joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ce0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
test edi, edi
je 0x406e40
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jl 0x406e40
mov al, byte [esp + 0x10]
cmp al, 0x41
jl 0x406d3d
cmp al, 0x5a
jle 0x406d4d
cmp al, 0x61
jl 0x406e40
cmp al, 0x7a
jg 0x406e40
cmp byte [esp + 0x11], 0x3a
jne 0x406e40
cmp byte [esp + 0x12], 0x5c
jne 0x406e40
cmp ecx, 3
jne 0x406da3
mov eax, dword [esp + 0x11c]
test eax, eax
jne 0x406d96
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.00407e56
add esp, 8
test eax, eax
je 0x406d96
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret
mov al, byte [esp + 0x13]
mov esi, 3
test al, al
mov edi, 1
je 0x406e2e
mov ebx, dword [esp + 0x11c]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + esi + 0x10]
mov ecx, eax
mov al, byte [eax]
test al, al
je 0x406ddb
cmp al, 0x5c
je 0x406ddb
mov al, byte [esp + esi + 0x11]
inc esi
test al, al
jne 0x406dce
mov al, byte [esp + esi + 0x10]
xor edx, edx
test al, al
sete dl
push ecx
mov edi, edx
mov byte [esp + esi + 0x14], 0
call fcn.00406a80
add esp, 4
test eax, eax
je 0x406e40
test ebx, ebx
jne 0x406e1c
lea eax, [esp + 0x10]
push ebx
push eax
call ebp
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.00407e56
add esp, 8
test eax, eax
jne 0x406d86
test edi, edi
jne 0x406e2e
mov byte [esp + esi + 0x10], 0x5c
mov al, byte [esp + esi + 0x11]
inc esi
test al, al
jne 0x406dc2
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
pop ebx
sete al
add esp, 0x104
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret

Function at 0x407e56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409c87
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x407e99
test byte [esp + 8], 2
je 0x407e99
call fcn.00409cfa
mov dword [eax], 0xd
call fcn.00409d03
mov dword [eax], 5
jmp 0x407e72
xor eax, eax
ret
Function at 0x4148e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00408110
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4149ab
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4149ab
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41495e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x414969
or bh, 8
and edi, 0x8000000
je 0x414984
mov eax, dword [0x42ea1c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4149ab
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x414dab
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x414dcf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x414dea
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x41776f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4177a7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041a1a9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0041a181
jmp 0x4177b3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x418cde
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x418d20
call fcn.0041d735
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x418d20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x418d17
xor eax, eax
jmp 0x418d28
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00418d2e
pop edi
pop esi
pop ebx
ret 4

Function at 0x41e397
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41e3c5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e3e3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041e2fd
jmp 0x41e3e3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41e3e3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041e2fd
test edi, edi
mov eax, edi
jne 0x41e3cd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403370
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x108]
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
xor eax, eax
push fcn.00403360
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 1
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
xor cx, cx
mov edx, 0xff
call fcn.0040aec0
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 4]
call fcn.0041a520
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00403360
mov esp, ebp
pop ebp
ret

Function at 0x403420
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
mov edx, 0x583978
lea eax, [ebp - 0x18]
call fcn.004100e0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.00403400
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, str.Parametr
call fcn.0040a4d0
mov edx, dword [0x5d76f0]
lea eax, [ebp - 0x14]
call fcn.0040a4d0
lea eax, [ebp - 0x10]
mov edx, str.Parametr
call fcn.0040a4d0
mov edx, dword [0x5d76f4]
lea eax, [ebp - 0xc]
call fcn.0040a4d0
mov byte [ebp - 8], 0
add byte [ebp - 8], 1
mov edx, 1
mov eax, 0x58b6a0
call fcn.00437c50
mov dword [ebp - 4], eax
xor eax, eax
push fcn.004033f0
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x80000001
call fcn.00437c10
mov al, byte [ebp - 8]
cmp al, 1
jl 0x4034f4
sub al, 1
je 0x4034d0
sub al, 1
je 0x4034e4
jmp 0x4034f4
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00437e80
jmp 0x4034f4
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.00437e80
nop
movzx eax, byte [ebp - 8]
mov edx, dword [ebp + eax*8 - 0x20]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.00438060
mov eax, dword [ebp - 0x1c]
movzx edx, byte [ebp - 8]
mov edx, dword [ebp + edx*8 - 0x1c]
call fcn.0040b090
test eax, eax
je 0x403534
movzx eax, byte [ebp - 8]
mov ecx, dword [ebp + eax*8 - 0x1c]
movzx eax, byte [ebp - 8]
mov edx, dword [ebp + eax*8 - 0x20]
mov eax, dword [ebp - 4]
call fcn.00438220
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004033f0
cmp byte [ebp - 8], 2
jl 0x403488
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00403400
mov esp, ebp
pop ebp
ret
Function at 0x404320
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x258]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x138], 0
xor eax, eax
push fcn.00404300
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x5d7010]
cmp ebx, 1
jl 0x4043a8
mov dword [ebp - 0x134], 0
lea esi, [esi]
mov eax, dword [ebp - 0x134]
add eax, 1
mov dword [ebp - 0x134], eax
lea eax, [eax*4 + 0x5d500c]
xor edx, edx
call fcn.0040a4d0
mov eax, dword [ebp - 0x134]
mov dword [eax*4 + 0x5d600c], 0
cmp ebx, dword [ebp - 0x134]
jg 0x404370
mov esi, esi
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.0040a4d0
mov dword [0x5d7010], 1
mov dword [ebp - 0x130], 0x128
push 0
push 2
call fcn.0043dc70
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 8]
call fcn.0043dc80
test eax, eax
je 0x404514
jmp 0x4044fb
push 1
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x10c]
xor cx, cx
mov edx, 0x103
call fcn.0040aec0
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
lea eax, [eax*4 + 0x5d500c]
call fcn.0040a4d0
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0x128]
mov dword [eax*4 + 0x5d600c], edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax*4 + 0x5d500c]
mov dword [ebp - 0x148], eax
mov eax, 0x5835d4
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax*4 + 0x5d600c]
xor edx, edx
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], edx
push dword [ebp - 0x154]
push dword [ebp - 0x158]
mov ecx, 0xff
lea edx, [ebp - 0x258]
mov eax, 0xffffffff
call fcn.004069c0
lea ecx, [ebp - 0x150]
xor dx, dx
lea eax, [ebp - 0x258]
call fcn.0040ad50
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x150]
call fcn.0040bb20
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x140], eax
mov eax, 0x5835c4
mov dword [ebp - 0x13c], eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
mov ecx, 4
call fcn.0040a860
add dword [ebp - 0x134], 1
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 8]
call fcn.0043dc90
test eax, eax
jne 0x4043f8
mov esi, esi
mov eax, dword [ebp - 0x134]
mov dword [0x5d7010], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00404300
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4107f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5d8bc0], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5d8bbc]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5d8bc0], edx
cmp eax, 0x26f
jl 0x4107f8
mov dword [0x568070], 0x270
ret
Function at 0x410830
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5d8bc4]
mov ebx, dword [eax*4 + 0x5d8bc0]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d91f4]
mov dword [eax*4 + 0x5d8bc0], edx
cmp eax, 0xe2
jl 0x410838
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d8bc4]
mov ebx, dword [eax*4 + 0x5d8bc0]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d8834]
mov dword [eax*4 + 0x5d8bc0], edx
cmp eax, 0x26e
jl 0x410888
mov edx, dword [0x5d8bc0]
mov ecx, dword [0x5d957c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5d91f0]
mov dword [0x5d957c], eax
mov dword [0x568070], 0
pop ebx
ret

Function at 0x410910
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x568070]
add dword [0x568070], 1
mov eax, dword [0x5d7760]
cmp eax, dword [0x5677c0]
jne 0x410933
cmp ebx, 0x271
jb 0x410954
mov eax, dword [0x5d7760]
call fcn.004107f0
not dword [0x5d7760]
mov eax, dword [0x5d7760]
mov dword [0x5677c0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x410970
call fcn.00410830
xor ebx, ebx
mov dword [0x568070], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5d8bc0]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret

Function at 0x4124c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x567510]
cmp ax, 0xcb
je 0x4125cc
cmp ax, 0xcc
je 0x4125cc
lea esi, [esi]
mov edx, dword [0x5d97c0]
test edx, edx
je 0x4124f5
mov eax, dword [0x5d9670]
call edx
mov ebx, eax
jmp 0x4124fa
mov ebx, 0x5d9674
cmp word [0x5d9660], 0
jle 0x412520
mov eax, 0x5d9640
call fcn.00412730
mov eax, ebx
call fcn.00412080
mov eax, ebx
call fcn.004120f0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x412542
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41253d
mov edx, edi
mov eax, ebx
call fcn.004114f0
jmp 0x412540
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x412528
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5d9660], 0
jle 0x4125cc
mov edx, 0x5d9580
mov eax, ebx
call fcn.00411630
mov edi, eax
test edi, edi
je 0x41259c
mov eax, dword [0x5d9614]
mov dword [edi + 0xc], eax
cmp dword [0x5d9614], 0
je 0x412590
mov eax, dword [0x5d9614]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5d9614], eax
nop
sub word [0x5d9660], 1
cmp word [0x5d9660], 0
sete bl
mov eax, 0x5d9640
call fcn.00412750
test bl, bl
je 0x4125cc
mov eax, 0x5d9640
call fcn.00412720
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x414780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00414760
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x4148aa
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040d0c0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41480f
mov edx, 0x5d8a40
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x414861
call sub.kernel32.dll_GetLastError
call fcn.00405bc0
lea eax, [ebp - 0x10]
call fcn.0040bca0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040c140
mov edx, dword [ebp - 0x14]
mov ecx, 0x583c2c
lea eax, [ebp - 0x10]
call fcn.0040bfd0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040c990
jmp 0x4148f8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41487a
cmp eax, ecx
je 0x414884
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040d0c0
cmp byte [0x567790], 0
jne 0x4148f8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040d660
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040ca20
lea esi, [esi]
jmp 0x4148f8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040d0c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x4148ce
mov eax, 0x5d8a40
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x567790], 0
jne 0x4148f8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040d660
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040ca20
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00414760
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414d10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5d89a0], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00414ef0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5d89a0]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00405130
call sub.kernel32.dll_GetCommandLineA
mov dword [0x567590], eax
mov ebx, eax
jmp 0x414eb3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x414d98
cmp byte [ebx], 0
je 0x414ebc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x414e13
mov al, byte [ebx]
cmp al, 1
jb 0x414e08
sub al, 0x20
jbe 0x414dd8
sub al, 2
je 0x414dec
jmp 0x414e08
mov al, byte [ebp - 0x114]
test al, al
je 0x414e18
add dword [ebp - 0x110], 1
jmp 0x414e10
cmp byte [ebx + 1], 0x22
je 0x414e03
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x414e10
add ebx, 1
jmp 0x414e10
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x414dc8
test dword [ebp - 0x10c], 0xffffffff
je 0x414eac
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00414ef0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5d89a0]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x414ea3
mov al, byte [ebx]
cmp al, 1
jb 0x414e98
sub al, 0x20
jbe 0x414e68
sub al, 2
je 0x414e7c
jmp 0x414e98
mov al, byte [ebp - 0x114]
test al, al
je 0x414ea8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x414ea0
cmp byte [ebx + 1], 0x22
je 0x414e93
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x414ea0
add ebx, 1
jmp 0x414ea0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x414e58
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x414d9b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5d8990], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5d89a0
call fcn.00412300
mov eax, dword [0x5d89a0]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4196a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.00419690
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.0040a4d0
lea eax, [ebp - 0xc10]
call fcn.00405650
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x419700
mov eax, 0x5d8a40
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4197aa
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.00411330
xor eax, eax
push fcn.00419680
push ebp
push 0x415b90
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x41975c
mov eax, 0x5d8a40
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x419798
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x586c9c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x419798
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00419680
jmp 0x419808
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4197cc
mov eax, 0x5d8a40
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x419808
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x586c9c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x419808
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00419690
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret