joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477160
Capabilities:
Gather filezilla information

Disassembly:
push 0xffffffffffffffff
push 0x4ba408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [esi]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.Server.Host
call fcn.004abd48
mov edi, dword [esp + 0x24]
push edi
call fcn.00476f90
mov eax, dword [esi + 4]
add esp, 0xc
cdq
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Server.Port
call fcn.004abd48
push edi
call fcn.00476fc0
mov eax, dword [esi + 8]
add esp, 0x10
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Server.User
call fcn.004abd48
push edi
call fcn.00476f90
add esp, 8
lea eax, [esi + 0xc]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x24]
push ecx
call fcn.004249e0
add esp, 8
mov eax, dword [eax]
mov dword [esp + 0x14], 0
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Server.Pass
call fcn.004abd48
push edi
call fcn.00476f90
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x10]
cdq
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Firewall_bypass
call fcn.004abd48
push edi
call fcn.00476fc0
mov eax, dword [esi + 0x18]
add esp, 0x10
cdq
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Dont_Remember_Pass
call fcn.004abd48
push edi
call fcn.00476fc0
mov eax, dword [esi + 0x1c]
add esp, 0x10
cdq
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Server_Type
call fcn.004abd48
push edi
call fcn.00476fc0
mov eax, dword [esi + 0x14]
add esp, 0x10
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Path
call fcn.004abd48
push edi
call fcn.00476f90
mov eax, dword [esi + 0x24]
add esp, 0xc
cdq
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Pasv_Mode
call fcn.004abd48
push edi
call fcn.00476fc0
mov eax, dword [esi + 0x28]
add esp, 0x10
cdq
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Time_Zone_Offset
call fcn.004abd48
push edi
call fcn.00476fc0
mov ecx, dword [esp + 0x1c]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x47cd30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bb154
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call sub.MFC42.DLL_CString::CString_2
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 8]
mov byte [esp + 0x14], 1
call fcn.004958d0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.00452d80
lea ecx, [esi + 0xa0]
mov dword [esp + 0x14], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xa4]
mov byte [esp + 0x14], 4
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], 0x104
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x497370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bcd5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 4], 0
call fcn.004958d0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 1
call fcn.00497150
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 4]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ecx, [esi + 8]
mov dword [edx + 4], eax
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x38]
add esp, 4
dec ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004961f0
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call fcn.00496360
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x49a280
Capabilities:
Access peb ldr_data
Get number of processors
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bd47f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [esp + 0xc], 0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push str.Software8uftpSite_Manager_
push ecx
mov dword [esp + 0x28], 2
call sub.MFC42.DLL_operator
mov eax, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x49a39f
push edi
push 0x64
call sub.MFC42.DLL_operatornew
mov esi, eax
mov ecx, 0x19
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x38]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x64
push ecx
push esi
push eax
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
je 0x49a353
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x28]
add esp, 4
mov ecx, esi
push 0x4e58d8
call fcn.004abd48
mov ebx, 1
mov dword [esp + 0xc], ebx
jmp 0x49a3b8
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [esp + 0x2c]
call fcn.004abd48
push esi
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x28]
add esp, 4
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString_1
mov ebx, 1
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
jmp 0x49a3b8
mov esi, dword [esp + 0x24]
push 0x4e58d8
mov ecx, esi
call fcn.004abd48
mov ebx, 1
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x49a3f0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bd4a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x4df1dc
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 2
call sub.MFC42.DLL_CString::TrimLeft
mov eax, dword [esp + 0x30]
mov eax, dword [eax - 8]
inc eax
push eax
call sub.MFC42.DLL_operatornew
mov edi, dword [esp + 0x34]
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x28]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.Software8uftpSite_Manager_
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
lea edx, [esp + 0x10]
push 0
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
lea ecx, [esp + 0x14]
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x49a4c7
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov eax, dword [eax - 8]
inc eax
push eax
push ebp
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a0110
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bdfe8
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
mov ecx, esi
mov eax, dword [edi]
push eax
mov eax, dword [esi + 0x24]
push str.Host
push eax
call fcn.00408350
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x24]
push eax
push str.Port
push ecx
mov ecx, esi
call fcn.004082d0
mov eax, dword [edi + 8]
mov edx, dword [esi + 0x24]
push eax
push str.User
push edx
mov ecx, esi
call fcn.00408350
mov eax, dword [edi + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi + 0x24]
push str.RemoteDir
push eax
call fcn.00408350
mov eax, dword [edi + 0x14]
mov ecx, dword [esi + 0x24]
push eax
push str.LocalDir
push ecx
mov ecx, esi
call fcn.00408350
lea edx, [esp + 0x20]
push 0x47
push edx
call fcn.00474330
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0xc
test eax, eax
jne 0x4a01ba
mov eax, dword [edi + 0x20]
test eax, eax
jne 0x4a01ba
xor bl, bl
jmp 0x4a01bc
mov bl, 1
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x4a01e0
mov eax, dword [esi + 0x24]
push 0x4e58d8
push str.Pass
push eax
mov ecx, esi
call fcn.00408350
jmp 0x4a0229
push ecx
lea edx, [edi + 0xc]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x20]
push eax
call fcn.004249e0
add esp, 8
mov eax, dword [eax]
mov ecx, dword [esi + 0x24]
push eax
push str.Pass
push ecx
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.00408350
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov edx, dword [edi + 0x18]
mov eax, dword [esi + 0x24]
push edx
push str.Logontype
push eax
mov ecx, esi
call fcn.004082d0
mov ecx, dword [edi + 0x1c]
mov edx, dword [esi + 0x24]
push ecx
push str.FWBypass
push edx
mov ecx, esi
call fcn.004082d0
mov eax, dword [edi + 0x20]
mov ecx, dword [esi + 0x24]
push eax
push str.DontSavePass
push ecx
mov ecx, esi
call fcn.004082d0
mov edx, dword [edi + 0x24]
mov eax, dword [esi + 0x24]
push edx
push str.ServerType
push eax
mov ecx, esi
call fcn.004082d0
mov ecx, dword [edi + 0x30]
mov edx, dword [esi + 0x24]
push ecx
push str.PasvMode
push edx
mov ecx, esi
call fcn.004082d0
mov eax, dword [edi + 0x34]
mov ecx, dword [esi + 0x24]
push eax
push str.TimeZoneOffset
push ecx
mov ecx, esi
call fcn.004082d0
mov edx, dword [edi + 0x38]
mov eax, dword [esi + 0x24]
push edx
push str.TimeZoneOffsetMinutes
push eax
mov ecx, esi
call fcn.004082d0
mov ecx, dword [edi + 0x3c]
mov edx, dword [esi + 0x24]
push ecx
push 0x4e51ac
push edx
mov ecx, esi
call fcn.00408350
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x4a0e20
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x4be0b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x428]
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_accept
mov dword [esp + 0x434], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4a0f21
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edx, [esp + 0x18]
push 0x400
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
call ebp
test eax, eax
jne 0x4a0f01
lea ecx, [esp + 0x428]
push 0x4df1dc
lea edx, [esp + 0x14]
push ecx
push edx
call sub.MFC42.DLL_operator_3
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x424], 1
call fcn.004abdba
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, edi
call fcn.004a0e20
test eax, eax
je 0x4a0eda
inc esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x420], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push 0x400
push eax
push esi
push ecx
call ebp
test eax, eax
je 0x4a0e90
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x428]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 0x428]
mov dword [esp + 0x420], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x418]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x418
ret 4
Function at 0x4a2ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4be50f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call sub.MFC42.DLL_CString::CString_2
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 4
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 4], 0x15
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ab4a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4bf028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004ab3c0
add esp, 4
push str.Trusted_Certs.dat
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x44], 0
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x10]
mov ebx, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
cmp ebx, 0xffffffff
je 0x4ab575
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x18]
push 0
push edx
lea eax, [esp + 0x24]
push 0x14
push eax
push ebx
call ebp
test eax, eax
je 0x4ab56e
cmp dword [esp + 0x18], 0x14
jne 0x4ab56e
mov esi, dword [esp + 0x40]
mov ecx, 5
lea edi, [esp + 0x1c]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x4ab520
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4ab770
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4bf0bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
xor ebx, ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.004ab6d0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x74], 1
mov eax, dword [ecx - 8]
inc eax
push eax
call sub.MFC42.DLL_operatornew
mov edi, dword [esp + 0x18]
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x24]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x4ab80a
mov esi, dword [esp + 0x78]
push str.8uftp
mov ecx, esi
call fcn.004abd48
mov dword [esp + 0x20], 1
jmp 0x4ab93d
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
push esi
push edi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x30]
lea edx, [esp + 0x28]
push ecx
push edx
push str.VarFileInfoTranslation
push esi
mov byte [esp + 0x80], 2
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4ab893
mov eax, dword [esp + 0x28]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x3c]
push str.StringFileInfo_04x_04xProductName
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x14]
lea eax, [esp + 0x34]
push ecx
push edx
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4ab893
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0x2c]
lea eax, [esp + 0x14]
push edx
push eax
push 0x4df1dc
push esi
mov byte [esp + 0x80], 3
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4ab8f7
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
mov edx, eax
and edx, 0xffff
shr eax, 0x10
push edx
push eax
mov eax, ecx
lea edx, [esp + 0x20]
and eax, 0xffff
shr ecx, 0x10
push eax
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
push str._s__d._d._d._d
push edx
call sub.MFC42.DLL_CString::Format_1
add esp, 0x1c
push ebp
call sub.MFC42.DLL_operatordelete
push esi
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x80]
add esp, 8
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 1
mov byte [esp + 0x70], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x70], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x70], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x68]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x4ab960
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4bf0e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
xor bl, bl
call fcn.004ab6d0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x6c], 0
mov eax, dword [ecx - 8]
inc eax
push eax
call sub.MFC42.DLL_operatornew
mov edi, dword [esp + 0x18]
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4ab9ff
lea ecx, [esp + 0x10]
mov dword [esp + 0x68], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
add esp, 0x5c
ret
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
push edx
push str.VarFileInfoTranslation
push edi
mov byte [esp + 0x78], 1
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4aba86
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x34]
push str.StringFileInfo_04x_04xProductName
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4aba86
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::operator
lea edx, [esp + 0x24]
lea eax, [esp + 0x14]
push edx
push eax
push 0x4df1dc
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4abad9
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
mov edx, eax
and edx, 0xffff
shr eax, 0x10
push edx
push eax
mov eax, ecx
and eax, 0xfff
shr ecx, 0x10
push eax
push ecx
mov ecx, dword [esp + 0x80]
push str._d._d._d._d
push ecx
call sub.MFC42.DLL_CString::Format_1
add esp, 0x18
mov bl, 1
push ebp
call sub.MFC42.DLL_operatordelete
push edi
call sub.MFC42.DLL_operatordelete
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x68], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x60]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret
Function at 0x654481
Capabilities:
Encode data using xor

Disassembly:
cli
lcall 0, 0xff8360
add byte [edi], cl
mov edi, 0x14e9d0
add byte [eax], al
pop edi
iretd
mov edi, 0xe649a331
mov cl, 0xd
pop ebx
mov si, dx
jmp 0x6544a5
jmp 0x6544be
mov ebp, 0xbb38a659
mov dx, si
add ebx, 0xc522bb57
mov esi, 0x1c1b86c3
mov di, bp
jmp 0x6544ed
mov dl, 0x25
movsx ecx, bp
xor dword [ebx + 0x3add447f], 0x7c9b5d13
movsx edx, bp
sub ebx, 2
sub ebx, 2
inc ebp
cmp ebp, 0xbb38a767
jne 0x6544ed
mov edi, 0xcf0e9247
movsx edi, bx
jmp 0x65443b