joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b17a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edx
push eax
xor esi, esi
mov dword [ebp - 0xc], ecx
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, esi
mov dword [ebp - 4], esi
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b263
mov eax, 0x20000
push eax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40b263
lea eax, [ebp - 8]
mov esi, edi
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b1fc
mov esi, dword [ebp - 8]
shr esi, 1
dec esi
lea esi, [edi + esi*2]
push dword [ebp - 0xc]
push str.___s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
xor eax, eax
mov word [esi], ax
add esi, 2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40b233
push eax
push 0x507c6c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
xor eax, eax
mov word [esi], ax
add esi, 2
mov word [esi], ax
sub esi, edi
add esi, 2
push esi
push edi
push 7
mov dword [ebp - 8], esi
xor esi, esi
push esi
push str.PendingFileRenameOperations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
inc ecx
test eax, eax
cmove ebx, ecx
cmp dword [ebp - 4], 0
je 0x40b272
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40b285
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40b553
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x810], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x814], esi
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x80c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x80c], 0
mov edi, eax
jne 0x40b70a
cmp edi, 0x20
je 0x40b5b7
cmp edi, 5
jne 0x40b654
and dword [ebp - 0x808], 0
cmp dword [ebp + 0xc], 0
je 0x40b62e
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x808]
call fcn.0040afc4
test eax, eax
jne 0x40b62e
cmp dword [ebp - 0x808], eax
je 0x40b62e
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40b615
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x80c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x808]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x80c], 0
jne 0x40b70a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x810]
inc eax
mov dword [ebp - 0x810], eax
cmp eax, 5
jl 0x40b57b
cmp edi, 5
je 0x40b671
cmp edi, 0x20
je 0x40b671
cmp edi, 0x21
je 0x40b671
push 0x12
pop eax
mov dword [esi], edi
push 0x15
cmp edi, 2
pop ecx
cmove eax, ecx
jmp 0x40b710
push 0x14
lea eax, [ebx + 2]
push 0x507d2c
push eax
call fcn.004d8169
add esp, 0xc
test eax, eax
jne 0x40b6ad
lea eax, [ebx + 0x2a]
push eax
movzx eax, word [ebx]
push eax
lea eax, [ebp - 0x804]
push 0x507d58
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ebx, [ebp - 0x804]
jmp 0x40b6cc
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x40b6fc
mov esi, dword [ebp - 0x814]
xor edx, edx
mov ecx, ebx
call fcn.0040b532
test eax, eax
jne 0x40b6fc
mov dword [esi], edi
cmp edi, 5
jne 0x40b6e4
push 0x13
jmp 0x40b707
cmp edi, 0x20
je 0x40b6f8
cmp edi, 0x21
je 0x40b6f8
push 0x12
pop eax
push 0x70
jmp 0x40b665
push 0x72
jmp 0x40b707
mov eax, dword [ebp - 0x814]
push 2
and dword [eax], 0
pop eax
jmp 0x40b710
and dword [esi], 0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x40b71f
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004f3f20
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1008], 0
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x1010], eax
mov ebx, ecx
inc esi
push edi
mov edi, edx
test ebx, ebx
je 0x40b794
push 0x14
lea eax, [ebx + 2]
push 0x507d2c
push eax
call fcn.004d8169
add esp, 0xc
test eax, eax
jne 0x40b794
lea eax, [ebx + 0x2a]
push eax
movzx eax, word [ebx]
push eax
lea eax, [ebp - 0x804]
push 0x507d58
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x1008], esi
lea ebx, [ebp - 0x804]
test edi, edi
je 0x40b7d4
push 0x14
lea eax, [edi + 2]
push 0x507d2c
push eax
call fcn.004d8169
add esp, 0xc
test eax, eax
jne 0x40b7d4
lea eax, [edi + 0x2a]
push eax
movzx eax, word [edi]
push eax
lea eax, [ebp - 0x1004]
push 0x507d58
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edi, [ebp - 0x1004]
jmp 0x40b7da
mov esi, dword [ebp - 0x1008]
test esi, esi
je 0x40b7fb
mov edx, edi
mov ecx, ebx
call fcn.0040b532
test eax, eax
je 0x40b7f3
push 2
pop eax
jmp 0x40b8b6
push 0x12
pop eax
jmp 0x40b8bf
push 5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x1008], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x1008], 0
mov esi, eax
jne 0x40b8b3
and dword [ebp - 0x100c], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40b880
lea edx, [ebp - 0x100c]
call fcn.0040afc4
test eax, eax
jne 0x40b880
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40b86b
push 5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x1008], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x100c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1008], 0
jne 0x40b8b3
mov ecx, dword [ebp - 0x1010]
mov dword [ecx], esi
cmp esi, 5
jne 0x40b894
push 0x13
jmp 0x40b7f5
cmp esi, 0x20
je 0x40b8ac
cmp esi, 0x21
je 0x40b8ac
push 0x12
pop eax
push 0x70
cmp esi, 2
pop ecx
cmove eax, ecx
jmp 0x40b8bf
push 0x72
jmp 0x40b7f5
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x1010]
and dword [ecx], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x40b8ce
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
mov ebx, edx
mov eax, ecx
push ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
jne 0x40b96b
and dword [ebp - 4], edi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40b940
lea edx, [ebp - 4]
call fcn.0040afc4
test eax, eax
jne 0x40b940
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40b933
push edi
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x40b96b
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
cmp esi, 5
jne 0x40b94f
push 0x13
pop eax
jmp 0x40b974
cmp esi, 0x20
je 0x40b967
cmp esi, 0x21
je 0x40b967
push 0x12
pop eax
push 0x70
cmp esi, 2
pop ecx
cmove eax, ecx
jmp 0x40b974
push 0x72
jmp 0x40b94c
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b979
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b9d6
and dword [ebp - 4], 0
test edi, edi
je 0x40b9d2
lea edx, [ebp - 4]
mov ecx, edi
call fcn.0040afc4
test eax, eax
jne 0x40b9d2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40b9c4
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
jne 0x40b9d6
xor eax, eax
jmp 0x40b9d9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ba4d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
call fcn.0048dc50
xor ecx, ecx
xor esi, esi
inc ecx
cmp eax, ecx
jne 0x40baf8
cmp dword [ebp - 4], 0xffffffff
je 0x40baf8
push ebx
push dword [ebp - 4]
push str._nK7RTScan:Execing_task_on_station__lu___s_
call fcn.0040cec2
mov esi, 0x510
mov dword [ebp - 8], 4
push esi
call fcn.0049da45
mov edi, eax
add esp, 0x10
and dword [edi + 8], 0
lea ecx, [edi + 0xc]
push ebx
mov dword [edi], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ecx
call esi
push dword [ebp + 8]
lea edx, [edi + 0x40c]
push edx
call esi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, 0x10007
push eax
push 0x510
push edi
call fcn.0048dfc0
xor ecx, ecx
xor esi, esi
inc ecx
cmp eax, ecx
push 0x510
push edi
cmove esi, ecx
call fcn.0049da37
add esp, 0x18
cmp esi, 1
je 0x40bb67
xor esi, esi
push ebx
push str._nK7RTScan:Execing_task_locally__s_
call fcn.0040cec2
push 0x44
call fcn.0049da45
push 0x10
mov ebx, eax
call fcn.0049da45
push 0x44
push esi
push ebx
mov edi, eax
call fcn.0049ef70
add esp, 0x1c
mov dword [ebx], 0x44
push edi
push ebx
push dword [ebp + 8]
push esi
push 0x40
push esi
push esi
push esi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x40bb54
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 4]
call esi
xor esi, esi
inc esi
push 0x44
push ebx
call fcn.0049da37
push 0x10
push edi
call fcn.0049da37
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40bb77
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push ecx
xor edi, edi
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40bb9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x40bbcd
inc edi
jmp 0x40bbcd
mov ecx, esi
call fcn.0040a7b4
test eax, eax
jne 0x40bbc6
push 0x4b494c4c
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40bbc6
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x40bc7b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x51e850], 0
je 0x40bcc0
push esi
push ecx
call fcn.004d8288
mov esi, eax
pop ecx
test esi, esi
je 0x40bcbf
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push esi
push 0x40bc61
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40bcb8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40bcbf
push esi
call fcn.004c8ceb
pop ecx
pop esi
xor eax, eax
leave
ret
Function at 0x40bd66
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x51e850], 0
je 0x40bd93
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push 0x40bd3d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40bd93
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret

Function at 0x40be13
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp + 0xc]
or edx, 0xffffffff
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x104]
call fcn.0040159a
add esp, 0xc
lea eax, [ebp - 0x104]
xor edi, edi
mov dword [ebp - 0x108], eax
push str.K7RTScan
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x40be7f
push edi
lea eax, [ebp - 0x108]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret
Function at 0x40be8d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xa8], edx
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push ecx
mov dword [ebp - 0xac], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x9c], ebx
cmp ebx, 0xffffffff
je 0x40c063
push 0x1000
call fcn.004c8d06
mov dword [ebp - 0x94], eax
pop ecx
test eax, eax
je 0x40c05c
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x98]
lea ecx, [ebp - 0x84]
xor ebx, ebx
or edx, esi
or ebx, eax
mov dword [ebp - 0x90], edx
call fcn.00429510
xorps xmm0, xmm0
movlpd qword [ebp - 0xa4], xmm0
cmp edx, esi
jb 0x40bfeb
ja 0x40bf3f
cmp ebx, esi
jbe 0x40bfeb
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x90]
mov edx, ebx
sub edx, edi
sbb eax, ecx
mov dword [ebp - 0xa0], eax
jne 0x40bf73
cmp edx, 0x1000
ja 0x40bf73
mov eax, ebx
sub eax, edi
jmp 0x40bf78
mov eax, 0x1000
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], eax
push ecx
push eax
push dword [ebp - 0x94]
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bff9
cmp dword [ebp - 0x88], esi
je 0x40bff9
push dword [ebp - 0x88]
mov edx, dword [ebp - 0x94]
lea ecx, [ebp - 0x84]
call fcn.0042955b
add edi, dword [ebp - 0x88]
mov edx, dword [ebp - 0x90]
pop ecx
mov ecx, dword [ebp - 0x8c]
adc ecx, esi
mov dword [ebp - 0x8c], ecx
cmp ecx, edx
jb 0x40bf51
ja 0x40c005
cmp edi, ebx
jb 0x40bf51
jmp 0x40c005
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa4]
jmp 0x40c005
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
cmp edi, ebx
jne 0x40c04a
cmp ecx, edx
jne 0x40c04a
mov edi, dword [ebp - 0xa8]
lea ecx, [ebp - 0x84]
mov edx, edi
call fcn.004295a1
mov ebx, dword [ebp - 0xac]
test ebx, ebx
je 0x40c047
movzx eax, byte [edi + esi]
push eax
push str._02X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add ebx, 2
inc esi
cmp esi, 0x14
jl 0x40c02a
xor esi, esi
inc esi
push dword [ebp - 0x94]
call fcn.004c8ceb
mov ebx, dword [ebp - 0x9c]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x40c074
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xa0], edx
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push ecx
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x94], ebx
cmp ebx, 0xffffffff
je 0x40c22a
push 0x1000
call fcn.004c8d06
mov dword [ebp - 0x8c], eax
pop ecx
test eax, eax
je 0x40c223
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x90]
lea ecx, [ebp - 0x7c]
xor ebx, ebx
or edx, esi
or ebx, eax
mov dword [ebp - 0x88], edx
call fcn.004298eb
xorps xmm0, xmm0
movlpd qword [ebp - 0x9c], xmm0
cmp edx, esi
jb 0x40c1b5
ja 0x40c123
cmp ebx, esi
jbe 0x40c1b5
mov ecx, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x88]
mov edx, ebx
sub edx, edi
sbb eax, ecx
mov dword [ebp - 0x98], eax
jne 0x40c157
cmp edx, 0x1000
ja 0x40c157
mov eax, ebx
sub eax, edi
jmp 0x40c15c
mov eax, 0x1000
push esi
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], eax
push ecx
push eax
push dword [ebp - 0x8c]
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c1c3
cmp dword [ebp - 0x80], esi
je 0x40c1c3
push dword [ebp - 0x80]
mov edx, dword [ebp - 0x8c]
lea ecx, [ebp - 0x7c]
call fcn.0042992f
add edi, dword [ebp - 0x80]
mov edx, dword [ebp - 0x88]
pop ecx
mov ecx, dword [ebp - 0x84]
adc ecx, esi
mov dword [ebp - 0x84], ecx
cmp ecx, edx
jb 0x40c135
ja 0x40c1cf
cmp edi, ebx
jb 0x40c135
jmp 0x40c1cf
mov ecx, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
jmp 0x40c1cf
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x84]
cmp edi, ebx
jne 0x40c211
cmp ecx, edx
jne 0x40c211
mov edi, dword [ebp - 0xa0]
lea ecx, [ebp - 0x7c]
mov edx, edi
call fcn.00429975
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x40c20e
movzx eax, byte [edi + esi]
push eax
push str._02X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add ebx, 2
inc esi
cmp esi, 0x20
jl 0x40c1f1
xor esi, esi
inc esi
push dword [ebp - 0x8c]
call fcn.004c8ceb
mov ebx, dword [ebp - 0x94]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x40c6fe
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc0], eax
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb0], eax
cmp eax, 0xffffffff
je 0x40c8e6
lea ecx, [ebp - 0xbc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40c8da
mov eax, dword [ebp - 0xbc]
cmp eax, dword [edi]
jne 0x40c8da
mov eax, dword [ebp - 0xb8]
cmp eax, dword [edi + 4]
jne 0x40c8da
push 0x40000
call fcn.004c8d06
mov edx, eax
mov dword [ebp - 0xac], edx
pop ecx
test edx, edx
je 0x40c8da
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0x9c]
mov ebx, dword [ebp - 0xb8]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa8], ebx
call fcn.004168d1
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
cmp ebx, esi
jb 0x40c8f7
mov ecx, eax
ja 0x40c7d0
cmp ecx, esi
jbe 0x40c8f7
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
jmp 0x40c7de
mov edx, dword [ebp - 0xac]
mov eax, ecx
sub eax, edi
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa8]
sbb eax, ebx
mov dword [ebp - 0x10], eax
jne 0x40c807
cmp dword [ebp - 0xa4], 0x40000
ja 0x40c807
mov eax, ecx
sub eax, edi
jmp 0x40c80c
mov eax, 0x40000
push esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], eax
push ecx
push eax
push edx
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c8ff
cmp dword [ebp - 0xa4], esi
je 0x40c8ff
push dword [ebp - 0xa4]
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x9c]
call fcn.0041702a
add edi, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xa8]
adc ebx, esi
pop ecx
mov ecx, dword [ebp - 0xa0]
cmp ebx, edx
jb 0x40c7d8
ja 0x40c87a
cmp edi, ecx
jb 0x40c7d8
mov eax, ecx
cmp edi, eax
jne 0x40c8ce
cmp ebx, edx
jne 0x40c8ce
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x1c]
call fcn.004170c6
mov edi, esi
lea ebx, [ebp - 0x40]
movzx eax, byte [ebp + edi - 0x1c]
push eax
push str._02X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add ebx, 2
inc edi
cmp edi, 0x10
jl 0x40c897
push dword [ebp - 0xc0]
lea eax, [ebp - 0x40]
push eax
call fcn.004cb9b0
pop ecx
pop ecx
xor ecx, ecx
inc ecx
test eax, eax
cmove esi, ecx
push dword [ebp - 0xac]
call fcn.004c8ceb
pop ecx
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
jmp 0x40c905
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0xa8]
jmp 0x40c87c
Function at 0x40c910
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 8], ecx
mov edi, str.version.dll
mov dword [ebp - 0x20], esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x40c940
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x40c988
xor edi, edi
test esi, esi
je 0x40c948
mov dword [esi], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c951
mov dword [eax], edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeExA
push ebx
call esi
push str.GetFileVersionInfoExA
push ebx
mov dword [ebp - 0x14], eax
call esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
test ecx, ecx
je 0x40c98f
test eax, eax
je 0x40c98f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push edi
call ecx
mov esi, eax
test esi, esi
jne 0x40c99e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
jmp 0x40c982
lea eax, [esi + 0x800]
push eax
call fcn.0049da2e
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40c988
lea eax, [ebx + esi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], edi
je 0x40ca35
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ca35
push ebx
push esi
push edi
push dword [ebp - 8]
push edi
call eax
cmp eax, 1
jne 0x40caad
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push str.VarFileInfoTranslation
push ebx
mov dword [ebp - 4], edi
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5069c8
push ebx
call esi
test eax, eax
je 0x40ca20
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
test ecx, ecx
je 0x40ca14
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40ca20
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0xc]
test ecx, ecx
je 0x40ca43
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
jmp 0x40ca4d
push ebx
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
jmp 0x40c9cc
push 0x4e4
push 0x409
push str.StringFileInfo_04x_04x_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
mov esi, edi
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0x10]
push dword [ecx + esi*8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueA]
cmp dword [ebp - 4], edi
je 0x40caa1
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [eax + esi*8 + 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x20]
inc esi
cmp esi, 5
jl 0x40ca6a
xor edi, edi
inc edi
push 1
push ebx
call fcn.0049da37
pop ecx
pop ecx
mov eax, edi
jmp 0x40c98a