joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
jne 0x42616a
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
je 0x42615f
cmp dword [edi + 0x7c], ebx
je 0x42617d
push edi
call fcn.004241c0
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
call fcn.00423fd0
add esp, 0x10
test eax, eax
je 0x4261a4
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
push 0x84
call fcn.0045306c
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4261e5
push 0x4000
call fcn.0045306c
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x4261f1
push esi
call fcn.00452c6a
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x42623d
lea eax, [esi + 4]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004235a0
add esp, 4
test eax, eax
jne 0x42623d
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x426267
mov dl, byte [edi + 0x39]
mov byte [esi + 0x80], dl
jmp 0x426270
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
movzx ecx, byte [esi + 0x6c]
neg ecx
sbb ecx, ecx
push ebp
mov ebp, dword [esp + 0x20]
and ecx, 0xc
lea ebx, [esi + 0x70]
mov dword [esi + 0x7c], ecx
mov dword [ebx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebp, ebp
je 0x4262b7
mov edi, edi
movzx eax, byte [ebp]
test al, al
je 0x4262b7
push eax
push ebx
call fcn.004232d0
add esp, 8
add ebp, 1
jne 0x4262a0
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x1e]
pop ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x426560
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
jne 0x42662d
cmp dword [ebx + 4], 0xffffffff
jne 0x42662d
push edi
lea edi, [ebx + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426590
sub eax, edx
mov al, byte [eax + ebx + 0x13f]
cmp al, 0x5c
je 0x4265c1
cmp al, 0x2f
je 0x4265c1
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4265b0
mov ax, word [0x46ead0]
mov word [edi], ax
mov edi, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
cmp edi, 1
jne 0x4265ec
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4265ec
pop esi
pop edi
mov eax, 0x2000000
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edi
push edx
push esi
call fcn.00423650
add esp, 0x10
test eax, eax
jne 0x42660e
mov eax, dword [esp + 0x18]
pop esi
pop edi
pop ebx
ret 0xc
push eax
call fcn.00425f60
add esp, 4
mov dword [ebx], eax
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
ret 0xc
mov eax, 0x1000000
pop ebx
ret 0xc
Function at 0x4279d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.004361d0
Function at 0x42a660
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x46b058
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x48b270]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00435c99
mov ebx, eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CBitmap.0
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea edi, [esi + 0x9c]
mov dword [edi], edx
mov edx, dword [esp + 0x24]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
push edi
mov ecx, esi
mov dword [edi + 0xc], edx
call fcn.0044176e
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esi + 0x8c], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x90], ecx
push 0x7ffe
mov dword [esi + 0x94], edx
push 0
mov dword [esi + 0x98], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.00441c8a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x38]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0x10]
call fcn.00441cb6
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
sub edx, dword [esp + 0x28]
sub eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esi + 0xac], edx
mov dword [esi + 0xb0], eax
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x10], vtable.CBitmap.0
call fcn.0042a540
mov eax, ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x42b7c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
push edi
xor edi, edi
cmp eax, edi
je 0x42b8a6
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], edi
mov ecx, dword [eax]
push 0x47a760
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x42b834
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax]
push 0x47a740
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x42b828
mov edx, dword [esi + 0x60]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x20], edi
cmp dword [esi + 0x18], edi
je 0x42b878
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x42b856
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edi
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push eax
call edx
mov ebx, eax
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x18], edi
jmp 0x42b87c
mov ebx, dword [esp + 0x10]
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x42b88b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp ebx, edi
mov dword [esi + 0x38], edi
jge 0x42b8a6
push str.IOleObject::Close_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x42bbe0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x42bbfe
push str.ActiveX
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 0x50]
sub eax, dword [esi + 0x48]
push ebp
lea ebp, [esi + 0x48]
je 0x42bc12
mov ecx, dword [esi + 0x54]
sub ecx, dword [esi + 0x4c]
jne 0x42bc23
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push ebp
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x18]
push ebx
push edi
push 1
push eax
call dword [sym.imp.ole32.dll_OleSetContainedObject]
test eax, eax
jne 0x42bda0
cmp dword [esi + 0x40], eax
jne 0x42bda0
mov edi, dword [esi + 0x18]
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], eax
mov eax, dword [edi]
push ebp
mov ecx, esi
lea ebx, [esi + 4]
mov dword [esp + 0x1c], eax
call edx
push eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x2c]
xor ebp, ebp
push ebp
push ebx
push ebp
push 0xfffffffffffffffb
push edi
call eax
test eax, eax
jge 0x42bc8e
push str.DoVerb
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebx
lea eax, [ebp + 1]
pop ebp
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edi, [esi + 0x20]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
cmp eax, ebp
jne 0x42bcd6
mov eax, dword [esi + 0x18]
cmp eax, ebp
jne 0x42bcb8
push str.Ole
call ebx
xor eax, eax
jmp 0x42bcd6
mov ecx, dword [eax]
mov edx, dword [ecx]
push edi
push 0x47a730
push eax
call edx
test eax, eax
jge 0x42bcd4
push str.QueryInterface_IID_IWebBrowser2
call ebx
xor eax, eax
jmp 0x42bcd6
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x47a760
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jge 0x42bcf7
push 0x4748f0
call ebx
jmp 0x42bd80
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x47a740
push eax
mov eax, dword [ecx + 0x10]
call eax
test eax, eax
jge 0x42bd1a
push str.FindConnectionPoint
call ebx
jmp 0x42bd80
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x60]
push eax
mov dword [eax], ebp
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push ecx
call eax
test eax, eax
jge 0x42bd3a
push str.advise
call ebx
jmp 0x42bd80
mov eax, dword [edi]
cmp eax, ebp
je 0x42bd44
mov edi, eax
jmp 0x42bd74
mov esi, dword [esi + 0x18]
cmp esi, ebp
jne 0x42bd56
push str.Ole
call ebx
xor edi, edi
jmp 0x42bd74
mov ecx, dword [esi]
mov edx, dword [ecx]
push edi
push 0x47a730
push esi
call edx
test eax, eax
jge 0x42bd72
push str.QueryInterface_IID_IWebBrowser2
call ebx
xor edi, edi
jmp 0x42bd74
mov edi, dword [edi]
mov eax, dword [edi]
mov ecx, dword [eax + 0x100]
push ebp
push edi
call ecx
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x42bd90
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x42bda0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x42bdb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x48b270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ebx, dword [ebp + 8]
mov ecx, 8
mov word [ebp - 0x18], cx
test ebx, ebx
je 0x42be1b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jg 0x42be1b
lea eax, [edi + edi]
call fcn.00455ba0
mov esi, esp
test esi, esi
je 0x42be1b
push edi
push esi
push 0xffffffffffffffff
xor edx, edx
push ebx
push edx
push 3
mov word [esi], dx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x42be1d
xor eax, eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esi, 0x20
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
test eax, eax
jne 0x42be6e
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x42be4d
push str.Ole
call edi
xor eax, eax
jmp 0x42be6e
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push esi
push 0x47a730
push eax
call edx
test eax, eax
jge 0x42be6c
push str.QueryInterface_IID_IWebBrowser2
call edi
xor eax, eax
jmp 0x42be6e
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
lea ecx, [ebp - 0x18]
push ecx
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jge 0x42bea0
push str.Navigate2
call edi
xor eax, eax
jmp 0x42bea5
mov eax, 1
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004517f0
mov esp, ebp
pop ebp
ret 4
Function at 0x42bf10
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
push edi
lea edi, [esi + 0x20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test eax, eax
jne 0x42bf73
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x42bf48
push str.Ole
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42c048
mov ecx, dword [eax]
mov edx, dword [ecx]
push edi
push 0x47a730
push eax
call edx
test eax, eax
jge 0x42bf69
push str.QueryInterface_IID_IWebBrowser2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42c048
mov eax, dword [edi]
test eax, eax
je 0x42c048
mov ecx, esi
call fcn.0042b8b0
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
cmp dword [esp + 8], 0
je 0x42c048
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x24]
test eax, eax
je 0x42bfa4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
push edi
mov dword [edi], 0
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x47a6a0
push eax
call edx
test eax, eax
jl 0x42bfc9
mov eax, dword [edi]
push eax
mov ecx, esi
call fcn.0042bec0
mov eax, dword [esi + 0x28]
push ebx
lea ebx, [esi + 0x28]
test eax, eax
je 0x42bfdc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
push ebx
mov dword [ebx], 0
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x47a6b0
push eax
call edx
cmp dword [edi], 0
je 0x42c01e
mov eax, dword [esi + 0x2c]
lea ebx, [esi + 0x2c]
test eax, eax
je 0x42c00a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [edi]
mov dword [ebx], 0
mov eax, dword [edi]
mov ecx, dword [eax + 0x1b0]
push ebx
push edi
call ecx
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x10]
push ecx
push 0x47a6e0
push eax
call edx
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x42c058
mov edx, dword [esi + 0x38]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42c058
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
pop edi
pop esi
test eax, eax
je 0x42c06a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
add esp, 8
ret 8
Function at 0x42c100
Capabilities:
Access peb ldr_data
Get ntdll base address
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x46b16b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b270]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea ebp, [esi + 0x5c]
push ebp
push 0x47a5a0
push edi
push edi
push edi
xor eax, eax
mov dword [esi], vtable.CWBContainer.4.0
mov dword [esi + 4], vtable.CWBContainer.3.0
mov dword [esi + 8], vtable.CWBContainer.2.0
mov dword [esi + 0xc], vtable.CWBContainer.1.0
mov dword [esi + 0x10], vtable.CWBContainer.0
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x58], 1
push edi
lea ebx, [esi + 0x18]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
push 0x1012
mov dword [esi + 0x50], eax
push edi
mov dword [esi + 0x54], eax
call dword [sym.imp.ole32.dll_StgCreateStorageEx]
test eax, eax
je 0x42c1af
push str.Cant_Create_Storage_Object_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp], edi
mov eax, dword [ebp]
push ebx
push eax
lea eax, [esi + 4]
push eax
push edi
push 1
push 0x47a620
push 0x47a750
call dword [sym.imp.ole32.dll_OleCreate]
test eax, eax
jge 0x42c1dc
push 0x474984
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42c224
mov ebx, dword [ebx]
mov ecx, dword [ebx]
mov edx, dword [ecx]
lea eax, [esi + 0x1c]
push eax
push 0x47a660
push ebx
call edx
cmp eax, edi
jge 0x42c1ff
push str.OleInplaceObject
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42c224
push 0x14
call fcn.0043189c
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x42c21f
push esi
mov ecx, eax
call fcn.0042c630
jmp 0x42c221
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x42d3b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x114
mov eax, dword [0x48b270]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
xor esi, esi
cmp eax, esi
jne 0x42d3ee
push 0x104
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x42d3fa
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, esi
je 0x42d490
push edi
push ebx
push 2
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x10]
mov edi, eax
push edi
push ebx
push ecx
lea edx, [esp + 0x28]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x46ead0
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x18]
mov dx, word [eax + 0x10]
mov cx, word [eax + 0x12]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx edx, dx
push edx
movzx eax, cx
push eax
push str._d._d._d._d
push ebp
call fcn.0045428b
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov ecx, dword [esp + 0x11c]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004517f0
add esp, 0x114
ret

Function at 0x42d4b0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d4f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esp, 0xc
ret
Function at 0x42df60
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
xor edi, edi
mov ebp, ecx
cmp ebx, edi
jne 0x42df81
push edi
push edi
push edi
push 2
call fcn.0042ff80
pop edi
pop ebp
xor al, al
pop ebx
ret 8
push esi
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x42dfa1
lea esp, [esp]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x42df90
push 2
or eax, 0xffffffff
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
push edi
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call fcn.00455e61
push ebx
call fcn.00455d69
push 0
push 0
push ebx
mov edi, eax
call fcn.00455e61
add esp, 0x1c
test edi, edi
jg 0x42dfea
push 0
push 0
push 0
push 0xc
mov ecx, ebp
call fcn.0042ff80
pop esi
pop edi
pop ebp
xor al, al
pop ebx
ret 8
lea eax, [edi + 1]
push eax
call fcn.0043189c
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.00454ff8
add esp, 0x14
cmp eax, 1
je 0x42e02b
push esi
call fcn.004318cb
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebp
call fcn.0042ff80
pop esi
pop edi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x42e054
mov dl, byte [eax]
cmp dl, 0xd
jne 0x42e04b
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x42e04f
jmp 0x42e04e
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x42e038
mov eax, dword [esp + 0x18]
push eax
mov byte [ecx], 0
mov edx, dword [ebp]
mov edx, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call edx
push esi
call fcn.004318cb
add esp, 4
pop esi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop edi
pop ebp
sete al
pop ebx
ret 8

Function at 0x42e7d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46b3d3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x48b270]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x48d0c8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x48d0c8
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x46eb20
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0042dd30
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret