joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb7c6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x10dd
cmp dword [0x900ea8], 0
jne 0x4bb842
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor edx, edx
xor eax, eax
lock cmpxchg dword [0x900ea8], ecx
jne 0x4bb842
mov dword [0x900ea4], edx
mov dword [0x900eac], edx
mov dword [0x900eb0], edx
mov dword [0x900eb4], edx
mov dword [0x900eb8], edx
mov esi, dword [0x900ebc]
test esi, esi
je 0x4bb840
lea edi, [ebp - 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x40
push 0x10000
push esi
call ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x4bb82e
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4bb856
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [0x900ea8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, 0x10dd
cmp edi, eax
jne 0x4bb929
mov edi, dword [0x900eac]
test edi, edi
je 0x4bb8e6
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x10]
movzx eax, byte [eax + 0x17]
lea ecx, [ebp - 0x14]
push ecx
push dword [edi + 0x14]
push eax
push dword [edi + 0xc]
call ebx
cmp dword [edi + 4], 0
jne 0x4bb8d5
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4bb8d5
mov ecx, eax
and ecx, 0xffff0000
xorps xmm0, xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
mov dword [ecx + 8], eax
mov dword [edi + 0x10], 0
mov esi, dword [edi]
push edi
call fcn.00517bd6
add esp, 4
mov edi, esi
test esi, esi
jne 0x4bb892
mov dword [0x900eac], 0
call fcn.004bb93d
mov edi, dword [0x900eb0]
test edi, edi
je 0x4bb91b
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call esi
mov ebx, dword [edi]
push edi
call fcn.00517bd6
add esp, 4
mov edi, ebx
test ebx, ebx
jne 0x4bb905
xor esi, esi
mov dword [0x900eb0], esi
mov dword [0x900ea8], esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bbc41
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [0x900eb4]
test esi, esi
je 0x4bbc5a
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor esi, esi
cmp eax, ebx
je 0x4bbc51
push 8
call fcn.00517b56
add esp, 4
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x4bbc93
mov dword [edi + 4], ebx
mov eax, dword [0x900eb0]
mov dword [edi], eax
mov dword [0x900eb0], edi
jmp 0x4bbc51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call fcn.00517bd6
add esp, 4
mov dword [0x900eb4], esi
mov dword [0x900eb8], 0
jmp 0x4bbc51
Function at 0x4bc163
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, edx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x2c]
push 0x1c
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [edi + 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x4bc1b9
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x4bc1b9
mov edx, dword [eax + ecx + 0xd8]
add edx, eax
cmp edx, esi
ja 0x4bc1b9
add edx, dword [eax + ecx + 0xdc]
mov bl, 1
cmp edx, esi
ja 0x4bc1bb
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ccaa0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
cmp eax, 3
jne 0x4ccbac
mov eax, dword [0x9017e0]
cmp eax, 1
je 0x4ccb31
mov esi, 2
mov edi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x9017e0], esi
cmp eax, 2
jne 0x4ccae7
call edi
jmp 0x4ccad4
cmp eax, 1
je 0x4ccb31
test eax, eax
jne 0x4ccbbf
push 0x400
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov esi, 1
mov ecx, 1
test eax, eax
je 0x4ccb25
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x9017e8], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x9017e4], ecx
xchg dword [0x9017e0], esi
cmp dword [0x9017e4], 0
jne 0x4ccbac
push dword [0x9017e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ccbac
mov esi, eax
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x90180c]
mov dword [ebp - 0x10], eax
movsd xmm0, qword [0x901804]
movsd qword [ebp - 0x18], xmm0
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4ccb85
push dword [esi]
call eax
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4ccb94
push dword [esi + 4]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4ccba3
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.004a6e40
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x10
pop esi
pop edi
pop ebp
ret 0xc
call fcn.0061842c
int3

Function at 0x4ccbd0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x9017e0]
cmp eax, 1
je 0x4ccc44
mov esi, 2
mov edi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x9017e0], esi
cmp eax, 2
jne 0x4ccbfe
call edi
jmp 0x4ccbeb
cmp eax, 1
je 0x4ccc44
test eax, eax
jne 0x4ccc7d
push 0x400
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov esi, 1
mov ecx, 1
test eax, eax
je 0x4ccc38
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x9017e8], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x9017e4], ecx
xchg dword [0x9017e0], esi
xor esi, esi
cmp dword [0x9017e4], 0
jne 0x4ccc76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x9017e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4ccc76
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0061842c
int3
Function at 0x4ccc90
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x9017e0]
cmp eax, 1
je 0x4ccd08
mov esi, 2
mov edi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x9017e0], esi
cmp eax, 2
jne 0x4cccbe
call edi
jmp 0x4cccab
cmp eax, 1
je 0x4ccd08
test eax, eax
jne 0x4ccdb4
push 0x400
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov esi, 1
mov ecx, 1
test eax, eax
je 0x4cccfc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x9017e8], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x9017e4], ecx
xchg dword [0x9017e0], esi
mov ebx, dword [ebp + 0x10]
cmp dword [0x9017e4], 0
je 0x4ccd20
push dword [ebp + 0xc]
call ebx
add esp, 4
xor eax, eax
jmp 0x4ccd6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [0x9017e8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4ccd71
mov edi, dword [ebp + 8]
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi*4 + 0x901804], ebx
push 0x9017ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*4], eax
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xc
call fcn.004a6e10
add esp, 4
test eax, eax
je 0x4ccd14
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
push eax
push dword [0x9017e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4ccd41
push esi
call fcn.004a6e40
add esp, 4
jmp 0x4ccd14
call fcn.0061842c
int3

Function at 0x4cd140
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4cd15e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x4cd220
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4cd242
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret
Function at 0x4cd330
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4cd35a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x4cd4a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4cd4ff
Function at 0x4cf3e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.004cee80
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x4cf451
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4cf416
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x4dc790
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x24], edx
push edx
push ecx
push edi
call fcn.0047cba0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x4dc7bf
mov edi, dword [ebp - 0x1c]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x4dc7dd
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
cmp dword [ebp + 8], 0
je 0x4dc8bc
test esi, esi
je 0x4dc8bc
mov dword [ebp - 0x20], esi
add esi, esi
mov ecx, 0xffffffff
cmovae ecx, esi
push ecx
call fcn.00517c03
add esp, 4
mov edi, eax
lea esi, [ebp - 0x1c]
push dword [ebp - 0x24]
push ebx
push esi
call fcn.0047cba0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x4dc820
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x4dc83c
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
cmp word [edi], 0
mov esi, dword [ebp + 8]
je 0x4dc85f
xor ecx, ecx
nop word [eax + eax]
lea eax, [ecx + 1]
cmp word [edi + ecx*2 + 2], 0
mov ecx, eax
jne 0x4dc850
jmp 0x4dc861
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.0047d020
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x4dc87e
mov byte [esi], 0
mov byte [esi + 0xb], 0
jmp 0x4dc8a1
mov eax, dword [esi]
mov byte [eax], 0
mov dword [esi + 4], 0
cmp byte [esi + 0xb], 0
jns 0x4dc8a1
push dword [esi]
call fcn.00517bd6
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
push edi
call fcn.00517c15
add esp, 4
mov esi, dword [ebp - 0x20]
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4e50d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x4e5173
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.00517b56
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.004e5040
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.004e5190
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x4e515d
mov ecx, edi
call fcn.004e51e0
push edi
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x4e5170
push dword [esp + 8]
call fcn.00517bd6
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00517c1a
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ebcd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.006030b0
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x4ebd05
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
jmp 0x4ebd12
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
Function at 0x4fadac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
cmp edx, 0x40
jb 0x4fae00
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0x4d
jne 0x4fae00
cmp byte [ecx + 1], 0x5a
jne 0x4fae00
mov esi, dword [ecx + 0x3c]
mov edi, edx
sub edi, esi
xor eax, eax
cmp edi, 0x18
jb 0x4fae02
cmp esi, edx
jae 0x4fae02
cmp esi, 0x40
jb 0x4fae02
mov edi, esi
and edi, 7
jne 0x4fae02
cmp byte [ecx + esi], 0x50
jne 0x4fae00
cmp byte [ecx + esi + 1], 0x45
jne 0x4fae00
cmp byte [ecx + esi + 2], 0
jne 0x4fae00
cmp byte [ecx + esi + 3], 0
je 0x4fae06
xor eax, eax
pop esi
pop edi
pop ebp
ret
add esi, 0x18
xor eax, eax
sub edx, esi
jbe 0x4fae02
cmp edx, 2
jb 0x4fae02
movzx eax, word [ebp + 0x10]
cmp word [ecx + esi], ax
sete al
jmp 0x4fae02

Function at 0x51acb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0x114
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.006030b0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x51ad14
cmp dword [ebp - 0x114], 6
jb 0x51ad14
mov dword [ebp - 0x11c], 1
jmp 0x51ad1e
mov dword [ebp - 0x11c], 0
mov al, byte [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517c1a
mov esp, ebp
pop ebp
ret
Function at 0x51ee00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63665b
mov eax, dword fs:[0]
push eax
mov eax, 0x4224
call fcn.00517f10
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x9001ad]
test eax, eax
jne 0x51efe2
mov byte [0x9001ad], 1
push 0x68a05c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x4224], eax
cmp dword [ebp - 0x4224], 0
je 0x51efe2
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.006030b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x4224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x51efe2
xor edx, edx
mov word [ebp - 0x4218], dx
push 0x3ffe
push 0
lea eax, [ebp - 0x4216]
push eax
call fcn.006030b0
add esp, 0xc
lea ecx, [ebp - 0x422c]
push ecx
lea edx, [ebp - 0x218]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x4228], eax
cmp dword [ebp - 0x4228], 0x4000
jae 0x51efe2
lea eax, [ebp - 0x4218]
push eax
mov ecx, dword [ebp - 0x4228]
push ecx
push 0
lea edx, [ebp - 0x218]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x51efe2
lea eax, [ebp - 0x4230]
push eax
lea ecx, [ebp - 0x421c]
push ecx
push 0x68a074
lea edx, [ebp - 0x4218]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x51efe2
lea ecx, [ebp - 0x4220]
call fcn.0042d1fc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x421c]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x421c]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x421c]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x421c]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push 0x68a078
lea eax, [ebp - 0x4220]
push eax
call fcn.004374b8
add esp, 0x18
push str.6.1.7601.19044
lea ecx, [ebp - 0x4220]
push ecx
call fcn.0051ac20
add esp, 8
movzx edx, al
test edx, edx
je 0x51efd0
mov byte [0x9001ac], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4220]
call fcn.0051a980
mov al, byte [0x9001ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov esp, ebp
pop ebp
ret
Function at 0x520eb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x632666
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xb4
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0051a1d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.00519400
cmp eax, 0xffffffff
jne 0x520f49
call fcn.00434c1f
mov dword [ebp - 0xac], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0051a1f0
mov eax, dword [ebp - 0xac]
jmp 0x521133
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00519400
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa4], 0
je 0x520f98
mov dword [ebp - 0xb0], 0x80004005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0051a1f0
mov eax, dword [ebp - 0xb0]
jmp 0x521133
cmp dword [ebp - 0xa8], 0xffffffff
jne 0x520fc9
call fcn.00434c1f
mov dword [ebp - 0xb4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0051a1f0
mov eax, dword [ebp - 0xb4]
jmp 0x521133
lea ecx, [ebp - 0x98]
call fcn.00518e40
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xa8]
add edx, 2
push edx
lea ecx, [ebp - 0x98]
call fcn.00530770
jmp 0x520ff9
mov dword [ebp - 4], 1
jmp 0x521009
lea ecx, [ebp - 0x98]
call fcn.00519400
test eax, eax
jne 0x52104e
mov dword [ebp - 0xb8], 0x8007000e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00530750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0051a1f0
mov eax, dword [ebp - 0xb8]
jmp 0x521133
lea ecx, [ebp - 0x98]
call fcn.00519400
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xbc], 0
push 0
lea eax, [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
lea ecx, [ebp - 0x9c]
call fcn.00519400
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5210ca
call fcn.00434c1f
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00530750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0051a1f0
mov eax, dword [ebp - 0xc0]
jmp 0x521133
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0xa8]
mov byte [eax], 0
mov ecx, dword [ebp - 0xa0]
add ecx, dword [ebp - 0xa8]
mov byte [ecx + 1], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xa8]
add eax, 2
push eax
mov ecx, dword [ebp - 0xa0]
push ecx
call fcn.005211a0
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.00530750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.0051a1f0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00517c1a
mov esp, ebp
pop ebp
ret
Function at 0x594e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634350
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ATL::CComObject_class_Smartui::CQtlControlTemplate_.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], vtable.ATL::CComObject_class_Smartui::CQtlControlTemplate_.1.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], vtable.ATL::CComObject_class_Smartui::CQtlControlTemplate_.2.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], vtable.ATL::CComObject_class_Smartui::CQtlControlTemplate_.3.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], 0xc0000001
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00518de0
mov edx, dword [0x70bd40]
mov eax, dword [edx]
mov ecx, dword [0x70bd40]
mov edx, dword [eax + 8]
call edx
mov ecx, dword [ebp - 0x10]
call fcn.00572e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x595220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x634350
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ATL::CComObject_class_Smartui::CQtlRowDefinition_.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], vtable.ATL::CComObject_class_Smartui::CQtlRowDefinition_.1.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], vtable.ATL::CComObject_class_Smartui::CQtlRowDefinition_.2.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], vtable.ATL::CComObject_class_Smartui::CQtlRowDefinition_.3.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], 0xc0000001
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00518de0
mov edx, dword [0x70bd40]
mov eax, dword [edx]
mov ecx, dword [0x70bd40]
mov edx, dword [eax + 8]
call edx
mov ecx, dword [ebp - 0x10]
call fcn.00566fd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret