joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d730
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
push ebx
push ebp
push esi
mov esi, 0x400
xor ebx, ebx
cmp eax, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
jbe 0x40d755
mov esi, eax
push esi
call fcn.004131d6
mov ebp, dword [esp + 0x28]
add esp, 4
test eax, eax
mov dword [ebp], eax
jne 0x40d777
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x10
ret 0xc
push edi
push esi
push 0
push eax
call fcn.00413a50
mov edx, dword [esp + 0x30]
mov edi, dword [ebp]
add esp, 0xc
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x40d82f
mov eax, dword [esp + 0x1c]
lea ecx, [eax + ebx]
cmp ecx, esi
jbe 0x40d7d6
add esi, esi
push esi
call fcn.004131d6
mov edx, dword [ebp]
push ebx
mov edi, eax
push edx
push edi
call fcn.004162d0
mov eax, dword [ebp]
push eax
call fcn.0041356e
add esp, 0x14
mov dword [ebp], edi
add edi, ebx
jmp 0x40d813
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40d849
mov eax, dword [esp + 0x18]
add edi, eax
add ebx, eax
test eax, eax
je 0x40d86b
mov ecx, dword [esp + 0x14]
push eax
call fcn.0040d1f0
cmp eax, 1
mov dword [esp + 0x10], eax
jne 0x40d863
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x24]
push 0
push 0
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x40d7a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
mov dword [edx + 0x110], eax
mov dword [esp + 0x10], 0xe
jmp 0x40d86b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x110], eax
mov dword [esp + 0x10], 0xe
jmp 0x40d86b
mov dword [esp + 0x10], 0x12
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
test eax, eax
pop edi
je 0x40d889
cmp eax, ebx
je 0x40d889
cmp dword [esp + 0xc], 1
jne 0x40d889
mov dword [esp + 0xc], 0x10
mov eax, dword [esp + 0xc]
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
add esp, 0x10
ret 0xc
Function at 0x40d8a0
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov eax, 0x186c0
call fcn.00414890
mov eax, dword [0x441384]
xor eax, esp
mov dword [esp + 0x186bc], eax
mov eax, dword [esp + 0x186cc]
push ebx
push ebp
mov ebp, dword [esp + 0x186cc]
push esi
xor esi, esi
cmp dword [esp + 0x186dc], esi
push edi
mov edi, dword [esp + 0x186d8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], esi
lea ebx, [esi + 1]
je 0x40d91b
push 2
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.0040ea00
mov ebx, eax
add esp, 0xc
cmp ebx, 1
jne 0x40dac1
lea edx, [esp + 0x10]
push edx
call fcn.0040ea60
add esp, 4
push 3
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040ef20
add esp, 0xc
cmp eax, 1
je 0x40d93a
mov ebx, 7
jmp 0x40dac1
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebp
lea edi, [esp + 0x3c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x40da0d
jmp 0x40d960
mov eax, dword [esp + 0x14]
lea edx, [eax + esi]
cmp edx, 0x186a0
jbe 0x40d9ae
test esi, esi
je 0x40d998
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
push edx
call fcn.0040ec20
add esp, 0x10
cmp eax, 1
jne 0x40da9c
mov eax, dword [esp + 0x14]
cmp eax, 0x186a0
lea edi, [esp + 0x2c]
jbe 0x40d9ac
mov eax, 0x186a0
mov dword [esp + 0x14], eax
xor esi, esi
lea ecx, [esp + 0x24]
push ecx
push eax
push edi
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40da49
mov eax, dword [esp + 0x24]
add dword [esp + 0x18], eax
add edi, eax
add esi, eax
test eax, eax
je 0x40da7b
mov ecx, dword [esp + 0x1c]
push eax
call fcn.0040d1f0
mov ebx, eax
cmp ebx, 1
jne 0x40da76
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push ebp
mov dword [esp + 0x34], 0
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x40d960
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2ee2
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 0x110], eax
jne 0x40da2b
mov ebx, 0xe
jmp 0x40da7b
cmp eax, 0x2eff
jne 0x40da39
mov ebx, 0x17
jmp 0x40da7b
xor ebx, ebx
cmp eax, 0x2f83
setne bl
lea ebx, [ebx + ebx + 0x16]
jmp 0x40da7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov edx, dword [esp + 0x1c]
mov dword [edx + 0x110], eax
