joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4782e0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push esi
push edi
test eax, eax
je 0x47831b
cdq
mov edi, eax
add eax, dword [ebp + 0xc]
mov esi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push esi
sub eax, 1
push edi
sbb ecx, 0
push ecx
push eax
call fcn.00502db0
push esi
push edi
push edx
push eax
call fcn.004f7a00
jmp 0x478321
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov esi, ebx
call fcn.00478140
add esp, 8
test eax, eax
jne 0x478348
mov edx, dword [ebx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x478354
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov eax, 0x60a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x478390
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4783c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4783c1
mov dword [edi + 0x10], eax
pop edi
mov eax, 0x70a
pop esi
ret
mov edx, dword [esp + 0xc]
push 1
push 0
push 0
push edx
call fcn.004f7a00
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret
Function at 0x479230
Capabilities:
Get common file path

Disassembly:
sub esp, 0x320
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x31c], eax
mov eax, dword [0x561524]
push ebx
push ebp
mov ebp, dword [esp + 0x32c]
push esi
push edi
test eax, eax
je 0x479275
push eax
push 0x53967c
lea eax, [esp + 0x20]
push eax
push 0xe6
call fcn.00476310
add esp, 0x10
jmp 0x47931c
call fcn.00477f40
test eax, eax
je 0x4792c1
lea ecx, [esp + 0x120]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x120]
call fcn.00478000
mov esi, eax
test esi, esi
jne 0x4792fe
mov eax, 7
mov ecx, dword [esp + 0x32c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f070d
add esp, 0x320
ret
lea eax, [esp + 0x120]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x120]
push ecx
call fcn.00478060
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4792a3
call fcn.00478000
push ebx
mov esi, eax
call fcn.004f0a4a
add esp, 4
test esi, esi
je 0x4792a3
push esi
push 0x53967c
lea edx, [esp + 0x20]
push edx
push 0xe6
call fcn.00476310
push esi
call fcn.004f0a4a
add esp, 0x14
mov dl, byte [esp + 0x18]
lea eax, [esp + 0x18]
test dl, dl
je 0x47932e
inc eax
cmp byte [eax], 0
jne 0x479328
lea ecx, [esp + 0x18]
sub eax, ecx
and eax, 0x3fffffff
mov ecx, str.etilqs_
mov edi, edi
inc ecx
cmp byte [ecx], 0
jne 0x479340
sub ecx, str.etilqs_
and ecx, 0x3fffffff
lea eax, [ecx + eax + 0x11]
cmp eax, 0x105
jl 0x479367
mov eax, 1
jmp 0x4792a8
lea eax, [esp + 0x18]
test dl, dl
je 0x479376
nop
inc eax
cmp byte [eax], 0
jne 0x479370
lea ecx, [esp + 0x18]
sub eax, ecx
and eax, 0x3fffffff
jbe 0x47938f
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x47938f
sub eax, 1
jne 0x479384
lea edx, [esp + 0x18]
push edx
push str._setilqs_
push ebp
push 0xf4
mov byte [esp + eax + 0x28], 0
call fcn.00476310
add esp, 0x10
mov eax, ebp
test ebp, ebp
je 0x4793c5
cmp byte [ebp], 0
je 0x4793be
inc eax
cmp byte [eax], 0
jne 0x4793b8
sub eax, ebp
and eax, 0x3fffffff
cmp dword [0x55d914], 0
mov esi, eax
mov edi, 0xf
lea ebx, [eax + ebp]
jne 0x4793e2
mov dword [esp + 0x14], 0
jmp 0x479400
push 5
call dword [0x55d950]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x479400
push eax
call dword [0x55d958]
add esp, 4
nop
dec edi
call fcn.00476460
mov byte [ebx], al
inc ebx
test edi, edi
jne 0x479400
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47941f
push eax
call dword [0x55d960]
add esp, 4
mov ecx, 0xf
movzx eax, byte [esi + ebp]
xor edx, edx
mov edi, 0x3e
div edi
inc esi
sub ecx, 1
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + ebp - 1], dl
jne 0x479424
mov byte [esi + ebp], cl
xor eax, eax
jmp 0x4792a8
Function at 0x4797b0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call fcn.00477f40
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x4797d7
call fcn.00477fa0
mov edi, eax
jmp 0x4797f3
call fcn.00477fa0
mov esi, eax
cmp esi, ebp
je 0x4797f7
push esi
call fcn.004780d0
push esi
mov edi, eax
call fcn.004f0a4a
add esp, 8
cmp edi, ebp
jne 0x479804
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 8
ret
call fcn.00477f40
test eax, eax
je 0x479854
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esp, [esp]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x47983c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 5
jne 0x479894
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x479894
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x479820
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x47987c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 5
jne 0x479894
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x479894
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x479860
push edi
call fcn.004f0a4a
add esp, 4
cmp esi, 0xffffffff
jne 0x4798b3
cmp dword [esp + 0x14], 2
jne 0x4798b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 0xa0a
pop ebx
add esp, 8
ret
Function at 0x479b20
Capabilities:
Get disk size

Disassembly:
sub esp, 0x11c
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x120]
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
push ecx
push 0x104
push eax
push edx
mov dword [esp + 0x24], 0x200
call fcn.004799f0
add esp, 0x10
test eax, eax
jne 0x479c33
call fcn.00477f40
lea ebx, [esp + 0x18]
test eax, eax
je 0x479b78
call fcn.00477fa0
mov esi, eax
jmp 0x479b9b
call fcn.00477fa0
mov edi, eax
test edi, edi
je 0x479c16
push edi
call fcn.004780d0
add esp, 4
push edi
mov esi, eax
call fcn.004f0a4a
add esp, 4
test esi, esi
je 0x479c16
call fcn.00477f40
test eax, eax
mov eax, esi
je 0x479bdd
cmp word [esi], 0
je 0x479bc6
cmp word [eax], 0x5c
je 0x479bc1
add eax, 2
cmp word [eax], 0
jne 0x479bb0
jmp 0x479bc6
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0x10]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x479c07
cmp byte [esi], 0
je 0x479bf2
cmp byte [eax], 0x5c
je 0x479bef
inc eax
cmp byte [eax], 0
jne 0x479be2
jmp 0x479bf2
mov byte [eax], 0
lea eax, [esp + 0x10]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.004f0a4a
add esp, 4
test edi, edi
jne 0x479c33
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.004f070d
add esp, 0x11c
ret
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f070d
add esp, 0x11c
ret

Function at 0x479e80
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
push 0x562b00
mov dword [0x562b00], eax
mov dword [0x562b04], eax
mov dword [0x562b08], eax
mov dword [0x562b0c], eax
mov dword [0x562b10], eax
mov dword [0x562b14], eax
mov dword [0x562b18], eax
mov dword [0x562b1c], eax
mov dword [0x562b20], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.004c9c90
test eax, eax
jne 0x479f1b
push esi
cmp dword [0x55d914], eax
jne 0x479ed0
xor esi, esi
jmp 0x479eeb
push 2
call dword [0x55d950]
mov esi, eax
add esp, 4
test esi, esi
je 0x479eeb
push esi
call dword [0x55d958]
add esp, 4
mov edx, 0x55db50
call fcn.004740d0
mov eax, dword [0x5613dc]
mov dword [0x55db5c], eax
mov dword [0x5613dc], 0x55db50
test esi, esi
je 0x479f17
push esi
call dword [0x55d960]
add esp, 4
xor eax, eax
pop esi
ret
xor eax, eax
ret
Function at 0x47dff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + 0x3c]
sub esp, 0x14
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [edx], ebx
jne 0x47e023
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f3f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
add esp, 0x14
test eax, eax
jne 0x47e0ff
mov ebx, eax
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x47e05f
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.004f7a00
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 5
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], ecx
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x47e0fd
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x18]
ja 0x47e0ee
test byte [ebp + 0x14], 0x20
jne 0x47e0ee
mov ebx, dword [esi + 0x80]
mov eax, ebx
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.004f7a00
mov ecx, dword [esi + 0x3c]
mov ebp, dword [ebp]
push edx
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
push ebx
push ebp
push ecx
call eax
add esp, 0x14
mov dword [esp + 0x10], eax
cmp edi, 1
jne 0x47e0d0
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 0x18]
mov dword [esi + 0x64], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x68], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x6c], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x70], edx
cmp edi, dword [esi + 0x20]
jbe 0x47e0d8
mov dword [esi + 0x20], edi
mov eax, dword [esp + 0x24]
mov ebx, dword [eax]
mov eax, dword [esi + 0x58]
call fcn.0048c150
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x24], ecx
test ebx, ebx
je 0x47e05f
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x49a660
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x49a67a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x50
call fcn.00474f60
mov edi, eax
test edi, edi
je 0x49a671
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
push eax
push ecx
push esi
call fcn.0049a270
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.0049a360
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.00499ff0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.0049a270
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.00499ff0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.0049a270
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.0049a660
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.00499ff0
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.00499ff0
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
add esp, 0x20
and cx, dx
mov dword [edi + 0x24], eax
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1df0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x4a1e07
xor ebx, ebx
jmp 0x4a1e1f
cmp byte [ebp], 0
je 0x4a1e16
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x4a1e10
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4a1ede
jmp 0x4a1e44
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x4a1e4c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4a1e6c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.00476e80
test eax, eax
jne 0x4a1ecb
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x4a1eb5
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x4a1eaf
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x534f68]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x4a1e90
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x4a1eb7
xor edx, edx
push ebp
call fcn.00477d50
add esp, 4
test eax, eax
je 0x4a1ee8
mov edi, dword [eax + 8]
test edi, edi
jne 0x4a1ede
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x4a1e40
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x4a1ecb

Function at 0x4a1f80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x4a1f96
xor ebx, ebx
jmp 0x4a1faf
cmp byte [edi], 0
je 0x4a1fa6
jmp 0x4a1fa0
inc eax
cmp byte [eax], 0
jne 0x4a1fa0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x4a206c
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x4a1fd4
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x4a1fdc
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x4a1ffc
mov edx, dword [eax]
call fcn.00476e80
test eax, eax
jne 0x4a204b
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x4a2035
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x4a202f
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x534f68]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x4a2010
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x4a2037
xor edx, edx
push edi
call fcn.00477d50
add esp, 4
test eax, eax
je 0x4a2068
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x4a205e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x4a1fd0
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x4a204b
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4a6700
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x4a6720
mov al, byte [ebp + 0x5357c4]
mov byte [esp + 0x10], al
test edi, edi
je 0x4a67a5
cmp byte [edi], 0
mov eax, edi
je 0x4a673b
inc eax
cmp byte [eax], 0
jne 0x4a6735
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x190
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x4a678d
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x4a6783
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x534f68]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x4a6760
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x4a678f
xor edx, edx
push edi
call fcn.00477d50
add esp, 4
test eax, eax
je 0x4a67a1
mov eax, dword [eax + 8]
jmp 0x4a67ac
xor eax, eax
jmp 0x4a67ac
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x4a67bc
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x4a67dd
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x4a6720
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4cd78a
Capabilities:
Get file version info

Disassembly:
push 0xdc
mov eax, 0x5265b5
call fcn.004f89d8
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x4cd7b3
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
jne 0x4cd87a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004cefff
mov edx, dword [eax]
push 8
mov ecx, eax
call dword [edx + 8]
mov edi, 0x534dc0
test al, al
je 0x4cd86c
push 0x534dc4
push ecx
push esi
push 0x427160
push str.Cant_get_FileInfo._Error:_0x
push ecx
push 0x534dd4
push ecx
push 0x139
push ecx
push 0x534dd8
push ecx
push str.JustUtil::GetVersion
push ecx
push edi
push ecx
call fcn.004cf0d6
pop ecx
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
pop ecx
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
pop ecx
pop ecx
mov esi, eax
call fcn.00426b10
push eax
call fcn.0041f0d0
pop ecx
push eax
call fcn.00405660
pop ecx
pop ecx
push 8
call fcn.004cf0e5
push edi
mov ecx, dword [ebp - 0x30]
call fcn.00402ac0
jmp 0x4cd9b1
push edi
call fcn.004e1766
pop ecx
mov dword [ebp - 0x34], eax
cmp eax, esi
jne 0x4cd88f
push 0x534dc0
jmp 0x4cd86d
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00403d90
mov byte [ebp - 4], 1
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], esi
jae 0x4cd8b2
lea eax, [ebp + 0x10]
push dword [ebp - 0x34]
push edi
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4cd994
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x534e64
push dword [ebp - 0x34]
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x38], esi
je 0x4cd994
lea eax, [ebp - 0xe8]
push eax
call fcn.00416c30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
push ecx
mov ecx, 0x53afb0
push ecx
push ecx
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push ecx
push ecx
push edx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00402b90
pop ecx
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
pop ecx
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
pop ecx
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0xe8]
call fcn.00416d70
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 0x10
jb 0x4cd971
mov eax, dword [eax + 4]
jmp 0x4cd974
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b6f0
lea ecx, [ebp - 0x5c]
call fcn.00402b30
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 1
call fcn.0040e800
push dword [ebp - 0x34]
call fcn.004f0cf1
pop ecx
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.00402b00
lea ecx, [ebp - 0x2c]
call fcn.00402b30
lea ecx, [ebp + 0xc]
call fcn.00402d80
mov eax, dword [ebp - 0x30]
call fcn.004f8a5b
ret
Function at 0x4cda04
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x55bb24]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 8
mov eax, 0x523985
call fcn.004f896f
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
push eax
lea ecx, [ebp + 0x24c]
mov dword [ebp - 4], eax
call fcn.00402db0
mov ecx, eax
push 0x25
pop eax
cmp word [ecx], ax
je 0x4cda6b
lea eax, [ebp + 0x24c]
push eax
mov ecx, edi
call fcn.00402d50
lea ecx, [ebp + 0x24c]
call fcn.00402d80
mov eax, edi
jmp 0x4cdb2a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
xor eax, eax
xor ebx, ebx
inc ebx
inc eax
lea edx, [ebp + 0x24c]
call fcn.00439b40
mov ebx, eax
lea eax, [ebp + 0x24c]
push eax
cmp ebx, 0xffffffff
je 0x4cda52
xor edx, edx
lea ecx, [ebx - 1]
inc edx
lea esi, [ebp + 0x1c]
call fcn.00402e10
mov byte [ebp - 4], 1
cmp dword [ebp + 0x30], 0
lea eax, [ebp + 0x24c]
push eax
jne 0x4cdac0
mov ecx, edi
call fcn.00402d50
mov ecx, esi
call fcn.00402d80
jmp 0x4cda59
lea ecx, [ebp]
call fcn.00402d50
xor eax, eax
mov byte [ebp - 4], 2
lea edi, [ebp + 0x1c]
mov word [ebp + 0x38], ax
call fcn.004cd9c2
xor esi, esi
cmp eax, esi
je 0x4cdb00
push esi
push eax
lea eax, [ebp + 0x38]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4cdb00
inc ebx
push ebx
push esi
lea eax, [ebp]
push eax
lea edx, [ebp + 0x38]
call fcn.00439260
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.00402d50
lea ecx, [ebp]
call fcn.00402d80
lea ecx, [ebp + 0x1c]
call fcn.00402d80
lea ecx, [ebp + 0x24c]
call fcn.00402d80
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.004f070d
add ebp, 0x244
leave
ret