joyce8/EMBER2024-capa huggingface dataset:
Function at 0x89a619
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x89a439
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
mov ax, 0x8b3
clc
jmp 0x89a484
not al
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
xor edx, dword [edi - 0x3e]
cli
not ah
jmp 0x89a41c
mov dl, bl
mov ah, bl
not eax
mov al, 7
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
mov ax, 0x3652
jmp 0x89a3f2
not dl
lea eax, [eax*4]
neg al
jg 0x89a460
jle 0x89a44a
mov dh, 0x35
movsd dword es:[edi], dword [esi]
int3
sub bl, cl
setnp ah
mov edx, 0x2de2a36c
mov eax, 0x476d1169
jmp 0x89a408
neg ah
jmp 0x89a462
neg ah
call 0x89a468
jno 0x89a3f6
and al, 4
dec dl
rcl ah, cl
jb 0x89a4e9
mov ah, dl
mov ax, cx
not ax
cmc
cmc
jmp 0x89a490
jae 0x89a3b9
bswap eax
jmp 0x89a439
cmc
cmc
push esp
jmp 0x89a4cc
lea esp, [esp + 4]
inc dl
btc ax, dx
jg 0x89a4b6
jle 0x89a5a2
dec ecx
int3
mov ah, dl
mov ax, cx
not ax
jmp 0x89a48e
lea eax, [edi*4]
pushfd
mov dword [esp], ebx
cmp al, bh
jmp 0x89a51e
ror dl, 0
mov ah, dh
xchg ah, al
bswap eax
jmp 0x89a493
jmp 0x89a4ac
pop word [esp]
call fcn.0089a501
jae 0x89a53d
mov eax, 0x968f5afc
jmp 0x89a542
mov eax, 0x968f5afc
sub cl, dl
not edx
jmp 0x89a54c
add dx, sp
jno 0x89a582
pushfd
xchg edx, eax
jmp 0x89a56c
cmp al, bh
pop word [esp]
jmp 0x89a522
inc esi
mov al, byte [esp]
mov dl, byte [esp]
lea eax, [ecx*4]
jmp 0x89a587
pushfd
xchg edx, eax
jmp 0x89a56c
mov dx, 0x6bd2
not ax
mov ax, word [esp]
xchg edx, eax
lea edx, [ebx + edi]
jmp 0x89a5c5
in al, 0xef
mul cl
and byte [ebp + 0xbd04], cl
add byte [eax], al
lea eax, [edi*4]
pushfd
mov dword [esp], ebx
jmp 0x89a564
call 0x89a619
jo 0x89a59d
ja 0x89a5ca
loope 0x89a60b
mov ds, word [eax]
mov gs, ecx
sbb dl, bl
cmc
in al, 0x17
jle 0x89a60e
rol bl, 0
jne 0x89a5af
je 0x89a5af
pushfd
and al, 0x57
js 0x89a601
push word [esp + 4]
jmp 0x89a5eb
lea esp, [esp + 2]
jmp 0x89a622
mov al, byte [0xb3f632c7]
stosb byte es:[edi], al
lds esi, [esi - 1]
je 0x89a629
push word [esp + 4]
lea esp, [esp + 2]
add al, 0x8d
and al, 2
jmp 0x89a622
push ss
jg 0x89a5f9
jnp 0x89a62e
in eax, dx
pop esp
xchg edi, eax
or al, 0x82
in eax, 0x14
rcr byte [ecx], 1
rdtsc
mov dl, dh
mov dx, ax
jmp 0x89a5cc
lea esp, [esp + 8]
sub bl, 0xbb
mov ax, word [esp]
neg edx
jmp 0x89a68a
invalid
not edx
mov edx, dword [esp]
mov edx, dword [esp]
sub dx, dx
mov eax, ebx
push sp
jmp 0x89a668
mov edx, dword [esp]
sub dx, dx
mov eax, ebx
jmp 0x89a642
lea esp, [esp + 2]
rol bl, 0
je 0x89ab2d
neg eax
jmp 0x89ab2f
jo 0x89a635
not edx
mov edx, dword [esp]
jmp 0x89a65e
neg eax
call fcn.0089a706
push dword [esp + 1]
lea esp, [esp + 1]
jmp 0x89ab73
mov dword [edi], edx
mov ebx, esp
mov eax, 0xfaf53b21
jmp 0x89ab59

Function at 0x89b73d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xe
jnp 0x89b76f
lea esp, [esp + 2]
jmp 0x89b77d
lea esp, [esp + 2]
lea esp, [esp + 0x14]
jmp 0x89b7b2
lea esp, [esp + 0x14]
sub esp, 0x1a
lea esp, [esp + 0x12]
jmp 0x89b7b9
sub esp, 0x1a
lea esp, [esp + 0x12]
mov esp, ebx
jmp 0x89b799

Function at 0x89bc87
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
xchg dh, al
mov ax, word [esp + 2]
lea eax, [eax + edx]
mov eax, 0xe390307d
jmp 0x89bc2e
Function at 0x8bc306
Capabilities:
Encode data using xor

Disassembly:
rcr ax, cl
jmp 0x8bc324
xchg esi, eax
push dword [ebp + 8]
call fcn.008a91d4
bsr ecx, edi
inc eax
mov ch, byte [esp]
jmp 0x8bc2d7
lea esp, [esp + 0x10]
jmp 0x8bc2ed
pop ecx
push ax
mov ecx, esi
bts ecx, ebp
lea esp, [esp + 2]
jmp 0x8bc3d2
mov eax, dword [ebx]
mov ch, 0xaf
bswap ecx
mov cx, ax
jmp 0x8bc30c
mov dword [ecx], eax
pop ecx
not eax
jmp 0x8bc34c
cmp eax, ecx
push ecx
mov ecx, esi
jmp 0x8bc32f
mov eax, dword [ebp - 0x18]
call 0x8bc38e
cmp al, byte [eax]
add byte [eax], al
xor byte [edi + 0x6a95a3f], ch
pop esi
rcl byte [esi + 0x31], 0xc0
add ah, al
jge 0x8bc350
je 0x8bc2ec
xor esp, ecx
pushal
add esp, 0xb
push word [esp + 2]
lea esp, [esp + 3]
add eax, ecx
jmp 0x8bc345
pop ecx
mov ch, cl
mov ecx, dword [ebp - 8]
stc
jmp 0x8bc367

Function at 0x8bf053
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
mov bx, 0xece1
mov bh, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x8bf091
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
mov bp, ax
lea ebp, [edx*4]
bswap ebp
setae bh
jmp 0x8bf07b

Function at 0x8bf369
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop dword [esp]
and edx, esi
jmp 0x8bfae4
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
call fcn.008bf77c

Function at 0x8bf49b
Capabilities:
Encrypt data using aes

Disassembly:
call 0x8bf4da
lea esp, [esp + 0x38]
cmp ebx, 0x8991fc
pushfd
jmp 0x8bf4c4
lea esp, [esp + 4]
jne 0x88c6c2
je 0x8bf4e3
add eax, 0xa455329c
adc eax, 0x422b8869
pushfd
push di
lea esp, [esp + 2]
jmp 0x8bf4a0
push 0xa
push dx
lea esp, [esp + 2]
pop eax
jmp 0x8bf6f3
pushfd
lea esp, [esp + 4]
pop ebx
ret
not ebp
lea ebx, [ecx + ebp]
xchg bx, bp
not bl
pop ebp
jmp 0x8bf5be
lea esi, [ebx + edi]
mov bx, cx
pop edi
pop esi
jmp 0x8bf661

Function at 0x8bf4da
Capabilities:
Encrypt data using aes

Disassembly:
call 0x8bf4da
lea esp, [esp + 0x38]
cmp ebx, 0x8991fc
pushfd
jmp 0x8bf4c4
lea esp, [esp + 4]
jne 0x88c6c2
je 0x8bf4e3
add eax, 0xa455329c
adc eax, 0x422b8869
pushfd
push di
lea esp, [esp + 2]
jmp 0x8bf4a0
push 0xa
push dx
lea esp, [esp + 2]
pop eax
jmp 0x8bf6f3
pushfd
lea esp, [esp + 4]
pop ebx
ret
not ebp
lea ebx, [ecx + ebp]
xchg bx, bp
not bl
pop ebp
jmp 0x8bf5be
lea esi, [ebx + edi]
mov bx, cx
pop edi
pop esi
jmp 0x8bf661
Function at 0x8bf77c
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, ebx
jmp 0x8bf3c6
stc
lea edx, [ebp - 0x39]
ror dh, cl
xor ecx, dword [eax]
btc dx, sp
jmp 0x8bf38c
mov dword [edi], ecx
sub esp, 8
jmp 0x8bf3fa
add ebx, 4
ror dl, 1
bswap edx
sub esp, 0xa
pop dx
jmp 0x8bf3b0
xor edx, ecx
mov cx, word [esp]
push ebp
jmp 0x8bf425
dec cx
mov dword [esp], edi
mov cx, 0x50c
jmp 0x8bf40f
mov edx, dword [eax + 4]
sub esp, 6
mov byte [esp + 2], bh
mov word [esp + 3], bx
lea esp, [esp + 2]
jmp 0x8bf3d4
mov ecx, dword [eax + 8]
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x8bf46f
mov ebp, eax
add ebp, 0x14
mov dword [ebp], edx
pop ebp
push ebp
jmp 0x8bf3dd
xor ecx, dword [ebx]
btc edx, esi
mov di, 0x2ab
mov di, 0xd298
lea edi, [eax + 0x10]
jmp 0x8bf3a2
mov dword [eax + 0x18], ecx
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x8bf4b7
xor ecx, edx
mov dh, 0xd
jmp 0x8bf459
and edx, ebp
xor ecx, edx
lea esp, [esp + 0x24]
jmp 0x8bf444
push esp
mov dword [eax + 0x1c], edx
call fcn.008bf49b
shr al, 0x3a
call 0x8bf4da
lea esp, [esp + 0x38]
cmp ebx, 0x8991fc
mov edx, dword [eax + 0xc]
push si
lea esp, [esp + 2]
xor edx, ecx
jmp 0x8bf491
movzx edi, byte [edi*4 + 0x8979d4]
xor ecx, edi
mov di, 0xf037
clc
jmp 0x8bf487
mov byte [esp + 1], al
shr edi, 0x18
stc
jmp 0x8bf501

Function at 0x8bfaf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov bl, bh
jmp 0x8bfb83
mov byte [esp], bl
pushfd
lea esp, [esp + 2]
jmp 0x8bfb56
lea esp, [esp + 3]
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
and edx, ecx
push sp
jmp 0x8bfb18
mov edx, dword [esi + 0xc]
jmp 0x8bfb69
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
xchg dl, dh
mov dx, 0x8c68
jmp 0x8bfb3f
mov dword [esi + 8], edi
bts di, ax
lea edi, [edi + ebp]
mov di, bx
jmp 0x8bfb8f
movzx ebx, byte [esi + 0xd]
and edx, ecx
cmc
sub esp, 7
jmp 0x8bfb2e
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
not di
mov edi, edx
jmp 0x8bfce8
mov eax, edi
lea eax, [eax*4]
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
mov edi, dword [eax]
pop eax
jmp 0x8bfc73
and ebx, ecx
call fcn.008bfbc9
mov eax, esi
add eax, 0xe
movzx ebx, byte [eax]
pop eax
jmp 0x8bfc2e
and edx, ecx
jmp 0x8bfc18
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
push ebx
jmp 0x8bfc5c
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
sub esp, 0xb
mov byte [esp + 6], dl
lea esp, [esp + 2]
lea esp, [esp + 1]
jmp 0x8bfbf1
and ebx, ecx
cmc
call fcn.008bfc46
cmp dh, byte [esi + 0xcbe4324]
sub byte [ebx + 0x19ad5e3b], ch
dec esi
fnstcw word [eax]
and edi, ecx
clc
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x8bfbdf
shr edi, 0x18
push si
lea esp, [esp + 2]
push eax
jmp 0x8bfba0

Function at 0x8bfbc9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 1], al
jmp 0x8bfc07
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
mov bx, ax
push eax
jmp 0x8bfbe6
Function at 0x8bfc46
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x8bfc98
and edx, ecx
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
call fcn.008bfc82
lea esp, [esp + 8]
jne 0x88cd89
je 0x88cd5d
inc ecx
ret

Function at 0x8bfc82
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jmp 0x8bfcbc
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
pushal
lea esp, [esp + 0x16]
lea esp, [esp + 2]
jmp 0x8bfca6

Function at 0xdd85a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp]
sub esp, 0x1a
bsr edx, esp
mov word [esp + 2], cx
xchg cx, bx
jmp 0xdd8241
xchg byte [esp + 7], ch
mov esi, ebp
call fcn.00dd81ba
jmp 0xdd81e5
jmp 0xdd8580
mov byte [esp + 1], al
rdtsc
rdtsc
bswap ecx
sub esp, 0x1d
pop esi
jmp 0xdd81d0
cmc
xchg dword [esp + 0xe], ebx
bswap ebp
lea esp, [esp + 0xb]
lea esp, [esp + 0xc]
mov ebp, dword [esp]
jmp 0xdd81ec
call 0xdd85a1
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor ebp, dword cs:[esi]
aaa
xor byte cs:[eax], al
pushfd
push cx
lea esp, [esp + 2]
pushal
jmp 0xdd8192

Function at 0xdd872c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 1]
not bh
mov cl, byte [esp + 3]
push si
mov cx, dx
pop si
jmp 0xdd8703
add esp, 0xa
mov word [esp + 9], bx
rdtsc
mov ebp, dword [esp + 0x15]
pop word [esp + 0xe]
push word [esp + 8]
jmp 0xdd86b9
mov ebp, 0xaa0df397
cpuid
pop dword [esp + 0xc]
xchg byte [esp + 8], dh
jmp 0xdd8716
shl cx, cl
pop edx
rdtsc
pop word [esp + 6]
push dword [esp + 0xc]
neg esi
jmp 0xdd86ed
rol dl, 6
mov word [esp + 5], ax
cmp ecx, 0x4f01548a
jmp 0xdd874b
lea ebp, [edi*4]
jmp 0xdd86d3
lea eax, [esp + esi]
mov cl, ch
xchg byte [esp + 6], al
lea esp, [esp + 0xb]
mov ch, bl
jmp 0xdd8778
xchg cx, bp
mov edx, ebp
mov cl, byte [esp + 0x11]
mov ebp, 0xe937ddfc
xchg byte [esp + 9], ah
pop dword [esp]
jmp 0xdd8735
mov dl, byte [esp + 1]
mov word [esp], sp
btr ecx, edx
bswap ecx
jmp 0xdd878b
lea ecx, [esi + 0xc4]
xchg si, ax
mov eax, dword [esp]
mov ebx, edi
cpuid
inc ecx
jmp 0xdd8762
mov edi, 0x56ca7de0
xchg bp, dx
not edi
lea edi, [edi + edi]
not dl
neg ecx
jmp 0xdd884c
cpuid
not di
cpuid
call 0xdd87cf

Function at 0xdd87f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, dx
not esi
not si
lea eax, [edx + edx]
push dword [esp + 4]
jmp 0xdd8813
and eax, esi
mov dl, 0xff
xchg dword [esp], ebx
push ax
jmp 0xdd87dc
mov ah, 0x2e
mov edx, 0x190085df
mov cx, word [esp + 6]
jmp 0xdd8827
rdtsc
mov di, word [esp + 3]
xchg dword [esp + 0xa], ebp
shl ebx, 9
pushfd
neg ax
jmp 0xdd87fd
mov word [esp + 1], di
Function at 0xdd8bcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0xb]
mov dl, byte [esp + 0x21]
add esp, 0x1a
pop word [esp + 2]
dec al
mov dword [esp], ecx
jmp 0xdd8be7
pop di
jmp 0xdd8bb1
mov eax, 0x42a5846f
neg dl
lea ebp, [esp - 0xc1]
jmp 0xdd8c0f
push word [esp + 1]
mov bh, byte [esp]
mov edx, eax
mov ecx, esi
lea ecx, [eax + esi]
pop edx
jmp 0xdd8bd1
mov edi, 0x2dd434e3
mov edi, 0xcf6f1a17
xchg dh, cl
mov al, byte [esp]
jmp 0xdd8c3b
bsf ecx, esi
cmp cx, 0x9f6a
add esp, 3
bswap edx
mov ebp, 0xa5e47ac5
not ebx
jmp 0xdd8bf9
inc ax
neg esi
dec di
cpuid
lea eax, [edi*4]
jmp 0xdd8c52
mov dx, word [esp]
xchg dx, ax
mov ecx, dword [esp]
mov eax, dword [esp]
cmp cx, 0x9862
bts esi, edi
jmp 0xdd8c25
xchg edx, ecx
clc
bsf edx, edi
add esp, 0
dec ah
xchg ch, ah
jmp 0xdd8c9c
bsf ecx, esp
inc ax
lea ebp, [ecx + ebx]
mov dh, 0xcf
sbb edx, esp
mov byte [esp], bl
jmp 0xdd8c7f

Function at 0xdd911b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0x20]
mov si, 0x47d0
neg bh
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0xdd9126
sub esp, 0x19
lea esi, [esp + edx]
xchg word [esp + 4], bx
mov word [esp + 0x10], sp
btc cx, bx
pushfd
jmp 0xdd90e5
pop word [esp + 7]
push dword [esp + 0xb]
jmp 0xdd90fb
cmc
mov ebp, 0x232e93e5
lea esp, [esp + 9]
lea edi, [edx + ebx]
popal
stc
jmp 0xdd913b
dec dh
mov al, ch
lea esp, [esp]
sete al
pop di
xchg bp, cx
jmp 0xdd9165

Function at 0xdd9212
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
pop word [esp]
mov byte [esp], dl
lea esp, [esp + 2]
mov dword [esp], esp
jmp 0xdd9252
push cx
mov byte [esp], ch
push word [esp]
mov dword [esp], edx
mov dword [esp], edi
jmp 0xdd9263
push ebp
push bx
lea esp, [esp + 1]
lea esp, [esp]
lea esp, [esp + 1]
push esi
jmp 0xdd923c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xdd92d4
Function at 0x40177b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 2
push eax
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
xor esi, esi
mov ebx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x401808
cmp dword [ebp - 4], esi
je 0x401817
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push str.Version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401808
cmp dword [ebp - 8], esi
je 0x401808
push edi
push dword [ebp - 8]
call fcn.00425578
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push str.Version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401800
push edi
mov ecx, ebx
call fcn.0040263f
inc esi
push edi
call fcn.004250db
pop ecx
pop edi
cmp dword [ebp - 4], 0
je 0x401817
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x401cd1
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4be17b
call fcn.00425b2a
mov esi, ecx
and dword [ebp - 4], 0
lea ebx, [esi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x28]
lea ecx, [ebp + 8]
push ecx
cmp eax, dword [esi + 0x2c]
je 0x401d0e
and dword [eax + 0x10], 0
mov ecx, eax
and dword [eax + 0x14], 0
call fcn.0040274c
add dword [esi + 0x28], 0x18
jmp 0x401d17
push eax
lea ecx, [esi + 0x24]
call fcn.0040294b
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
cmp dword [esi], ecx
jne 0x401d47
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
push eax
push ecx
push esi
push 0x4020f9
push ecx
push ecx
call fcn.004a40f8
add esp, 0x18
mov dword [esi], eax
lea ecx, [ebp + 8]
call fcn.00402600
xor eax, eax
inc eax
call fcn.00425b04
ret 0x18
Function at 0x403693
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
xor esi, esi
test edi, edi
je 0x403721
push ebx
push esi
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x403720
lea eax, [ebx + 4]
push eax
call fcn.00425578
pop ecx
push eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x403720
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 0x4dc390
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x403720
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
push edi
movzx eax, word [edx + 0xa]
mov dword [ecx], eax
movzx ecx, word [edx + 8]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [edx + 0xe]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 0xc]
mov dword [eax], ecx
call fcn.004250db
pop ecx
inc esi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x403727
Capabilities:
Get file version info

Disassembly:
push 0x120
mov eax, 0x4be338
call fcn.00425b5e
mov ebx, edx
mov dword [ebp - 0x114], ebx
mov esi, ecx
mov dword [ebp - 0x11c], esi
push str.Enter
push 0x74
push str.Utility::GetVersionBlockString
xor edi, edi
mov dword [ebp - 4], edi
push str.D:_thunder11_thunder11_cppsrc_setupThunderInstallCommonThunderUtility.cpp
mov dword [ebp - 0x12c], esi
push 5
mov dword [ebp - 0x120], edi
call fcn.00403339
add esp, 0x14
mov ecx, esi
push 0x4dbf70
call fcn.00402468
mov dword [ebp - 4], edi
mov dword [ebp - 0x120], 1
test ebx, ebx
je 0x4038c2
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], edi
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x4037d0
push str.dwSize__0
push 0x83
push str.Utility::GetVersionBlockString
push str.D:_thunder11_thunder11_cppsrc_setupThunderInstallCommonThunderUtility.cpp
push 2
call fcn.00403339
add esp, 0x14
jmp 0x4038c2
push edi
call fcn.00425578
pop ecx
mov ebx, eax
push ebx
push edi
push 0
push dword [ebp - 0x114]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4038bb
and dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x128]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4038bb
xor edi, edi
test dword [ebp - 0x118], 0xfffffffc
jbe 0x4038bb
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0049d5c0
mov ecx, dword [ebp - 0x128]
and dword [ebp - 0x114], 0
and dword [ebp - 0x11c], 0
push str.SpecialBuild
movzx eax, word [ecx + edi*4 + 2]
push eax
movzx eax, word [ecx + edi*4]
push eax
push str.StringFileInfo_04x_04x_s
mov eax, 0x80
push eax
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403043
add esp, 0x28
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x4038ae
mov eax, dword [ebp - 0x118]
inc edi
shr eax, 2
cmp edi, eax
jl 0x40382c
jmp 0x4038bb
push dword [ebp - 0x114]
mov ecx, esi
call fcn.0040263f
push ebx
call fcn.004250db
pop ecx
mov eax, esi
call fcn.00425b19
ret
Function at 0x4038ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, edx
xor edx, edx
mov dword [ebp - 8], eax
push ebx
mov ebx, edx
test ecx, ecx
je 0x403950
test eax, eax
je 0x403950
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40394f
push edi
push edx
push 0x80
push 2
push edx
push edx
push 7
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40394e
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [ebp - 8]
push esi
add eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40393b
mov ecx, dword [ebp - 4]
test ecx, ecx
jle 0x40393b
add ebx, ecx
sub esi, ecx
jne 0x40390f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x403944
mov dword [eax], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x403b90
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Print debug messages

Disassembly:
push 0x284
mov eax, 0x4be377
call fcn.00425b5e
mov ebx, edx
mov esi, ecx
test esi, esi
je 0x403d5b
push esi
lea ecx, [ebp - 0x28]
call fcn.00402468
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0x4dc620
call fcn.004023ac
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
jmp 0x403d10
mov edx, ebx
lea ecx, [ebp - 0x264]
call fcn.004039bb
test eax, eax
je 0x403c08
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x403d10
push esi
lea ecx, [ebp - 0x28]
call fcn.0040263f
push 0x4dc390
lea ecx, [ebp - 0x28]
call fcn.004023ac
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x28]
call fcn.004023ac
test byte [ebp - 0x290], 0x10
je 0x403c89
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edx, ebx
cmovae ecx, dword [ebp - 0x28]
call fcn.00403b90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.RemoveDirectory_dir__s
push 0x20b
push str.Utility::CleanDirectory
push str.D:_thunder11_thunder11_cppsrc_setupThunderInstallCommonThunderUtility.cpp
push 4
call fcn.00403339
add esp, 0x18
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x403d10
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x403d10
and dword [ebp - 0x30], eax
lea ecx, [ebp - 0x40]
and dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040274c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
jmp 0x403cd3
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403ce6
lea ecx, [ebp - 0x40]
push 0x4dc688
call fcn.004023ac
cmp dword [ebp - 0x30], 0x104
jb 0x403cba
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00402600
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403be5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push str.RemoveDirectory_dir__s
push 0x228
push str.Utility::CleanDirectory
push str.D:_thunder11_thunder11_cppsrc_setupThunderInstallCommonThunderUtility.cpp
push 4
call fcn.00403339
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x28]
call fcn.00402600
call fcn.00425b19
ret