joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411200
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b45d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6319d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0046d4f0
test eax, eax
je 0x4112b4
mov eax, dword [ebp + 8]
push eax
push str.PROGBAR_DATA::Set_:_nProgBarSetCnt___d_n
push 0x642688
call fcn.00599ee3
mov ecx, dword [str.ENTRY:]
mov edx, dword [0x5ccf7c]
mov eax, 0x642688
mov dword [0x642588], ecx
add esp, 0xc
mov dword [0x64258c], edx
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x411270
mov edi, 0x642588
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x411281
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x642588
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, dword [ebx + 4]
jae 0x41134f
push str.SoftwareCnxtProgBar
lea ecx, [ebp - 0x14]
call fcn.00403380
mov dword [ebp - 4], edi
mov esi, 0xf003f
call fcn.0049cb90
test eax, eax
je 0x4112e5
mov esi, 0xf013f
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411329
mov ecx, dword [ebp - 0x10]
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.ProgBarCnt
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41131f
lea edi, [eax + 1]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41134f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0046d4f0
test eax, eax
je 0x4113d4
push edi
push str.PROGBAR_DATA::Set_:_bStatus___d_n
push 0x642488
call fcn.00599ee3
mov ecx, dword [str.EXIT:]
mov edx, dword [0x5ccefc]
mov eax, 0x642488
mov dword [0x642388], ecx
add esp, 0xc
mov dword [0x64238c], edx
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x411390
mov edi, 0x642388
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4113a1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x642388
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d600
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
call fcn.0046d4f0
test eax, eax
je 0x41d686
push 0
push str.CCPanel::OpenControlPanel_n
push 0x64bb88
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x64ba88], eax
mov eax, 0x64bb88
mov dword [0x64ba8c], ecx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41d642
mov edi, 0x64ba88
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41d653
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x64ba88
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
push 0x3c
lea edx, [ebp - 0x3c]
push 0
push edx
call fcn.00599fb0
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0x540
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x2c], str.control.exe
mov dword [ebp - 0x28], 0x5cf9d0
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x41d6ef
call fcn.0046d4f0
test eax, eax
je 0x41d6ef
push str.ShellExecuteEx__FALSE_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d4f0
test eax, eax
je 0x41d774
push 0
push str.CCPanel::OpenControlPanel_n
push 0x64b988
call fcn.00599ee3
mov ecx, dword [str.EXIT:]
mov edx, dword [0x5ccefc]
mov eax, 0x64b988
mov dword [0x64b888], ecx
add esp, 0xc
mov dword [0x64b88c], edx
mov ecx, eax
jmp 0x41d730
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41d730
mov edi, 0x64b888
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41d741
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x64b888
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp dword [ecx + 0x28], edi
je 0x427283
push 0x20019
push 2
push edi
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push 1
push eax
push ecx
call fcn.0041ea10
mov ecx, eax
call fcn.0041e4f0
mov esi, eax
cmp esi, 0xffffffff
je 0x427283
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push edx
push edi
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42726d
lea edi, [eax + 1]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x427283
mov eax, dword [ebx]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret 0xc
pop edi
xor eax, eax
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret 0xc

Function at 0x427290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [ecx + 0x28], edi
je 0x42731a
push 0x20019
push 2
push edi
push 1
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push eax
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x42731a
mov eax, dword [ebp + 8]
push ebx
lea edx, [ebp - 4]
push edx
push 0x20019
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x427303
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 4]
push eax
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4272fd
lea edi, [eax + 1]
mov eax, dword [ebp - 4]
push eax
call ebx
push esi
call ebx
pop ebx
test edi, edi
je 0x42731a
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
pop edi
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
xor eax, eax
pop edi
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x427330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
xor edi, edi
cmp dword [ecx + 0x28], edi
je 0x427390
push 0x20019
push 2
push edi
push 1
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push eax
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x427390
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edx
push eax
push edi
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42737a
lea edi, [eax + 1]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x427390
mov eax, dword [ebx]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret 0x10
Function at 0x4273a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [ecx + 0x28], edi
je 0x427427
push 0x20019
push 2
push edi
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push 1
push eax
push ecx
call fcn.0041ea10
mov ecx, eax
call fcn.0041e4f0
mov esi, eax
cmp esi, 0xffffffff
je 0x427427
mov eax, dword [ebp + 8]
push ebx
lea edx, [ebp - 4]
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x427410
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edx
push edi
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42740a
lea edi, [eax + 1]
mov edx, dword [ebp - 4]
push edx
call ebx
push esi
call ebx
pop ebx
test edi, edi
je 0x427427
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
pop edi
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
xor eax, eax
pop edi
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x427440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ecx + 0x28], edi
je 0x42749e
push esi
push 0xf003f
push 2
push edi
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push 1
push eax
push ecx
call fcn.0041ea10
mov ecx, eax
call fcn.0041e4f0
mov esi, eax
cmp esi, 0xffffffff
je 0x427496
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x42748f
lea edi, [eax + 1]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
pop ebp
ret 0x10
mov eax, edi
pop edi
pop ebp
ret 0x10

Function at 0x4274b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ecx + 0x28], edi
je 0x42753b
push esi
push 0x20019
push 2
push edi
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push 1
push eax
push ecx
call fcn.0041ea10
mov ecx, eax
call fcn.0041e4f0
mov esi, eax
cmp esi, 0xffffffff
je 0x427531
mov eax, dword [ebp + 8]
push ebx
lea edx, [ebp - 4]
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x427523
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 4]
push eax
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x42751d
lea edi, [eax + 1]
mov eax, dword [ebp - 4]
push eax
call ebx
push esi
call ebx
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x14
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x14
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x427e20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [eax + 0x28], ebx
je 0x427f36
mov edx, dword [eax]
push 0x20019
push 2
push ebx
push 1
lea ecx, [eax + 4]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
je 0x427f36
lea ecx, [ebp - 0x210]
push ecx
push 0x20019
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427f29
push 0x208
lea edx, [ebp - 0x20c]
push edx
push eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x427f1c
lea ebx, [ebx]
mov esi, dword [edi]
inc ebx
cmp esi, 0x5dc
jae 0x427efe
lea ecx, [esi + 1]
mov dword [edi], ecx
cmp esi, 0xffffffff
je 0x427efe
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427ed0
sub eax, edx
add eax, 5
push eax
call fcn.004a6dbf
add esp, 4
mov dword [edi + esi*4 + 0x5e0], eax
lea ecx, [ebp - 0x20c]
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x427ef4
mov eax, dword [ebp - 0x210]
push 0x208
lea edx, [ebp - 0x20c]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x427eb0
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8
Function at 0x427f50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
cmp dword [eax + 0x28], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], 0
je 0x42804b
mov edx, dword [eax]
push ebx
push 0x20019
push 2
push 0
push 1
lea ecx, [eax + 4]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x428037
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x428030
push esi
jmp 0x427fc0
mov esi, dword [edi]
inc dword [ebp - 0x210]
cmp esi, 0x5dc
jae 0x428011
lea ecx, [esi + 1]
mov dword [edi], ecx
cmp esi, 0xffffffff
je 0x428011
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427fe3
sub eax, edx
add eax, 5
push eax
call fcn.004a6dbf
add esp, 4
mov dword [edi + esi*4 + 0x5e0], eax
lea ecx, [ebp - 0x20c]
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x428007
mov eax, dword [ebp - 0x210]
push 0x208
lea edx, [ebp - 0x20c]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x427fc0
pop esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, dword [edi]
xor ecx, ebp
pop edi
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4
Function at 0x42c580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
movzx esi, dx
test eax, eax
je 0x42c5cf
mov ecx, dword [ebp + 0x14]
push ebx
push edi
mov edi, dword [ebp + 0x10]
sub edi, ecx
mov dword [ebp + 8], eax
mov edi, edi
and esi, 0x1ff
mov al, byte [esi + 0x5d1930]
xor al, byte [edi + ecx]
and dl, 3
movzx ebx, dl
mov ebx, dword [ebx*4 + 0x62a77c]
movzx eax, al
mov al, byte [eax + ebx]
mov byte [ecx], al
inc esi
inc dl
inc ecx
dec dword [ebp + 8]
jne 0x42c5a0
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x42c5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
movzx esi, dx
test eax, eax
je 0x42c62d
mov ecx, dword [ebp + 0x14]
push ebx
push edi
mov edi, dword [ebp + 0x10]
sub edi, ecx
mov dword [ebp + 8], eax
mov edi, edi
movzx ebx, byte [edi + ecx]
and dl, 3
movzx eax, dl
mov eax, dword [eax*4 + 0x62a77c]
mov al, byte [ebx + eax]
and esi, 0x1ff
xor al, byte [esi + 0x5d1930]
inc dl
mov byte [ecx], al
inc esi
inc ecx
dec dword [ebp + 8]
jne 0x42c600
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x42d0f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x114], eax
lea eax, [ebx + edi]
push 0x5cd28c
push eax
mov dword [ebp - 0x110], ecx
call fcn.0059ade0
mov esi, eax
add esp, 8
test esi, esi
je 0x42d21c
test ebx, ebx
jne 0x42d16a
lea ecx, [esi + 1]
push 0x5cd28c
push ecx
call fcn.0059ade0
add esp, 8
test eax, eax
jne 0x42d16a
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8
sub esi, edi
push esi
lea edx, [ebp - 0x108]
push edi
push edx
call fcn.0059ae70
mov ecx, dword [ebp - 0x110]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov byte [ebp + esi - 0x108], 0
call fcn.0042d020
test eax, eax
jne 0x42d1f2
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42d1f2
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
mov eax, dword [ebp - 0x114]
add eax, 0x1f4
mov dword [ebp - 0x114], eax
cmp eax, 0x1388
jae 0x42d1e8
mov ecx, dword [ebp - 0x110]
lea edx, [ebp - 0x108]
push edx
call fcn.0042d020
test eax, eax
je 0x42d1b3
mov dword [ebp - 0x10c], 1
mov ecx, dword [ebp - 0x110]
inc esi
push esi
push edi
call fcn.0042d0f0
test eax, eax
jne 0x42d212
cmp dword [ebp - 0x10c], eax
mov dword [ebp - 0x10c], eax
je 0x42d21c
mov dword [ebp - 0x10c], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8

Function at 0x42d2e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x42d3b7
cmp esi, 0x7d00
jae 0x42d3b7
push ebx
push esi
call fcn.0059a064
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42d3ac
mov ecx, dword [ebp + 8]
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42d3ac
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push str.StringFileInfo040904b0FileVersion
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42d395
mov eax, dword [ebp - 8]
test eax, eax
je 0x42d3ac
mov esi, dword [ebp - 4]
cmp esi, 0x100
jae 0x42d3ac
test esi, esi
je 0x42d3ac
push esi
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.0059b910
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x408]
mov ecx, eax
add esp, 0xc
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42d380
mov dword [ebp + esi*4 - 0x408], 0
push ebx
call fcn.0059a02a
add esp, 4
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42d3d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x118]
push ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x42d446
cmp esi, 0x7d00
jae 0x42d446
push esi
call fcn.0059a064
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42d446
mov edx, dword [ebp - 0x118]
push ebx
push esi
push edx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x42d45b
push ebx
call fcn.0059a02a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x65cc90
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
xor esi, esi
test dword [ebp - 0x10c], 0xfffffffc
jbe 0x42d548
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ebx, [ebx]
mov eax, dword [0x65cc90]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
lea eax, [ebp - 0x108]
push str.StringFileInfo_04x_04xComments
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x108]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42d4eb
mov edx, dword [ebp - 0x120]
test edx, edx
je 0x42d4eb
mov eax, dword [ebp - 0x11c]
cmp eax, 0x100
jae 0x42d4eb
test eax, eax
jne 0x42d51b
mov ecx, dword [ebp - 0x10c]
inc esi
shr ecx, 2
cmp esi, ecx
jb 0x42d490
push ebx
call fcn.0059a02a
mov eax, dword [ebp - 0x114]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jae 0x42d52d
push ecx
push edx
mov edx, dword [ebp - 0x110]
push edx
jmp 0x42d536
push eax
mov eax, dword [ebp - 0x110]
push edx
push eax
call fcn.0059b910
add esp, 0xc
mov dword [ebp - 0x114], 1
push ebx
call fcn.0059a02a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x114]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42dd50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x118]
push ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x42ddc6
cmp esi, 0x7d00
jae 0x42ddc6
push esi
call fcn.0059a064
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42ddc6
mov edx, dword [ebp - 0x118]
push ebx
push esi
push edx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x42dddb
push ebx
call fcn.0059a02a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x65cc90
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
xor esi, esi
test dword [ebp - 0x10c], 0xfffffffc
jbe 0x42dec8
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ebx, [ebx]
mov eax, dword [0x65cc90]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
lea eax, [ebp - 0x108]
push str.StringFileInfo_04x_04xFileDescription
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x108]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42de6b
mov edx, dword [ebp - 0x120]
test edx, edx
je 0x42de6b
mov eax, dword [ebp - 0x11c]
cmp eax, 0x100
jae 0x42de6b
test eax, eax
jne 0x42de9b
mov ecx, dword [ebp - 0x10c]
inc esi
shr ecx, 2
cmp esi, ecx
jb 0x42de10
push ebx
call fcn.0059a02a
mov eax, dword [ebp - 0x114]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jae 0x42dead
push ecx
push edx
mov edx, dword [ebp - 0x110]
push edx
jmp 0x42deb6
push eax
mov eax, dword [ebp - 0x110]
push edx
push eax
call fcn.0059b910
add esp, 0xc
mov dword [ebp - 0x114], 1
push ebx
call fcn.0059a02a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x114]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 0xc