joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086250
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100c844c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10078e00
mov dword [ebp - 0x14], eax
cmp dword [0x100e850c], edi
jne 0x10086341
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x100862ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10086421
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10086421
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10086421
push eax
call ebx
push 0x100ab8fc
push esi
mov dword [0x100e850c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100ab90c
push esi
mov dword [0x100e8510], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x100e8514], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100e851c], eax
test eax, eax
je 0x1008633e
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100e8518], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10086366
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10086359
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1008637b
push 4
pop eax
jmp 0x10086423
cmp dword [ebp - 0x14], edi
je 0x1008637b
push dword [0x100e850c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10086360
mov eax, dword [0x100e8518]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x100863d9
cmp dword [0x100e851c], esi
je 0x100863d9
push eax
call ebx
push dword [0x100e851c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100863d9
test eax, eax
je 0x100863d9
call ecx
test eax, eax
je 0x100863ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100863ce
test byte [ebp - 8], 1
jne 0x100863d9
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10086409
mov eax, dword [0x100e8510]
cmp eax, esi
je 0x10086406
push eax
call ebx
test eax, eax
je 0x10086406
call eax
mov edi, eax
test edi, edi
je 0x10086406
mov eax, dword [0x100e8514]
cmp eax, esi
je 0x10086406
push eax
call ebx
test eax, eax
je 0x10086406
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x100e850c]
call ebx
test eax, eax
je 0x10086421
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10086423
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007cb2c
leave
ret
Function at 0x1008d64f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1008d687
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1008b721
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1008b6f9
jmp 0x1008d693
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1008ed44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1008ed86
call fcn.100946a2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1008ed86
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1008ed7d
xor eax, eax
jmp 0x1008ed8e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1008ed94
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x46f569e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x243a114a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret

Function at 0x402060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fd80
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4607a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4021b1
cmp dword [ebp - 0x10], 2
jl 0x4021b1
lea ecx, [ebp - 0x1c]
call fcn.00402780
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 1
jmp 0x4020db
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jge 0x402174
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x28]
call fcn.004027a0
mov byte [ebp - 4], 1
push 0x453620
lea ecx, [ebp - 0x28]
call fcn.00402a00
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x40213f
push 0x453624
lea ecx, [ebp - 0x28]
call fcn.00402970
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x28]
call fcn.004029d0
push 0x453628
lea ecx, [ebp - 0x28]
call fcn.004029d0
mov ecx, dword [ebp - 0x20]
add ecx, 1
cmp ecx, dword [ebp - 0x10]
jge 0x402157
push 0x45362c
lea ecx, [ebp - 0x28]
call fcn.004029d0
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004029a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402ca0
jmp 0x4020d2
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x1c]
call fcn.0043c600
push eax
push 0x410
push 0x461b40
call fcn.00403200
mov dword [ebp - 0x2c], 0x461b40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00402ca0
mov eax, dword [ebp - 0x2c]
jmp 0x4021c3
cmp dword [ebp - 0x14], 0
je 0x4021c1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x403b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
push 0x4538a0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403b58
xor eax, eax
jmp 0x403bfa
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403b76
xor eax, eax
jmp 0x403bfa
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403b91
xor eax, eax
jmp 0x403bfa
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x403bbb
cmp dword [ebp - 8], 0
jne 0x403bbf
xor eax, eax
jmp 0x403bfa
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00403350
test eax, eax
jne 0x403bd7
xor eax, eax
jmp 0x403bfa
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.0043e8b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4043d0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fe7a
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x4607a0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x248]
call fcn.00409d70
test eax, eax
jne 0x40441e
xor eax, eax
jmp 0x4045d6
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.0043f140
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x234]
push edx
call fcn.00403200
push str.Baymax.Ini
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.00403250
cmp dword [ebp + 0xc], 0
jne 0x404480
lea ecx, [ebp - 0x234]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404480
mov eax, 1
jmp 0x4045d6
push 0
push 0
push 2
push 0
push 7
push 0xc0000000
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4044ac
xor eax, eax
jmp 0x4045d6
mov byte [ebp - 0x20], 0xff
mov byte [ebp - 0x1f], 0xfe
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 2
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str._BAYMAX__r_n
lea ecx, [ebp - 0x18]
call fcn.004027a0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404e30
shl eax, 1
push eax
lea ecx, [ebp - 0x18]
call fcn.0043c600
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x248]
call fcn.00415200
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x248]
call fcn.0040a090
push eax
lea ecx, [ebp - 0x14]
call fcn.00404ff0
movzx ecx, al
test ecx, ecx
je 0x4045ae
lea ecx, [ebp - 0x238]
call fcn.00402780
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00418140
mov edx, dword [eax]
push edx
push str._s_r_n
lea eax, [ebp - 0x238]
push eax
call fcn.00404680
add esp, 0xc
push 0
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00404e30
shl eax, 1
push eax
lea ecx, [ebp - 0x238]
call fcn.0043c600
push eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x14]
call fcn.00418120
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.00402ca0
jmp 0x404518
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x244], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402ca0
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0043ec15
mov esp, ebp
pop ebp
ret 8
Function at 0x4086b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
call fcn.00408840
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4086ed
xor eax, eax
jmp 0x408800
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockFile]
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x40872c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
cmp dword [ebp - 4], 0
jne 0x4087e1
cmp dword [ebp - 0x10], 0xa00000
jge 0x4087e1
cmp dword [ebp - 0x10], 6
jle 0x4087e1
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0043f1ba
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x4087e1
mov eax, dword [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0043f140
add esp, 0xc
mov dword [ebp - 0x1c], 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4087c8
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x10]
jne 0x4087c8
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x28]
call fcn.00408950
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0043ec24
add esp, 4
mov dword [ebp - 0x14], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x40d9f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45049e
mov eax, dword fs:[0]
push eax
sub esp, 0x5b8
mov eax, dword [0x4607a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5bc], ecx
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x4ac]
push ecx
call fcn.00401000
add esp, 4
push 0x453ec4
lea ecx, [ebp + 8]
call fcn.0043c600
push eax
call fcn.0043fec4
add esp, 8
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x40da88
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402ca0
mov eax, dword [ebp - 0x4b0]
jmp 0x40db8e
mov edx, dword [ebp - 0x3c]
push edx
push 0x400
push 1
lea eax, [ebp - 0x454]
push eax
call fcn.0043fde1
add esp, 0x10
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x40dac7
mov ecx, dword [ebp - 0x50]
push ecx
lea edx, [ebp - 0x454]
push edx
lea eax, [ebp - 0x4ac]
push eax
call fcn.00401040
add esp, 0xc
jmp 0x40da88
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0043fac5
add esp, 4
mov dword [ebp - 0x3c], 0
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x4ac]
push eax
call fcn.00401f70
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x38], 0x20
mov edx, dword [ebp - 0x38]
push edx
lea eax, [ebp - 0x34]
push eax
push 0x10
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040d8a0
add esp, 0x10
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x5b4]
call fcn.0040e020
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x5c4]
call fcn.0043c600
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00402970
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5b4]
call fcn.0040e060
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402ca0
mov eax, dword [ebp - 0x5b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ec15
mov esp, ebp
pop ebp
ret 8
Function at 0x40dbb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4504ce
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4607a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], 0
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x40dc09
mov eax, dword [ebp - 0x20]
jmp 0x40dd13
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x19000
jae 0x40dc30
cmp dword [ebp - 0x1c], 0
je 0x40dc42
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
jmp 0x40dd13
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00402780
mov dword [ebp - 4], 0
lea edx, [ebp - 0x18]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
mov eax, dword [ebp + 8]
push eax
call fcn.004027a0
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x40]
call fcn.0040d9f0
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x40dc9c
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402ca0
mov eax, dword [ebp - 0x30]
jmp 0x40dd13
lea ecx, [ebp - 0x18]
call fcn.0043c600
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x40]
call fcn.0041b760
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0040dfb0
push eax
lea ecx, [ebp - 0x14]
call fcn.00428a00
movzx ecx, al
test ecx, ecx
je 0x40dcfb
lea ecx, [ebp - 0x18]
call fcn.0043c600
push eax
lea ecx, [ebp - 0x14]
call fcn.004289e0
mov ecx, eax
call fcn.0040de90
test eax, eax
jne 0x40dcf1
mov dword [ebp - 0x20], 1
jmp 0x40dcfb
lea ecx, [ebp - 0x14]
call fcn.00421520
jmp 0x40dcb0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402ca0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40dd30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450501
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4607a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
call fcn.0040e890
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40dd9a
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040e8c0
mov eax, dword [ebp - 0x24]
jmp 0x40de7e
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040e920
test eax, eax
jne 0x40ddaf
jmp 0x40de51
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.0040ded0
mov byte [ebp - 4], 1
push 0x453f1c
lea ecx, [ebp - 0x1c]
call fcn.00405070
test eax, eax
je 0x40ddef
push str.Baymax_Patcher_Tools
lea ecx, [ebp - 0x1c]
call fcn.00405070
test eax, eax
je 0x40ddef
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402ca0
jmp 0x40de51
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040df10
mov byte [ebp - 4], 2
push 0x453f70
lea ecx, [ebp - 0x20]
call fcn.00405070
test eax, eax
je 0x40de2a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402ca0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402ca0
jmp 0x40de51
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402ca0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402ca0
xor ecx, ecx
jne 0x40dd9a
cmp dword [ebp - 0x10], 0
jne 0x40de66
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2c]
call fcn.0040dbb0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040e8c0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e920
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0043f226
add esp, 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40e952
xor eax, eax
jmp 0x40e9f9
mov eax, dword [ebp - 0x10]
push eax
call fcn.0043f1ba
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40e990
mov ecx, dword [ebp - 0x18]
call fcn.0040e8e0
xor eax, eax
jmp 0x40e9f9
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push str.VarFileInfoTranslation
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40e9b8
mov ecx, dword [ebp - 0x18]
call fcn.0040e8e0
xor eax, eax
jmp 0x40e9f9
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
and edx, 0xffff
movzx ecx, dx
and ecx, 0xffff
movzx edx, cx
shl edx, 0x10
or eax, edx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4