jne 0x40da63
lea ebx, [eax - 0x65]
jmp 0x40da7b
sub eax, 0x2ee2
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0xe
mov ebx, eax
jmp 0x40da7b
mov ebx, 0x12
test esi, esi
je 0x40daa1
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
push edx
call fcn.0040ec20
add esp, 0x10
cmp eax, 1
je 0x40daa1
mov ebx, 8
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
test eax, eax
je 0x40dabb
cmp eax, dword [esp + 0x18]
je 0x40dabb
cmp ebx, 1
jne 0x40dabb
mov ebx, 0x10
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
lea ecx, [esp + 0x10]
push ecx
call fcn.0040ea60
mov ecx, dword [esp + 0x186d0]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00413a38
add esp, 0x186c0
ret 0x10
Function at 0x40daf0
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x410
mov eax, dword [0x441384]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x418]
push ebx
push esi
push edi
mov edi, dword [esp + 0x420]
push 2
push eax
mov ebx, ecx
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.0040ef20
mov esi, eax
add esp, 0xc
cmp esi, 1
jne 0x40dbb8
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [esp + 0x10]
push ecx
push 0x400
lea edx, [esp + 0x24]
push edx
push edi
call ebp
test eax, eax
je 0x40dbb7
lea esp, [esp]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40dbb7
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push eax
call fcn.0040ec20
mov esi, eax
add esp, 0x10
cmp esi, 1
jne 0x40dbb7
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.0040d1f0
mov esi, eax
cmp esi, 1
jne 0x40dbb2
lea edx, [esp + 0x10]
push edx
push 0x400
lea eax, [esp + 0x24]
push eax
push edi
call ebp
test eax, eax
jne 0x40db60
jmp 0x40dbb7
mov esi, 0x12
pop ebp
lea ecx, [esp + 0x10]
push ecx
call fcn.0040ea60
mov ecx, dword [esp + 0x41c]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00413a38
add esp, 0x410
ret 8

Function at 0x40dbf0
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x114
mov eax, dword [0x441384]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebp
mov ebp, dword [esp + 0x120]
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x18], 0x7530
mov dword [esp + 0x14], 0
call fcn.0040d140
add esp, 0xc
cmp eax, 1
jne 0x40dcea
mov ecx, dword [edi + 0x10c]
push ebx
push esi
push 0
push 0x4480000
push 0
push 0
push 0
mov ebx, eax
mov eax, dword [esp + 0x24]
push eax
push str.HEAD
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x40dc81
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x110], eax
lea eax, [ebx + 0xe]
jmp 0x40dce8
push 4
lea edx, [esp + 0x18]
push edx
push 6
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40dcb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x110], eax
mov ebx, 0xf
jmp 0x40dcdf
lea eax, [esp + 0x1c]
push eax
push 5
push esi
mov ecx, edi
call fcn.0040d220
test eax, eax
jne 0x40dccf
lea ebx, [eax + 0x10]
jmp 0x40dcdf
lea ecx, [esp + 0x1c]
push ecx
call fcn.00413f52
add esp, 4
mov dword [ebp], eax
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
xor ecx, esp
call fcn.00413a38
add esp, 0x114
ret 8
Function at 0x40df20
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push edi
lea eax, [esp + 0x10]
mov edi, ecx
push eax
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x14], 0x7530
mov dword [esp + 0x10], 0
call fcn.0040d140
add esp, 0xc
cmp eax, 1
jne 0x40e016
mov eax, dword [esp + 4]
mov ecx, dword [edi + 0x10c]
push esi
push 0
push 0x4480000
push 0
push 0
push 0
push eax
push 0x43a914
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x40df98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x110], eax
lea eax, [esi + 0xf]
pop esi
pop edi
add esp, 8
ret 0xc
push ebx
push 4
lea edx, [esp + 0x14]
push edx
push 6
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40dfdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [edi + 0x110], eax
mov ebx, 0xf
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
pop ebx
pop esi
pop edi
add esp, 8
ret 0xc
push esi
mov ecx, edi
call fcn.0040d5a0
mov ebx, eax
cmp ebx, 1
jne 0x40e00b
cmp dword [esp + 0x20], 0
jne 0x40dffc
mov eax, dword [esp + 0x1c]
push eax
jmp 0x40e001
mov ecx, dword [esp + 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.0040daf0
mov ebx, eax
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
pop ebx
pop esi
pop edi
add esp, 8
ret 0xc
Function at 0x40e0f0
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x11c
mov eax, dword [0x441384]
xor eax, esp
mov dword [esp + 0x118], eax
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x120]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x128]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edx
push ecx
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x18], 0x7530
mov dword [esp + 0x10], 0
call fcn.0040d140
add esp, 0xc
cmp eax, 1
jne 0x40e295
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 0x10c]
push edi
push 0
push 0x4480000
push 0
push 0
push 0
push eax
push 0x43a914
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
jne 0x40e18f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x110], eax
lea eax, [edi + 0xf]
jmp 0x40e294
mov ecx, dword [esp + 0x134]
test ecx, ecx
mov eax, dword [esp + 0x138]
jne 0x40e219
test eax, eax
je 0x40e1e2
push eax
push ecx
push str.Range:_bytes_d__d
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.00413e53
add esp, 0x14
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e1c5
push 0xa0000000
sub eax, edx
push eax
lea ecx, [esp + 0x24]
push ecx
push edi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
push esi
push 4
lea edx, [esp + 0x18]
push edx
push 6
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40e237
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x110], eax
mov esi, 0xf
jmp 0x40e28a
test eax, eax
jne 0x40e1a5
push ecx
push str.Range:_bytes_d_
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.00413e53
add esp, 0x10
jmp 0x40e1be
push edi
mov ecx, ebp
call fcn.0040d5a0
mov esi, eax
cmp esi, 1
jne 0x40e28a
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, ebp
mov dword [esp + 0x18], 0
call fcn.0040d730
mov esi, eax
cmp esi, 1
je 0x40e280
mov edx, dword [esp + 0xc]
push edx
call fcn.0041356e
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [eax], 0
jmp 0x40e28a
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop esi
pop edi
mov ecx, dword [esp + 0x11c]
pop ebp
xor ecx, esp
call fcn.00413a38
add esp, 0x11c
ret 0x14
Function at 0x40e2b0
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x118
mov eax, dword [0x441384]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x11c]
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x12c]
push ebp
mov ebp, dword [esp + 0x128]
lea edx, [esp + 0x14]
mov dword [esp + 0xc], ecx
push edx
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x1c], 0x7530
mov dword [esp + 0x14], 0
call fcn.0040d140
add esp, 0xc
cmp eax, 1
jne 0x40e426
mov edx, dword [esp + 8]
mov eax, dword [ebx + 0x10c]
push edi
push 0
push 0x4480000
push 0
push 0
push 0
push edx
push 0x43a914
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
jne 0x40e34c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x110], eax
lea eax, [edi + 0xf]
jmp 0x40e425
mov ecx, dword [esp + 0x138]
test ecx, ecx
mov eax, dword [esp + 0x13c]
jne 0x40e3d6
test eax, eax
je 0x40e39f
push eax
push ecx
push str.Range:_bytes_d__d
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.00413e53
add esp, 0x14
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40e382
push 0xa0000000
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
push esi
push 4
lea ecx, [esp + 0x1c]
push ecx
push 6
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40e3f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x110], eax
mov esi, 0xf
jmp 0x40e41b
test eax, eax
jne 0x40e362
push ecx
push str.Range:_bytes_d_
lea ecx, [esp + 0x24]
push 0x104
push ecx
call fcn.00413e53
add esp, 0x10
jmp 0x40e37b
push edi
mov ecx, ebx
call fcn.0040d5a0
mov esi, eax
cmp esi, 1
jne 0x40e41b
mov edx, dword [esp + 0x134]
mov eax, dword [esp + 0x14]
push edx
push eax
push ebp
push edi
mov ecx, ebx
call fcn.0040d8a0
mov esi, eax
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop esi
pop edi
mov ecx, dword [esp + 0x11c]
pop ebp
pop ebx
xor ecx, esp
call fcn.00413a38
add esp, 0x118
ret 0x18

Function at 0x40ea90
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 1
mov dword [esi], 0
jne 0x40eab1
pop edi
mov eax, 2
pop esi
ret
cmp eax, 0xffffffff
jne 0x40eabe
pop edi
mov eax, 5
pop esi
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40ead2
mov edi, 7
mov eax, edi
pop edi
pop esi
ret

Function at 0x40eae0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, 1
jne 0x40eaf5
mov eax, 2
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40eb10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40eb10
mov esi, 2
mov eax, esi
pop esi
ret
Function at 0x40ebd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, 1
jne 0x40ebe5
mov eax, 2
pop esi
ret
mov edx, dword [esp + 0xc]
test edx, edx
je 0x40ebde
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40ebde
cmp eax, 0xffffffff
jne 0x40ec01
mov eax, 7
pop esi
ret
push edi
mov edi, dword [esp + 0x18]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x40ec1c
mov esi, 2
mov eax, esi
pop esi
ret

Function at 0x40ec20
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, 1
jne 0x40ec35
mov eax, 2
pop esi
ret
mov edx, dword [esp + 0xc]
test edx, edx
je 0x40ec2e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40ec2e
cmp eax, 0xffffffff
jne 0x40ec51
mov eax, 7
pop esi
ret
push edi
mov edi, dword [esp + 0x18]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
jne 0x40ec6c
mov esi, 2
mov eax, esi
pop esi
ret
Function at 0x40ecb0
Capabilities:
Get file version info
Identify system language via api

Disassembly:
sub esp, 0x218
mov eax, dword [0x441384]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x220]
push ebx
push ebp
mov ebp, dword [esp + 0x224]
xor ebx, ebx
push 0x1ff
lea ecx, [esp + 0x21]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
call fcn.00413a50
add esp, 0xc
cmp ebp, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
jne 0x40ed23
pop ebp
lea eax, [ebx + 2]
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00413a38
add esp, 0x218
ret
push esi
lea edx, [esp + 0x18]
push edx
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x40ed52
pop esi
pop ebp
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00413a38
add esp, 0x218
ret
push edi
push esi
call fcn.00413504
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x40ed6f
mov dword [esp + 0x10], 2
jmp 0x40ee48
push esi
push ebx
push edi
call fcn.00413a50
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push esi
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ed98
mov dword [esp + 0x10], 2
jmp 0x40ee48
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40edf1
cmp dword [esp + 0x18], 4
jne 0x40edf1
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
push ecx
mov edx, eax
shr edx, 0x18
push edx
movzx ecx, al
push ecx
movzx edx, ah
push edx
push str.StringFileInfo_02X_02X_02X_02XFileVersion
lea eax, [esp + 0x38]
push 0x200
push eax
call fcn.00413e53
add esp, 0x1c
jmp 0x40ee12
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
push ecx
push str.StringFileInfo_04X04B0FileVersion
lea edx, [esp + 0x2c]
push 0x200
push edx
call fcn.00413e53
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40ee35
mov dword [esp + 0x10], 2
jmp 0x40ee48
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
push eax
push esi
push ecx
call fcn.00413573
add esp, 0xc
cmp edi, ebx
je 0x40ee55
push edi
call fcn.004135d8
add esp, 4
mov ecx, dword [esp + 0x224]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413a38
add esp, 0x218
ret
Function at 0x40ef20
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov dword [esp + 8], 0
mov ebx, 1
jne 0x40ef3f
pop edi
lea eax, [ebx + 1]
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, ebp
sub eax, 1
je 0x40ef72
sub eax, 1
je 0x40ef66
sub eax, 1
je 0x40ef5f
pop ebp
pop edi
mov eax, 5
pop ebx
pop ecx
ret
mov eax, 0x40000000
jmp 0x40ef77
mov eax, 0x40000000
mov ecx, 2
jmp 0x40ef7c
mov eax, 0x80000000
mov ecx, 3
push esi
push 0
push 0x80
push ecx
push 0
push 3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x40efaf
push 2
push edi
push esi
call fcn.0040ea00
mov ebx, eax
add esp, 0xc
cmp ebx, 1
jne 0x40eff2
cmp ebp, 3
jne 0x40eff2
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40efda
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
lea eax, [ebp + 4]
pop ebp
pop edi
pop ebx
pop ecx
ret
mov edx, dword [esi]
push 0
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40eff2
mov ebx, 7
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x4111d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00410eb0
push 0
push 0
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41120a
xor eax, eax
jmp 0x411327
push 2
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
add eax, 4
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x320], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x320], 0
jne 0x411258
xor eax, eax
jmp 0x411327
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x324], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x324], 0
jne 0x41128c
mov ecx, dword [ebp - 0x10]
call fcn.00410eb0
xor eax, eax
jmp 0x411327
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x324]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x32c], 4
mov edx, dword [ebp - 8]
add edx, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x328], edx
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x328]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x324]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
call fcn.00411a10
test eax, eax
jne 0x411312
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x10]
call fcn.00410eb0
xor eax, eax
jmp 0x411327
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x413a38
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441384]
jne 0x413a42
repz ret
jmp fcn.0041842c
Function at 0x41d4e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x441c30]
je 0x41d4fb
inc edi
cmp edi, 0x17
jb 0x41d4ec
cmp edi, 0x17
jae 0x41d67b
push ebp
push 3
call fcn.00430b14
cmp eax, 1
pop ecx
je 0x41d647
push 3
call fcn.00430b14
test eax, eax
pop ecx
jne 0x41d52f
cmp dword [0x441420], 1
je 0x41d647
cmp ebx, 0xfc
je 0x41d67a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x46bc70
push ebp
call fcn.00413573
add esp, 0xc
test eax, eax
je 0x41d565
push esi
push esi
push esi
push esi
push esi
call fcn.00414015
add esp, 0x14
push 0x104
mov esi, 0x46bc89
push esi
push 0
mov byte [0x46bd8d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41d5a9
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00413573
add esp, 0xc
test eax, eax
je 0x41d5a9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00414015
add esp, 0x14
push esi
call fcn.00413460
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41d5ee
push esi
call fcn.00413460
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x46bf84
push 0x43b38c
sub ecx, eax
push ecx
push eax
call fcn.00425de6
add esp, 0x14
test eax, eax
je 0x41d5ee
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00414015
add esp, 0x14
jmp 0x41d5f0
xor esi, esi
push 0x43b388
push ebx
push ebp
call fcn.004148bb
add esp, 0xc
test eax, eax
je 0x41d610
push esi
push esi
push esi
push esi
push esi
call fcn.00414015
add esp, 0x14
push dword [edi*8 + 0x441c34]
push ebx
push ebp
call fcn.004148bb
add esp, 0xc
test eax, eax
je 0x41d632
push esi
push esi
push esi
push esi
push esi
call fcn.00414015
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00430957
add esp, 0xc
jmp 0x41d67a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x41d67a
cmp ebp, 0xffffffff
je 0x41d67a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x441c34]
push dword [esi]
call fcn.00413460
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret