joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x160
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x110
je 0x10001870
cmp eax, 0x111
jne 0x10001832
mov dword [esp + 4], 8
mov dword [esp], ebx
call dword [sym.imp.user32.dll_GetWindowLongW]
sub esp, 8
mov esi, eax
test eax, eax
je 0x10001940
movzx eax, word [ebp + 0x10]
cmp eax, 2
je 0x10001960
jbe 0x10001840
cmp eax, 0x410
je 0x10001900
cmp eax, 0x411
jne 0x10001832
mov edx, esi
mov eax, ebx
call dbg.SERIALUI_DialogInfoToDCB
mov dword [esp + 8], 0x34
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetDefaultCommConfigW]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x100019b0
xor esi, esi
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 0x10
cmp eax, 1
jne 0x10001832
mov edx, esi
mov eax, ebx
mov esi, 1
call dbg.SERIALUI_DialogInfoToDCB
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EndDialog]
sub esp, 8
jmp 0x10001834
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10001832
mov eax, dword [ebp + 0x14]
mov dword [esp], ebx
lea esi, [ebp - 0x158]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_SetWindowLongW]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], 0x28
call dword [sym.imp.user32.dll_GetWindowTextW]
mov eax, dword [ebp + 0x14]
sub esp, 0xc
mov eax, dword [eax]
mov dword [esp + 8], esi
lea esi, [ebp - 0x108]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], pe_nt_image_headers32
call dbg.swprintf
mov dword [esp + 4], esi
mov esi, 1
mov dword [esp], ebx
call dword [sym.imp.user32.dll_SetWindowTextW]
mov edx, dword [ebp + 0x14]
mov eax, ebx
sub esp, 8
call dbg.SERIALUI_DCBToDialogInfo
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 0x10
mov dword [ebp - 0x108], 0x34
lea eax, [ebp - 0x108]
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDefaultCommConfigW]
sub esp, 0xc
test eax, eax
je 0x10001980
mov edx, esi
mov eax, ebx
call dbg.SERIALUI_DCBToDialogInfo
jmp 0x10001832
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EndDialog]
sub esp, 8
jmp 0x100017e1
mov dword [esp + 4], 0x4c7
mov esi, 1
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EndDialog]
sub esp, 8
jmp 0x10001834
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.GetDefaultCommConfig
mov dword [esp + 4], str.Failed
mov dword [esp], ebx
call dword [sym.imp.user32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x1000192d
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.GetDefaultCommConfig
mov dword [esp + 4], str.Failed
mov dword [esp], ebx
call dword [sym.imp.user32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x10001834
Function at 0x10001da0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
call dbg.SERIALUI_strdup
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dbg.drvCommConfigDialogW@12
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x10001e00
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
test byte [0x10003178], 8
jne 0x10001e70
cmp ebx, 0x33
jbe 0x10001e5e
test esi, esi
je 0x10001e5e
lea eax, [ebp - 0xdc]
mov dword [esp + 4], 0x80000002
mov dword [esp + 8], eax
mov dword [esp], 0
call dword [sym.imp.advapi32.dll_RegConnectRegistryW]
sub esp, 0xc
test eax, eax
je 0x10001ea5
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._p__p__lx_n
mov dword [esp + 8], str.drvSetDefaultCommConfigW
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.6
jmp 0x10001e2f
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0xd4]
mov dword [esp + 0xc], str.SystemCurrentControlSetServicesClassPorts
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x64
call dbg.swprintf
lea eax, [ebp - 0xd8]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x10001f20
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
call edi
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp - 0xd8]
add esi, 8
mov dword [esp + 0x14], 0x1c
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], 0x100050e6
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov ebx, eax
test byte [0x10003178], 8
jne 0x10001f80
mov eax, dword [ebp - 0xd8]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x10001efe
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.write_key_r_ld_n
mov dword [esp + 8], str.drvSetDefaultCommConfigW
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.6
jmp 0x10001f64
Function at 0x10001fb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
call dbg.SERIALUI_strdup
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dbg.drvSetDefaultCommConfigW@12
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x100022e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
call dbg.SERIALUI_strdup
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dbg.drvGetDefaultCommConfigW@12
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x10002390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x100023e8
cmp byte [ebx + esi - 1], 0xa
je 0x100023bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100070a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10002a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10002bc4
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x100070a4]
cmp dword [edx + 0x24], edi
je 0x10002ae7
test byte [0x100031a8], 8
jne 0x10002b70
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100031b8], 8
jne 0x10002b33
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002a89
cmp esi, 3
jbe 0x10002af2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x10002a9a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100053e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x10002a89
mov dword [esp], 0x100031b8
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x10002a60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x10002a60
mov dword [esp], 0x100031a8
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x10002a4b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10002a53
mov eax, 0xffffffff
jmp 0x10002ae7
Function at 0x405177
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov esi, 0x206
mov word [ebp - 0x20c], ax
push esi
xor edi, edi
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.0058e700
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.0058e700
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405219
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x405219
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
lea eax, [ebp - 0x414]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret
Function at 0x408d3a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x637190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78], eax
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x408d89
push str.pszMsg_is_invalid_string._n
push str.AbbreviationInControl
push 5
call fcn.00424dad
add esp, 0xc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x408ed5
push esi
push eax
push ebx
call fcn.00591dbe
push 0x1abe
push str.CommonFunctions.cpp
lea eax, [eax*4 + 2]
push eax
call fcn.0045a88d
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x408dcd
push str.pszMsg_is_invalid_string._n
push str.AbbreviationInControl
push 5
call fcn.00424dad
add esp, 0xc
or eax, 0xffffffff
jmp 0x408ed4
push 0
push 0
push 0x31
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x70]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 0x74], eax
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x7c]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x10
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0058e700
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp - 0x78]
push ebx
call fcn.00591dbe
push ebx
lea eax, [eax*2 + 1]
push eax
push esi
call fcn.00591d62
mov ebx, dword [ebp - 0x74]
add esp, 0x14
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov eax, ecx
sub eax, dword [ebp - 0x14]
cdq
mov dword [ebp - 0x78], 0xfffffff6
idiv dword [ebp - 0x78]
add ecx, eax
cmp dword [ebp + 0x18], 0xffffffff
mov dword [ebp - 0xc], ecx
je 0x408e99
cmp dword [ebp + 0x18], 0
lea eax, [ebp - 0x14]
je 0x408e89
push 0x18120
jmp 0x408e8e
push 0x14120
push eax
push 0xffffffffffffffff
push esi
push edi
call dword [sym.imp.USER32.dll_DrawTextW]
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x80]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x408ec2
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.0045a8a4
xor eax, eax
pop ecx
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0058f6bb
mov esp, ebp
pop ebp
ret
Function at 0x409cce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
call fcn.00474a71
push 2
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x409e8a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409e8a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x409e8a
mov ecx, 0x100
cmp dword [ebx + 0x20], esi
je 0x409d2a
movzx esi, word [ebx + 0x20]
jmp 0x409d4f
movzx eax, word [ebx + 0xe]
dec eax
je 0x409d4c
sub eax, 3
je 0x409d48
sub eax, 4
je 0x409d44
sub eax, 0x10
jne 0x409d4f
xor esi, esi
jmp 0x409d4f
mov esi, ecx
jmp 0x409d4f
push 0x10
jmp 0x409d4e
push 2
pop esi
movzx eax, si
mov dword [ebp + 0xc], eax
lea eax, [eax*4 + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x409db0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x409db0
mov eax, 0x300
mov word [edi + 2], si
mov word [edi], ax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x409db0
lea ecx, [edi + 5]
mov esi, eax
lea edx, [ebx + 0x29]
mov al, byte [edx + 1]
mov byte [ecx - 1], al
mov al, byte [edx]
lea edx, [edx + 4]
mov byte [ecx], al
lea ecx, [ecx + 4]
mov al, byte [edx - 5]
mov byte [ecx - 3], al
mov byte [ecx - 2], 0
dec esi
jne 0x409d93
push 8
call fcn.004730a5
mov esi, eax
pop ecx
test esi, esi
je 0x409dca
and dword [esi + 4], 0
mov dword [esi], vtable.CPalette.0
jmp 0x409dcc
xor esi, esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
test edi, edi
je 0x409de7
push edi
call dword [sym.imp.GDI32.dll_CreatePalette]
push eax
mov ecx, esi
call fcn.004754f2
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
push 1
push dword [eax]
call fcn.00475bbe
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_RealizePalette]
test edi, edi
je 0x409e09
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
test eax, eax
je 0x409e17
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebx]
mov ecx, dword [ebp + 0xc]
push 4
push dword [esi + 4]
lea edi, [eax + ecx*4]
add edi, ebx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
test eax, eax
je 0x409e52
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, dword [eax]
sub edx, dword [eax + 4]
push 0xcc0020
xor eax, eax
push eax
push ebx
push edi
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push eax
push edx
push ecx
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0x5c5a14
push str.CopyDIB
push 5
call fcn.00424dad
xor eax, eax
add esp, 0xc
inc eax
jmp 0x409ea0
push 0x5c5a30
push str.CopyDIB
push 5
call fcn.00424dad
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a5de
Capabilities:
Delete directory

Disassembly:
push 0x2c
mov eax, 0x5ae978
call fcn.0058f75f
lea ecx, [ebp - 0x38]
call fcn.0047409e
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.00406ad4
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0041efc9
push 0x5c5f64
lea ecx, [ebp - 0x14]
call fcn.00409054
push esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
call fcn.004741ba
test eax, eax
je 0x40a714
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00406ad4
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.00474362
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.00474720
test eax, eax
je 0x40a661
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
jmp 0x40a6f0
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0041efc9
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x38]
call fcn.0047442e
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push 0x5c4f0c
push eax
call fcn.0040897a
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
push dword [eax - 0xc]
push eax
call fcn.0040907d
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0041d6f2
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.0041d6f2
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
push 0x10
call dword [eax + 0x38]
test eax, eax
je 0x40a6d3
push dword [ebp - 0x10]
call fcn.0040a5de
pop ecx
jmp 0x40a6ea
push 0x80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], 1
call fcn.0041d6f2
test esi, esi
jne 0x40a631
lea ecx, [ebp - 0x38]
call fcn.0047416e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0041d6f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004740ce
mov eax, esi
call fcn.0058f72d
ret
Function at 0x40b387
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, dword [ebp + 8]
push edi
call esi
or ecx, 0xffffffff
cmp eax, ecx
jne 0x40b3aa
push 0xfffffffffffffffe
pop eax
jmp 0x40b444
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call esi
cmp eax, 0xffffffff
jne 0x40b3be
push 2
pop eax
jmp 0x40b443
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.004700a1
push dword [ebp + 0x10]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.004700a1
add esp, 0x20
test esi, esi
je 0x40b461
test eax, eax
je 0x40b44a
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
ja 0x40b4d1
jb 0x40b47a
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
ja 0x40b4d1
jb 0x40b47a
xor eax, eax
push eax
push eax
push 3
push eax
inc eax
push eax
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
je 0x40b441
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
test eax, eax
jne 0x40b47f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push str._s_is_newer._Has_resource__n
push str.FileCompare
push 4
call fcn.00424dad
add esp, 0x10
jmp 0x40b4d1
test eax, eax
je 0x40b409
push ebx
push str._s_is_newer._Has_resource__n
push str.FileCompare
push 4
call fcn.00424dad
add esp, 0x10
or eax, 0xffffffff
jmp 0x40b443
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocStringLen
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
je 0x40b441
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
test eax, eax
jne 0x40b4bd
call edi
jmp 0x40b441
call edi
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
ja 0x40b4d1
jb 0x40b4df
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], ecx
jbe 0x40b4d9
xor eax, eax
inc eax
jmp 0x40b443
jae 0x40b441
mov ax, bx
jmp 0x40b443
Function at 0x4125dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x350
mov eax, 0x5af05f
call fcn.0058f792
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
and dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x35c]
call sym.SETUP.exe_public:_void___thiscall_CDeviceInfSection::constructor_void_
mov byte [ebp - 4], 1
test esi, esi
je 0x41271d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41271d
mov eax, dword [ebp + 0x18]
movzx eax, ax
push eax
lea eax, [ebp - 0x1c]
push 0x5c5f14
push eax
call fcn.00401b7b
push str.Source
call fcn.0058edd4
add esp, 0x10
lea ecx, [ebp - 0x34]
push eax
push str.Source
call fcn.00404be0
push 0x5c5de0
call fcn.0058edd4
pop ecx
push eax
push 0x5c5de0
lea ecx, [ebp - 0x34]
call fcn.00404a83
cmp word [ebp - 0x1c], 0
jne 0x412684
xor eax, eax
jmp 0x41268e
lea eax, [ebp - 0x1c]
push eax
call fcn.0058edd4
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00404a83
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmovae ecx, dword [ebp - 0x34]
inc eax
push eax
push ecx
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x35c]
push esi
call sym.SETUP.exe_public:_int___thiscall_CDeviceInfSection::Init_wchar_t_const___unsigned_int__class_CInfStringTable___wchar_t_const___unsigned_int_
test eax, eax
je 0x4126db
lea ecx, [ebp - 0x35c]
call sym.SETUP.exe_public:_int___thiscall_CDeviceInfSection::GetList_void_
lea ecx, [ebp - 0x35c]
call sym.SETUP.exe_public:_unsigned_long_int___thiscall_CDeviceInfSection::Count_void_
test eax, eax
jne 0x4126f4
push str.Source
call fcn.0058edd4
pop ecx
push eax
push str.Source
lea ecx, [ebp - 0x34]
call fcn.00404be0
cmp dword [ebp - 0x20], 8
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov ecx, edi
cmovae edx, dword [ebp - 0x34]
inc eax
push eax
push edx
push ebx
push dword [ebp + 0xc]
push esi
call sym.SETUP.exe_public:_int___thiscall_CDeviceInfSection::Init_wchar_t_const___unsigned_int__class_CInfStringTable___wchar_t_const___unsigned_int_
mov ecx, edi
call sym.SETUP.exe_public:_int___thiscall_CDeviceInfSection::GetList_void_
xor esi, esi
inc esi
jmp 0x41271f
xor esi, esi
lea ecx, [ebp - 0x35c]
mov byte [ebp - 4], 0
call sym.SETUP.exe_public_virtual:_void___thiscall_CDeviceInfSection::destructor_void_
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00404970
mov eax, esi
call fcn.0058f741
ret