joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4237b8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4652da
call fcn.004341ac
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00436653
mov eax, 0x46abf8
lea edi, [ebx + 0x10]
mov esi, eax
and dword [ebp - 4], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov edi, 0x46953c
mov esi, 0x469534
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401aef
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401aef
mov eax, dword [ebp + 8]
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebx], 0x469768
mov dword [ebx + 0xc], eax
call fcn.00423946
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x42384a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x465302
call fcn.004341ac
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00436653
and dword [ebp - 4], 0
lea edi, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov esi, 0x469534
push 0
push eax
mov ecx, edi
mov dword [edi], 0x46953c
mov dword [edi + 0x20], esi
call fcn.00401aef
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x46953c
mov dword [ecx + 0x20], esi
call fcn.00401aef
mov esi, dword [ebp + 8]
mov dword [ebx], 0x469768
mov ecx, edi
mov byte [ebp - 4], 2
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [esi + 0x30]
push eax
call fcn.00409658
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
call fcn.00409658
add esi, 0x20
lea edi, [ebx + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x10]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x425b5b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
and dword [ebp - 0x14], 0
push esi
push edi
mov edi, ecx
call fcn.00401087
push 1
lea eax, [ebp - 0xd0]
pop esi
mov dword [ebp - 0xd0], 0x94
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 4], eax
sub eax, 0
mov dword [ebp - 8], ecx
je 0x425c0b
dec eax
je 0x425c00
dec eax
jne 0x425c12
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x3c]
push 4
dec eax
pop ecx
je 0x425bf0
dec eax
je 0x425be7
dec eax
jne 0x425bf3
mov dword [ebp - 0x18], 5
jmp 0x425bf3
mov dword [ebp - 0x18], 3
jmp 0x425bf3
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0xcc], ecx
jb 0x425c12
mov dword [ebp - 0x14], esi
jmp 0x425c12
movzx eax, cx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jmp 0x425c12
mov dword [ebp - 0x18], 7
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00401083
mov ecx, eax
call fcn.004271e6
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x425fea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x426024
mov eax, dword [ecx + 0x70]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x426002
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x4297d6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42988c
lea eax, [ebp - 0x118]
push 0xff
push eax
push dword [ebp + 0xc]
call fcn.0042f87f
add esp, 0xc
cmp dword [ebp + 0xc], 0x452
jne 0x42987c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x429838
lea eax, [ebp - 0x118]
push 0x47b520
push eax
call fcn.00436990
pop ecx
test eax, eax
pop ecx
jne 0x429854
mov eax, 0x486
push eax
mov dword [0x4863c8], eax
call fcn.0042f792
pop ecx
push dword [0x4863c8]
call fcn.00436078
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00430e5a
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
leave
ret 8
Function at 0x429f6f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
mov esi, str.SetupBitmapCls
push edi
lea eax, [ebp - 0x14]
push esi
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 4
xor ebx, ebx
pop eax
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 0x604]
push 0x7f00
push ebx
mov dword [ebp - 0x50], 0x42a0c7
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [edi + 0x604]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
jne 0x429ff2
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x42a094
push 0xd0
call fcn.004342c0
mov esi, eax
pop ecx
cmp esi, ebx
je 0x42a094
mov eax, dword [ebp + 8]
push 1
pop ecx
mov dword [esi + 4], ecx
mov edx, dword [eax]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [esi + 8], edx
mov eax, dword [eax]
mov dword [esi + 0x78], eax
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [esi]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebx
sub eax, dword [ebp - 0x28]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call ebx
sub eax, dword [ebp - 0x24]
push esi
push dword [edi + 0x604]
xor ecx, ecx
cdq
push ecx
push ecx
push dword [ebp - 0x24]
sub eax, edx
sar eax, 1
push dword [ebp - 0x28]
mov dword [edi + 0x1c0], ecx
push eax
push dword [ebp + 8]
push 0x86000000
push str.SetupBitmapWin
push str.SetupBitmapCls
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
test ebx, ebx
jne 0x42a098
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x42a0c0
push esi
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 5
push ebx
mov dword [edi + 0x1c0], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x1c0]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42a4d4
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x465b66
call fcn.004341ac
sub esp, 0x4a4
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x4af]
mov byte [ebp - 0x4b0], bl
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4b0]
lea ecx, [esi + 0x18]
push eax
push 0x48391c
push str.ClickOncePackage
push str.Startup
call fcn.004029c5
cmp byte [ebp - 0x4b0], bl
jne 0x42a535
xor eax, eax
jmp 0x42a635
push 1
lea eax, [ebp - 0xe]
pop edi
mov ecx, esi
push edi
push eax
call fcn.004272af
push eax
lea ecx, [ebp - 0x38]
call fcn.00401a6d
lea eax, [ebp - 0xd]
push edi
push eax
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.00401a6d
push ebx
lea eax, [ebp - 0x88]
push ebx
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040e277
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, eax
call fcn.0040e1ec
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.00409658
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.00401306
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00401306
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401306
lea ecx, [ebp - 0x38]
call fcn.00401c5e
push eax
call fcn.0043037e
test eax, eax
jne 0x42a606
lea eax, [ebp - 0xd]
push edi
push eax
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x60]
call fcn.00401a6d
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x38]
push eax
mov byte [ebp - 4], 4
call fcn.00409658
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401306
push edi
push ebx
push ebx
lea ecx, [ebp - 0x38]
call fcn.00401c5e
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x38]
sbb esi, esi
or dword [ebp - 4], 0xffffffff
neg esi
call fcn.00401306
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42dbfd
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x465f8e
call fcn.004341ac
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x18], esi
or dword [esi + 0x11c], 0xffffffff
lea eax, [esi + 0x124]
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov byte [esi + 0x110], 1
mov byte [esi + 0x111], 1
mov byte [esi + 0x112], 1
mov dword [esi + 0x118], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
push dword [ebp + 8]
lea ebx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], 0x46a020
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push ebx
call fcn.0042ddbf
pop ecx
mov dword [esi + 0x114], eax
pop ecx
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x108], eax
jne 0x42dcab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x118], eax
jmp 0x42ddac
push 0x2e
mov dword [esi + 0x10c], 1
call fcn.004342c0
push 0x2e
push edi
push eax
mov dword [esi + 0x120], eax
call fcn.00434af0
add esp, 0x10
mov ecx, esi
push edi
push edi
push dword [esi + 0x114]
push dword [esi + 0x108]
call fcn.0042f017
test eax, eax
je 0x42ddac
lea eax, [ebp - 0x14]
push edi
push eax
push 0x2e
push dword [esi + 0x120]
push dword [esi + 0x108]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x42ddac
cmp dword [ebp - 0x14], edi
je 0x42ddac
mov ecx, esi
call fcn.0042e2d5
test eax, eax
je 0x42dd32
mov eax, dword [esi + 0x120]
mov ax, word [eax + 0xe]
cmp ax, di
jne 0x42dda1
push edi
push ebx
call fcn.0042ddbf
cmp eax, dword [esi + 0x114]
pop ecx
pop ecx
jbe 0x42dd49
mov dword [esi + 0x114], eax
push edi
push edi
push dword [esi + 0x114]
mov ecx, esi
push dword [esi + 0x108]
call fcn.0042f017
test eax, eax
je 0x42ddac
lea eax, [ebp - 0x10]
push edi
push eax
push 0x2e
push dword [esi + 0x120]
push dword [esi + 0x108]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x42ddac
cmp dword [ebp - 0x14], edi
je 0x42ddac
mov ecx, esi
call fcn.0042e2d5
test eax, eax
je 0x42ddac
mov eax, dword [esi + 0x120]
mov ax, word [eax + 0xe]
cmp ax, di
je 0x42ddac
movzx eax, ax
push eax
mov ecx, esi
call fcn.0042ef15
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42e080
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x465fc4
call fcn.004341ac
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x42e18b
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42e0c9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push str..debug
call fcn.0042e1db
pop ecx
test eax, eax
pop ecx
je 0x42e0f5
cmp dword [eax + 0xc], esi
jne 0x42e0f5
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x42e148
push edi
push str..rdata
call fcn.0042e1db
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x42e11b
push edi
push str..text
call fcn.0042e1db
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x42e18b
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x42e18b
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x42e196
cmp dword [ebp + 8], 0
je 0x42e196
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x42e18f
xor eax, eax
jmp 0x42e1cc
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x42e1b5
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x42e1af
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x42e1a0
cmp dword [ebp - 0x10], 0
je 0x42e1c9
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x42e1c9
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42e776
Capabilities:
Get common file path

Disassembly:
mov eax, 0x466088
call fcn.004341ac
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0xd]
mov ebx, 0x469580
mov esi, 0x469578
push 0
push eax
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.00402c39
and dword [ebp - 4], 0
lea eax, [ebp - 0xe]
push 0
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x28], esi
call fcn.00402c39
mov esi, 0x104
lea eax, [ebp - 0x20]
push esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004025f2
mov ebx, eax
mov ecx, dword [ebx]
mov byte [ebp - 4], 2
call fcn.0040316b
push eax
push esi
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00402704
lea eax, [ebp - 0x20]
push esi
push eax
mov ecx, edi
call fcn.004025f2
mov esi, eax
mov ecx, dword [esi]
mov byte [ebp - 4], 3
call fcn.0040316b
push eax
push 0
push 0x47e4ec
lea ecx, [ebp - 0x48]
mov dword [esi + 8], eax
call fcn.0040316b
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00402704
and byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004020a2
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42ef15
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
jle 0x42ef92
mov esi, 0x138
push esi
call fcn.004342c0
mov ebx, eax
push esi
push 0
push ebx
call fcn.00434af0
add esp, 0x10
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push dword [edi + 0x108]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ef92
cmp dword [ebp - 8], 0
je 0x42ef92
push ebx
lea ecx, [edi + 0x124]
call fcn.0042f2ce
push 1
push 0
push dword [ebx + 0x10c]
mov ecx, edi
push dword [edi + 0x108]
call fcn.0042f017
test eax, eax
je 0x42ef92
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jl 0x42ef2e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42f053
Capabilities:
Clear file content
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
xor esi, esi
push 0x2e
lea eax, [ebp - 0x40]
push esi
mov edi, ecx
push eax
call fcn.00434af0
add esp, 0xc
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0042e93c
test eax, eax
je 0x42f1a3
push esi
push 0x80
push 3
push esi
lea eax, [edi + 4]
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 8], ebx
je 0x42f197
cmp dword [edi + 0x12c], 1
jbe 0x42f104
mov eax, dword [edi + 0x114]
push 1
push esi
push eax
push ebx
mov ecx, edi
call fcn.0042f017
test eax, eax
je 0x42f1a3
push dword [0x47e4c0]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [edi + 0x12c]
push esi
dec eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push 0x2e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
push esi
add eax, 0xfffffec8
push esi
push eax
push ebx
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.0042f017
test eax, eax
je 0x42f1a3
mov eax, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
mov ebx, dword [eax + 0x10c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0xc]
add ecx, ebx
cmp ecx, eax
jne 0x42f16b
cmp dword [edi + 0x12c], 1
jne 0x42f15d
push esi
push esi
push dword [edi + 0x114]
mov ecx, edi
push dword [ebp + 8]
call fcn.0042f017
test eax, eax
je 0x42f1a3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x42f221
mov eax, dword [ebp - 8]
push esi
push 0x80
push 3
lea ebx, [ebx + eax + 0x138]
push esi
push 3
lea eax, [edi + 4]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42f1ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x118], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 1
push esi
push ebx
push eax
mov ecx, edi
call fcn.0042f017
test eax, eax
je 0x42f1a3
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x440]
push 0x400
push eax
push dword [ebp - 8]
call ebx
test eax, eax
je 0x42f20f
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x440]
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], esi
je 0x42f20f
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x440]
push 0x400
push eax
push dword [ebp - 8]
jmp 0x42f1d6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
mov ecx, edi
call fcn.0042f23c
push 1
pop eax
jmp 0x42f1a5
Function at 0x42fb20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov esi, 0x48391c
push edi
push esi
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x10], edi
call ebx
push esi
push dword [ebp + 0x10]
call ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, edi
je 0x42fca8
push esi
call fcn.00434889
push esi
push edi
push eax
mov dword [ebp - 8], eax
call fcn.00434af0
add esp, 0x10
push dword [ebp - 8]
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42fc9f
lea eax, [ebp - 0x44]
push 0x34
mov dword [ebp + 8], eax
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.00434af0
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp + 8]
push eax
push 0x47ceac
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42fbe2
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
shr ecx, 0x10
push edx
push ecx
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
push str._u._u._u._u
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0x34
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.00434af0
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42fc9f
and byte [ebp - 0x144], 0
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x143]
mov esi, dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
xor edi, edi
shr esi, 2
test esi, esi
mov dword [ebp + 0xc], eax
jle 0x42fc9f
and dword [ebp - 0xc], 0
test edi, edi
jle 0x42fc45
add dword [ebp + 0xc], 4
push 4
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push eax
call fcn.00434be0
movzx eax, word [ebp - 0xc]
add esp, 0xc
test edi, edi
push eax
jne 0x42fc76
lea eax, [ebp - 0x144]
push 0x47dafc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x42fc8e
push dword [ebp + 0x10]
lea eax, [ebp - 0x144]
push str._s__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0x10]
call ebx
inc edi
cmp edi, esi
jl 0x42fc39
push dword [ebp - 8]
call fcn.004347a0
pop ecx
pop edi
pop esi
pop ebx
leave
ret