joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddca0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xc
push 0x590
call fcn.004e5670
mov ecx, eax
add esp, 4
mov dword [esp + 4], ecx
test ecx, ecx
jne 0x4ddcbe
add esp, 0xc
ret
mov eax, dword [0x7a8b9c]
mov dword [ecx + 0x58c], eax
mov eax, dword [0x7a8ba0]
push ebx
mov dword [ecx], eax
mov eax, dword [0x7a8ba4]
push esi
mov dword [ecx + 4], eax
lea eax, [ecx + 8]
push 0x580
mov dword [esp + 0x14], eax
mov dword [eax], 0
lea eax, [ecx + 0xc]
push 0
push eax
mov dword [esp + 0x14], eax
call fcn.00690e10
mov esi, dword [0x7a8bbc]
xor ebx, ebx
add esp, 0xc
cmp dword [0x7a8bc0], ebx
jbe 0x4dddde
push ebp
mov ebp, dword [esp + 0x10]
add ebp, 0x24
push edi
nop dword [eax + eax]
push dword [0x7a9170]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4ddd53
mov edi, dword [0x7a8bd8]
test edi, edi
jne 0x4ddd53
push 0x397
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push 0x6f8818
call fcn.006adcf2
add esp, 0xc
cmp dword [edi], 0xa
jl 0x4ddd6c
push dword [esi + 8]
push dword [esi]
push str.adding_image_format__s__s_n
push 0xa
call fcn.004f70e0
add esp, 0x10
mov edi, dword [esp + 0x18]
lea eax, [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi + 8]
push dword [esi]
push ebx
push edi
push dword [esp + 0x28]
call fcn.004e2960
add esp, 0x1c
test eax, eax
jne 0x4dddcf
cmp dword [ebp - 0x18], ebx
je 0x4dddaa
push 0x353
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push str.ctx__image_fmtinfos_i_.id__i
call fcn.006adcf2
add esp, 0xc
mov eax, dword [esi + 0x18]
inc ebx
mov dword [ebp], eax
add esi, 0x1c
add ebp, 0x2c
cmp ebx, dword [0x7a8bc0]
jb 0x4ddd20
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
push edi
push dword [esp + 0x14]
call fcn.004e33a0
add esp, 8
pop edi
pop ebp
mov eax, dword [esp + 0xc]
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4dddf0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7a9170]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4dde25
push esi
mov esi, dword [0x7a8bd8]
test esi, esi
jne 0x4dde22
push 0x397
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push 0x6f8818
call fcn.006adcf2
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x4dde30
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7a9170]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4dde66
push esi
mov esi, dword [0x7a8bd8]
test esi, esi
jne 0x4dde62
push 0x397
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push 0x6f8818
call fcn.006adcf2
add esp, 0xc
mov eax, dword [esi]
pop esi
ret
mov eax, dword [eax]
ret
Function at 0x4dde70
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7a9170]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4ddeaa
push esi
mov esi, dword [0x7a8bd8]
test esi, esi
jne 0x4ddea2
push 0x397
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push 0x6f8818
call fcn.006adcf2
add esp, 0xc
mov eax, dword [esi + 0x58c]
pop esi
ret
mov eax, dword [eax + 0x58c]
ret

Function at 0x4ddec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push str.use_of_jas_init_is_deprecated_n
call fcn.004f7050
add esp, 4
mov word [0x7a8b80], 1
mov dword [0x7a8b84], 0
mov byte [0x7a8b88], 1
mov dword [0x7a8b8c], 0
mov byte [0x7a8b90], 0
mov dword [0x7a8b98], 8
mov dword [0x7a8b94], 0x6f7c98
mov dword [0x7a8b9c], 0
mov dword [0x7a8ba0], 0
mov dword [0x7a8ba4], 0x4f7210
call fcn.004de080
test eax, eax
je 0x4ddf37
or eax, 0xffffffff
ret
push ebx
mov ebx, 0x7a916c
nop dword [eax]
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x4ddf40
cmp byte [0x7a8bd0], al
je 0x4de046
push esi
push edi
push dword [0x7a9170]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
test esi, esi
jne 0x4ddf92
mov esi, dword [0x7a8bd8]
test esi, esi
jne 0x4ddfb1
push 0x397
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push 0x6f8818
call fcn.006adcf2
add esp, 0xc
cmp esi, dword [0x7a8bd8]
je 0x4ddfb1
push 0x2d6
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push str.jas_get_ctx____jas_global.ctx
call fcn.006adcf2
add esp, 0xc
push dword [0x7a9174]
call edi
test eax, eax
jne 0x4ddfc5
cmp dword [0x7a8bd8], eax
je 0x4ddff4
push dword [0x7a9174]
call edi
test eax, eax
cmove eax, dword [0x7a8bd8]
cmp eax, 0x7a8bdc
je 0x4ddff4
push 0x2d8
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push str._jas_get_default_ctx____jas_get_default_ctx____jas_global.ctx_buf
call fcn.006adcf2
add esp, 0xc
call fcn.004ddca0
mov esi, eax
test esi, esi
je 0x4de036
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push dword [0x7a9170]
call edi
test eax, eax
je 0x4de058
push esi
push dword [0x7a9174]
call edi
test eax, eax
jne 0x4de026
push 0x3dc
jmp 0x4de05d
inc dword [0x7a8bd4]
xor eax, eax
xchg dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor eax, eax
xchg dword [ebx], eax
call fcn.004dd9f0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
push str.FATAL_ERROR:_jas_init_thread_called_before_JasPer_library_initialized_n
call fcn.004f70b0
add esp, 4
call fcn.006ad580
push 0x3b7
push str.C:DeveloperVisual_Package_vcpkg_buildtreesjasper_src5eb260a2e4_ca02e25be6.clean_srclibjasper_basejas_init.c
push 0x776090
call fcn.006adcf2
add esp, 0xc
call fcn.006ad580
int3
Function at 0x4df8b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x79a200]
xor eax, esp
mov dword [esp + 0x104], eax
call fcn.004dddf0
cmp dword [eax], 0x64
jl 0x4df8dd
push str.jas_stream_tmpfile___n
push 0x64
call fcn.004f70e0
add esp, 8
push esi
call fcn.004dea30
mov esi, eax
test esi, esi
jne 0x4df8ff
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0068d76f
add esp, 0x108
ret
push ebx
push edi
push 0x110
mov dword [esi], 0xb
call fcn.004e5670
mov edi, eax
add esp, 4
test edi, edi
je 0x4df9c4
lea eax, [esp + 0xc]
mov dword [edi], 0xffffffff
mov dword [edi + 4], 0
lea ebx, [edi + 8]
push eax
mov byte [ebx], 0
push 0x104
mov dword [esi + 0x38], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4df9be
push ebx
push 0
push str.jasper
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4df9be
push 0x1b6
push 0x8702
push ebx
call fcn.006b45fc
add esp, 0xc
mov dword [edi], eax
test eax, eax
js 0x4df9c4
cmp byte [ebx], 0
je 0x4df98e
push ebx
call fcn.006a70f4
add esp, 4
test eax, eax
jns 0x4df98e
or dword [edi + 4], 1
push 0
push 0
push 2
push esi
call fcn.004df040
add esp, 0x10
mov dword [esi + 0x34], 0x6f8820
mov eax, esi
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0068d76f
add esp, 0x108
ret
mov dword [edi], 0xffffffff
push esi
call fcn.004deaa0
mov ecx, dword [esp + 0x114]
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.0068d76f
add esp, 0x108
ret
Function at 0x50b160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [esi + 0x38]
call fcn.0051e580
push eax
push esi
call fcn.0051e6f0
push 0x108
push 0
push edi
call fcn.0050aab0
mov ebp, 1
mov dword [edi + 0x34], 0x10001
mov dword [edi + 0x2c], 0x10001
mov eax, 2
mov word [edi + 0x54], ax
add esp, 0x14
mov dword [edi + 0x38], 0x10001
xor eax, eax
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0xd8], 0x20002
mov word [edi + 0xdc], bp
mov dword [esi + 0x334], fcn.004056a0
mov dword [esi + 0x340], 0
mov dword [esi + 0x344], 0x50bff0
mov dword [esi + 0x348], 0x50b750
mov dword [esi + 0x34c], 0
mov word [edi + 0x56], bp
mov word [edi + 0x30], bp
mov dword [edi + 0x28], 0
mov dword [edi + 0x40], 0x10000
mov word [edi + 0x74], ax
mov dword [edi + 0x78], eax
cmp dword [esi + 0x358], eax
jbe 0x50b27d
push ebx
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x354]
cmp dword [ebx + eax + 4], 0
je 0x50b24d
push dword [ebx + eax + 0xc]
push esi
call fcn.0050f3a0
add esp, 8
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x358]
jb 0x50b233
pop ebx
push dword [esi + 0x354]
push esi
call fcn.0050f3a0
add esp, 8
mov dword [esi + 0x358], 0
mov dword [esi + 0x354], 0
mov eax, dword [0x7a91d0]
test eax, eax
je 0x50b28c
push esi
call eax
add esp, 4
push 1
push 0x103
push esi
call fcn.0050b660
and dword [esi + 0xc], 0xfffffbf7
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
ret
Function at 0x516380
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movzx eax, word [esi + 0x20]
cmp eax, 6
ja case.0x516398.12
jmp dword [eax*4 + 0x516568]
cmp word [esi + 0x18], 8
je case.0x516398.12
movzx eax, word [esi + 0x18]
mov edi, 1
mov cl, al
shl edi, cl
mov ecx, 0xff
dec edi
cmp eax, 0x10
cmove edi, ecx
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.0050f3b0
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x5163fc
push str.No_space_for_photometric_conversion_table
push dword [esi]
call fcn.004fc9c0
add esp, 4
push eax
push dword [esi]
call fcn.0051da80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor ebx, ebx
cmp word [esi + 0x20], bx
jne 0x516428
test edi, edi
js 0x516446
imul ebp, edi, 0xff
nop
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
sub ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x516410
jmp 0x516446
test edi, edi
js 0x516446
xor ebp, ebp
nop
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
add ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x516430
cmp word [esi + 0x18], 0x10
ja case.0x516398.12
movzx eax, word [esi + 0x20]
cmp eax, 1
je 0x51645b
test ax, ax
jne case.0x516398.12
push esi
call fcn.00517600
add esp, 4
test eax, eax
jne 0x516470
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push dword [esi + 0x38]
push dword [esi]
call fcn.0050f3a0
add esp, 8
mov dword [esi + 0x38], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov cl, byte [esi + 0x18]
mov eax, 1
mov ebp, dword [esi + 0x24]
mov edx, ebp
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x28]
shl eax, cl
mov ecx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x5164ec
mov dword [esp + 0x1c], 0x100
nop dword [eax]
mov ax, word [edx]
lea edx, [edx + 2]
dec ecx
cmp ax, word [esp + 0x1c]
jae 0x516528
mov ax, word [edi]
add edi, 2
cmp ax, word [esp + 0x1c]
jae 0x516528
mov ax, word [ebx]
add ebx, 2
cmp ax, word [esp + 0x1c]
jae 0x516528
test ecx, ecx
jg 0x5164c0
push str.Assuming_8_bit_colormap
push dword [esi]
call fcn.004fc9c0
add esp, 4
push eax
push dword [esi]
call fcn.00526da0
add esp, 0xc
cmp word [esi + 0x18], 8
ja case.0x516398.12
push esi
call fcn.005178a0
add esp, 4
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
add edx, 0xffffffff
js 0x516506
mov eax, dword [esi + 0x28]
sub ebp, eax
mov ebx, dword [esp + 0x14]
sub ebx, eax
lea ecx, [eax + edx*2]
nop
sub edx, 1
movzx eax, byte [ecx + ebp + 1]
mov word [ecx + ebp], ax
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 3]
mov word [ecx + 2], ax
movzx eax, byte [ebx + ecx + 3]
mov word [ebx + ecx + 2], ax
jns 0x516540
jmp 0x516506
Function at 0x541f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x542105
cmp dword [esi + 0x20], 0
je 0x542105
cmp dword [esi + 0x24], 0
je 0x542105
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x542105
cmp dword [eax], esi
jne 0x542105
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x541fe5
cmp eax, 0x39
je 0x541fe5
cmp eax, 0x45
je 0x541fe5
cmp eax, 0x49
je 0x541fe5
cmp eax, 0x5b
je 0x541fe5
cmp eax, 0x67
je 0x541fe5
cmp eax, 0x71
je 0x541fe5
cmp eax, 0x29a
jne 0x542105
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x54201e
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x542040
call fcn.00542b50
jmp 0x542045
call fcn.00542f80
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.00544110
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00690e10
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x727f1a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x727f18]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x727f1c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x727f1e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x54675f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x5467a7
call fcn.0054ae98
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5467a7
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x5467b4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x5467f0
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x5467d3
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x5467dc
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x5467ee
test di, di
jne 0x5467ee
test dx, dx
je 0x5467f0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x546859
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.0054ae98
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x546899
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x546899
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.005468a1
jmp 0x54689b
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x546b91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x6dbae5
call fcn.0068e750
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.0054ae98
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x546bf0
call fcn.0054ae98
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x546c04
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x546c00
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x546c0c
or eax, 0xffffffff
jmp 0x546d5e
mov ecx, edi
call fcn.0054719b
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0054bdd2
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x546c98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x546c98
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x546c98
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.00421140
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x546c95
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x6ebb00]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x546c95
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0054a56a
test eax, eax
je 0x546c95
push 0
mov ecx, esi
call fcn.00549e22
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0054ba55
push ebx
call fcn.0054d141
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00546b34
test eax, eax
jne 0x546ce1
cmp dword [edi + 0x9c], eax
jne 0x546ce1
call fcn.0054ae98
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0054d141
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00546b34
and dword [edi + 0x9c], 0
jmp 0x546d0c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x546d20
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.00549e22
test esi, esi
je 0x546d2d
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x546d43
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x546d43
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x6ebb00]
mov ecx, edi
call esi
mov ecx, edi
call fcn.00547152
mov eax, dword [edi + 0x68]
call fcn.0068e6b5
ret
Function at 0x54a42a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x6dbb43
call fcn.0068e6e7
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x54a450
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x54a4aa
lea ecx, [ebp - 0x10]
call fcn.00407380
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x6ebb00]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0069a742
push eax
call fcn.004069d0
add esp, 0x14
test esi, esi
je 0x54a49d
push esi
call fcn.0069bbeb
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00407360
mov eax, ebx
call fcn.0068e6b5
ret 8

Function at 0x54d0d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x54d113
call fcn.0054ae98
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x54d113
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x54d11b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00549a91
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x54de90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x54df1c
cmp dword [esi + 0x20], 0
je 0x54df1c
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x54df1c
cmp dword [ebp + 8], 0
je 0x54df1c
xor edi, edi
mov ebx, edi
call fcn.0054ae98
push 0x72d470
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x54df00
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x54df1c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00567ea5
mov edi, eax
add esp, 0xc
test edi, edi
je 0x54df18
mov ecx, esi
call fcn.0054dc2e
mov eax, edi
jmp 0x54df1e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x553003
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x55302d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x553033
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.004071b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0056109d
int3
Function at 0x5530e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x553127
push 0x72ca10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x553136
push str.MoveFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x553136
push dword [esi]
mov ecx, edi
push 2
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x6ebb00]
call edi
jmp 0x553138
cmp dword [esi + 4], ebx
je 0x553136
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x55336d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x55337e
xor eax, eax
jmp 0x55339a
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x55339f
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.004071b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0056109d
int3

Function at 0x553473
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x6ebb00]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x5534a6
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.004071b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0056109d
int3

Function at 0x55357f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x5535aa
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5535b0
cmp dword [ebp - 4], esi
jne 0x5535c7
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.004071b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0056109d
lea ecx, [edi + 0xc]
call fcn.004071b0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.00560cf3
int3