joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bbd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b4b0b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00465f07
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.0046a85e
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40bcd3
call fcn.00466e70
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40bc52
push 0x80004005
call fcn.0040cf30
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.0046a168
test eax, eax
je 0x40bc86
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c8c0
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40bcae
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bcd3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040ba90
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00577e97
mov esp, ebp
pop ebp
ret

Function at 0x40c550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00465787

Function at 0x40c790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c7a5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c7e4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c7e0
lea ebx, [ebx]
cmp esi, edx
jae 0x40c7e4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c7d0
cmp esi, edx
jb 0x40c7e9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4fcb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.004082d0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b5d08
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0xc], 0
call fcn.00444ad0
push str.pro.nlp
lea edx, [esp + 0x44]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x2c]
call fcn.004099a0
add esp, 4
mov byte [esp + 0x68], 1
lea edx, [esp + 0x28]
cmp dword [esp + 0x3c], 0x10
lea ecx, [esp + 0x10]
cmovae edx, dword [esp + 0x28]
call fcn.00430cd0
mov byte [esp + 0x68], 2
lea ecx, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
mov edx, 0x602665
push 0
cmovae ecx, dword [esp + 0x14]
call fcn.00405ee0
add esp, 4
test eax, eax
jne 0x418fcd
cmp dword [esp + 0x20], eax
setne al
test eax, eax
jne 0x418fcd
push eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x602665
mov byte [esi], al
call fcn.00404c00
jmp 0x419005
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418ff9
test al, 0x10
je 0x418ff9
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004044f0
jmp 0x419005
push 0x602665
mov ecx, esi
call fcn.00404490
cmp dword [esp + 0x24], 0x10
jb 0x419018
push dword [esp + 0x10]
call fcn.0044ffc1
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x419040
push dword [esp + 0x28]
call fcn.0044ffc1
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x419068
push dword [esp + 0x40]
call fcn.0044ffc1
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00577e97
mov esp, ebp
pop ebp
ret
Function at 0x41a940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6048
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00445640
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
test eax, 0xfffffffc
jne 0x41a9d0
test ecx, ecx
je 0x41a9b7
push ecx
call fcn.0044ffc1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577e97
mov esp, ebp
pop ebp
ret
cmp dword [0x6316dc], 1
jne 0x41a9de
call fcn.0041a0a0
cmp dword [0x640360], 0
je 0x41a9ec
call fcn.00418a20
push 0
call fcn.00579512
int3
Function at 0x420510
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jge 0x420536
cmp byte [ecx + 0x61], 0
jne 0x420536
cmp byte [ecx + 0x60], 0
je 0x420536
mov byte [ecx + 0x60], 0
jmp fcn.0044a890
ret
Function at 0x424d90
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6d42
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x154], 0
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x602665
mov dword [ebp - 0x158], esi
mov byte [esi], 0
call fcn.00404c00
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x154], 1
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
push str.unknown_OperatingSystem.
mov ecx, esi
mov dword [ebp - 0x150], 0x11c
call fcn.00404c00
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x424f56
mov eax, dword [ebp - 0x14c]
sub eax, 4
je 0x424f11
dec eax
je 0x424eb4
dec eax
jne 0x424f56
mov eax, dword [ebp - 0x148]
sub eax, 0
je 0x424e98
dec eax
je 0x424e7c
dec eax
jne 0x424f56
cmp byte [ebp - 0x36], 1
jne 0x424f56
push str.Microsoft_Windows_10
jmp 0x424f4f
cmp byte [ebp - 0x36], 1
mov ecx, esi
jne 0x424e8e
push str.Microsoft_Windows_7
jmp 0x424f51
push str.Microsoft_Windows_Server_2008_R2
jmp 0x424f51
cmp byte [ebp - 0x36], 1
mov ecx, esi
jne 0x424eaa
push str.Microsoft_Windows_Vista
jmp 0x424f51
push str.Microsoft_Windows_Server_2008
jmp 0x424f51
mov eax, dword [ebp - 0x148]
sub eax, 0
je 0x424f0a
dec eax
je 0x424f03
dec eax
jne 0x424f56
cmp byte [ebp - 0x36], 1
jne 0x424edd
cmp word [ebp - 0x34], 9
jne 0x424edd
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x424f4f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x424ef0
push str.Microsoft_Windows_Server_2003
jmp 0x424f4f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x424f56
push str.Microsoft_Windows_Server_2003_R2
jmp 0x424f4f
push str.Microsoft_Windows_XP
jmp 0x424f4f
push str.Microsoft_Windows_2000
jmp 0x424f4f
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x424f33
cmp eax, 0xa
je 0x424f2c
cmp eax, 0x5a
jne 0x424f56
push str.Microsoft_Windows_Me
jmp 0x424f4f
push str.Microsoft_Windows_98
jmp 0x424f4f
mov eax, dword [ebp - 0x140]
cmp eax, 2
jne 0x424f45
push str.Microsoft_Windows_NT_4.0
jmp 0x424f4f
cmp eax, 1
jne 0x424f56
push str.Microsoft_Windows_95
mov ecx, esi
call fcn.00405a30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577e97
mov esp, ebp
pop ebp
ret
Function at 0x4252f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
mov dword [ebp - 0x14], edx
cmp byte [ecx], 0
je 0x42542d
push esi
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
push ebx
lea ecx, [ecx]
mov bl, byte [esi - 2]
xor al, al
mov dword [ebp - 8], 0xffffffff
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dl, byte [ebp - 8]
cmp byte [esi], bl
lea esi, [esi + 1]
movzx ecx, al
movzx edx, dl
cmove edx, ecx
inc al
cmp al, 0x40
jb 0x425324
mov eax, dword [ebp - 4]
xor bl, bl
mov cl, byte [ebp - 7]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dword [ebp - 0x10], edx
mov bh, byte [eax - 1]
jmp 0x425350
cmp byte [esi], bh
lea esi, [esi + 1]
movzx eax, bl
movzx ecx, cl
cmove ecx, eax
inc bl
cmp bl, 0x40
jb 0x425350
mov eax, dword [ebp - 4]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov bl, byte [ebp - 6]
mov dword [ebp - 0xc], ecx
xor cl, cl
mov ch, byte [eax]
cmp byte [esi], ch
lea esi, [esi + 1]
movzx eax, cl
movzx ebx, bl
cmove ebx, eax
inc cl
cmp cl, 0x40
jb 0x425377
mov esi, dword [ebp - 4]
xor cl, cl
mov dl, byte [ebp - 5]
mov ch, byte [esi + 1]
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea esp, [esp]
cmp byte [esi], ch
lea esi, [esi + 1]
movzx eax, cl
movzx edx, dl
cmove edx, eax
inc cl
cmp cl, 0x40
jb 0x4253a0
mov ecx, dword [ebp - 0xc]
mov al, cl
mov esi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
shr al, 4
shl dl, 2
and al, 3
or al, dl
mov edx, dword [ebp - 0x14]
mov byte [edi + edx], al
cmp byte [esi], 0x3d
je 0x425423
mov al, bl
shl cl, 4
shr al, 2
and al, 0xf
or al, cl
mov byte [edi + edx + 1], al
cmp byte [esi + 1], 0x3d
je 0x425419
mov ecx, dword [ebp - 8]
add esi, 4
and cl, 0x3f
shl bl, 6
or cl, bl
mov dword [ebp - 4], esi
mov byte [edi + edx + 2], cl
add edi, 3
cmp byte [esi - 2], 0
jne 0x425310
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
lea eax, [edi + 2]
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
lea eax, [edi + 1]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42a580
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b7260
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x602665
mov byte [esi], 0
call fcn.00404c00
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
mov byte [ebp - 4], 1
lea ecx, [esi + 0x40]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 3
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 5
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 6
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x602665
mov byte [ecx], 0
call fcn.00404c00
mov word [esi + 0xd0], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42bca0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b73fb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0x234], 0
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x230]
call fcn.00425d70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 0x10
mov edx, 0x602665
push 0
cmovae ecx, dword [ebp - 0x230]
call fcn.00405ee0
add esp, 4
test eax, eax
jne 0x42bd3b
cmp dword [ebp - 0x220], eax
setne al
test eax, eax
je 0x42bd5f
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bd5f
test al, 0x10
jne 0x42bd71
push 1
push 0x605c84
lea ecx, [ebp - 0x230]
call fcn.00404c00
push 1
push 0
push esi
lea ecx, [ebp - 0x230]
call fcn.00426130
cmp dword [ebp - 0x21c], 0x10
jb 0x42bd98
push dword [ebp - 0x230]
call fcn.0044ffc1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577e97
mov esp, ebp
pop ebp
ret
Function at 0x42c5f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b7590
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push esi
mov byte [edi], 0
call fcn.004047d0
push 0xffffffffffffffff
lea ecx, [edi + 0x18]
mov dword [ebp - 4], 0
push 0
lea eax, [esi + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x40]
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
lea eax, [esi + 0x40]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
push 0xffffffffffffffff
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 2
push 0
lea eax, [esi + 0x58]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
push 0xffffffffffffffff
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 3
push 0
lea eax, [esi + 0x70]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
push 0xffffffffffffffff
lea ecx, [edi + 0x88]
mov byte [ebp - 4], 4
push 0
lea eax, [esi + 0x88]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
lea ecx, [edi + 0xa0]
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push 0
lea eax, [esi + 0xa0]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
push eax
call fcn.004047d0
push 0xffffffffffffffff
lea ecx, [edi + 0xb8]
mov byte [ebp - 4], 6
push 0
lea eax, [esi + 0xb8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
movzx eax, byte [esi + 0xd0]
mov byte [edi + 0xd0], al
movzx eax, byte [esi + 0xd1]
mov byte [edi + 0xd1], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4301e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
xor esi, esi
xor bl, bl
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], edx
cmp dword [ecx + 0x10], esi
je 0x430331
cmp dword [eax + 0x10], esi
je 0x430331
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00404590
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x430331
push edi
push 0x63d0b4
push eax
call fcn.00579b85
mov edi, eax
add esp, 8
test edi, edi
je 0x43031e
mov ecx, dword [ebp - 0x18]
push edi
push dword [ebp - 0x20]
push dword [ebp - 0xc]
call fcn.00404590
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x430308
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x430308
mov eax, dword [ebp - 0x10]
push 0x63d0b4
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0x18], ecx
call fcn.00579b85
mov esi, eax
add esp, 8
test esi, esi
je 0x430308
mov ecx, dword [ebp - 0x1c]
call fcn.00404590
push eax
push dword [ebp - 0x18]
push str.StringFileInfo_08lx_s
push 0x80
push esi
call fcn.0057879c
add esp, 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x430306
mov edx, dword [ebp - 0x14]
cmp byte [edx], bl
jne 0x4302ee
xor ecx, ecx
jmp 0x4302fc
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4302f3
sub ecx, ebx
push ecx
mov ecx, dword [ebp - 0x24]
push edx
call fcn.00404c00
mov bl, 1
push edi
call fcn.0044ffc1
add esp, 4
test esi, esi
je 0x43031e
push esi
call fcn.0044ffc1
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00577e97
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00577e97
mov esp, ebp
pop ebp
ret

Function at 0x430380
Capabilities:
Create directory

Disassembly:
test ecx, ecx
jne 0x430387
xor eax, eax
ret
push ebx
push edi
push ecx
call fcn.00579ed8
mov ebx, eax
add esp, 4
mov edi, ebx
lea eax, [edi + 1]
lea esp, [esp]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x4303a0
push esi
sub edi, eax
xor esi, esi
test edi, edi
jle 0x4303e4
mov al, byte [ebx + esi]
cmp al, 0x5c
je 0x4303bb
cmp al, 0x2f
jne 0x4303df
push 0
push ebx
mov byte [ebx + esi], 0
call fcn.00579f28
add esp, 8
test eax, eax
je 0x4303db
push ebx
call fcn.00579f88
add esp, 4
test eax, eax
jne 0x43040f
mov byte [ebx + esi], 0x2f
inc esi
cmp esi, edi
jl 0x4303b0
push 0
push ebx
call fcn.00579f28
mov esi, eax
add esp, 8
test esi, esi
je 0x430400
push ebx
call fcn.00579f88
add esp, 4
mov esi, eax
push ebx
call fcn.005786d4
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
pop esi
pop edi
or eax, 0xffffffff
pop ebx
ret
Function at 0x432be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b7e6f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x605d64
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.00424f80
lea eax, [ebp - 0x14]
mov dword [esi + 0x3c], 0
lea ebx, [edi + 0x10]
mov ecx, esi
push eax
mov dword [esi + 0x38], ebx
call fcn.004043b0
push eax
mov dword [ebp - 4], 2
call fcn.00405300
mov byte [ebp - 4], 1
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x432caa
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x432caa
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x18]
push 0x20
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x432ccf
mov eax, dword [esi + 0xc]
mov ecx, esi
or eax, 4
push 0
push eax
call fcn.004042f0
mov dword [ebp - 4], 3
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, ebx
call fcn.00428340
lea eax, [ebx + 4]
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [ebx + 0xc], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 0x14]
mov byte [ebx + 0x4c], 0
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov byte [ebx + 0x45], 0
mov dword [ebx + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov dword [ebx + 0x50], 0
mov eax, dword [0x64092c]
mov dword [ebx + 0x48], eax
mov eax, edi
mov dword [ebx + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4