joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c9d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50c718
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x572bb0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0xc], vtable.CObjectVector_class_CStringBase_wchar_t__.0
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.0046c730
lea eax, [esp + 0xc]
mov word [esp + 0x20], 0x100
push eax
push 1
mov ecx, esi
mov byte [esp + 0x2a], 1
call fcn.0046c8e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00453e30
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46d610
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x46d624
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
ret

Function at 0x46de10
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor ecx, ecx
lea esi, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], esi
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
mov dword [ebp - 8], ebx
test edi, edi
je 0x46de4d
lea esp, [esp]
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x46de40
cmp ecx, esi
jae 0x46df33
mov eax, ecx
sub eax, edi
lea esi, [ebx + eax*4]
mov dword [ebp + 8], esi
nop
xor edx, edx
mov ebx, dword [ebx + ecx*4 - 4]
mov eax, ecx
div edi
mov dword [ebp - 4], eax
test edx, edx
jne 0x46dec8
movzx edx, bl
movzx esi, byte [edx + str.cw]
mov edx, ebx
shr edx, 0x18
shl esi, 8
movzx eax, byte [edx + str.cw]
or esi, eax
mov eax, ebx
shr eax, 0x10
and eax, 0xff
shl esi, 8
shr ebx, 8
and ebx, 0xff
movzx eax, byte [eax + str.cw]
or esi, eax
mov eax, dword [ebp - 4]
movzx ebx, byte [ebx + str.cw]
shl esi, 8
movzx eax, byte [eax + 0x54aeb0]
xor ebx, eax
or ebx, esi
mov esi, dword [ebp + 8]
jmp 0x46df19
cmp edi, 6
jbe 0x46df19
cmp edx, 4
jne 0x46df19
mov eax, ebx
shr eax, 0x10
and eax, 0xff
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ebx
shr eax, 8
and eax, 0xff
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
or ebx, edx
mov eax, dword [esi]
add esi, 4
xor eax, ebx
mov dword [ebp + 8], esi
mov ebx, dword [ebp - 8]
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, dword [ebp - 0xc]
jb 0x46de60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46edb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x46edd0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
add edx, 0xfffffffc
push ebx
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
lea esi, [edi + ecx]
mov dword [ebp - 0xc], esi
cmp esi, edx
jae 0x46ee05
jmp 0x46edf0
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x46edff
inc esi
cmp esi, edx
jb 0x46edf0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x46ef15
cmp ecx, 3
jbe 0x46ee1e
xor eax, eax
jmp 0x46ee5c
dec ecx
shl eax, cl
and eax, 7
je 0x46ee5c
movzx ecx, byte [eax + 0x54afc8]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x54afc0], 0
mov cl, byte [edx + 4]
je 0x46ee46
test cl, cl
je 0x46ee46
cmp cl, 0xff
jne 0x46ee59
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x46ede1
mov edx, dword [ebp - 8]
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x14], ebx
test cl, cl
je 0x46ee7e
cmp cl, 0xff
je 0x46ee7e
mov ecx, dword [ebp - 4]
and eax, 3
add eax, eax
or eax, 1
inc edi
jmp 0x46ede1
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 8]
shl edx, 8
or edx, ecx
nop
sub edx, edi
sub edx, esi
mov ebx, edx
test eax, eax
je 0x46eedf
movzx edx, byte [eax + 0x54afc8]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0x10], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x46eecb
cmp dl, 0xff
jne 0x46eedf
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0x10]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x46eea0
mov esi, dword [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 8]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], bl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
shr ecx, 8
add edi, 5
mov byte [esi + 2], cl
mov ecx, dword [ebp - 4]
jmp 0x46ede1
pop esi
pop ebx
cmp ecx, 3
jbe 0x46ef2a
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x471390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4713a9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4713e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4713e0
lea ebx, [ebx]
cmp esi, edx
jae 0x4713e4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4713d0
cmp esi, edx
jb 0x4713eb
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x479090
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d6b2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x54c95c
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00479df0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0047a4c0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x57c4e8]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
push ecx
push 1
push dword [ebp + 8]
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00479ee0
test eax, eax
jne 0x4791ea
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x4791e2
or eax, 4
push 0
push eax
call fcn.004769b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47a110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50d768
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x572bb0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x47a264
cmp byte [ebx + 0x45], 0
je 0x47a264
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x47a170
xor al, al
jmp 0x47a266
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x47a1b0
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x47a1f1
dec eax
je 0x47a1f5
sub eax, 2
je 0x47a24b
xor bl, bl
jmp 0x47a24d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x47a22c
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004ec0c0
add esp, 0x10
cmp esi, eax
jne 0x47a1ed
cmp byte [ebx + 0x45], 0
je 0x47a24b
test esi, esi
jne 0x47a1b0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00479d40
jmp 0x47a1b0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x47a260
push dword [esp + 0x18]
call fcn.004e98a6
add esp, 4
mov al, bl
jmp 0x47a266
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004e94b7
mov esp, ebp
pop ebp
ret
Function at 0x47ab00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d817
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x54ce40
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00479df0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0047a4c0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x57c4e8]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x47c990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47ca01
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x47c9cf
cmp eax, 2
jne 0x47c9eb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x47c9fb
test ecx, ecx
je 0x47c9f6
test cl, 1
jne 0x47c9eb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x47c9fb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x47ca10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d958
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
push 0
mov dword [ebp - 4], 0
xor bl, bl
push 0
mov byte [ebp - 4], 1
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x47cae4
inc eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ea22e
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
push dword [ebp - 0x18]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x47cad7
test esi, esi
jne 0x47caac
xor ecx, ecx
push ecx
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.004725a0
jmp 0x47cad5
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47cab1
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.004725a0
jmp 0x47cad5
mov bl, 1
test esi, esi
je 0x47cae4
push esi
call fcn.004ea229
add esp, 4
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47cb08
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47d140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50da00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov dword [ebp - 4], 0
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x47d19b
xor bl, bl
jmp 0x47d242
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 0
test bl, bl
je 0x47d1cc
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push 0
push edx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x47d22b
lea edx, [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.0047d4b0
mov ebx, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov eax, dword [ecx - 0xc]
mov ecx, dword [ebx]
mov dword [ebp - 0x14], eax
cmp dword [ecx - 4], 1
jle 0x47d1fb
push dword [ecx - 0xc]
mov ecx, ebx
call fcn.0047e0e0
mov eax, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 0
mov ecx, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d22b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x47d263
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50db28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor bl, bl
call fcn.00460220
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x47e845
push 0x80004005
call fcn.004712d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test esi, esi
jne 0x47e85f
xor ecx, ecx
jmp 0x47e873
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e864
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.004725a0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47e8d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x47e8a1
cmp eax, 3
je 0x47e8a1
cmp eax, 0x15
jne 0x47e8d5
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47e8f8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
mov bl, 1
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47e8f8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492630
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510369
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push eax
push str.iexplore.exe
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
call fcn.00460220
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4926ad
push 0x80004005
call fcn.004712d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x49273e
push ebx
call fcn.004ea22e
add esp, 4
mov esi, eax
push esi
push ebx
push dword [ebp - 0x10]
push str.iexplore.exe
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x492735
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x54d150
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x492735
cmp dword [ebp - 0x14], 0
je 0x492735
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0xfeef04bd
jne 0x492735
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push edi
call fcn.00472d30
add esp, 0x18
push esi
call fcn.004ea229
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492e80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510440
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], 0
call fcn.00492cb0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x492ef4
push 0x54eaa4
mov ecx, edi
call fcn.00471bb0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jmp 0x492fe9
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push 0x54eaa4
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00471bb0
mov byte [ebp - 4], 1
test esi, esi
je 0x492f9f
push esi
call fcn.004ea22e
add esp, 4
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x492f96
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x54d150
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x492f96
cmp dword [ebp - 0x1c], 0
je 0x492f96
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0xfeef04bd
jne 0x492f96
movzx esi, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x14]
push str._d._d._d._d
push eax
call fcn.00472d30
add esp, 0x18
push ebx
call fcn.004ea229
add esp, 4
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00471fb0
mov byte [ebp - 4], 0
add eax, 0x10
mov edx, dword [ebp - 0x14]
or esi, 0xffffffff
add edx, 0xfffffff0
mov dword [edi], eax
mov eax, esi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x492fd2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x492ff3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret