joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
call esi
sub eax, dword [edi + 0x288]
cmp eax, 0xea60
jbe 0x40a329
call esi
mov esi, dword [sym.imp.rime.dll_rime_get_api]
mov dword [edi + 0x288], eax
mov dword [ebp - 4], 0
call esi
lea ecx, [ebp - 4]
push ecx
push str.user
mov eax, dword [eax + 0x140]
call eax
add esp, 8
test eax, eax
je 0x40a329
mov dword [ebp - 8], 0
call esi
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
mov eax, dword [eax + 0xa4]
push str.sync_need_reset_rime
push ecx
call eax
call esi
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x9c]
call eax
add esp, 0x10
cmp dword [ebp - 8], 1
jne 0x40a329
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x48]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x4c]
call esi
lea ecx, [ebp - 4]
push ecx
push str.user
mov eax, dword [eax + 0x140]
call eax
add esp, 8
test eax, eax
je 0x40a329
call esi
push 0
lea ecx, [ebp - 4]
push str.sync_need_reset_rime
mov eax, dword [eax + 0xf4]
push ecx
call eax
call esi
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x9c]
call eax
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4128f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bb68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x589ed0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov edi, dword [eax + 4]
add edi, esi
mov ecx, edi
call fcn.00420060
mov eax, dword [ebp + 8]
mov dword [edi + 0x38], eax
mov eax, dword [edi + 0x30]
mov dword [edi + 0x3c], 0
mov ebx, dword [eax + 4]
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.0041b980
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx eax, ax
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4129ae
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
test eax, eax
je 0x4129ab
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp + 8]
cmp dword [edi + 0x38], 0
mov word [edi + 0x40], ax
jne 0x4129c8
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.004214f0
mov eax, dword [esi + 0x10]
lea edx, [esi + 0x10]
mov dword [ebp + 8], edx
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bc70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x589ed0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004ba332
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004bbdb1
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cf40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x589ed0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004ba332
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004bbdb1
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428f80
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x589ed0]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov esi, ecx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], esi
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x428ff5
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ba8db
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [esp + 0xc], 0
ja 0x42902e
push edi
call fcn.004ba362
add esp, 4
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov dword [esi + 0x14], 7
push 0x5679b8
mov word [esi], ax
call fcn.00406ee0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 7
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429050
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.00406ee0
push edi
call fcn.004ba362
movups xmm0, xmmword [esp + 0x14]
mov ecx, dword [esp + 0x40]
add esp, 4
mov dword [esi], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [esp + 0x1c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret
Function at 0x429d90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dadd
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x589ed0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004d6070
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0
push eax
push 0xc
mov edi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x429e38
call ebx
cmp eax, 0xea
jne 0x429f63
push dword [esi + 0x24]
push 0
push dword [esi + 0x2c]
call fcn.004d90f0
add esp, 0xc
lea eax, [ebp - 0x34]
push 0
push eax
push dword [esi + 0x24]
push dword [esi + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x34]
mov dword [esi + 0x28], ecx
test eax, eax
je 0x429f74
mov byte [esi + 0x20], 0
call fcn.004d6070
mov esi, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x429dd8
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
test edx, edx
je 0x429e6a
lock inc dword [edx + 4]
mov ecx, dword [esi + 0x24]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x74], vtable.std::_Func_impl_no_alloc_class__lambda_a2c0e87d93472c7c9ba1630052b2df16___void__unsigned_long_int__class_ivan::PipeServerChannel__.0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 3
test ecx, ecx
je 0x429f87
mov eax, dword [ecx]
lea edx, [ebp - 0x44]
push edx
lea edx, [ebp - 0x74]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x50]
test ecx, ecx
je 0x429ed2
mov edx, dword [ecx]
lea eax, [ebp - 0x74]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x50], 0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x429dd8
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x429dd8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x429dd8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x429dd8
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push 0x586558
push eax
call fcn.004d8583
call ebx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push 0x586558
push eax
call fcn.004d8583
call fcn.004bba81
int3
Function at 0x42e990
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e2ed
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x589ed0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp + 8]
push ebx
push 0
push 0xf4240
push dword [eax + 4]
push dword [eax]
call fcn.004bacb0
mov edi, ebx
pop ebx
nop
push 0
push 0xf4240
push edx
push eax
mov esi, ecx
call fcn.004bad90
add eax, esi
push 0
push 0x3e8
adc edx, edi
push edx
push eax
call fcn.004bad90
mov ebx, eax
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x42ea16
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
jmp 0x42ea8a
cmp dword [ebp - 0x5c], 0
jg 0x42ea2e
jl 0x42ea0c
cmp dword [ebp - 0x60], 0
ja 0x42ea2e
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
jmp 0x42ea8a
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x68]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x42ea50
inc esi
cmp esi, 3
ja 0x42ea0c
lea eax, [ebp - 0x68]
push eax
call edi
test eax, eax
je 0x42ea40
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
call fcn.0053a420
mulsd xmm0, qword [0x56bb30]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
movsd qword [ebp - 0x50], xmm0
call fcn.0053a420
movsd xmm1, qword [ebp - 0x50]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.0053a310
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
add ecx, ebx
mov edi, dword [ebp - 0x58]
adc eax, dword [ebp - 0x54]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x70], ecx
mov ecx, edi
push eax
call fcn.004d5980
mov esi, eax
lea eax, [ebp - 0x58]
push eax
call fcn.004d5930
add esp, 4
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x42eaf1
lea eax, [ebp - 0x41]
mov ecx, edi
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004d5580
neg al
sbb al, al
and al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret 4
sub esp, 8
lea ecx, [ebp - 0x40]
call fcn.00434930
push eax
mov dword [ebp - 4], 0
call fcn.00423780
int3
Function at 0x434240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e789
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x589ed0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push 0x20
mov dword [ebp - 0x44], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ba332
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x43432c
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x40]
call fcn.00423a00
push eax
mov byte [ebp - 4], 4
call fcn.00423780
int3

Function at 0x4347e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x43480f
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jg 0x43481f
jl 0x4347f9
cmp dword [esp + 8], 0
jbe 0x4347f9
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x434843
inc esi
cmp esi, 3
ja 0x4347f9
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x434832
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.0053a420
mulsd xmm0, qword [0x56bb30]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.0053a420
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.0053a310
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
mov esp, ebp
pop ebp
ret
Function at 0x4364d0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x589ed0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 4], 0
cmp dword [ebx + 0x1c], 0xffffffff
jne 0x43663b
cmp byte [ebx], 0
lea esi, [ebx + 4]
je 0x436559
cmp dword [esi + 0x14], 8
jb 0x43651e
mov esi, dword [esi]
push dword [ebx + 0x38]
mov eax, dword [ebx + 0x24]
push 0
push eax
push eax
push 0xff
push 6
push 3
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43664f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x43664f
jmp 0x43660d
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x18], esi
jb 0x436567
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xa
nop
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43657a
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4365d2
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x436666
mov esi, edi
cmp esi, 0xffffffff
mov dword [ebx + 0x1c], esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x43667d
jmp 0x4365ff
mov edi, dword [ebp - 0x14]
dec edi
mov dword [ebp - 0x14], edi
test edi, edi
jg 0x436628
or esi, 0xffffffff
cmp esi, 0xffffffff
mov dword [ebx + 0x1c], esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1f4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
jmp 0x436570
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x586558
push eax
call fcn.004d8583
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x586558
push eax
call fcn.004d8583
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x586558
push eax
call fcn.004d8583
int3
Function at 0x436840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43689c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4368a7
push dword [esi + 0x24]
push 0
push dword [esi + 0x2c]
call fcn.004d90f0
add esp, 0xc
lea eax, [ebp - 4]
push 0
push eax
push dword [esi + 0x24]
push dword [esi + 0x2c]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x28], ecx
test eax, eax
je 0x4368b8
mov byte [esi + 0x20], 0
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 0x586558
push eax
call fcn.004d8583
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 0x586558
push eax
call fcn.004d8583
int3

Function at 0x440990
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f410
mov eax, dword fs:[0]
push eax
sub esp, 0xac
push ebx
push esi
push edi
mov eax, dword [0x589ed0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x1c], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x440a1a
push 7
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
push str.0.0.0.0
mov byte [edi], al
push edi
mov dword [edi + 0x10], 7
call fcn.004d8b70
add esp, 0xc
mov byte [edi + 7], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004ba8db
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x5679c4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push ecx
lea ecx, [ebp - 0xb8]
mov esi, eax
call fcn.004227e0
mov dword [ebp - 4], 0
test esi, esi
je 0x440ae7
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x440ae7
cmp dword [ebp - 0x14], 0
jbe 0x440ae7
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push ecx
push 0x5685bc
push ecx
push eax
movzx eax, word [ecx + 8]
push ecx
push 0x5685bc
push ecx
push eax
movzx eax, word [ecx + 0xa]
push ecx
push 0x5685bc
push ecx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00440c60
add esp, 4
push eax
call fcn.0041f490
add esp, 0xc
mov ecx, eax
call fcn.00440c60
add esp, 4
push eax
call fcn.0041f490
add esp, 0xc
mov ecx, eax
call fcn.00440c60
add esp, 4
push eax
call fcn.0041f490
add esp, 0xc
mov ecx, eax
call fcn.00440c60
push ebx
call fcn.004ba362
add esp, 4
lea ecx, [ebp - 0xb4]
push edi
call fcn.0041c9f0
lea ecx, [ebp - 0xb8]
call fcn.0041fde0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a620
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x589ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
push eax
push 0x569c04
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x45a6b9
push esi
call fcn.004e4d1e
add esp, 4
mov ebx, eax
mov dword [ebp - 0x18], ebx
push ebx
push esi
push dword [ebp - 0x24]
push 0x569c04
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x5679c4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45a6a3
cmp dword [ebp - 0x28], 0x34
jb 0x45a6a3
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x18]
movzx ebx, word [eax + 0xe]
movzx edi, word [eax + 8]
movzx esi, word [eax + 0xa]
call fcn.004e4691
add esp, 4
jmp 0x45a6c2
push dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
call fcn.004e4691
add esp, 4
jmp 0x45a6c2
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
movzx ecx, bx
cmp si, 6
jb 0x45a807
ja 0x45a6eb
cmp di, 1
jb 0x45a807
ja 0x45a6eb
mov eax, 0x1db0
cmp cx, ax
jb 0x45a807
mov eax, dword [ebp - 0x1c]
mov ebx, 0x64
test eax, eax
je 0x45a7ca
cmp si, 0xa
jb 0x45a742
ja 0x45a712
test di, di
jne 0x45a712
mov eax, 0x3a6b
cmp cx, ax
jb 0x45a74e
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45a7f4
push str.GetDpiForWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45a7b0
mov ecx, dword [ebp - 0x1c]
push ecx
call eax
imul ecx, eax, 0x64
jmp 0x45a7a4
cmp si, 6
ja 0x45a74e
cmp di, 3
jb 0x45a7ca
push str.Shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45a7f4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
push str.GetDpiForMonitor
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45a7b0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push edi
call eax
test eax, eax
js 0x45a7b0
imul ecx, dword [ebp - 0x18], 0x64
mov eax, 0xaaaaaaab
mul ecx
mov ebx, edx
shr ebx, 6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x60
push 0x64
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x64
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret