joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f440
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [esi]
add esp, 0xc
cmp esi, 0xffffffff
je 0x1002f545
mov edi, dword [edi]
cmp edi, 0xffffffff
je 0x1002f545
push 0x44
lea eax, [ebp - 0x268]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x220], xmm0
call sub.VCRUNTIME140.dll_memset
or dword [ebp - 0x23c], 0x101
xor eax, eax
push 0xffffffffffffffff
push str._ipconfig___all
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
mov dword [ebp - 0x268], 0x44
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x1c
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x1002f545
push dword [ebp - 0x220]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
Function at 0x1002f560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e7e6
mov eax, dword fs:[0]
push eax
sub esp, 0xc4c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc38], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc18]
mov ebx, dword [ebp + 0xc]
push 0x802
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, 7
mov dword [ebp - 0xc20], 0
xor eax, eax
mov dword [ebp - 0xc1c], esi
add esp, 0xc
mov word [ebp - 0xc30], ax
mov dword [ebp - 4], eax
mov eax, dword [ebx]
test eax, eax
je 0x1002f5f1
cmp eax, 0xffffffff
je 0x1002f5f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1002f722
mov dword [ebx], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc34]
push 0
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [edi]
call esi
test eax, eax
je 0x1002f6d4
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov eax, dword [ebp - 0xc34]
test eax, eax
je 0x1002f6d4
push 0x400
lea ecx, [ebp - 0xc18]
push ecx
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
call ebx
push dword [ebp - 0xc34]
xor eax, eax
mov dword [ebp - 0xc3c], 7
mov word [ebp - 0xc50], ax
lea ecx, [ebp - 0xc50]
lea eax, [ebp - 0xc18]
mov dword [ebp - 0xc40], 0
push eax
call fcn.10002e00
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc50]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xc30]
call fcn.1000c520
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc3c]
cmp eax, 8
jb 0x1002f6b3
inc eax
push eax
push dword [ebp - 0xc50]
call fcn.10003020
push 0
lea eax, [ebp - 0xc34]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [edi]
call esi
test eax, eax
jne 0x1002f620
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0xc30]
push eax
call fcn.10002f00
mov ecx, dword [ebp - 0xc38]
call fcn.1002f760
mov ecx, dword [ebp - 0xc38]
call fcn.1002fe00
mov esi, dword [ebp - 0xc1c]
test eax, eax
je 0x1002f722
mov edi, 1
jmp 0x1002f724
xor edi, edi
cmp esi, 8
jb 0x1002f738
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0xc30]
call fcn.10003020
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
Function at 0x10031160
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
push 8
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
mov dword [ebp - 0x98], 0x98badcfe
mov dword [ebp - 0x94], 0x10325476
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
call fcn.10030fd0
add esp, 4
lea ecx, [ebp - 0xa0]
mov edx, esi
call fcn.100310b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10032a80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
xorps xmm0, xmm0
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], 0x67452301
mov dword [ebp - 0x9c], 0xefcdab89
movups xmmword [ebx], xmm0
mov dword [ebp - 0x98], 0x98badcfe
movups xmmword [edi], xmm0
mov dword [ebp - 0x94], 0x10325476
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
jb 0x10032b03
mov ecx, dword [ecx]
mov edx, ecx
lea ecx, [ebp - 0xa0]
push eax
call fcn.10030fd0
add esp, 4
lea ecx, [ebp - 0xa0]
mov edx, ebx
call fcn.100310b0
xor esi, esi
movzx eax, byte [ebx + esi]
push eax
push str._02x
push 2
push 3
push edi
call fcn.100311f0
inc esi
add esp, 0x14
add edi, 2
cmp esi, 0x10
jb 0x10032b23
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov byte [eax + 0x20], 0
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x100334f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.10033201
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1003352a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1003323c
sub edi, ebx
salc
invalid
Function at 0x10033f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x100340fa
cmp dword [ebp + 0xc], 1
je 0x100340fa
cmp dword [ebp + 0xc], 8
jne 0x100340c2
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1003324c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10033201
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
call fcn.1003323c
adc al, byte [ecx]
mov esp, 0xbca5806b
cli
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
invalid

Function at 0x100346b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1003323c
lds ecx, [ebx*2 - 0x2b7a72e8]
clc
invalid
Function at 0x10035420
Capabilities:
Read file on windows

Disassembly:
call fcn.1003323c
ror dword [edi - 0x74b64ca9], 1
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10035429
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10035429
call fcn.1003323c
or ebp, dword [ebx - 0x34]
mov esi, 0x3245a8b
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.1003323c
pop ds
cmp byte [ebp + eax - 1], bl
jne 0x10035473
push dword [ebp + 4]
push dword [ebp]
call fcn.10033a3c
cmp esi, 0xffffffff
je 0x100354c0
in eax, 0xff
inc dword [ebx + 0x4574fffe]
push 0x1007da74
push esi
call fcn.1005be25
add esp, 8
mov dword [edi], eax
test eax, eax
je 0x100354c0
push 0
push dword [ebp + 8]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100354c0
mov eax, dword [ebp + 8]
cmp dword [eax], esi
jne 0x100354c0
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi]
test esi, esi
je 0x100354d9
push esi
call fcn.1005be17
add esp, 4
test esi, esi
je 0x100354d9
mov dword [edi], 0x8123
push ebx
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037e80
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x20
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
mov edx, 0xff
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1006df30]
cvtpd2ps xmm1, xmm0
mulss xmm1, dword [0x1006dee0]
mulss xmm1, dword [0x1006dee0]
mulss xmm1, dword [0x1006dee4]
cvtps2pd xmm0, xmm1
addsd xmm0, qword [0x1006def8]
cvttsd2si ecx, xmm0
cmp ecx, edx
movzx eax, cl
mov ecx, dword [ebp - 4]
cmovl edx, eax
xor ecx, ebp
mov byte [esi], dl
mov al, 1
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x10037f90
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xdc], ecx
push eax
push 0x64
mov dword [ebp - 0xd8], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0xcc], di
je 0x10038061
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
lea esi, [ebp - 0xcc]
push esi
call ebx
cmp eax, 3
jne 0x1003804d
push 0
lea eax, [ebp - 0xd4]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1003804d
mov eax, dword [ebp - 0xd4]
movsd xmm1, qword [0x1006def0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1006df30]
mov eax, dword [ebp - 0xd0]
mulsd xmm0, xmm1
mulsd xmm0, xmm1
mulsd xmm0, xmm1
addsd xmm0, qword [0x1006def8]
cvttsd2si ecx, xmm0
add ecx, dword [ebp - 0xd8]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xd8], eax
add edi, 4
lea esi, [ebp - 0xcc]
cmp word [esi + edi*2], 0
lea esi, [esi + edi*2]
jne 0x10037fe0
pop esi
mov ecx, dword [ebp - 0xd8]
mov eax, 0x66666667
pop edi
lea ecx, [ecx + 9]
imul ecx
mov ecx, 0xff
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp ebx, ecx
movzx eax, bl
pop ebx
cmovl ecx, eax
mov eax, dword [ebp - 0xdc]
mov byte [eax], cl
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100380b0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
lea eax, [ebp - 0xcc]
push 0xc8
xor edi, edi
push edi
push eax
mov dword [ebx], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0xcc], di
je 0x10038183
push esi
lea esi, [ebp - 0xcc]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1003816f
push 0
lea eax, [ebp - 0xd4]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1003816f
mov eax, dword [ebp - 0xd4]
movsd xmm1, qword [0x1006def0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1006df30]
mulsd xmm0, xmm1
mulsd xmm0, xmm1
mulsd xmm0, xmm1
addsd xmm0, qword [0x1006def8]
call fcn.1005cce1
mov ecx, dword [ebp - 0xd0]
lea eax, [eax + ecx*4]
add dword [ebx], eax
add edi, 4
lea esi, [ebp - 0xcc]
cmp word [esi + edi*2], 0
lea esi, [esi + edi*2]
jne 0x10038107
pop esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10038320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ed30
mov eax, dword fs:[0]
push eax
sub esp, 0x664
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x670], edx
mov ebx, ecx
xor esi, esi
lea eax, [ebp - 0x320]
push 0x20a
push esi
push eax
mov dword [edx], esi
mov dword [ebp - 4], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x320]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x320]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10038390
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jl 0x100383ae
xor al, al
jmp 0x1003854e
test ecx, ecx
jle 0x100383e5
mov eax, 0x5c
cmp ax, word [ebp + ecx*2 - 0x322]
je 0x100383e5
mov word [ebp + ecx*2 - 0x320], ax
lea eax, [ecx*2 + 2]
cmp eax, 0x20a
jae 0x100384f5
xor ecx, ecx
mov word [ebp + eax - 0x320], cx
push 0xa
push str.User32.DLL
lea eax, [ebp - 0x320]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100383a7
push str.EnumDisplayDevicesW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x344
mov dword [ebp - 0x66c], eax
lea eax, [ebp - 0x664]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x66c]
add esp, 0xc
mov dword [ebp - 0x668], 0x348
test ecx, ecx
je 0x1003854c
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [eax + eax]
push 0
lea edx, [ebp - 0x668]
mov eax, esi
push edx
push eax
push 0
inc esi
call ecx
test eax, eax
je 0x1003854c
test byte [ebp - 0x524], 4
je 0x1003851b
mov eax, dword [ebp - 0x670]
push 0x100
push 0
inc dword [eax]
lea eax, [ebp - 0x114]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x624]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call edi
push 0
push 0
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x624]
push eax
push 0
push 0
call edi
push 1
push 0x100695a8
mov ecx, ebx
call fcn.10012640
cmp byte [ebp - 0x114], 0
jne 0x100384fa
xor ecx, ecx
jmp 0x1003850c
call fcn.1005bfc9
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038503
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
mov ecx, ebx
push eax
call fcn.10012640
push 0x348
lea eax, [ebp - 0x668]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x66c]
add esp, 0xc
mov dword [ebp - 0x668], 0x348
jmp 0x10038460
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x1003a030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f01b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x24c], eax
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], esi
mov word [ebp - 0x234], ax
push eax
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0x23c], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x1003a1fe
push 0x1007da74
push edi
call fcn.1005be25
add esp, 8
mov dword [ebp - 0x244], eax
test eax, eax
je 0x1003a1fe
push eax
push edi
push esi
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov ebx, dword [ebp - 0x244]
test eax, eax
je 0x1003a1f5
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x100697e8
push ebx
call edi
test eax, eax
je 0x1003a1f5
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test dword [ebp - 0x21c], 0xfffffffc
jbe 0x1003a1d4
cmp dword [ebp - 0x224], 0
jne 0x1003a1c2
mov eax, dword [ebp - 0x240]
push dword [ebp - 0x248]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1000f290
add esp, 0x1c
mov dword [ebp - 0x23c], 0
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call edi
test eax, eax
je 0x1003a1c2
mov edx, dword [ebp - 0x23c]
cmp word [edx], 0
jne 0x1003a198
xor eax, eax
jmp 0x1003a1b5
mov eax, edx
lea edi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003a1a0
sub eax, edi
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x234]
call fcn.10002e00
mov eax, dword [ebp - 0x21c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x1003a122
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x234]
cmp eax, ecx
je 0x1003a1f0
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.10002f00
mov esi, 1
push ebx
call fcn.1005be17
add esp, 4
mov ecx, dword [ebp - 0x220]
cmp ecx, 8
jb 0x1003a216
inc ecx
push ecx
push dword [ebp - 0x234]
call fcn.10003020
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x1003a240
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x22c], edx
test esi, esi
je 0x1003a41b
cmp byte [esi], 0
je 0x1003a41b
test edx, edx
je 0x1003a41b
mov eax, dword [ebp + 8]
test eax, eax
jle 0x1003a41b
push ebx
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
push 0x105
lea eax, [ebp - 0x214]
mov dword [ebp - 0x228], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x105
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x224], 0
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0x1003a405
push edi
push 0x1007da74
push ebx
call fcn.1005be25
mov edi, eax
add esp, 8
test edi, edi
je 0x1003a404
push edi
push ebx
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x1003a3fb
mov ebx, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push str.VarFileInfoTranslation
push edi
call ebx
test eax, eax
je 0x1003a3fb
xor esi, esi
test dword [ebp - 0x218], 0xfffffffc
jbe 0x1003a3db
nop word [eax + eax]
mov eax, dword [ebp - 0x224]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x100698c0
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.100311f0
add esp, 0x18
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
call ebx
test eax, eax
jne 0x1003a3c3
mov eax, dword [ebp - 0x218]
inc esi
shr eax, 2
cmp esi, eax
jb 0x1003a360
jmp 0x1003a3db
push 0x104
push dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x228], 1
push edi
call fcn.1005be17
add esp, 4
pop edi
mov eax, dword [ebp - 0x228]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret