joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012eae0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ecx + 0xc]
fld dword [0x101f69a8]
push ebx
fstp dword [esp + 0xc]
push esi
push edi
test eax, eax
je 0x1012ec94
mov eax, dword [eax + 4]
test eax, eax
je 0x1012ec94
mov esi, dword [eax + 4]
test esi, esi
je 0x1012ec94
jmp 0x1012eb20
mov ecx, dword [esi + 0x18]
movzx ecx, word [ecx + 6]
mov edx, 0x1203
cmp cx, dx
je 0x1012eb62
mov edx, 0x1303
cmp cx, dx
je 0x1012eb62
test eax, eax
je 0x1012ec94
mov eax, dword [eax + 8]
test eax, eax
je 0x1012ec94
mov esi, dword [eax + 4]
test esi, esi
jne 0x1012eb20
fld dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1012ec94
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
lea edx, [esp + 0x10]
push edx
movzx edx, byte [esi + 0x16]
push 0xa4
push edx
movzx edx, byte [esi + 0x15]
push edx
movzx edx, byte [esi + 0x14]
push edx
call eax
test eax, eax
je 0x1012ec94
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x498], 0
jne 0x1012ec11
push 0x16c
call fcn.1003ddbb
add esp, 4
test eax, eax
je 0x1012ebc7
push 1
mov ecx, eax
call fcn.100550e0
mov edi, eax
jmp 0x1012ebc9
xor edi, edi
push 0x101ebc8c
lea ecx, [edi + 4]
push 0x100
push ecx
call fcn.1013b440
fldz
fstp dword [edi + 0x168]
add esp, 0xc
mov dword [ebx + 0x498], edi
or dword [edi + 0x144], 0x1802000
call fcn.1013c470
mov edx, dword [eax + 0x38]
mov ecx, dword [edx + 8]
mov dword [edi + 0x148], ecx
mov ecx, dword [eax + 0x38]
push edi
call fcn.100021e0
mov edi, dword [ebx + 0x498]
test edi, edi
je 0x1012ec94
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1012ec4a
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [esi + 0x16]
push 0xa4
push eax
movzx eax, byte [esi + 0x15]
push eax
movzx eax, byte [esi + 0x14]
push eax
call edx
mov eax, dword [esp + 0x10]
shr eax, 0x15
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
mov dword [edi + 0x14c], eax
push 1
test eax, eax
jge 0x1012ec6b
fadd dword [0x101f69c0]
fmul qword [0x101f6ec8]
push ecx
mov ecx, edi
fadd dword [edi + 0x168]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.10054a50
fld dword [edi + 0x158]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101371c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x10228cd0], 0
jne 0x10137266
mov ecx, 2
mov eax, 0x102286d4
jmp 0x101371e0
lea edx, [ecx - 2]
and edx, 0x3f
mov edx, dword [edx*4 + 0x102285d0]
xor dword [eax - 4], edx
lea edx, [ecx - 1]
and edx, 0x3f
mov edx, dword [edx*4 + 0x102285d0]
xor dword [eax], edx
mov edx, ecx
and edx, 0x3f
mov edx, dword [edx*4 + 0x102285d0]
xor dword [eax + 4], edx
lea edx, [ecx + 1]
and edx, 0x3f
mov edx, dword [edx*4 + 0x102285d0]
xor dword [eax + 8], edx
lea edx, [ecx + 2]
and edx, 0x3f
mov edx, dword [edx*4 + 0x102285d0]
xor dword [eax + 0xc], edx
lea edx, [ecx + 3]
and edx, 0x3f
mov edx, dword [edx*4 + 0x102285d0]
xor dword [eax + 0x10], edx
add ecx, 6
lea edx, [ecx - 2]
add eax, 0x18
cmp edx, 0x180
jl 0x101371e0
mov ecx, dword [esp + 4]
mov eax, 1
mov dword [0x10228cd0], eax
mov dword [0x102285c8], ecx
ret 0xc
mov edx, dword [esp + 4]
mov dword [0x102285c8], edx
mov eax, 1
ret 0xc
Function at 0x1013b090
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x224
mov eax, dword [0x10206870]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x22c]
push ebx
push esi
xor esi, esi
push str.setupapi.dll
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x1013b2a9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push edi
push str.CM_Get_DevNode_Registry_PropertyA
push ebx
call esi
push str.CM_Locate_DevNodeA
push ebx
mov ebp, eax
call esi
push str.CM_Get_Child
push ebx
mov edi, eax
call esi
push str.CM_Get_Sibling
push ebx
mov dword [esp + 0x28], eax
call esi
push str.CM_Get_Parent
push ebx
mov dword [esp + 0x34], eax
call esi
mov dword [esp + 0x24], eax
test ebp, ebp
je 0x1013b285
test edi, edi
je 0x1013b285
cmp dword [esp + 0x20], 0
je 0x1013b285
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x1013b285
test eax, eax
je 0x1013b285
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
jne 0x1013b27d
mov eax, dword [esp + 0x10]
mov edi, 0x200
push 0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x38]
push ecx
push 0
push 0xa
push eax
mov dword [esp + 0x34], edi
call ebp
test eax, eax
jne 0x1013b1a9
mov eax, dword [esp + 0x238]
lea ecx, [esp + 0x30]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1013b1a0
test dl, dl
je 0x1013b19c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1013b1a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1013b180
xor eax, eax
jmp 0x1013b1a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1013b21b
mov edx, dword [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push eax
call dword [esp + 0x2c]
test eax, eax
jne 0x1013b1c7
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x1013b157
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
je 0x1013b20e
lea esp, [esp]
mov eax, dword [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [esp + 0x30]
test eax, eax
jne 0x1013b285
mov eax, dword [esp + 0x14]
push 0
push eax
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x1c], eax
call esi
test eax, eax
jne 0x1013b1e0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x1013b157
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push 1
push edx
mov dword [esp + 0x34], edi
call ebp
test eax, eax
jne 0x1013b27d
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x30]
push eax
push 0x100
push ecx
call fcn.1003dc98
add esp, 0xc
push ebx
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1003dc89
add esp, 0x224
ret
mov dword [esp + 0x18], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1003dc89
add esp, 0x224
ret
mov ecx, dword [esp + 0x228]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1003dc89
add esp, 0x224
ret
Function at 0x1013b5b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x58
mov eax, dword [0x10206870]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x64]
push edi
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x1013b706
push esi
push edi
call fcn.1003de3e
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1013b6fc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x101ef9b0
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1013b6fc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1013b6dd
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 2]
movzx eax, word [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push edx
push eax
lea ecx, [esp + 0x2c]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1013b68f
mov edx, dword [esp + 0x14]
push edx
lea eax, [ebx + 0x10]
push 0x100
push eax
call fcn.1013b440
add esp, 0xc
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.StringFileInfo_04x_04xCompanyName
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1013b6dd
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [ebx + 0x110]
push 0x100
push edx
call fcn.1013b440
add esp, 0xc
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + 0xa]
mov dword [ebx], ecx
movzx edx, word [eax + 8]
mov dword [ebx + 4], edx
movzx ecx, word [eax + 0xe]
mov dword [ebx + 8], ecx
movzx edx, word [eax + 0xc]
mov dword [ebx + 0xc], edx
push esi
call fcn.1003e211
add esp, 4
pop esi
mov ecx, dword [esp + 0x60]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003dc89
add esp, 0x58
ret 8
Function at 0x1013bc50
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x10206870]
xor eax, esp
mov dword [esp + 0x29c], eax
push ebx
push ebp
push 0x9c
xor ebp, ebp
lea eax, [esp + 0xc]
push ebp
push eax
call fcn.1003f7d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x9c
call ebx
test eax, eax
jne 0x1013bcb6
push 0x94
push eax
lea edx, [esp + 0x10]
push edx
call fcn.1003f7d0
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call ebx
push esi
lea ecx, [esp + 0xa8]
push 0x200
push ecx
call fcn.1013b440
mov eax, dword [esp + 0x24]
add esp, 0xc
sub eax, 1
je 0x1013bdf0
sub eax, 1
jne 0x1013be19
cmp dword [esp + 0xc], 4
push esi
lea edx, [esp + 0xa8]
ja 0x1013bdb8
push 0x101ef998
push 0x200
push edx
call fcn.1013b440
add esp, 0x10
lea eax, [esp + 0xa4]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x1013bd4d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa4]
push ecx
push edi
call fcn.1013b9e0
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.1003dc89
add esp, 0x2a0
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1013bd7d
lea edx, [esp + 0xa4]
push edx
push edi
call fcn.1013b9e0
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.1003dc89
add esp, 0x2a0
ret
push esi
lea eax, [esp + 0xa8]
push 0x200
push eax
call fcn.1013b440
add esp, 0xc
lea ecx, [esp + 0xa4]
push ecx
push edi
call fcn.1013b9e0
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.1003dc89
add esp, 0x2a0
ret
push str.Global_s
push 0x200
push edx
call fcn.1013b440
add esp, 0x10
lea eax, [esp + 0xa4]
push eax
push edi
call fcn.1013b9e0
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.1003dc89
add esp, 0x2a0
ret
lea ecx, [esp + 0xa4]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
pop ebp
pop ebx
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.1003dc89
add esp, 0x2a0
ret
mov ecx, dword [esp + 0x2a4]
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.1003dc89
add esp, 0x2a0
ret
Function at 0x416b81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x416bd7
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp fcn.00416b81
call fcn.00415781
adc esp, dword [esi + ebx*2 + 0x1e]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
jmp dword [ebx]
sub eax, 0x858d42dc
aam 0xf8
invalid

Function at 0x41ddbc
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4530d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41de27
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41ddff
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x41de0a
mov esi, 0x80004005
push esi
push 0x1ef
push str.msuengine.cpp
call fcn.0043166e
push str.Failed_to_stop_wusa_service.
push esi
call fcn.0042eef6
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042731a
leave
ret
Function at 0x434a6f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
and dword [ebp - 4], edi
xor esi, esi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434ab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434aaf
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x434abf
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 0x10]
jb 0x434a7c
jmp 0x434acf
push edi
push 0x34c
push str.fileutil.cpp
call fcn.0043166e
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x434c29
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x10], esi
sete al
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x434d02
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x434c70
cmp eax, 0x50
je 0x434c68
cmp eax, 0xb7
jne 0x434c70
xor edi, edi
inc edi
jmp 0x434d02
cmp eax, 3
jne 0x434cf2
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x434ceb
cmp ax, 0x5c
jne 0x434c87
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x434c7f
test esi, esi
je 0x434ceb
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.004358e5
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x434d02
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x434d02
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434cd3
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jns 0x434d02
push edi
push 0x3b1
push str.fileutil.cpp
call fcn.0043166e
jmp 0x434d02
mov edi, 0x80070003
jmp 0x434d02
cmp eax, esi
jle 0x434d00
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x434d5c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
je 0x434d76
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], esi
je 0x434d7f
or dword [ebp - 4], 2
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x434e48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x434db6
cmp eax, 0x50
je 0x434dae
cmp eax, 0xb7
jne 0x434db6
xor edi, edi
inc edi
jmp 0x434e48
cmp eax, 3
jne 0x434e38
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x434e31
cmp ax, 0x5c
jne 0x434dcd
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x434dc5
test esi, esi
je 0x434e31
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.004358e5
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x434e48
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x434e48
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434e19
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jns 0x434e48
push edi
push 0x424
push str.fileutil.cpp
call fcn.0043166e
jmp 0x434e48
mov edi, 0x80070003
jmp 0x434e48
cmp eax, esi
jle 0x434e46
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x434eaa
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor ebx, ebx
call fcn.004349fc
test eax, eax
je 0x434f38
test byte [ebp - 4], 7
push esi
push edi
mov edi, 0xffff
mov esi, 0x80070000
je 0x434f05
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x434f05
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434ef7
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jns 0x434f05
push ebx
push 0x519
jmp 0x434f2c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x434f36
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434f20
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jns 0x434f36
push ebx
push 0x51f
push str.fileutil.cpp
call fcn.0043166e
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x434f65
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x434fbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434fa4
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x434fbf
push esi
push 0x118
push str.fileutil.cpp
call fcn.0043166e
jmp 0x435068
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x434fde
mov esi, 0x8007000e
push esi
push 0x11c
jmp 0x434fb0
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x43500d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434fff
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x43500d
push esi
push 0x120
jmp 0x435040
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44f8b4
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x43504c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435034
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x43504c
push esi
push 0x125
push str.fileutil.cpp
call fcn.0043166e
jmp 0x43505f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4075b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0x4b31e4]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov edx, dword [edi + 0x3f8c]
mov dword [ebp - 8], edx
test al, 0x10
jne 0x407720
mov ebx, dword [edi + 0x4908]
test ebx, ebx
je 0x407621
cmp dword [edi + 0x3fdc], ebx
jne 0x407717
mov al, byte [edi + 0x3ff0]
xor ecx, ecx
cmp al, 0xff
movsx esi, al
cmove esi, ecx
cmp byte [esi + edi + 0xe08], cl
je 0x407717
cmp byte [edx + 0xb3], cl
jne 0x407717
xor al, al
jmp 0x4076c5
cmp byte [edi + 0xe08], 0
je 0x407717
cmp byte [edx + 0xb3], 0
jne 0x407717
test byte [edi + 0x4910], 1
jne 0x40765c
cmp dword [edi + 0x3fdc], esi
je 0x407717
cmp dword [edi + 0x3ffc], edx
jne 0x407717
test al, 8
je 0x407717
lea esi, [edi + 0x4914]
mov ecx, edx
push esi
call fcn.0040f850
mov ebx, eax
push ebx
mov dword [edi + 0x4908], ebx
call fcn.00414450
push dword [edi + 0x490c]
push ebx
push esi
call fcn.004140e0
add esp, 0x10
mov byte [ebp - 1], al
test al, al
je 0x4076b8
cmp byte [edi + 0x3820], 0
je 0x4076b8
mov esi, dword [ebp - 8]
push esi
push ebx
call fcn.0041d850
push 0
push esi
call fcn.0040ed60
mov al, byte [ebp - 1]
add esp, 0x10
cmp dword [edi + 0x3fdc], ebx
jne 0x407717
mov edx, dword [ebp - 8]
xor esi, esi
mov byte [edi + 0x3fe9], al
mov ecx, dword [edx + 0xec]
mov eax, dword [edx + 0xf4]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4b31e4]
cmp byte [eax + esi + 0xe08], 0
jne 0x4076f3
mov byte [ebp - 1], 0
jmp 0x40770c
movss xmm1, dword [eax + 0x58]
movss xmm0, dword [eax + esi*4 + 0x3878]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae byte [ebp - 1]
call fcn.0041d9a0
cmp byte [ebp - 1], 0
jne 0x40775c
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
or ebx, 0xffffffff
mov al, 0x23
mov edx, 0x492055
or esi, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x40773e
cmp byte [edx], al
jne 0x40773e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x4903e0]
test al, al
jne 0x407730
mov esi, dword [ebp - 0x10]
not ebx
cmp byte [edi + 0x4c30], 0
jne 0x40779e
call fcn.00409140
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x4c4c], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x4c48], ebx
mov byte [edi + 0x4c30], 1
mov dword [edi + 0x4c34], eax
mov dword [edi + 0x4c3c], esi
cmp ebx, dword [edi + 0x3fdc]
jne 0x40779e
mov byte [edi + 0x3fea], 1
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x3f08]
mov dword [edi + 0x4c38], eax
mov byte [edi + 0x4c31], 1
test bl, 1
jne 0x407811
cmp dword [edi + 0x4ca8], 0
je 0x407805
test dword [edi + 0x4c9c], 0x1000
je 0x407805
mov esi, dword [0x4b31e4]
push 0x2030347
push 0
push str.Tooltip_Hidden
call fcn.00404a70
mov eax, dword [esi + 0x3f8c]
add esp, 0xc
mov byte [eax + 0xb3], 1
mov byte [eax + 0xb5], 1
mov byte [eax + 0xd4], 1
jmp 0x407811
push 0
push 0
call fcn.00407fc0
add esp, 8
test bl, 0x12
jne 0x40781d
and dword [edi + 0x4910], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret