joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4364bd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x48
mov eax, 0x697ebd
call fcn.0064cfe4
mov bl, dl
mov esi, ecx
test esi, esi
jne 0x4364d8
xor al, al
jmp 0x43662a
test bl, bl
je 0x4364e9
xor eax, eax
cmp dword [0x829320], eax
sete al
jmp 0x4364ff
test byte [esi + 0x14], 0x10
jne 0x4364fd
cmp byte [0x82951d], 0
je 0x4364fd
xor eax, eax
inc eax
jmp 0x4364ff
xor eax, eax
test eax, eax
jne 0x4364d1
and dword [ebp - 0x10], eax
push ecx
push 0x829ab8
lea ecx, [ebp - 0x54]
call fcn.00422bbb
and dword [ebp - 4], 0
movzx eax, bl
mov dword [ebp - 0x18], eax
shl eax, 5
mov dword [ebp - 0x14], eax
and dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 1
push ecx
mov byte [ebp - 4], 1
push dword [esi + 0x18]
mov edx, dword [esi + 0x10]
push eax
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00434ef7
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.00437595
lea ecx, [ebp - 0x38]
call fcn.00438188
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4365a3
test bl, bl
je 0x43659f
mov eax, dword [ebp - 0x18]
mov edx, dword [esi + 0x10]
add eax, eax
push ecx
push dword [esi + 0x18]
push eax
push ecx
lea ecx, [ebp - 0x48]
call fcn.00434ef7
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x30]
push eax
call fcn.00437595
lea ecx, [ebp - 0x44]
call fcn.00438188
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x436608
xor eax, eax
push eax
push eax
push eax
push eax
push dword [esi]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp eax, 0x3f2
je 0x4365ca
cmp eax, 0x3fa
je 0x4365ca
cmp eax, 6
jne 0x436606
mov eax, dword [esi + 0x10]
movzx eax, word [eax + 6]
and eax, 0x1f
shl eax, 4
and dword [eax + 0x816b40], 0
cmp byte [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
je 0x436524
cmp dword [ebp - 0x20], 0
je 0x436524
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x436524
test eax, eax
sete bl
cmp byte [ebp - 0x1c], 0
je 0x436620
cmp dword [ebp - 0x20], 0
je 0x436620
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x54]
call fcn.00422b96
mov al, bl
call fcn.0064cfad
ret

Function at 0x436e0b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push esi
test ecx, ecx
je 0x436e8b
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
and dword [esp + 8], 0
mov edx, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 1
mov dword [esp + 0x1c], eax
call fcn.00436788
push eax
lea ecx, [esp + 0x18]
call fcn.00437595
lea ecx, [esp + 0x20]
call fcn.00438188
mov esi, dword [esp + 8]
test esi, esi
jne 0x436e6c
push esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov esi, eax
cmp byte [esp + 0x10], 0
je 0x436e84
cmp dword [esp + 0xc], 0
je 0x436e84
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0x230239f
call fcn.00422704
int3
Function at 0x436e98
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x697f97
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x436f6e
call fcn.00436630
test eax, eax
jne 0x436ee2
push 2
pop eax
jmp 0x436f5a
push ecx
mov edx, esi
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x14], ebx
call fcn.00436788
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x24]
push eax
call fcn.00437595
lea ecx, [ebp - 0x2c]
call fcn.00438188
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x436f32
cmp byte [ebp - 0x18], bl
je 0x436f2e
cmp dword [ebp - 0x1c], ebx
je 0x436f2e
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x436f5a
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
jmp 0x436f1b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push ebx
push 0x23023a0
call fcn.00422704
int3
Function at 0x436f7a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x697fb2
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x4370ca
call fcn.00436630
test eax, eax
jne 0x436fc7
push 2
pop eax
jmp 0x4370b6
push ecx
mov edx, edi
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x14], ebx
call fcn.00436788
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x24]
push eax
call fcn.00437595
lea ecx, [ebp - 0x30]
call fcn.00438188
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x43701c
cmp byte [ebp - 0x18], 0
je 0x437015
cmp dword [ebp - 0x1c], 0
je 0x437015
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4370b6
cmp esi, 0x4b
jb 0x437073
push 0x19
xor edx, edx
mov eax, esi
pop ecx
div ecx
test edx, edx
jne 0x437073
mov eax, dword [edi + 0x10]
mov edx, 0x3a7
mov dword [ebp - 0x28], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov ecx, 0x269a202
mov dword [ebp - 0x24], 0x6dfa04
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
push eax
push str.ExcessiveOrapiValEnumeration
push 0x32
mov dword [ebp - 0x30], 0x6dfc74
mov dword [ebp - 0x2c], esi
call fcn.00411dd9
xor eax, eax
push eax
push eax
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp byte [ebp - 0x18], 0
mov esi, eax
je 0x4370a2
cmp dword [ebp - 0x1c], 0
je 0x4370a2
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4370b6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push ebx
push 0x23023a1
call fcn.00422704
int3

Function at 0x437e81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
mov esi, ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x437ec3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x437ec3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x437ec3
cmp word [eax + 2], 0
je 0x437ec3
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x437ec3
add eax, 0x30
jmp 0x437ec8
mov eax, 0x6e41c4
pop edi
pop esi
ret

Function at 0x437f7e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], 0x20a
mov word [eax], dx
lea edx, [ebp - 4]
push edx
push eax
push 0
push 2
push str.mso.dll
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret 8
Function at 0x4389f8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69756a
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.0064f890
add esp, 0xc
mov dword [ebp - 0x50], 0x40
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x438a57
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x8d339f
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret

Function at 0x438b4d
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x829748]
test eax, eax
jne 0x438b6d
call fcn.004389f8
push edx
push eax
call fcn.00438a76
mov dword [0x829748], eax
dec eax
cmp eax, 9
ja case.default.0x438b73
jmp dword [eax*4 + 0x438bc1]
mov eax, 0x10000000
jmp 0x438bb9
mov eax, 0x20000000
jmp 0x438bb9
mov eax, 0x30000000
jmp 0x438bb9
mov eax, 0x40000000
jmp 0x438bb9
mov eax, SysReAllocString
jmp 0x438bb9
xor edx, edx
xor eax, eax
inc edx
jmp 0x438bbb
push 2
xor eax, eax
pop edx
jmp 0x438bbb
push 4
jmp 0x438ba6
push 8
jmp 0x438ba6
push 0x10
jmp 0x438ba6
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x43908d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x698134
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, 0x11c
lea eax, [ebp - 0x12c]
push edi
push 0
push eax
call fcn.0064f890
add esp, 0xc
mov dword [ebp - 0x12c], edi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4390f6
push 0x323658
mov ecx, 0x81cf10
jmp 0x439123
cmp dword [ebp - 0x128], 6
mov edi, 0x81cf10
jae 0x439113
mov eax, dword [0x81cf10]
mov ecx, edi
push 0x323659
call dword [eax + 4]
cmp dword [ebp - 0x11c], 2
je 0x43912b
push 0x32365a
mov ecx, edi
mov eax, dword [0x81cf10]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
test edx, 0x110
mov cl, byte [ebp - 0x12]
mov eax, dword [ebp - 0x128]
mov dword [esi], eax
mov eax, dword [ebp - 0x124]
mov byte [esi + 0xc], cl
setne cl
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x18]
shr edx, 8
and dl, 1
mov dword [esi + 8], eax
mov byte [esi + 0xd], cl
mov eax, esi
mov byte [esi + 0xe], dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret
Function at 0x43e4fc
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69851e
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 0x6e6dac
push 1
push edi
push 0x6e6f44
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x43e570
mov dword [esi], edi
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x43e564
mov dword [ebp - 0x10], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 4
jmp 0x43e5fe
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x43e621
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push str.ROOTCIMV2
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x43e5b6
mov dword [esi], edi
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x43e5ad
mov dword [ebp - 0x10], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 7
jmp 0x43e5fe
push edi
push edi
push 3
push 3
push edi
push edi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
je 0x43e5ef
mov dword [esi], edi
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x43e5e6
mov dword [ebp - 0x10], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xa
jmp 0x43e5fe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], edi
mov dword [esi], eax
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x43e60e
mov dword [ebp - 0x14], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0x152139a
call fcn.00422704
int3
Function at 0x43f48b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push edi
mov edi, ecx
mov dword [ebp - 8], 0x40
push 0x80
lea ecx, [ebp - 4]
mov ebx, edx
call fcn.004319a9
test al, al
jne 0x43f4bd
mov eax, dword [ebp - 4]
mov dword [edi], eax
jmp 0x43f5ce
push esi
mov esi, dword [ebp - 4]
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push esi
push ebx
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x43f5a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x43f53e
cmp eax, 0x534
je 0x43f52f
cmp eax, 0x54b
je 0x43f52f
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
push eax
push str.GetUserNameExW_failed_1
push ecx
mov ecx, 0x11ce1a1
mov dword [ebp - 0x10], str.EXTENDED_NAME_FORMAT
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], str.LastError
mov dword [ebp - 0x20], 0x6e7044
call fcn.0043f683
push esi
call fcn.0064e37d
and dword [edi], 0
pop ecx
jmp 0x43f5cd
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
add eax, eax
push eax
call fcn.004319a9
mov esi, dword [ebp - 4]
test al, al
je 0x43f5be
lea eax, [ebp - 8]
push eax
push esi
push ebx
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x43f5cb
mov dword [ebp - 0x20], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov dword [ebp - 0x1c], str.EXTENDED_NAME_FORMAT
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], str.LastError
push eax
push str.GetUserNameExW_failed_2
push ecx
mov ecx, 0x11ce1a2
mov dword [ebp - 0x14], 0x6e7044
call fcn.0043f683
jmp 0x43f5be
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
lea edx, [eax*2 + 2]
call fcn.004f7364
mov esi, dword [ebp - 4]
test eax, eax
jne 0x43f5cb
test esi, esi
je 0x43f5cb
push esi
xor esi, esi
call fcn.0064e37d
pop ecx
mov dword [edi], esi
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446649
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x816078]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov eax, dword [eax]
mov edi, ecx
mov dword [esp + 0x14], edi
mov ebx, 0x2710
mov eax, dword [eax + 0x10]
mov dword [esp + 0x10], eax
lea esi, [edi + 8]
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov ecx, eax
and ecx, 7
mov edx, ecx
sub edx, 1
je 0x4466be
sub edx, 1
jne 0x446725
push 5
and eax, 0xfffffffb
lea edx, [esp + 0x10]
push ecx
or eax, 3
mov ecx, esi
push eax
call fcn.0041a0aa
test eax, eax
jne 0x446743
mov eax, dword [esp + 0xc]
jmp 0x446686
cmp dword [esp + 0x10], edi
je 0x44669b
sub ebx, 1
je 0x44672c
call fcn.0063a513
push 0
pop edi
add eax, 0x2710
push edi
push 0x64
adc edx, edi
push edx
push eax
call fcn.0064d190
push edi
push 0x3b9aca00
mov esi, eax
push edx
push esi
call fcn.006933d0
mov dword [esp + 0x18], eax
lea edi, [esp + 0x28]
imul eax, eax, 0x3b9aca00
mov dword [esp + 0x1c], edx
sub esi, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], esi
lea esi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0063a663
mov edi, dword [esp + 0x18]
pop ecx
jmp 0x44667d
push 0x16055cb
jmp 0x446734
xor ecx, ecx
push 0x16055ca
inc ecx
mov dl, byte [ebp + 8]
push str.Cannot_move_to_Invoking_state
call fcn.00446982
jmp 0x446745
mov al, 1
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 4

Function at 0x44905e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x698f02
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
call dword [eax + 0xc]
test al, al
jne 0x4490eb
mov eax, dword [edi + 0x10]
cmp byte [eax], 0
je 0x4490b3
and dword [ebp - 4], 0
mov ecx, 0x81a9ec
mov eax, dword [0x81a9ec]
call dword [eax]
test al, al
jne 0x4490eb
cmp byte [edi + 0x14], 0
jne 0x4490bd
xor al, al
jmp 0x4490ed
lea ecx, [ebp - 0x18]
call fcn.0041dcea
push 0
push 0xf4240
push dword [edi + 4]
mov ebx, dword [eax]
mov esi, dword [eax + 4]
sub ebx, dword [edi + 8]
push dword [edi]
sbb esi, dword [edi + 0xc]
call fcn.0064d190
cmp esi, edx
jg 0x4490eb
jl 0x4490b9
cmp ebx, eax
jb 0x4490b9
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c2ea
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695d40
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
lea edi, [ebx + 0xc]
mov dword [edi], method.std::_Facet_base.virtual_4
lea esi, [ebx + 0xbc]
mov dword [ebx + 0x10], 0x6e7f20
mov dword [ebx], method.std::_Facet_base.virtual_4
mov dword [ebx + 4], 0x6e7f94
mov dword [ebx + 8], 0x6e7f7c
mov dword [edi], method.std::_Facet_base.virtual_4
mov dword [ebx + 0x10], 0x6e7f54
mov word [ebx + 0x14], ax
mov byte [ebx + 0x16], 1
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov byte [ebx + 0x44], 1
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov byte [ebx + 0x70], al
mov dword [ebx + 0x74], esi
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x90], eax
mov byte [ebx + 0x94], al
mov dword [ebx + 0x98], esi
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
push eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov dword [ebx + 0xb0], eax
push eax
mov dword [ebx + 0xb4], eax
push esi
mov byte [ebx + 0xb8], al
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
lea eax, [ebx + 0xd4]
xor ecx, ecx
mov word [eax + 8], cx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [ebx + 0xec], ecx
lea ecx, [ebx + 0xf0]
push str.Sequential_Queue
call fcn.004139db
test byte [0x831580], 0x10
je 0x44c44d
push ebx
lea eax, [ebx + 0xd4]
mov edx, 0x6e7c18
push eax
push ebx
call fcn.00448585
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45539a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6977d3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x829520
push 3
mov dword [ebp - 0x18], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov ebx, eax
test ebx, ebx
jne 0x4553ed
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
jmp 0x45546a
mov edx, ebx
lea ecx, [ebp - 0x1c]
call fcn.0043e27c
mov esi, dword [ebp - 0x1c]
push esi
push ebx
xor ebx, ebx
push ebx
push 0x829520
push 3
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
jne 0x45541d
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp 0x45545f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
push 0x6d9558
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x455410
cmp dword [ebp - 0x10], 0x34
jne 0x455410
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + 0xa]
mov dword [edi], eax
movzx eax, word [ecx + 8]
mov dword [edi + 4], eax
movzx eax, word [ecx + 0xe]
mov dword [edi + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edi + 0xc], eax
test esi, esi
je 0x45546a
push esi
call fcn.0064e37d
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b67e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69a97c
mov eax, dword fs:[0]
push eax
mov eax, 0x106c
call fcn.0064d770
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0
push 4
push 0x7e
mov eax, dword [edi]
push edi
call dword [eax + 0x70]
cmp eax, 0xffffffff
je 0x46b867
push 0x824
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
test ebx, ebx
jne 0x46b7a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x46b867
mov esi, dword [edi]
push edi
call dword [esi + 0x18]
push eax
push edi
call dword [esi + 0xa8]
mov ecx, dword [edi]
mov esi, eax
push edi
mov dword [ebp - 0x1060], esi
call dword [ecx + 0x18]
push 0x5c
pop ecx
push ecx
mov edx, eax
mov ecx, esi
call fcn.0043cc0a
mov esi, eax
test esi, esi
je 0x46b79e
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x105c]
push 0x824
push eax
push dword [ebp - 0x1060]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
push 0x5c
pop eax
mov word [esi], ax
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x46b79e
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov ecx, esi
sub ecx, dword [ebp - 0x1060]
sar ecx, 1
sub eax, ecx
lea ecx, [eax + ebx]
mov dword [ebp - 0x1060], ecx
cmp ecx, 0x824
ja 0x46b79c
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x105c]
lea eax, [eax + ebx*2]
push esi
push eax
call fcn.0064f310
mov ecx, dword [ebp - 0x1060]
add esp, 0xc
mov ebx, ecx
mov eax, dword [edi]
push edi
call dword [eax + 0xac]
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x46b867
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
lea ecx, [ebp - 0x105c]
cmp ecx, eax
je 0x46b867
test eax, eax
je 0x46b7e0
push eax
mov eax, ecx
push eax
call fcn.00677ec5
pop ecx
pop ecx
test eax, eax
je 0x46b867
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov dword [ebp - 0x1070], eax
lea ecx, [ebp - 0x105c]
lea eax, [ebp - 0x106c]
mov dword [ebp - 0x1064], ecx
push eax
lea eax, [ebp - 0x1078]
mov dword [ebp - 0x1068], str.After
push eax
mov edx, vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x1074], str.Before
push str.Converted_something_to_long_name_
mov dword [ebp - 0x106c], edx
mov ecx, 0x7c7180
mov dword [ebp - 0x1078], edx
mov edx, 0x8b
push 0xf
call fcn.00411dd9
cmp ebx, 0x104
ja 0x46b867
mov eax, dword [edi]
lea ecx, [ebp - 0x105c]
push ebx
push ecx
push edi
call dword [eax + 0x28]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
jmp 0x46b86a
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 4