 1
lea edx, [esi + 0xaf4]
push 2
push edx
call ebx
push edi
push 1
lea eax, [esi + 0xaf6]
push 2
push eax
call ebx
add esp, 0x48
lea ecx, [esi + 0xb4]
push edi
push 1
push 4
push ecx
call ebx
push edi
push 1
add esi, 0xb0
push 4
push esi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00404408
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x4036f0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x404c30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
lea eax, [esp + 8]
push edi
mov esi, ecx
push eax
call fcn.00403be0
xor ebx, ebx
push str.Cok_Free_Auto_Clicker_
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::operator
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
call fcn.00403cc0
lea eax, [esp + 0xc]
push str.para.dll
lea ecx, [esp + 0x14]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.00404408
mov edx, dword [esp + 0xc]
push 0x4071b4
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x403795
mov ecx, esi
call fcn.004035c0
jmp 0x4037fc
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 1
lea eax, [esi + 0xac]
push 4
push eax
call ebx
push edi
push 1
lea ecx, [esi + 0xa8]
push 4
push ecx
call ebx
push edi
push 1
lea edx, [esi + 0xaf4]
push 2
push edx
call ebx
push edi
push 1
lea eax, [esi + 0xaf6]
push 2
push eax
call ebx
add esp, 0x40
lea ecx, [esi + 0xb4]
push edi
push 1
push 4
push ecx
call ebx
push edi
push 1
add esi, 0xb0
push 4
push esi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00404408
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x403be0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x404c85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
mov dword [esp + 0x124], 1
push eax
push ebx
push ebx
push 0x23
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x403c54
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [esp + 0x18]
lea ecx, [esp + 0xc]
push edx
call fcn.00404582
push 0x40720c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], bl
call fcn.00404408
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 4
Function at 0x403cc0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x404cb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CFileFind::CFileFind
lea eax, [esp + 0xc]
push 1
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x40720c
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
setne bl
call fcn.00404408
test bl, bl
je 0x403d32
push 0x40720c
lea ecx, [esp + 0x44]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x40]
mov ecx, dword [eax - 8]
cmp ecx, 4
jl 0x403e11
mov eax, ecx
lea ecx, [esp + 0xc]
dec eax
push eax
push ecx
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 2
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
sete bl
call fcn.00404408
test bl, bl
je 0x403e54
mov ebx, 3
lea ecx, [esp + 0xc]
mov esi, ebx
call sub.MFC42.DLL_CString::CString
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esp + 0x38], bl
push esi
push 0x40720c
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
je 0x403e46
lea esi, [eax + 1]
lea edx, [esp + 0x10]
push esi
push edx
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00404408
mov eax, dword [esp + 0xc]
push 0
push eax
call edi
test eax, eax
jne 0x403d9c
push esi
push 0x40720c
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x403d9c
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.00404408
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.0040463c
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00404408
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.00404408
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.0040463c
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00404408
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4