joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407680
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4076c0
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.00429d12
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x407741
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x44a758
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x407741
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x40773f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x40774e
push esi
call fcn.00429cf7
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.004240d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x407856
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00429d85
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.00407680
add esp, 0x10
test al, al
je 0x407856
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x407844
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422285
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00422285
mov esp, ebp
pop ebp
ret
Function at 0x4091b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push esi
call fcn.00409330
test al, al
je 0x409219
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call fcn.0040cbc0
push esi
mov ecx, eax
call fcn.0040c730
mov esi, eax
cmp byte [esi], 0
je 0x40927e
mov ecx, esi
call fcn.0040cae0
mov eax, dword [esi + 4]
test eax, eax
jg 0x4091f1
mov dword [esi + 4], 0
pop esi
ret
mov dword [esi + eax*8 + 0xfc8], 0
mov dword [esi + eax*8 + 0xfcc], 0
add dword [esi + 4], 0xffffffff
je 0x40927e
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pop esi
ret
call fcn.00409700
test al, al
je 0x40927e
cmp byte [0x4599e6], 0
je 0x40927e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call fcn.0040cf80
mov esi, eax
cmp byte [esi + 4], 0
je 0x40927e
push ecx
mov ecx, esi
call fcn.0040d0a0
mov eax, dword [esi + 0xc]
test eax, eax
jg 0x409258
mov dword [esi + 0xc], 0
pop esi
ret
mov dword [esi + eax*8 + 0xfb0], 0
mov dword [esi + eax*8 + 0xfb4], 0
add dword [esi + 0xc], 0xffffffff
je 0x40927e
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pop esi
ret

Function at 0x409b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409bae
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x409b78
mov edi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
call fcn.004073e0
push 0x44eaa0
mov esi, eax
push 0x44eac8
push esi
call fcn.00406410
lea ecx, [edi + 4]
push ecx
push 0x44eac8
push esi
call fcn.00406410
add esp, 0x18
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 4], edi
je 0x409c47
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x409bcc
mov eax, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
push 0x450380
mov dword [ebp + 0x10], eax
call fcn.00401e30
push 0x450390
mov esi, eax
push 0x44eac8
push esi
call fcn.00406410
push edi
push 0x44eac0
push esi
call fcn.00406410
push 0x45039c
push 0x44eac8
push esi
call fcn.00406410
push dword [ebp - 4]
push 0x44eac0
push esi
call fcn.00406410
push 0x4503ac
push 0x44eac8
push esi
call fcn.00406410
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0x44eac8
push esi
call fcn.00406410
add esp, 0x48
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409c60
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
mov eax, dword [0x45604c]
xor eax, esp
mov dword [esp + 0x470], eax
push esi
push 0x44ec24
push ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov esi, edx
call fcn.0042aaf8
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x409cb5
xor al, al
pop esi
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00422285
mov esp, ebp
pop ebp
ret
push eax
push 0x400
lea eax, [esp + 0x78]
mov dword [esp + 0x14], 0
push 1
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.0042b117
add esp, 0x10
test eax, eax
je 0x409d2a
nop
push eax
lea edx, [esp + 0x74]
lea ecx, [esp + 0xc]
call fcn.0040d430
push dword [esp + 8]
lea eax, [esp + 0x78]
push 0x400
push 1
push eax
call fcn.0042b117
add esp, 0x14
test eax, eax
jne 0x409d00
mov edx, esi
lea ecx, [esp + 8]
call fcn.0040d4f0
push dword [esp + 4]
call fcn.0042ac64
mov ecx, dword [esp + 0x478]
add esp, 4
mov al, 1
pop esi
xor ecx, esp
call fcn.00422285
mov esp, ebp
pop ebp
ret
Function at 0x40c330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c415
test edi, edi
je 0x40c3cb
cmp word [edi], 0
je 0x40c3cb
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x40c385
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00407350
push 0x45062c
mov esi, eax
push 0x44eac8
push esi
call fcn.00406410
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push 0x44eac8
push esi
call fcn.00406410
add esp, 0xc
push 0x44a758
push 0x44eac8
push esi
call fcn.00406410
add esp, 0xc
push edi
jmp 0x40c3fc
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x40c3da
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00407350
push 0x45062c
mov esi, eax
push 0x44eac8
push esi
call fcn.00406410
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x44eac8
push esi
call fcn.00406410
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
je 0x40c485
test edi, edi
je 0x40c44a
cmp word [edi], 0
je 0x40c44a
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x40c436
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0
call fcn.00407350
push 0x45063c
jmp 0x40c393
cmp byte [esi + 0x128], 0
je 0x40c458
add esi, 0x18
jmp 0x40c45b
mov esi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0x45063c
call fcn.00401e30
lea ecx, [esi + 4]
push ecx
push 0x44eac8
push eax
call fcn.00406410
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40cbc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x456f60], 0
push ebx
mov dword [ebp - 4], 0
je 0x40ccf7
push dword [0x456f68]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x40cc27
cmp dword [eax], 0xd
jbe 0x40cc27
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x40cc27
push 0
push 0x45706c
push 0x4570a4
push 0
push eax
call fcn.0043ba74
add esp, 0x14
test eax, eax
je 0x40cc27
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40cd3a
cmp dword [0x456f60], 0
je 0x40ccf7
push esi
push edi
push 0x45fa80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 4]
call fcn.0040cd80
mov esi, dword [ebp - 4]
test esi, esi
jne 0x40cce3
push 0x2014
call fcn.00421ff6
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.0040c650
cmp dword [0x456f60], 0
mov esi, eax
je 0x40cce3
push dword [0x456f68]
call ebx
test eax, eax
je 0x40cce3
cmp dword [eax], 0xd
jbe 0x40cce3
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x34]
test ecx, ecx
jne 0x40ccdd
push 8
call fcn.00421ff6
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
mov dword [edi], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov dword [edi + 4], esi
cmp dword [0x456f60], 0
je 0x40cce3
push dword [0x456f68]
call ebx
test eax, eax
je 0x40cce3
cmp dword [eax], 0xd
jbe 0x40cce3
mov eax, dword [eax + 8]
push 0x45fa80
mov dword [eax + 0x34], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx]
push esi
call dword [edx + 0xc]
push 0x45fa80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45fae0]
test eax, eax
jne 0x40cd3a
push 0x45fa80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x45fc18]
cmp eax, dword [ecx + 4]
jg 0x40cd3f
push 0x45fa80
mov dword [0x45fae0], 0x45fc20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x45fae0]
pop ebx
mov esp, ebp
pop ebp
ret
push 0x45fc18
call fcn.0042260f
add esp, 4
cmp dword [0x45fc18], 0xffffffff
jne 0x40cd20
mov ecx, 0x45fc20
call fcn.0040c650
push 0x43da90
call fcn.00422270
push 0x45fc18
call fcn.004225c5
add esp, 8
jmp 0x40cd20

Function at 0x40cd80
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x456f60], 0
push esi
mov esi, edx
je 0x40cdd3
push dword [0x456f68]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40cdd3
cmp dword [eax], 0xd
jbe 0x40cdd3
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x40cdd3
push 0
push 0x45706c
push 0x4570a4
push 0
push eax
call fcn.0043ba74
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x40cdd3
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi], eax
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x40d150
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x456f60], 0
push ebx
mov dword [ebp - 4], 0
je 0x40d287
push dword [0x456f68]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x40d1b7
cmp dword [eax], 0x17
jbe 0x40d1b7
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x40d1b7
push 0
push 0x4570c4
push 0x4570a4
push 0
push eax
call fcn.0043ba74
add esp, 0x14
test eax, eax
je 0x40d1b7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40d2ca
cmp dword [0x456f60], 0
je 0x40d287
push esi
push edi
push 0x45fa80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 4]
call fcn.0040d310
mov esi, dword [ebp - 4]
test esi, esi
jne 0x40d273
push 0x202c
call fcn.00421ff6
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.0040ce80
cmp dword [0x456f60], 0
mov esi, eax
je 0x40d273
push dword [0x456f68]
call ebx
test eax, eax
je 0x40d273
cmp dword [eax], 0x17
jbe 0x40d273
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
jne 0x40d26d
push 8
call fcn.00421ff6
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
mov dword [edi], vtable.t_visualDataItemPtr_class_t_perfCationManager_.0
mov dword [edi + 4], esi
cmp dword [0x456f60], 0
je 0x40d273
push dword [0x456f68]
call ebx
test eax, eax
je 0x40d273
cmp dword [eax], 0x17
jbe 0x40d273
mov eax, dword [eax + 8]
push 0x45fa80
mov dword [eax + 0x5c], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx]
push esi
call dword [edx + 0xc]
push 0x45fa80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x45fae4]
test eax, eax
jne 0x40d2ca
push 0x45fa80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x463c64]
cmp eax, dword [ecx + 4]
jg 0x40d2cf
push 0x45fa80
mov dword [0x45fae4], 0x461c38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x45fae4]
pop ebx
mov esp, ebp
pop ebp
ret
push 0x463c64
call fcn.0042260f
add esp, 4
cmp dword [0x463c64], 0xffffffff
jne 0x40d2b0
mov ecx, 0x461c38
call fcn.0040ce80
push 0x43dac0
call fcn.00422270
push 0x463c64
call fcn.004225c5
add esp, 8
jmp 0x40d2b0

Function at 0x40d310
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x456f60], 0
push esi
mov esi, edx
je 0x40d363
push dword [0x456f68]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d363
cmp dword [eax], 0x17
jbe 0x40d363
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x5c]
test eax, eax
je 0x40d363
push 0
push 0x4570c4
push 0x4570a4
push 0
push eax
call fcn.0043ba74
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x40d363
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi], eax
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x40ddf0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c4a0
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x40de49
push eax
call fcn.00429cf7
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push ecx
lea ecx, [ebp - 0x370]
call fcn.00405ac0
mov dword [ebp - method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [ebp - 0x1c], 0x450840
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push esi
push ebx
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], 0
call fcn.00405c60
test al, al
je 0x40dfdf
lea eax, [ebp - 0x378]
mov dword [ebp - 0x378], 0
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x40dece
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40dec8
xor eax, eax
jmp 0x40dece
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x36c]
mov dword [ebp - 0x378], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x40df13
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40df0d
xor eax, eax
mov dword [ebp - 0x374], eax
jmp 0x40df13
mov eax, dword [ebp - 0x374]
add eax, 4
push eax
call fcn.00429d12
add esp, 4
mov dword [ebp - 0x378], eax
test eax, eax
jne 0x40df4c
mov dword [edi + 0x24], 2
cmp byte [esi + 0x11c], al
je 0x40df42
add esi, 0xc
push 0x4506f8
jmp 0x40df8c
mov esi, dword [esi + 8]
push 0x4506f8
jmp 0x40df8c
push dword [ebp - 0x374]
lea ecx, [ebp - 0x1c]
push eax
push ebx
call fcn.0040e400
test al, al
jne 0x40dfa7
mov ecx, dword [ebp - 0x378]
push ecx
mov dword [edi + 0x24], 3
call fcn.00429cf7
add esp, 4
cmp byte [esi + 0x11c], 0
je 0x40df84
add esi, 0xc
jmp 0x40df87
mov esi, dword [esi + 8]
push 0x44ea40
mov ecx, ebx
call fcn.00401e30
lea ecx, [esi + 4]
push ecx
push 0x44eac8
push eax
call fcn.00406410
add esp, 0xc
jmp 0x40dfe6
lea ecx, [ebp - 0x370]
call fcn.00405e80
mov ecx, dword [ebp - 0x378]
xor edx, edx
mov eax, dword [ebp - 0x374]
push ecx
push eax
push ecx
mov dword [ecx + eax], edx
mov ecx, edi
push ebx
call fcn.0040e100
test al, al
jne 0x40dfdb
mov dword [edi + 0x24], 4
jmp 0x40df76
mov bl, 1
jmp 0x40dfe8
mov dword [edi + 0x24], 1
xor bl, bl
lea ecx, [ebp - 0x370]
mov dword [ebp - method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [ebp - 0x1c], vtable.t_byteStreamRead.0
call fcn.00405ba0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422285
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40e4f0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [ebp + 0xc]
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e471
cmp byte [esi - 0x22c], al
je 0x40e44c
add esi, 0xfffffcc4
jmp 0x40e452
mov esi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
call fcn.004073e0
push 0x44ea70
mov edi, eax
push 0x44eac8
push edi
call fcn.00406410
add esp, 0xc
jmp 0x40e49d
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x40e4b9
cmp byte [esi - 0x22c], cl
je 0x40e488
add esi, 0xfffffcc4
jmp 0x40e48e
mov esi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
push 0x44ea80
call fcn.00401e30
mov edi, eax
lea eax, [esi + 4]
push eax
push 0x44eac8
push edi
call fcn.00406410
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, edi
je 0x40e4f0
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x40e4d2
mov eax, dword [esi - 0x340]
add eax, 4
push eax
push ecx
push edi
push str.penc_rN
push dword [ebp + 8]
call fcn.004072b0
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
add dword [esi + 8], edi
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411dd0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x45604c]
xor eax, esp
mov dword [esp + 0x480], eax
mov eax, dword [ebp + 8]
push esi
push 0x44ec24
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call fcn.0042aaf8
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x411edc
push eax
push 0x400
lea eax, [esp + 0x88]
mov dword [esp + 0x14], 0
push 1
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.0042b117
add esp, 0x10
test eax, eax
je 0x411e91
push eax
lea edx, [esp + 0x84]
lea ecx, [esp + 0xc]
call fcn.0040d430
push dword [esp + 8]
lea eax, [esp + 0x88]
push 0x400
push 1
push eax
call fcn.0042b117
add esp, 0x14
test eax, eax
jne 0x411e61
lea edx, [esp + 0x70]
lea ecx, [esp + 8]
call fcn.0040d4f0
push dword [esp + 4]
call fcn.0042ac64
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x74]
add esp, 4
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x411edc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x411eb6
mov al, 1
pop esi
mov ecx, dword [esp + 0x480]
xor ecx, esp
call fcn.00422285
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x484]
xor al, al
pop esi
xor ecx, esp
call fcn.00422285
mov esp, ebp
pop ebp
ret
Function at 0x411f00
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
mov eax, dword [0x45604c]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x44ec24
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call fcn.0042aaf8
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x411f59
xor al, al
pop esi
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00422285
mov esp, ebp
pop ebp
ret
push eax
push 0x400
lea eax, [esp + 0x78]
mov dword [esp + 0x14], 0
push 1
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.0042b117
add esp, 0x10
test eax, eax
je 0x411fcc
push eax
lea edx, [esp + 0x74]
lea ecx, [esp + 0xc]
call fcn.0040d430
push dword [esp + 8]
lea eax, [esp + 0x78]
push 0x400
push 1
push eax
call fcn.0042b117
add esp, 0x14
test eax, eax
jne 0x411fa2
mov edx, esi
lea ecx, [esp + 8]
call fcn.0040d4f0
push dword [esp + 4]
call fcn.0042ac64
mov ecx, dword [esp + 0x478]
add esp, 4
mov al, 1
pop esi
xor ecx, esp
call fcn.00422285
mov esp, ebp
pop ebp
ret
Function at 0x412180
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x45fa7d], 0
jne 0x412302
cmp byte [0x45faec], 0
mov byte [0x45fa7d], 1
jne 0x4122ea
push ebx
push edi
push 0x114
lea eax, [ebp - 0x32c]
mov byte [0x45faec], 1
push 0
push eax
call fcn.004240d0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004240d0
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4122c4
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00429d85
add esp, 0xc
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0
xor bl, bl
mov dword [ebp - 0x218], 0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x4122c4
push esi
push eax
call fcn.00429d12
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20c]
push esi
push dword [ebp - 0x210]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4122a9
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x44a758
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4122a9
mov eax, dword [ebp - 0x214]
mov bl, 1
movzx edi, word [eax + 0xa]
jmp 0x4122af
mov edi, dword [ebp - 0x218]
test esi, esi
je 0x4122bc
push esi
call fcn.00429cf7
add esp, 4
movzx eax, di
pop esi
test bl, bl
jne 0x4122ca
mov eax, dword [ebp - 0x328]
cmp eax, 6
pop edi
setae al
mov byte [0x45faed], al
pop ebx
mov byte [0x45fa7e], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422285
mov esp, ebp
pop ebp
ret
mov al, byte [0x45faed]
mov byte [0x45fa7e], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422285
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x45fa7e]
xor ecx, ebp
call fcn.00422285
mov esp, ebp
pop ebp
ret