joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a0d6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
xor eax, eax
push ebx
push esi
push edi
push 9
mov ebx, ecx
lea edi, [ebp - 0x28]
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
mov esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
mov ecx, 0x1000
test eax, eax
cmove eax, ecx
lea ecx, [esi - 1]
mov dword [ebp - 0x24], eax
add ecx, ebx
jmp 0x40a117
mov al, byte [ebx]
add ebx, dword [ebp - 0x24]
cmp ebx, ecx
jb 0x40a112
mov al, byte [ecx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a3f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0xc], ebx
call fcn.004150e0
cmp eax, 1
jle 0x40a4a7
push ebx
push 0x8000000
push 3
push ebx
push 7
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00409720
cmp dword [ebp - 8], ebx
je 0x40a49b
cmp dword [ebp - 8], 0xffffffff
je 0x40a49b
push 4
push 0x1000
mov edi, 0x100000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x40a49b
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x40a47a
cmp dword [ebp - 0xc], ebx
jbe 0x40a484
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x100000
push esi
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a46b
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [ebp - 8]
call fcn.004096e2
jmp 0x40a4f0
lea ecx, [ebp - 8]
call fcn.004096e2
xor al, al
jmp 0x40a4f2
push 9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x40a4a3
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4936b4
mov dword [ebp - 0x10], esi
call fcn.0043ba90
test al, al
jne 0x40a4d3
mov byte [0], bl
mov eax, dword [esi + 0x3c]
or edx, 0xffffffff
mov ecx, esi
cmp dword [eax + esi + 0x50], edx
cmovb edx, dword [eax + esi + 0x50]
call fcn.0040a0d6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40abf3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x4b206c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
mov esi, ecx
mov dword [esp + 0x10], esi
cmp edi, ebx
jne 0x40ac21
xor eax, eax
jmp 0x40ad98
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40ac4b
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x40ac4b
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x40ad98
cmp dword [esi + 0x4c], 0
je 0x40ad96
mov ecx, esi
call fcn.0040ae8c
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x40ac78
push dword [esi + 0x4c]
push edi
call fcn.0040a6c7
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x40ad96
mov eax, dword [ebp + 8]
push ecx
mov dword [esp + 0x38], ecx
mov byte [esp + 0x28], cl
lea ecx, [esp + 0x28]
push 8
mov byte [esp + 0x14], al
mov dword [esp + 0x40], 0xf
call fcn.00405dd4
lea eax, [esi + 0x40]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x38]
mov esi, dword [esi + 0x38]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x28]
cmp edi, 0x10
lea edx, [esp + 0x28]
mov edi, dword [esi]
cmovae ecx, dword [esp + 0x28]
cmovae edx, dword [esp + 0x28]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x2c]
call dword [edi + 0x1c]
test eax, eax
js 0x40ad89
cmp eax, 1
jg 0x40ad6c
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x24]
mov ecx, dword [esp + 0x24]
cmp edi, 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x1c], edx
je 0x40ad39
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [esp + 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.004707dc
mov edx, dword [esp + 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x40ad89
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x20], eax
jne 0x40ad67
test edx, edx
jne 0x40aca6
cmp dword [esp + 0x34], 0x20
jae 0x40ad89
push edx
push 8
lea ecx, [esp + 0x2c]
call fcn.004060b2
jmp 0x40aca2
mov ebx, dword [ebp + 8]
jmp 0x40ad89
cmp eax, 3
jne 0x40ad89
mov eax, dword [esp + 0x10]
push dword [eax + 0x4c]
push dword [esp + 0x10]
call fcn.0040a6c7
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [esp + 0x2c]
call fcn.00401abf
mov eax, ebx
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00460c27
mov esp, ebp
pop ebp
ret 4
Function at 0x40aeda
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4b206c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40aff3
cmp byte [ebx + 0x3d], 0
je 0x40aff3
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40af1a
xor al, al
jmp 0x40aff5
xor eax, eax
mov dword [esp + 0x28], 0xf
push eax
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x1c], al
call fcn.00405dd4
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x18]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40af7e
sub eax, 1
je 0x40af82
dec eax
sub eax, 1
je 0x40afe0
xor bl, bl
jmp 0x40afe2
mov byte [ebx + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x40afc1
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004707dc
add esp, 0x10
cmp esi, eax
jne 0x40af7a
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
cmp byte [ebx + 0x3d], 0
je 0x40afe0
test esi, esi
jne 0x40af40
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.004060b2
jmp 0x40af38
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.00401abf
mov al, bl
jmp 0x40aff5
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00460c27
mov esp, ebp
pop ebp
ret
Function at 0x40c010
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
sub esp, 8
cmp dword [eax + 0x14], 0x10
mov edx, esp
jb 0x40c034
mov ecx, dword [eax]
jmp 0x40c036
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.004137d0
mov esi, eax
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x40c053
mov esi, dword [esi]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push dword [ebp + 0xc]
call fcn.004137d0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40c06c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
mov eax, dword [ebp - 0xc]
setne bl
cmp eax, 8
jb 0x40c0cc
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x40c133
add eax, eax
cmp eax, 0x1000
jb 0x40c0c3
test cl, 0x1f
jne 0x40c138
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40c13d
sub ecx, eax
cmp ecx, 4
jb 0x40c142
cmp ecx, 0x23
ja 0x40c147
mov ecx, eax
push ecx
call fcn.00460c6b
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0
cmp eax, 8
jb 0x40c11f
mov ecx, dword [ebp - 0x38]
inc eax
cmp eax, 0x7fffffff
ja 0x40c14c
add eax, eax
cmp eax, 0x1000
jb 0x40c116
test cl, 0x1f
jne 0x40c151
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40c156
sub ecx, eax
cmp ecx, 4
jb 0x40c15b
cmp ecx, 0x23
ja 0x40c160
mov ecx, eax
push ecx
call fcn.00460c6b
add esp, 4
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c27
mov esp, ebp
pop ebp
ret 0xc
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
int3

Function at 0x40c170
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.004137d0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40c19a
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
mov eax, dword [ebp - 8]
setne bl
cmp eax, 8
jb 0x40c1e7
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x40c1fa
add eax, eax
cmp eax, 0x1000
jb 0x40c1de
test cl, 0x1f
jne 0x40c1ff
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40c204
sub ecx, eax
cmp ecx, 4
jb 0x40c209
cmp ecx, 0x23
ja 0x40c20e
mov ecx, eax
push ecx
call fcn.00460c6b
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
int3
Function at 0x40eac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x40eacd
mov eax, dword [esi]
jmp 0x40eacf
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40eaff
shr eax, 4
and al, 1
je 0x40eaff
mov ecx, esi
call fcn.0040e9e0
test al, al
jne 0x40eafb
push 1
push 0x495ac8
mov ecx, esi
call fcn.00401d59
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x40ff80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
call fcn.00460c38
mov ecx, eax
call fcn.0040fbb0
mov dword [0x4b6964], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 8], 7
xor eax, eax
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
cmp word [edx], ax
jne 0x40ffc9
xor ecx, ecx
jmp 0x40ffdf
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ffd0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.00401a46
mov ecx, dword [0x4b6964]
lea eax, [ebp - 0x1c]
push eax
call fcn.00411050
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x410037
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x410048
add eax, eax
cmp eax, 0x1000
jb 0x41002e
test cl, 0x1f
jne 0x41004d
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x410052
sub ecx, eax
cmp ecx, 4
jb 0x410057
cmp ecx, 0x23
ja 0x41005c
mov ecx, eax
push ecx
call fcn.00460c6b
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00460c27
mov esp, ebp
pop ebp
ret
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
int3
Function at 0x411050
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], 0
mov ecx, 0x495adc
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411090
sub ecx, esi
lea eax, [ebp - 0x20]
sar ecx, 1
push ecx
push 0x495adc
push eax
mov ecx, edx
call fcn.00417ac0
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x4110ea
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
cmovae eax, dword [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [ebp - 0x24]
call fcn.00410090
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x411129
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x41113b
add eax, eax
cmp eax, 0x1000
jb 0x411120
test cl, 0x1f
jne 0x411140
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x411145
sub ecx, eax
cmp ecx, 4
jb 0x41114a
cmp ecx, 0x23
ja 0x41114f
mov ecx, eax
push ecx
call fcn.00460c6b
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00460c27
mov esp, ebp
pop ebp
ret 4
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
int3

Function at 0x414340
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x41439b
mov ecx, esi
jmp 0x4143a0
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4143c5
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x4143af
mov eax, dword [eax]
jmp 0x414393
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4147a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x41481c
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x41481c
mov ecx, dword [edi]
nop word [eax + eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x414861
cmp esi, eax
jne 0x414810
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x41484a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x414899
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x4148bb
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.0040d070
push edi
call fcn.00460c6b
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4148a1
mov dword [ecx], edi
jmp 0x4148bb
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4148bb
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004148e0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415180
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x4b6bec]
mov dword [ebp - 0x648], edx
mov dword [ebp - 0x64c], ecx
push edi
mov edi, dword [ebp + 0x20]
test esi, esi
jne 0x41537b
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00463e50
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00463e50
push 0xffffffffffffffff
push 0x492bec
lea eax, [ebp - 0x414]
push eax
push 0x493918
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00415400
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x415251
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4152d7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4152d7
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4152d7
push 0x110
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.00463e50
add esp, 0xc
mov dword [ebp - 0x644], 0x114
lea eax, [ebp - 0x644]
push eax
call esi
mov eax, dword [ebp - 0x640]
test eax, eax
je 0x4152d7
mov dword [0x4b6bec], eax
mov eax, dword [ebp - 0x63c]
mov dword [0x4b69cc], eax
mov eax, dword [ebp - 0x638]
mov dword [0x4b69d0], eax
mov eax, dword [ebp - 0x634]
mov dword [0x4b69d4], eax
lea eax, [ebp - 0x630]
push 0xffffffffffffffff
push eax
push 0x104
push 0x4b69e0
call fcn.00471819
add esp, 0x10
push 0x118
lea eax, [ebp - 0x52c]
push 0
push eax
call fcn.00463e50
add esp, 0xc
mov dword [ebp - 0x530], 0x11c
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [0x4b6bec]
test eax, eax
je 0x415375
test esi, esi
jne 0x41533f
mov eax, dword [ebp - 0x528]
mov esi, dword [ebp - 0x52c]
mov dword [0x4b69cc], eax
mov eax, dword [ebp - 0x524]
mov dword [0x4b69d0], eax
mov eax, dword [ebp - 0x520]
mov dword [0x4b6bec], esi
mov dword [0x4b69d4], eax
cmp byte [0x4b69da], 0
mov edx, dword [ebp - 0x648]
jne 0x41537b
movzx eax, word [ebp - 0x41a]
mov word [0x4b6be8], ax
movzx eax, word [ebp - 0x41c]
mov word [0x4b69d8], ax
mov al, byte [ebp - 0x416]
mov byte [0x4b69da], al
jmp 0x41537b
mov edx, dword [ebp - 0x648]
mov eax, dword [ebp - 0x64c]
test eax, eax
je 0x415387
mov dword [eax], esi
test edx, edx
je 0x415392
mov eax, dword [0x4b69cc]
mov dword [edx], eax
test ebx, ebx
je 0x41539d
mov eax, dword [0x4b69d0]
mov dword [ebx], eax
test edi, edi
je 0x4153a8
mov al, byte [0x4b69da]
mov byte [edi], al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460c27
mov esp, ebp
pop ebp
ret
Function at 0x416f30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00461a60
mov eax, dword [0x4b206c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100c]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [ebp - 0x808]
mov dword [ebp - 0x100c], 0
push edx
lea edx, [ebp - 0x1010]
mov dword [ebp - 0x1010], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [ebp - 0x100c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4170ce
mov ecx, dword [ebp - 0x1010]
cmp ecx, 1
jne 0x417012
cmp word [ebp - 0x808], ax
jne 0x416fd0
xor ecx, ecx
lea eax, [ebp - 0x808]
push ecx
push eax
mov ecx, edi
call fcn.00401a46
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x808]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416fe0
sub ecx, edx
lea eax, [ebp - 0x808]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00401a46
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x4170c9
push 0x400
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x4170b2
cmp eax, 0x400
ja 0x4170b2
cmp word [ebp - 0x1008], 0
jne 0x417074
xor ecx, ecx
lea eax, [ebp - 0x1008]
push ecx
push eax
mov ecx, edi
call fcn.00401a46
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1008]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417080
sub ecx, edx
lea eax, [ebp - 0x1008]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00401a46
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00460c27
mov esp, ebp
pop ebp
ret 8
Function at 0x4186b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 8
jb 0x4186c3
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x4186db
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.00418e50
mov ebx, dword [ebp - 0x18]
test al, al
je 0x418712
push edi
push 0
push ebx
call fcn.00463e50
lea eax, [ebx + edi]
add esp, 0xc
mov dword [ebp - 0x14], eax
push ebx
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41876d
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41876d
mov esi, dword [ebp - 4]
test esi, esi
je 0x41876d
push 0x1c
call fcn.00460c38
movzx ecx, word [esi + 2]
add esp, 4
push ecx
movzx ecx, word [esi]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.00418d40
mov ebx, dword [ebp - 0x18]
mov esi, eax
jmp 0x41876f
xor esi, esi
test ebx, ebx
je 0x4187a2
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp eax, 0x1000
jb 0x418799
test bl, 0x1f
jne 0x4187ab
mov eax, dword [ebx - 4]
cmp eax, ebx
jae 0x4187b0
sub ebx, eax
cmp ebx, 4
jb 0x4187b5
cmp ebx, 0x23
ja 0x4187ba
mov ebx, eax
push ebx
call fcn.00460c6b
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
call fcn.004662a1
int3