joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420dda
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x429788
call fcn.0042057c
mov edi, 0x94
mov eax, edi
call fcn.00420030
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4608c8], ecx
mov eax, dword [esi + 4]
mov dword [0x4608d4], eax
mov edx, dword [esi + 8]
mov dword [0x4608d8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4608cc], esi
cmp ecx, 2
je 0x420e3a
or esi, 0x8000
mov dword [0x4608cc], esi
shl eax, 8
add eax, edx
mov dword [0x4608d0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x420e75
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420e75
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x420e8d
cmp eax, 0x20b
je 0x420e7a
mov dword [ebp - 0x1c], esi
jmp 0x420ea1
cmp dword [ecx + 0x84], 0xe
jbe 0x420e75
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x420e9b
cmp dword [ecx + 0x74], 0xe
jbe 0x420e75
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00423ddd
pop ecx
test eax, eax
jne 0x420ecd
cmp dword [0x4608a8], 1
jne 0x420eba
call fcn.00423592
push 0x1c
call fcn.0042341b
push 0xff
call fcn.00421605
pop ecx
pop ecx
call fcn.00423d3b
mov dword [ebp - 4], esi
call fcn.00423b90
test eax, eax
jge 0x420ee6
push 0x1b
call fcn.00420db5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x461e90], eax
call fcn.00423a6e
mov dword [0x4608a0], eax
call fcn.004239cc
test eax, eax
jge 0x420f0c
push 8
call fcn.00420db5
pop ecx
call fcn.00423799
test eax, eax
jge 0x420f1d
push 9
call fcn.00420db5
pop ecx
push 1
call fcn.00421635
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x420f33
push eax
call fcn.00420db5
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0042373c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x420f54
movzx eax, word [ebp - 0x40]
jmp 0x420f57
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040c98b
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x420f75
push edi
call fcn.00421760
call fcn.00421782
jmp 0x420fa7
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004205b7
ret
Function at 0x421af2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x421b20
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x421b27
cmp ebx, dword [eax + 4]
jae 0x421b27
xor eax, eax
jmp 0x421d17
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x421b38
xor eax, eax
inc eax
jmp 0x421d16
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x421b4e
cmp ecx, edx
jae 0x421c93
cmp dword [eax + 4], 0
je 0x421b57
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x421b3f
cmp dword [ebp + 8], 0
je 0x421b79
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x421c93
cmp eax, esi
jae 0x421c93
mov eax, dword [0x460910]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x421b9e
cmp dword [esi*4 + 0x460918], edi
je 0x421c97
inc esi
cmp esi, eax
jl 0x421b8c
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x421d13
cmp dword [ebp - 8], 0x1000000
jne 0x421d13
test byte [ebp - 0xc], 0xcc
je 0x421c1c
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x421d13
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x421d13
cmp word [eax + 0x18], 0x10b
jne 0x421d13
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x421d13
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x421c1c
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x421c1c
test byte [ecx + 0x27], 0x80
jne 0x421c93
push 1
push 0x460958
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x421b30
mov ecx, dword [0x460910]
test ecx, ecx
mov edx, ecx
jle 0x421c50
lea eax, [ecx*4 + 0x460914]
cmp dword [eax], edi
je 0x421c50
dec edx
sub eax, 4
test edx, edx
jg 0x421c44
test edx, edx
jne 0x421c81
push 0xf
pop ebx
cmp ecx, ebx
jg 0x421c5d
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x421c75
lea eax, [edx*4 + 0x460918]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x421c63
cmp ecx, 0x10
jge 0x421c81
inc ecx
mov dword [0x460910], ecx
push 0
push 0x460958
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x421b30
xor eax, eax
jmp 0x421d16
test esi, esi
jle 0x421b30
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x460958
call ebx
test eax, eax
jne 0x421b30
cmp dword [esi*4 + 0x460918], edi
je 0x421ced
mov eax, dword [0x460910]
lea esi, [eax - 1]
test esi, esi
jl 0x421cdb
cmp dword [esi*4 + 0x460918], edi
je 0x421cd7
dec esi
jns 0x421ccb
test esi, esi
jge 0x421ceb
cmp eax, 0x10
jge 0x421ce6
inc eax
mov dword [0x460910], eax
lea esi, [eax - 1]
jmp 0x421ced
je 0x421d05
xor ecx, ecx
test esi, esi
jl 0x421d05
lea eax, [ecx*4 + 0x460918]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x421cf3
push 0
push 0x460958
call ebx
jmp 0x421b30
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002e3a
Capabilities:
Check os version

Disassembly:
push 0xa0
push 0x1002f08
call fcn.01003099
mov esi, dword [ebp + 0xc]
mov dword [0x101702c], esi
mov eax, dword [ebp + 8]
mov dword [0x101701c], eax
xor edi, edi
mov dword [ebp - 4], edi
push 0x1017034
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1002f04
cmp dword [ebp - 0xac], 6
sbb al, al
inc al
mov byte [section..data], al
call fcn.01003030
mov dword [0x1017020], eax
cmp dword [ebp - 0xa0], 2
jne 0x1002ee6
mov byte [0x1017001], 1
cmp dword [ebp - 0xac], 5
jb 0x1002ec8
mov byte [0x1017002], 1
je 0x1002ef9
cmp dword [ebp - 0xac], 6
jb 0x1002ee6
cmp esi, 0x7d0
jne 0x1002edf
push edi
call fcn.01002f29
mov byte [0x1017028], 1
xor eax, eax
cmp dword [0x101701c], edi
setne al
call fcn.01003481
ret 8
cmp dword [ebp - 0xa8], 1
jb 0x1002ec8
jmp 0x1002ed1
xor eax, eax
jmp 0x1002ef1
Function at 0x1003030
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1017020]
test eax, eax
jne 0x100308d
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
mov ecx, esi
and ecx, 0x3ff
xor edx, edx
movzx eax, cx
inc edx
cmp dx, ax
je 0x10092e1
push 0xd
pop edx
cmp dx, ax
je 0x10092e1
cmp byte [section..data], 0
je 0x1009300
mov eax, dword [0x101701c]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret
cmp dword [0x101702c], 0x7d0
je 0x1003087
mov dword [0x10174c4], 0x180000
jmp 0x100307a
push 9
pop eax
cmp ax, cx
je 0x1003087
push ebx
push edi
push esi
push dword [0x101701c]
call fcn.01013480
cmp eax, dword [0x101701c]
jne 0x100932a
push eax
call fcn.01014606
jmp 0x1009332
test eax, eax
jne 0x10094e7
push 5
lea eax, [ebp - 0xc]
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x100934f
mov eax, dword [0x1017020]
jmp 0x10094de
mov esi, 0x104
push esi
lea eax, [ebp - 0x318]
push eax
push 0x3e9
push dword [0x101701c]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x1009345
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
mov ebx, 0x10094f0
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0100f869
add esp, 0x14
push esi
lea eax, [ebp - 0x41c]
push eax
push dword [0x101701c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010134db
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x10094e7
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x10094e7
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jle 0x1009463
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
mov byte [ebp - 0xa], 0
call fcn.0100ce89
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010134db
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x10094e7
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x10094e7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 5
lea ecx, [ebp - 0xc]
push ecx
and eax, 0x3ff
or eax, 0x400
push 3
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1009345
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.0100ce89
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, esi
lea ecx, [ebp - 0x41c]
call fcn.010134db
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
jne 0x10094e7
push 2
push eax
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
jne 0x10094e7
mov eax, dword [0x101701c]
pop edi
pop ebx
jmp 0x100308c
Function at 0x10030e6
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.01002fa1
push 0x1003104
mov eax, 0x1003100
call fcn.0100310d
pop ecx
jmp fcn.010020cf

Function at 0x10032be
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xc1c], esi
cmp byte [0x1017001], bl
je 0x1009852
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc08]
push ecx
push ebx
push edi
push eax
mov dword [ebp - 0xc0c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1004a28
jle 0x1003335
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0xc
lea eax, [ebp - 0xc04]
cmp dword [ebp - 0xc08], ebx
jbe 0x1004a99
cmp dword [ebp - 0xc08], 2
ja 0x1009953
push 0xffffffffffffffff
push 0x1004ab0
lea eax, [ebp - 0xc04]
push eax
mov byte [esi], 1
call fcn.01002753
test eax, eax
je 0x1004a95
push 0xffffffffffffffff
push 0x1004ab4
lea eax, [ebp - 0xc04]
push eax
call fcn.01002753
test eax, eax
je 0x1004a95
push 0xffffffffffffffff
push 0x1004aa4
lea eax, [ebp - 0xc04]
push eax
call fcn.01002753
test eax, eax
je 0x1004a95
mov byte [esi], 1
xor eax, eax
jmp 0x1003335
mov byte [esi], bl
jmp 0x1004a8e
mov eax, 0x80040153
jmp 0x1003335
cmp edi, ebx
je 0x10098fb
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
mov dword [ebp - 0xc18], eax
cmp eax, ebx
jne 0x1009882
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x1003329
call fcn.0100320b
mov dword [ebp - 0xc10], esp
push ebx
push ebx
push dword [ebp - 0xc18]
push dword [ebp - 0xc10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x1009875
mov esi, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc08]
push eax
push ebx
push dword [ebp - 0xc10]
mov edi, 0x400
push dword [ebp - 0xc14]
mov dword [ebp - 0xc0c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1003329
mov eax, dword [ebp - 0xc0c]
cmp eax, ebx
jne 0x1009903
mov eax, 0x80004005
jmp 0x1003335
mov dword [ebp - 0xc10], ebx
jmp 0x10098ac
cmp dword [ebp - 0xc08], 1
mov byte [ebp + eax - 0x405], bl
je 0x1009927
cmp dword [ebp - 0xc08], 2
je 0x1009927
lea eax, [ebp - 0x404]
jmp 0x1004a2e
push edi
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1009875
mov eax, dword [ebp - 0xc14]
jmp 0x1004a2e
cmp dword [ebp - 0xc08], 4
jne 0x1004a99
cmp dword [ebp - 0xc0c], 4
jne 0x1004a99
cmp dword [eax], ebx
setne al
mov byte [esi], al
jmp 0x1004a8e
Function at 0x100413d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 8], 4
cmp byte [0x1017001], bl
je 0x10097cd
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1009835
jle 0x1004193
and eax, 0xffff
or eax, 0x80070000
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0xc
cmp dword [ebp + 0xc], ebx
je 0x1009815
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x10097f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x1004187
call fcn.0100320b
mov dword [ebp - 0xc], esp
push ebx
push ebx
push edi
push dword [ebp - 0xc]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x10097eb
jmp 0x1009818
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x100417f
cmp dword [ebp - 0x10], 4
jne 0x1009848
cmp dword [ebp - 8], 4
jne 0x1009848
xor eax, eax
jmp 0x1004193
mov eax, 0x80040153
jmp 0x1004193
Function at 0x10042b5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x1017001], bl
je 0x100971c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x14]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.0100434f
test eax, eax
jl 0x10096f1
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10096fb
cmp dword [ebp - 0xc], 1
jne 0x1009710
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x10096f1
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x10
mov eax, 0x80040153
jmp 0x1004336
jle 0x1004336
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004336
cmp dword [ebp - 0xc], 2
je 0x1004324
jmp 0x10096f1
cmp dword [ebp + 0xc], ebx
je 0x1009761
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x1009744
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jmp 0x10096fb
call fcn.0100320b
mov dword [ebp - 0x10], esp
push ebx
push ebx
push edi
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x100973a
jmp 0x1009764
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x14]
inc esi
mov eax, esi
call fcn.0100320b
mov edi, esp
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x10096fb
cmp dword [ebp - 0xc], 1
je 0x10097a2
cmp dword [ebp - 0xc], 2
jne 0x10096f1
mov eax, dword [ebp - 8]
cmp byte [edi + eax - 1], bl
jne 0x10096f1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1004334
jmp 0x100973a
Function at 0x100442a
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
push esi
mov dword [eax], ebx
push edi
cmp byte [0x1017001], bl
je 0x1007eb9
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x10044c1
call fcn.0100320b
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10044c1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10044cc
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10044c1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1007ea2
cmp eax, ebx
jle 0x10044ad
and eax, 0xffff
or eax, 0x80070000
jmp 0x10044ad
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x10044c1
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
jne 0x1007eec
mov eax, 0x8007000e
jmp 0x10044ad
push ebx
push ebx
push edi
push dword [ebp - 8]
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x10044c1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x10044c1
call fcn.0100320b
mov edi, esp
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10044c1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10055b8
push edi
call sub.VERSION.dll_VerQueryValueA
jmp 0x1004494
Function at 0x100453e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x10045e9
mov ecx, eax
call fcn.010045f5
mov esi, eax
cmp esi, ebx
je 0x1008561
mov eax, dword [ebp + 8]
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x100856b
lea eax, [esi + 0x14]
push eax
push ebx
push esi
push 0x1002516
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
cmp eax, ebx
je 0x100856b
push 0xff
push 0xffffffffffffffff
push ebx
push dword [esi + 0x1c]
call fcn.010024cf
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
cmp eax, ebx
mov dword [esi + 0x1c], ebx
jg 0x1008586
mov edi, eax
cmp edi, ebx
jl 0x10045d8
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor esi, esi
xor edi, edi
cmp esi, ebx
jne 0x1008595
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
xor esi, esi
jmp 0x1004561
mov edi, 0x8007000e
jmp 0x10045e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100857f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10045d8
and eax, 0xffff
or eax, 0x80070000
jmp 0x10045c9
push 1
mov ecx, esi
call fcn.01005f2e
jmp 0x10045e0

Function at 0x10055ca
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [eax], 0
push esi
push 0
lea eax, [ebp - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x1008d51
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10055f3
push ebx
sub eax, ecx
push edi
lea edi, [eax + esi + 2]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1008d6e
inc esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1008d78
sub edi, eax
push 0x10055b8
lea esi, [eax + ebx]
push edi
push esi
call fcn.01005673
push dword [ebp + 8]
dec edi
push edi
inc esi
push esi
call fcn.01005673
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1008d78
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor esi, esi
test ebx, ebx
je 0x1005665
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1008d62
mov esi, eax
jmp 0x1005667
and eax, 0xffff
or eax, 0x80070000
jmp 0x1008d5b
mov esi, 0x8007000e
jmp 0x100565a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1008d8c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100565a