joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3f38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a4198
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a3f9b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a3a00
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d7c4
cmp al, 1
jne 0x4a3f9b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a3d18
test al, al
je 0x4a4127
cmp dword [ebp - 8], 0
jge 0x4a3fb9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a3a00
mov eax, dword [ebp - 0x210]
call fcn.004046f4
cmp ebx, eax
jge 0x4a4003
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a3a00
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5b2c54]
and eax, 0xff
bt dword [edx], eax
jae 0x4a4003
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a4017
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a3f14
cmp ebx, dword [ebp - 8]
je 0x4a4119
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a4043
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004037fc
and eax, 0x7f
movzx eax, word [eax*2 + 0x5ab580]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a4106
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004037fc
and eax, 0x7f
movzx eax, word [eax*2 + 0x5ab580]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00486a08
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004037fc
and eax, 0x7f
movzx eax, word [eax*2 + 0x5ab580]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00486a08
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a410d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a417a
cmp dword [ebp - 8], 0
jge 0x4a4132
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a3a00
mov eax, dword [ebp - 0x218]
call fcn.004046f4
cmp eax, dword [ebp - 8]
jg 0x4a416c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a3a00
mov eax, dword [ebp - 0x21c]
call fcn.004046f4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a3f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a419f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404458
ret
Function at 0x4b2368
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4b23b9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4b23a0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4b2390
jmp 0x4b23b9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4b23a1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c15e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4c160f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4c168e
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004bfe9c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c165c
mov cx, word [esp]
sub cx, si
jmp 0x4c165e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c1645
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c1684
mov cx, word [esp]
sub cx, si
jmp 0x4c1686
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c166d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4c16eb
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004c12b4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4c16d6
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4c16eb
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4c15ea
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c7c94
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5b3c44
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4c7cb6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4c7cb8
shr eax, 1
dec edx
jne 0x4c7ca4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4c7c9d
mov byte [0x5b4044], 1
pop esi
pop ebx
ret

Function at 0x4c7cd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5b4044], 0
jne 0x4c7ceb
call fcn.004c7c94
mov eax, edi
dec eax
test eax, eax
jl 0x4c7d14
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5b3c44]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4c7cf5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4caaa4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4caad5
dec al
je 0x4cab11
dec al
je 0x4cab55
dec al
je 0x4cabc0
jmp 0x4cac4a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4cac4a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4caae5
jmp 0x4cac4a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cac4a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4cab21
jmp 0x4cac4a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cac4a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4cab83
xor ebp, ebp
jmp 0x4cab94
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4cab9d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4cab65
jmp 0x4cac4a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cac4a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4cac18
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004c7d1c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4cabd4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d15b4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d15e2
mov eax, ebx
call fcn.004d2068
cmp dword [ebx + 0x40], 0
je 0x4d15db
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d1653
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d1645
cmp dword [ebx + 8], 0
je 0x4d1604
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d1616
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d1645
cmp dword [ebx + 8], 0
je 0x4d15f7
cmp eax, 3
je 0x4d1629
dec eax
jne 0x4d15f7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d15f7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d15f7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d1671
cmp dword [ebx + 0x14], 0xcc
je 0x4d1671
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d167c
pop ebx
ret

Function at 0x4e74b4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e7605
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4e7500
cmp dword [ebp - 0x8c], 1
je 0x4e7504
xor ebx, ebx
jmp 0x4e7506
mov bl, 1
mov dl, 1
mov eax, dword [0x443cb0]
call fcn.00443d80
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e75e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00443e20
test bl, bl
je 0x4e7543
mov edx, 0x4e761c
mov eax, dword [ebp - 4]
call fcn.00443fa8
jmp 0x4e7550
mov edx, 0x4e7650
mov eax, dword [ebp - 4]
call fcn.00443fa8
lea ecx, [ebp - 0x1a0]
mov edx, 0x4e7688
mov eax, dword [ebp - 4]
call fcn.004441d8
mov edx, dword [ebp - 0x1a0]
lea eax, [esi + 0x1c]
call fcn.00404488
lea ecx, [ebp - 0x1a4]
mov edx, 0x4e76a0
mov eax, dword [ebp - 4]
call fcn.004441d8
mov edx, dword [ebp - 0x1a4]
lea eax, [esi + 0x20]
call fcn.00404488
mov eax, dword [ebp - 4]
call fcn.00443df0
cmp dword [esi + 0x1c], 0
jne 0x4e75ca
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19c]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0x1c]
lea edx, [ebp - 0x19c]
mov ecx, pe_nt_image_headers32
call fcn.004046a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e75e7
mov eax, dword [ebp - 4]
call fcn.00403600
ret
Function at 0x4eef6c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419744]
call fcn.00404e2c
xor eax, eax
push ebp
push 0x4ef0b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5af884], 0
jne 0x4eefbf
mov ecx, dword [0x5b2584]
mov dl, 1
mov eax, dword [0x407cc0]
call fcn.0040ce84
call fcn.00403dcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f70
mov eax, ebx
call fcn.00404c9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4ef0c0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405ef8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404cac
test eax, eax
jle 0x4ef057
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ef050
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004046a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b6c
test eax, eax
jne 0x4ef050
mov ebx, 0x15
jmp 0x4ef05c
mov ebx, 0x10
jmp 0x4ef05c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5af884]
call fcn.004eeec4
mov eax, dword [ebp - 8]
call fcn.004eeec4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef0b7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, dword [0x419744]
call fcn.00404efc
ret
Function at 0x4f7274
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4f728d
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4f73a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00425a6c
lea eax, [ebx + 0x30]
mov edx, dword [ebp + 8]
call fcn.00404488
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebx + 0x30]
call fcn.004048f4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
mov dword [ebx + 0x34], esi
cmp esi, 0xffffffff
jne 0x4f72f6
mov ecx, dword [ebx + 0x30]
lea eax, [ebp - 8]
mov edx, 0x4f73d8
call fcn.00404740
mov eax, dword [ebp - 8]
call fcn.004f725c
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebx + 0x34]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x38], esi
test esi, esi
jne 0x4f731c
mov eax, 0x4f73f0
call fcn.004f725c
push 0
push 0
push 0
push 4
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x4f7340
mov eax, 0x4f7414
call fcn.004f725c
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x40], eax
mov ax, word [eax]
not ax
cmp ax, 0x5a4d
jne 0x4f735c
mov eax, 0x4f7434
call fcn.004f725c
mov eax, dword [ebx + 0x40]
mov edx, dword [ebx + 0x40]
add eax, dword [edx + 0x3c]
mov dword [ebx + 0x44], eax
push 0xf8
mov eax, dword [ebx + 0x44]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4f7385
mov eax, dword [ebx + 0x44]
cmp dword [eax], 0x4550
je 0x4f738f
mov eax, 0x4f7458
call fcn.004f725c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f73ac
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x4f8c38
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f8d79
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.004f6f14
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4f8d5e
mov eax, dword [ebp - 8]
call fcn.00408908
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f8d8c
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f8cca
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f8db4
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f8cec
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f8dd8
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f8d0e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040280c
lea edx, [ebp - 0x14]
mov eax, dword [edi]
call fcn.00408bdc
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00404488
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408bdc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00404488
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
call fcn.00408bdc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8d80
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404458
ret

Function at 0x4f9fe8
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.00409430
test al, al
je 0x4fa064
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x4fa064
mov eax, dword [esp]
call fcn.00408908
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x4fa06c
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4fa05a
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fb55c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
and eax, 0x7f
mov eax, dword [eax*4 + 0x5af9c0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409cec
add esp, 0x10c
pop ebx
ret

Function at 0x4fbcac
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.00409430
test al, al
je 0x4fbd28
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x4fbd28
mov eax, dword [esp]
call fcn.00408908
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x4fbd30
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4fbd1e
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fd2f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004fd074
lea edx, [ebp - 6]
mov ecx, 2
mov eax, ebx
call fcn.004fd04c
cmp word [ebp - 6], 0x5a4d
je 0x4fd331
mov eax, 0x4fd46c
call fcn.004fd17c
mov edx, 0x3c
mov eax, ebx
call fcn.004fd074
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
call fcn.004fd04c
cmp dword [ebp - 0xc], 0
jne 0x4fd35c
mov eax, 0x4fd490
call fcn.004fd17c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004fd074
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
call fcn.004fd04c
cmp dword [ebp - 0x10], 0x4550
je 0x4fd388
mov eax, 0x4fd4b4
call fcn.004fd17c
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, ebx
call fcn.004fd04c
movzx eax, word [ebp - 0x18]
cmp eax, 0xe0
je 0x4fd3ac
mov eax, 0x4fd4d8
call fcn.004fd17c
lea edx, [ebp - 0x108]
mov ecx, 0xe0
mov eax, ebx
call fcn.004fd04c
cmp word [ebp - 0x108], 0x10b
je 0x4fd3d3
mov eax, 0x4fd4fc
call fcn.004fd17c
cmp dword [ebp - 0x98], 0
je 0x4fd3e5
cmp dword [ebp - 0x94], 0
jne 0x4fd3ef
mov eax, 0x4fd520
call fcn.004fd17c
mov eax, dword [ebp - 0x98]
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
movzx esi, word [ebp - 0x26]
dec esi
test esi, esi
jl 0x4fd448
inc esi
lea edx, [ebp - 0x130]
mov ecx, 0x28
mov eax, ebx
call fcn.004fd04c
mov eax, dword [edi]
cmp eax, dword [ebp - 0x124]
jne 0x4fd445
cmp dword [ebp - 0x120], 0
je 0x4fd445
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x11c]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x120]
mov dword [eax], edx
jmp 0x4fd448
dec esi
jne 0x4fd408
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4fd45a
mov eax, 0x4fd53c
call fcn.004fd17c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4