joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c2b0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c1669
mov eax, dword fs:[0]
push eax
sub esp, 0x54c
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x548], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x560]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x574]
mov edi, dword [esp + 0x570]
push ebp
lea eax, [esp + 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 0x354]
push ecx
call fcn.00477190
add esp, 4
lea edx, [esp + 0x354]
push edx
push edi
mov ecx, 0x539fd8
call fcn.0046ee90
xor esi, esi
cmp eax, esi
jne 0x45c4be
push 0x48
call fcn.004919dd
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x568], esi
cmp eax, esi
je 0x45c35a
push edi
mov ecx, eax
call fcn.0045ba70
mov esi, eax
cmp dword [ebx], 1
mov dword [esp + 0x568], 0xffffffff
mov dword [esp + 0x14], esi
jne 0x45c378
mov eax, dword [esi + 0x3c]
or byte [eax + 0x6d0], 6
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x354]
push eax
call fcn.0046e1c0
mov ecx, dword [esi + 0x3c]
call fcn.0046e1f0
mov ecx, dword [edi + 0x3c]
mov ebx, eax
call fcn.0046e1f0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [edi + 0x3c]
call fcn.0042e270
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4ca150
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [esi + 0x3c]
call fcn.0042e280
mov ecx, dword [esi + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebp
add ecx, 0x418
push ecx
call ebx
push 0x410
push 0x2b4
lea edx, [esp + 0xa8]
push edx
push 0x10
push 0x4c49ac
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45c410
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x2b4]
push eax
add ecx, 0x620
push ecx
jmp 0x45c41f
mov edx, dword [esi + 0x3c]
push 0x4c49ac
add edx, 0x620
push edx
call ebx
push ebp
lea ecx, [esp + 0x1c]
call fcn.004be890
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x578], 1
call fcn.004bcf80
add esp, 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x568], 0xffffffff
call fcn.004be590
mov eax, dword [esi + 0x3c]
lea ecx, [eax + 0x6c2]
push ecx
add eax, 0x6c0
push eax
lea edx, [esp + 0x3c]
push edx
call fcn.004bdbe0
mov ebx, dword [edi + 0x14]
mov ecx, dword [ebx + 4]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
mov ecx, edi
call fcn.0045aea0
push 1
mov ecx, edi
mov ebp, eax
call fcn.0045bb10
mov dword [ebx + 4], ebp
mov edx, dword [ebp + 4]
mov dword [edx], ebp
mov eax, dword [edi + 0x44]
push esi
push eax
mov ecx, 0x539fd8
call fcn.0046e830
mov eax, esi
mov ecx, dword [esp + 0x560]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x548]
xor ecx, esp
call fcn.004911aa
add esp, 0x558
ret 8
Function at 0x45c7b0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c16de
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x354], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x36c]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x539fd8
mov dword [esp + 0x18], edi
call fcn.0046e560
mov esi, eax
push 0x80
lea eax, [esp + 0x2ec]
push eax
push esi
mov ecx, edi
call fcn.004593f0
test al, al
je 0x45c955
push 0x48
call fcn.004919dd
add esp, 4
mov dword [esp + 0x14], eax
xor edi, edi
mov dword [esp + 0x374], edi
cmp eax, edi
je 0x45c83f
push esi
mov ecx, eax
call fcn.0045ba70
mov edi, eax
lea ecx, [esp + 0x2e8]
push ecx
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x378], 0xffffffff
mov dword [esp + 0x18], edi
call fcn.0046e1c0
mov ecx, dword [edi + 0x3c]
call fcn.0046e1f0
push eax
mov ecx, 0x539fd8
call fcn.0046e520
mov ecx, dword [edi + 0x3c]
call fcn.0042e280
push 0x410
push 0x2b4
lea edx, [esp + 0x3c]
push edx
push 0x10
push 0x4c49ac
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45c8ad
mov ecx, dword [edi + 0x3c]
lea eax, [esp + 0x248]
push eax
add ecx, 0x620
push ecx
jmp 0x45c8bc
mov edx, dword [edi + 0x3c]
push 0x4c49ac
add edx, 0x620
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 0x6c2]
push ecx
add eax, 0x6c0
push eax
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
mov ecx, esi
call fcn.0045aea0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0045bb10
mov dword [ebx + 4], ebp
mov edx, dword [ebp + 4]
mov dword [edx], ebp
mov eax, dword [esi + 0x44]
push edi
push eax
mov ecx, 0x539fd8
call fcn.0046e830
mov ecx, 0x539fd8
call fcn.0046ed00
mov ecx, dword [esi + 0x44]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x24]
push ecx
mov ecx, dword [eax]
push 2
push 0x1102
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov ecx, dword [esp + 0x36c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.004911aa
add esp, 0x364
Function at 0x45c980
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c16de
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x354], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x36c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x37c]
push 0x80
lea eax, [esp + 0x2ec]
push eax
push esi
mov dword [esp + 0x24], ecx
call fcn.004593f0
test al, al
je 0x45cb3d
push 0x48
call fcn.004919dd
add esp, 4
mov dword [esp + 0x14], eax
xor edi, edi
mov dword [esp + 0x374], edi
cmp eax, edi
je 0x45ca06
push esi
mov ecx, eax
call fcn.0045ba70
mov edi, eax
lea ecx, [esp + 0x2e8]
push ecx
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x378], 0xffffffff
mov dword [esp + 0x18], edi
call fcn.0046e1c0
mov ecx, dword [edi + 0x3c]
call fcn.0046e1f0
mov ecx, dword [esi + 0x3c]
mov ebx, eax
call fcn.0046e1f0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esi + 0x3c]
call fcn.0042e270
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
push ebx
call ebp
push 0x4ca150
push ebx
call ebp
mov ecx, dword [edi + 0x3c]
call fcn.0042e280
push 0x410
push 0x2b4
lea edx, [esp + 0x3c]
push edx
push 0x10
push 0x4c49ac
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45ca95
mov ecx, dword [edi + 0x3c]
lea eax, [esp + 0x248]
push eax
add ecx, 0x620
push ecx
jmp 0x45caa4
mov edx, dword [edi + 0x3c]
push 0x4c49ac
add edx, 0x620
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [edi + 0x3c]
lea ecx, [eax + 0x6c2]
push ecx
add eax, 0x6c0
push eax
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
mov ecx, esi
call fcn.0045aea0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0045bb10
mov dword [ebx + 4], ebp
mov edx, dword [ebp + 4]
mov dword [edx], ebp
mov eax, dword [esi + 0x44]
push edi
push eax
mov ecx, 0x539fd8
call fcn.0046e830
mov ecx, 0x539fd8
call fcn.0046ed00
mov ecx, dword [esi + 0x44]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x24]
push ecx
mov ecx, dword [eax]
push 2
push 0x1102
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov ecx, dword [esp + 0x36c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.004911aa
add esp, 0x364
ret 4
Function at 0x462630
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push str.FeyWriter.chm
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x462f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, 4
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x462f7a
mov edx, dword [esp + 0x10]
mov eax, 1
cmp dword [esp + 0xc], eax
setae cl
mov byte [edx], cl
add esp, 8
ret 8
xor al, al
add esp, 8
ret 8

Function at 0x462f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
mov eax, dword [ecx + 4]
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
ret 0xc

Function at 0x462fc0
Capabilities:
Set registry value

Disassembly:
movzx eax, byte [esp + 8]
mov ecx, dword [ecx + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
ret 8

Function at 0x462ff0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push eax
mov eax, dword [esp + 8]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
ret 0xc

Function at 0x464fd0
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c0438
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push esi
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x465025
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
push esi
call fcn.00476ff0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
push str.FeyWriter_
push esi
call edi
push esi
lea ecx, [esp + 0x10]
call fcn.004be890
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x34], 0
call fcn.004bd650
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004be590
push str.Settings.xml
push esi
call edi
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4

Function at 0x466cb0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x234]
push 2
push 0x4c9d8c
call fcn.00423470
mov eax, dword [esi + 4]
push 0x3fa
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10
Function at 0x469400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c1ec1
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x18]
push edi
lea ecx, [esp + 0x18]
call fcn.004be890
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
mov dword [esp + 0xc0], ebp
call fcn.004bd080
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0xbc], 0xffffffff
call fcn.004be590
xor ecx, ecx
mov word [edi], cx
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x4695e5
mov bl, 3
lea esp, [esp]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x4694c2
call fcn.0049118f
mov eax, dword [esi + 0xc]
add eax, ebp
cmp dword [eax + 0x18], 8
jb 0x4694d2
mov eax, dword [eax + 4]
jmp 0x4694d5
add eax, 4
push eax
lea ecx, [esp + 0x18]
call fcn.004be890
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x58]
mov dword [esp + 0xc0], 1
call fcn.004be390
lea ecx, [esp + 0x14]
mov byte [esp + 0xbc], bl
call fcn.004be590
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x46952a
call fcn.0049118f
mov eax, dword [esi + 0xc]
add eax, ebp
cmp dword [eax + 0x18], 8
jb 0x46953a
mov eax, dword [eax + 4]
jmp 0x46953d
add eax, 4
push eax
lea ecx, [esp + 0x3c]
call fcn.004be890
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x78]
mov byte [esp + 0xc0], 4
call fcn.004bd440
lea ecx, [esp + 0x38]
mov byte [esp + 0xbc], 6
call fcn.004be590
lea ecx, [esp + 0x54]
call fcn.004be250
test al, al
je 0x469586
lea ecx, [esp + 0x54]
call fcn.004be220
jmp 0x46959c
lea ecx, [esp + 0x74]
call fcn.004bd0b0
test al, al
je 0x46959c
lea ecx, [esp + 0x74]
call fcn.004bd100
lea ecx, [esp + 0x74]
mov byte [esp + 0xbc], bl
call fcn.004bd370
lea ecx, [esp + 0x54]
mov dword [esp + 0xbc], 0xffffffff
call fcn.004be370
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebp, 0x1c
cmp edi, eax
jb 0x4694a0
mov ebp, dword [esi + 0x10]
cmp dword [esi + 0xc], ebp
jbe 0x4695f2
call fcn.0049118f
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x469601
call fcn.0049118f
mov eax, dword [esi]
push ebp
push ebx
push edi
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
call fcn.0043c9f0
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004911aa
add esp, 0xac
ret
Function at 0x470280
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c21bb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x2c]
mov al, byte [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
mov byte [esi], al
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], edx
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
mov word [ecx + 4], ax
mov eax, ebx
lea ebp, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4702e0
sub eax, ebp
sar eax, 1
push eax
push ebx
call fcn.00401c40
mov ebx, dword [esp + 0x28]
lea ecx, [esi + 0x2c]
xor edx, edx
mov eax, ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
mov dword [esp + 0x1c], 0
mov word [ecx + 4], dx
lea ebp, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x470320
sub eax, ebp
sar eax, 1
push eax
push ebx
call fcn.00401c40
mov eax, dword [esp + 0x38]
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18
Function at 0x4705e0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x4c21ee
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x2e8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2f8]
mov ebx, ecx
mov esi, dword [ebx + 8]
mov ecx, dword [esi + 0x44]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
mov ebp, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ebp
jle 0x4707d5
mov ecx, dword [esp + 0x2c]
movzx edx, word [ecx + ebp*2]
cmp dx, 0x5c
je 0x47066c
cmp dx, 0x2f
jne 0x4707c8
mov edx, ebp
sub edx, edi
push edx
push edi
push ecx
call fcn.00477030
add esp, 0xc
mov edi, eax
push edi
push esi
mov ecx, ebx
mov dword [esp + 0x2c], edi
call fcn.0046eaa0
mov ecx, eax
xor eax, eax
mov dword [esp + 0x14], ecx
cmp dword [ebx], eax
je 0x4706a7
mov eax, dword [esp + 0x1c]
push edi
push eax
mov ecx, ebx
call fcn.0046e8f0
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x47079e
push 0x48
call fcn.004919dd
add esp, 4
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x2f0], ebx
cmp eax, ebx
je 0x4706d4
push esi
mov ecx, eax
call fcn.0045ba70
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
push ecx
mov dword [esp + 0x2f8], 0xffffffff
mov dword [esp + 0x1c], ebx
call ebp
push 0x4410
push 0x2b4
lea edx, [esp + 0x38]
push edx
push 0x10
push 0x4c49ac
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x47072b
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x40], eax
mov edx, dword [ebx + 0x3c]
lea ecx, [esp + 0x244]
push ecx
add edx, 0x620
push edx
call ebp
mov eax, dword [esi + 0x3c]
mov edi, dword [ebx + 0x3c]
add eax, 0x208
push eax
add edi, 0x208
push edi
call ebp
mov ecx, dword [esi + 0x3c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ecx
push edi
call ebp
push 0x4ca150
push edi
call ebp
mov edi, dword [esi + 0x14]
mov eax, dword [edi + 4]
lea edx, [esp + 0x14]
push edx
push eax
push edi
mov ecx, esi
call fcn.0045aea0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0045bb10
mov edx, dword [esp + 0x18]
mov dword [edi + 4], ebp
mov ecx, dword [ebp + 4]
mov dword [ecx], ebp
cmp dword [edx], 0
mov esi, ebx
je 0x4707a6
mov eax, dword [esp + 0x1c]
push ebx
push eax
mov ecx, edx
call fcn.0046e830
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
jmp 0x4707a8
mov esi, ecx
mov dword [esp + 0x1c], eax
jmp 0x4707b0
mov ebx, edx
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
lea ecx, [ebp + 1]
push edi
mov dword [esp + 0x18], ecx
call fcn.0049119f
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
add esp, 4
inc ebp
cmp ebp, eax
mov dword [esp + 0x20], ebp
jl 0x470654
mov eax, esi
mov ecx, dword [esp + 0x2e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d0]
xor ecx, esp
call fcn.004911aa
add esp, 0x2e0
ret 4
Function at 0x475020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c2549
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
mov dword [esi], vtable.CWelcomePane.0
mov ebp, dword [esi + 0x30]
lea edi, [esi + 0x24]
mov dword [esp + 0x28], 0xd
cmp ebp, dword [edi + 0x10]
jbe 0x47506b
call fcn.0049118f
mov ebx, dword [edi]
lea ecx, [ecx]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
cmp dword [edi + 0xc], eax
jbe 0x475081
call fcn.0049118f
mov eax, dword [edi]
test ebx, ebx
je 0x47508b
cmp ebx, eax
je 0x475090
call fcn.0049118f
cmp ebp, dword [esp + 0x14]
je 0x4750d9
test ebx, ebx
jne 0x4750d1
call fcn.0049118f
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x4750ab
call fcn.0049118f
mov eax, dword [ebp]
push eax
call fcn.00490f74
add esp, 4
test ebx, ebx
jne 0x4750d5
call fcn.0049118f
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x4750cc
call fcn.0049118f
add ebp, 4
jmp 0x475070
mov eax, dword [ebx]
jmp 0x4750a1
mov eax, dword [ebx]
jmp 0x4750c2
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
cmp dword [edi + 0xc], eax
jbe 0x4750ea
call fcn.0049118f
mov ebx, dword [edi + 0xc]
mov ebp, dword [edi]
cmp ebx, dword [edi + 0x10]
jbe 0x4750f9
call fcn.0049118f
mov ecx, dword [esp + 0x14]
mov eax, dword [edi]
push ecx
push ebp
push ebx
push eax
lea edx, [esp + 0x24]
push edx
mov ecx, edi
call fcn.004177d0
lea ecx, [esi + 0xcc]
call fcn.00456c00
lea ecx, [esi + 0xc0]
mov byte [esp + 0x28], 0xc
call fcn.00456c00
lea ecx, [esi + 0xb4]
mov byte [esp + 0x28], 0xb
call fcn.00456c00
lea ecx, [esi + 0xa8]
mov byte [esp + 0x28], 0xa
call fcn.00456c00
lea ecx, [esi + 0x9c]
mov byte [esp + 0x28], 9
call fcn.00456c00
lea ecx, [esi + 0x90]
mov byte [esp + 0x28], 8
call fcn.00456c00
lea ecx, [esi + 0x84]
mov byte [esp + 0x28], 7
call fcn.00456c00
lea ecx, [esi + 0x78]
mov byte [esp + 0x28], 6
call fcn.00456c00
lea ecx, [esi + 0x6c]
mov byte [esp + 0x28], 5
call fcn.00456c00
lea ecx, [esi + 0x60]
mov byte [esp + 0x28], 4
call fcn.00456c00
lea ecx, [esi + 0x54]
mov byte [esp + 0x28], 3
call fcn.00456c00
lea ecx, [esi + 0x48]
mov byte [esp + 0x28], 2
call fcn.00456c00
lea ecx, [esi + 0x3c]
mov byte [esp + 0x28], 1
call fcn.00456c00
mov eax, dword [edi + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4751da
push eax
call fcn.00490f74
add esp, 4
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov edi, dword [edi]
push edi
call fcn.00490f74
mov esi, dword [esi + 0x14]
add esp, 4
mov dword [esp + 0x28], 0xffffffff
cmp esi, ebx
je 0x475203
push esi
call fcn.00490c3a
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4756e5
Capabilities:
Get file version info

Disassembly:
sub esp, 0x120
mov eax, dword [0x4f00a8]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esp + 0x14]
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x475728
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi], ecx
mov dword [esi + 4], edx
push 0
push str.shlwapi.dll
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x47578b
push edi
call fcn.00490ef9
add esp, 4
mov ebx, eax
push ebx
push edi
push 0
push str.shlwapi.dll
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x475782
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4c947c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x475782
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0xa]
mov dword [esi + 8], edx
movzx eax, word [eax + 8]
mov dword [esi + 0xc], eax
push ebx
call fcn.0049119f
add esp, 4
push 0
push 0x4d0b28
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x4757ee
push edi
call fcn.00490ef9
add esp, 4
mov ebx, eax
push ebx
push edi
push 0
push 0x4d0b28
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4757e5
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4c947c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4757e5
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 0xa]
mov dword [esi + 0x10], ecx
movzx edx, word [eax + 8]
mov dword [esi + 0x14], edx
push ebx
call fcn.0049119f
add esp, 4
mov ecx, dword [esp + 0x128]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004911aa
add esp, 0x120
ret