joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x14], ecx
mov ecx, 0x46b036
call fcn.0040c830
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x401885
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
call fcn.0040c810
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 2], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 2], 0
jne 0x4018ca
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040eaf0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [ebp - 3], dl
add dword [ebp - 0x10], 1
cmp byte [ebp - 3], 0
jne 0x40190c
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401983
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0040c7f0
add esp, 4
push 0x402a20
push 0x402a20
push 0x44c4fc
push 0x469060
call fcn.00401bc0
add esp, 8
mov ecx, eax
call fcn.00404200
mov ecx, eax
call fcn.00404200
jmp 0x4019ba
push 0x402a20
push 0x402a20
mov edx, dword [ebp - 0x18]
push edx
push 0x44c510
push 0x469060
call fcn.00401bc0
add esp, 8
push eax
call fcn.00401bc0
add esp, 8
mov ecx, eax
call fcn.00404200
mov ecx, eax
call fcn.00404200
mov esp, ebp
pop ebp
ret

Function at 0x411f10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00411b30
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411f42
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44c168]
call dword [ebp - 8]
jmp 0x411f4c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x42b64a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x44b280
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x469624], 1
jge 0x44b2ef
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x44b2c5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x44b2c5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x44b2a2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x44b2db
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x44b2e2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x44b3df
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x44b3b0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x44b3a5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x44b399
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x44b3a0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x44b3df
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x44b3da
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x44b3c3
mov eax, dword [ebx + 8]
jmp 0x44b3df
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x44b3d1
xor eax, eax
jmp 0x44b3df
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x44b30f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x402bd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x18]
push 0x3c
call fcn.0045b99a
add esp, 4
mov dword [ebp - 0x1c], eax
sub esp, 0x14
mov esi, esp
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [esi + 4], eax
mov edi, dword [ebx]
mov dword [ebx], eax
cmp edi, 0xffffffff
je 0x402c1f
test edi, edi
je 0x402c3e
call fcn.00449c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea eax, [edi + 1]
cmp eax, 2
jb 0x402c37
mov dword [esi + 4], edi
call fcn.00449c40
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ecx]
mov dword [ecx], eax
cmp edi, 0xffffffff
je 0x402c5a
test edi, edi
je 0x402c7b
call fcn.00449c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea eax, [edi + 1]
cmp eax, 2
jb 0x402c71
mov dword [esi], edi
call fcn.00449c40
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edx
mov edi, dword [ebp - 0x1c]
mov ecx, edi
call fcn.00410610
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4039d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4a538c]
mov ecx, dword [0x4a6954]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403a1d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, 0x4a5388
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4a538c
call fcn.0045bd5c
add esp, 4
cmp dword [0x4a538c], 0xffffffff
jne 0x403a03
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.0045d780
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x78
call fcn.0045b99a
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x4a53dc]
mov ecx, dword [0x4a6954]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403ac6
mov ecx, esi
push ebx
push 0x4a53b8
push edi
call fcn.00403b30
mov dword [0x4a5388], esi
push 0x4a538c
call fcn.0045bd12
add esp, 4
jmp 0x403a03
push 0x4a53dc
call fcn.0045bd5c
add esp, 4
cmp dword [0x4a53dc], 0xffffffff
jne 0x403aa0
xorps xmm0, xmm0
movups xmmword [0x4a53c8], xmm0
movups xmmword [0x4a53b8], xmm0
mov dword [0x4a53d8], 0
push 0x4a53b8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4a53dc
call fcn.0045bd12
add esp, 4
jmp 0x403aa0
Function at 0x40f6f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x40f7c9
cmp dword [esi], 0
jne 0x40f7c9
cmp dword [esi + 0xc], 0
jne 0x40f7c9
xor eax, eax
cmp dword [esi + 4], 0
jne 0x40f7c9
mov ebx, dword [edi]
cmp eax, ebx
je 0x40f753
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x40f799
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40f749
mov dword [esi], ebx
call fcn.00449c40
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x40f786
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x40f7b0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40f77c
mov dword [esi + 4], ebx
call fcn.00449c40
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00449c40
push dword [esi]
call fcn.00449c50
add esp, 4
mov dword [esi], 0
jmp 0x40f73a
call fcn.00449c40
push dword [esi + 4]
call fcn.00449c50
add esp, 4
mov dword [esi + 4], 0
jmp 0x40f76c
mov ecx, esi
call fcn.0047edc0
mov eax, dword [esi]
jmp 0x40f724

Function at 0x40f8f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x40f9a4
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x40f9a8
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x40f96e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x40f987
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x40f967
mov dword [esi], ebx
mov esi, eax
call fcn.00449c40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], eax
call fcn.00449c40
push dword [esi]
call fcn.00449c50
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
jmp 0x40f954
mov bl, 1
jmp 0x40f973
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40f967

Function at 0x4101e0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
pop ebp
ret 4
Function at 0x410610
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
call fcn.0040f6c0
xor eax, eax
mov dword [esi + 0x10], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x410636
call fcn.00449c40
cmp dword [esi + 0x10], edi
je 0x410666
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x10]
inc ecx
cmp ecx, 2
jae 0x410724
cmp ebx, 2
jb 0x41065f
mov dword [esi + 0x10], edi
mov edi, eax
call fcn.00449c40
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [esi + 0x14], eax
lea ecx, [ebp + 8]
mov edi, dword [ecx]
mov dword [ecx], eax
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x41067f
call fcn.00449c40
cmp dword [esi + 0x14], edi
je 0x4106af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x14]
inc ecx
cmp ecx, 2
jae 0x410746
cmp ebx, 2
jb 0x4106a8
mov dword [esi + 0x14], edi
mov edi, eax
call fcn.00449c40
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [esi + 0x18], eax
lea edi, [ebp + 8]
mov ecx, dword [edi + 8]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x30]
push dword [edi + 0x10]
push eax
call fcn.00424bf0
add esp, 8
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x4106f8
call fcn.00449c40
push dword [edi]
call fcn.00449c50
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
inc eax
cmp eax, 2
jb 0x410718
call fcn.00449c40
push dword [edi + 4]
call fcn.00449c50
add esp, 4
mov dword [edi + 4], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov dword [ebp - 0x10], eax
call fcn.00449c40
push dword [esi + 0x10]
call fcn.00449c50
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi + 0x10], 0
jmp 0x41064e
mov dword [ebp - 0x10], eax
call fcn.00449c40
push dword [esi + 0x14]
call fcn.00449c50
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi + 0x14], 0
jmp 0x410697
Function at 0x410770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
call fcn.0040f880
test al, al
je 0x410795
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test edi, edi
je 0x4107b3
mov ecx, edi
call fcn.00424d10
push edi
call fcn.0045c216
add esp, 4
mov edi, dword [esi + 0x30]
test edi, edi
je 0x410809
mov ebx, dword [esi + 0x34]
cmp edi, ebx
je 0x4107d2
mov ecx, edi
call fcn.0040fe90
add edi, 0xc
cmp edi, ebx
jne 0x4107c1
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
sub eax, edi
cmp eax, 0x1000
jb 0x4107f4
mov ecx, dword [edi - 4]
sub edi, ecx
add edi, 0xfffffffc
cmp edi, 0x20
jae 0x41089b
add eax, 0x23
mov edi, ecx
push eax
push edi
call fcn.0045b9ca
add esp, 8
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x410819
push eax
call fcn.00464d8e
add esp, 4
mov edi, dword [esi + 0x20]
test edi, edi
je 0x410830
mov ecx, edi
call fcn.00424d10
push edi
call fcn.0045c216
add esp, 4
mov eax, dword [esi + 0x18]
inc eax
cmp eax, 2
jb 0x410850
call fcn.00449c40
push dword [esi + 0x18]
call fcn.00449c50
add esp, 4
mov dword [esi + 0x18], 0
mov eax, dword [esi + 0x14]
inc eax
cmp eax, 2
jb 0x410870
call fcn.00449c40
push dword [esi + 0x14]
call fcn.00449c50
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x10]
inc eax
cmp eax, 2
jb 0x410890
call fcn.00449c40
push dword [esi + 0x10]
call fcn.00449c50
add esp, 4
mov dword [esi + 0x10], 0
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0040f7e0
call fcn.00460d04
Function at 0x4126d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412743
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x41272d
cmp dword [ebp - 0x18], 4
jne 0x41272d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x41272d

Function at 0x412750
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.0045c230
mov esi, ecx
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.0045d780
add esp, 0xc
lea eax, [ebp - 0x1018]
mov dword [eax], 1
lea ecx, [ebp - 0x101c]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x4128a4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1018]
cmp eax, 2
je 0x4127f3
mov edi, 0x3f4
cmp eax, 1
jne 0x4128a4
lea esi, [ebp - 0x810]
push esi
call fcn.00464f10
add esp, 4
mov edi, eax
mov eax, dword [ebx + 0x14]
cmp eax, edi
jae 0x412865
sub esp, 0xc
mov al, byte [ebp - 0x1010]
jmp 0x412851
lea esi, [ebp - 0x1010]
push 0x800
push 0xff
push esi
call fcn.0045d780
add esp, 0xc
push 0x400
push esi
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x101c], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x4128a4
push esi
call fcn.00464f10
add esp, 4
mov edi, eax
mov eax, dword [ebx + 0x14]
cmp eax, edi
jae 0x41287f
sub esp, 0xc
mov al, byte [ebp - 0x1014]
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp], edi
mov ecx, ebx
call fcn.004062b0
jmp 0x4128a2
mov esi, ebx
cmp eax, 8
jb 0x41286e
mov esi, dword [ebx]
mov dword [ebx + 0x10], edi
mov eax, edi
add eax, edi
push eax
lea eax, [ebp - 0x810]
push eax
jmp 0x412893
mov ecx, esi
mov esi, ebx
cmp eax, 8
jb 0x41288a
mov esi, dword [ebx]
mov dword [ebx + 0x10], edi
mov eax, edi
add eax, edi
push eax
push ecx
push esi
call fcn.0045d200
add esp, 0xc
mov word [esi + edi*2], 0
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x413c40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0xc]
push 0x4c
push str..._.._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.00449c10
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.0044a950
mov dword [esp + 8], 0xffffffff
cmp dword [ebx + 0x14], 8
jb 0x413ca8
mov ebx, dword [ebx]
lea eax, [esp + 8]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x413ce9
js 0x413e0d
mov edi, eax
mov esi, ebx
cmp eax, 0x1000
jb 0x413cf7
lea eax, [edi + 0x23]
push eax
call fcn.0045b99a
add esp, 4
test eax, eax
je 0x413e12
mov ebx, eax
add ebx, 0x23
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x413d02
mov eax, dword [ebp + 8]
mov dword [eax], 0
jmp 0x413dee
push edi
call fcn.0045b99a
add esp, 4
mov ebx, eax
push edi
push 0
push ebx
call fcn.0045d780
add esp, 0xc
push ebx
push edi
push dword [esp + 0x10]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x413dbd
mov dword [esp + 0xc], 0
lea esi, [esp + 0x1c]
mov dword [esi], 0xffffffff
push esi
lea eax, [esp + 0x10]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x413dbd
mov eax, dword [esp + 0xc]
test eax, eax
je 0x413dbd
add edi, ebx
push 0x1c
mov dword [esp + 8], eax
call fcn.0045b99a
add esp, 4
mov ecx, esi
mov esi, eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esi], 0x48b080
movd xmm0, edi
movd xmm1, ebx
punpckldq xmm1, xmm0
pshufd xmm0, xmm1, 0x14
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 0xffffffff
push ecx
lea eax, [esp + 0x10]
push eax
push 0x48b276
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x413e17
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x413dee
mov eax, dword [ebp + 8]
mov dword [eax], 0
test ebx, ebx
je 0x413dee
cmp edi, 0x1000
jb 0x413de4
mov eax, dword [ebx - 4]
add ebx, 0xfffffffc
sub ebx, eax
cmp ebx, 0x20
jae 0x413e12
add edi, 0x23
mov ebx, eax
push edi
push ebx
call fcn.0045b9ca
add esp, 8
lea ecx, [esp + 0x20]
call fcn.0044a9b0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0045be32
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004103b0
call fcn.00460d04
int3
Function at 0x414610
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x38], 0
jne 0x4146f5
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
test ebx, ebx
jne 0x4146fc
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41471a
mov ebx, dword [ebp - 0x20]
cmp dword [esi + 0x24], ebx
je 0x414694
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x4146dc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x41468a
mov dword [esi + 0x24], ebx
call fcn.00449c40
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi + 0x24]
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi], eax
push ebx
push edi
call fcn.00425520
add esp, 8
cmp byte [edi], 0
je 0x414724
lea ecx, [esi + 0x28]
push edi
call fcn.00414740
mov byte [esi + 0x38], 1
xor esi, esi
cmp byte [ebp - 0x1c], 0
jne 0x41472b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00449c40
push dword [esi + 0x24]
call fcn.00449c50
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x41467a
mov esi, 0x4df
jmp 0x4146c6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
lea edx, [ebp - 0x20]
push 2
push ecx
push ecx
push edx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x414659
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4146c6
mov esi, 0x3f0
jmp 0x4146c6
lea ecx, [ebp - 0x18]
call fcn.0041a8f0
jmp 0x4146c6
Function at 0x414c10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x4a3ecc]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x38], 0
je 0x414d03
lea eax, [ebp - 0x14]
mov dword [eax], 0
mov dword [esp], eax
call fcn.004147c0
sub esp, 4
test eax, eax
jne 0x414d0a
lea eax, [ebp - 0x18]
mov dword [eax], 0xffffffff
mov ebx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x48a580]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
sub esp, 0x18
test eax, eax
je 0x414d11
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
xor esi, esi
cmp dword [eax], edi
je 0x414cb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
inc edx
cmp edx, 2
jae 0x414ce0
lea edx, [edi + 1]
cmp edx, 2
jb 0x414ca9
mov dword [ecx], edi
mov edi, eax
call fcn.00449c40
mov eax, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
lea eax, [ebx + 1]
cmp eax, 2
jb 0x414cca
call fcn.00449c40
mov dword [esp], ebx
call fcn.00449c50
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be32
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x1c], eax
call fcn.00449c40
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00449c50
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
jmp 0x414c96
mov esi, 0x3f0
jmp 0x414cca
mov esi, eax
mov ebx, dword [ebp - 0x14]
jmp 0x414cb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x414cb5