joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf72c
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x3e8], eax
mov eax, dword [ebp + 0x3f4]
push ebx
push esi
push edi
push 0x3ff
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x17]
push 0
push eax
mov byte [ebp - 0x18], 0
call fcn.0059cb30
add esp, 0xc
push str.mailto:
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._Subject
lea eax, [ebp - 0x18]
push eax
call esi
push 0x6037c8
lea eax, [ebp - 0x18]
push eax
call esi
push str.body
lea eax, [ebp - 0x18]
push eax
call esi
push 0x6037e0
lea eax, [ebp - 0x18]
push eax
call esi
push 0x60bc74
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.004d0cbc
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
mov edi, 0x603864
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
mov ebx, str.cut_here
push ebx
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push str.If_you_like_this_program__recommend_it_to_your_friends.
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push str.Just_enter_your_friends_address_and_send_the_letter...
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push ebx
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push str.Thank_you_for_choosing_our_software_
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push str.Passcape_Software_
lea eax, [ebp - 0x18]
push eax
call esi
push str._r_nWWW:
lea eax, [ebp - 0x18]
push eax
call esi
push str.https:__www.passcape.com
lea eax, [ebp - 0x18]
push eax
call esi
push 3
push 0
push 0
lea eax, [ebp - 0x18]
push 0x400
push eax
call fcn.004cf65d
pop ecx
pop ecx
push eax
push str.open
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
cmp eax, 0x20
ja 0x4cf8a9
push 0x10
push str.ERROR
push str.Error_sending_e_mail_message._You_should_have_at_least_one_default_e_mail_client_to_be_installed_in_your_system.
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4cf8ac
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3e8]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x3ec
leave
ret
Function at 0x4cf8c1
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x98], eax
and dword [ebp - 0x70], 0
push esi
mov esi, dword [ebp + 0xa4]
push edi
push 0x104
lea eax, [ebp - 0x6c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea eax, [ebp - 0x6c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x4cf999
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push edi
mov dword [ebp - 0x78], eax
push 0
lea eax, [ebp - 0x6c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4cf987
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x602a2c
push dword [ebp - 0x78]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4cf987
mov eax, dword [ebp - 0x7c]
mov cx, word [eax + 0x12]
mov word [esi], cx
mov cx, word [eax + 0x10]
mov word [esi + 2], cx
mov cx, word [eax + 0x16]
shr cx, 4
mov word [esi + 6], cx
mov cx, word [eax + 0x16]
and cx, 0xf
mov word [esi + 8], cx
mov ax, word [eax + 0x14]
mov word [esi + 4], ax
mov dword [ebp - 0x70], 1
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 0x98]
mov eax, dword [ebp - 0x70]
pop edi
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0x9c
leave
ret

Function at 0x4cfabb
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0059cb30
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x50], ax
push 0x104
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x60bcbc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x20
push 1
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4cfb4b
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0x1e0
leave
ret
Function at 0x4cfce4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x105
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.0059bf90
pop ecx
jmp 0x4cfd19
cmp byte [esi + eax], 0x5c
je 0x4cfd1f
dec eax
test eax, eax
jg 0x4cfd12
jmp 0x4cfd24
inc eax
mov byte [esi + eax], 0
test eax, eax
je 0x4cfd67
lea eax, [ebp - 0x104]
push eax
call fcn.004cfcd4
mov dword [esp], str.Crash.log
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4cfd6a
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059ca15
leave
ret
Function at 0x4d0125
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x3e8], eax
push esi
push edi
mov edi, dword [ebp + 0x3f4]
push 0x3ff
lea eax, [ebp - 0x17]
push 0
push eax
mov dword [ebp - 0x80], edi
mov byte [ebp - 0x18], 0
call fcn.0059cb30
add esp, 0xc
push str.mailto:
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.support_passcape.com
lea eax, [ebp - 0x18]
push eax
call esi
mov eax, dword [ebp + 0x3f8]
dec eax
je 0x4d01a4
dec eax
je 0x4d019d
dec eax
jne 0x4d01ba
push edi
call fcn.004cf72c
pop ecx
jmp 0x4d02d1
push str._SubjectComments_and_suggestions_regarding
jmp 0x4d01a9
push str._SubjectBug_report_for
lea eax, [ebp - 0x18]
push eax
call esi
push 0x6037c8
lea eax, [ebp - 0x18]
push eax
call esi
push ebx
push str.body
lea eax, [ebp - 0x18]
push eax
call esi
push 0x6037e0
lea eax, [ebp - 0x18]
push eax
call esi
push 0x60bc74
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.004d0cbc
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
mov edi, 0x603864
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
mov ebx, str.cut_here
push ebx
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
mov eax, dword [ebp + 0x3f8]
dec eax
je 0x4d0229
dec eax
jne 0x4d0234
push str.Your_feedback_helps_us_to_improve_our_products_and_work_more_effective...
jmp 0x4d022e
push str.Please_describe_the_error__as_much_information_as_possible_
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push ebx
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push str.Thank_you_for_choosing_our_software_
lea eax, [ebp - 0x18]
push eax
call esi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
push str.Passcape_Software_
lea eax, [ebp - 0x18]
push eax
call esi
push str._r_nWWW:
lea eax, [ebp - 0x18]
push eax
call esi
push str.https:__www.passcape.com
lea eax, [ebp - 0x18]
push eax
call esi
push 3
push 0
push 0
lea eax, [ebp - 0x18]
push 0x400
push eax
call fcn.004cf65d
pop ecx
pop ecx
push eax
push str.open
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebx
cmp eax, 0x20
ja 0x4d02ce
push 0x10
push str.ERROR
push str.Error_sending_e_mail_message._You_should_have_at_least_one_default_e_mail_client_to_be_installed_in_your_system.
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4d02d1
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3e8]
pop edi
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0x3ec
leave
ret
Function at 0x4d02e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x4d03c3
mov eax, dword [eax + 4]
test eax, eax
je 0x4d03c3
push dword [eax + 0x18]
push dword [eax + 0xc]
push dword [eax + 0x14]
push dword [eax + 8]
push dword [eax]
push dword [eax + 0x10]
push dword [eax + 4]
push dword [eax + 0x8c]
push dword [eax + 0x9c]
push dword [eax + 0x94]
push dword [eax + 0xa8]
push dword [eax + 0x90]
push dword [eax + 0xa0]
push dword [eax + 0x98]
push dword [eax + 0xac]
push dword [eax + 0xb4]
push dword [eax + 0xc4]
push dword [eax + 0xc8]
push dword [eax + 0xa4]
push dword [eax + 0xc0]
push dword [eax + 0xb8]
push dword [eax + 0xbc]
push dword [eax + 0xb0]
lea eax, [ebp - 0x204]
push str.EAX_08X_CS_04X_EIP_08X_EFLGS_08X_r_nEBX_08X_SS_04X_ESP_08X_EBP_08X_r_nECX_08X_DS_04X_ESI_08X_FS_04X_r_nEDX_08X_ES_04X_EDI_08X_GS_04X_r_nDR0_08X_DR3_08X_CFLGS_08X_r_nDR1_08X_DR6_08X_r_nDR2_08X_DR7_08X_r_n_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x64
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0059bf90
pop ecx
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059ca15
leave
ret
Function at 0x4d03d0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xbb0]
sub esp, 0xc30
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xbac], eax
mov eax, dword [ebp + 0xbb8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xbbc]
test eax, eax
je 0x4d054d
mov ecx, dword [eax + 4]
push esi
mov esi, dword [ecx + 0xb8]
mov dword [ebp - 0x74], esi
test esi, esi
je 0x4d054c
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov eax, ecx
push dword [eax + 0xb8]
push dword [eax + 0xbc]
lea eax, [ebp - 0x6c]
push str._04X:_08X_r_n
push eax
call ebx
add esp, 0x10
add esi, 0xffffff80
mov edi, 0x200
push edi
and esi, 0xfffffff0
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4d051d
mov dword [ebp - 0x78], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x70], esi
and dword [ebp - 0x70], 0xf
jne 0x4d0492
push esi
lea eax, [ebp - 0x6c]
push str._08X_
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x6c]
push eax
call ebx
add esp, 0xc
cmp esi, dword [ebp - 0x74]
je 0x4d04d6
push 0x5f5834
lea eax, [ebp - 0x6c]
push eax
call edi
cmp esi, dword [ebp - 0x74]
je 0x4d04d6
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4d04c1
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x6c]
push str._02X
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x6c]
push eax
call ebx
add esp, 0xc
mov eax, dword [ebp - 0x74]
dec eax
cmp esi, eax
je 0x4d0500
push 0x5f5834
lea eax, [ebp - 0x6c]
push eax
call edi
jmp 0x4d0500
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4d0500
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x6c]
push 0x60c0e4
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x6c]
push eax
call ebx
add esp, 0xc
cmp dword [ebp - 0x70], 0xf
jne 0x4d0511
push 0x602a28
lea eax, [ebp - 0x6c]
push eax
call edi
inc esi
dec dword [ebp - 0x78]
jne 0x4d045f
jmp 0x4d052c
push str.__unavailable___r_n
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0059bf90
pop ecx
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp + 0xbac]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0xbb0
leave
ret
Function at 0x4d0562
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xbac]
sub esp, 0xc2c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xba8], eax
mov eax, dword [ebp + 0xbb4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xbb8]
test eax, eax
je 0x4d06c6
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [ecx + 0xc4]
test ebx, ebx
je 0x4d06c5
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, ecx
push dword [eax + 0xc4]
push dword [eax + 0xc8]
lea eax, [ebp - 0x70]
push str._04X:_08X_r_n
push eax
call edi
add esp, 0x10
lea esi, [ebx - 0x80]
push 0x200
and esi, 0xfffffff0
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4d0696
mov dword [ebp - 0x78], 0x80
mov dword [ebp - 0x74], esi
and dword [ebp - 0x74], 0xf
jne 0x4d0621
push esi
lea eax, [ebp - 0x70]
push str._08X_
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x70]
push eax
call edi
add esp, 0xc
cmp esi, ebx
je 0x4d0658
push 0x5f5834
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, ebx
je 0x4d0658
push dword [esi]
lea eax, [ebp - 0x70]
push 0x5f5790
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x70]
push eax
call edi
lea eax, [ebx - 4]
add esp, 0xc
cmp esi, eax
je 0x4d0673
push 0x5f5834
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4d0673
push dword [esi]
lea eax, [ebp - 0x70]
push 0x60c10c
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x70]
push eax
call edi
add esp, 0xc
cmp dword [ebp - 0x74], 0xc
jne 0x4d0688
push 0x602a28
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add esi, 4
dec dword [ebp - 0x78]
jne 0x4d05eb
jmp 0x4d06a5
push str.__unavailable___r_n
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0059bf90
pop ecx
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xba8]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0xbac
leave
ret
Function at 0x4d06db
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x3ff
mov dword [ebp - 0x508], eax
lea eax, [ebp - 0x503]
push 0
push eax
mov byte [ebp - 0x504], 0
call fcn.0059cb30
push 0xff
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.0059cb30
add esp, 0x18
test edi, edi
je 0x4d0873
mov eax, dword [edi]
test eax, eax
je 0x4d0873
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4d0873
mov eax, dword [edi]
mov ecx, dword [eax]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp ecx, 0xc0000005
je 0x4d07d0
cmp ecx, 0xc0000006
je 0x4d07c9
cmp ecx, 0xc000001d
je 0x4d07c2
cmp ecx, 0xc0000094
je 0x4d07b2
cmp ecx, 0xc0000096
je 0x4d07ab
lea eax, [ebp - 0x104]
cmp ecx, 0xc00000fd
je 0x4d07a4
push 0x60c1e4
jmp 0x4d07bd
push str.stack_overflow
jmp 0x4d07bd
push str.not_enough_privileges_to_execute_program_code
jmp 0x4d07b7
push str.divide_by_zero
lea eax, [ebp - 0x104]
push eax
call esi
jmp 0x4d0803
push str.illegal_instruction
jmp 0x4d07b7
push str.page_access_error
jmp 0x4d07b7
cmp dword [eax + 0x14], 0
mov ecx, str.write
jne 0x4d07e0
mov ecx, str.read
push dword [eax + 0x18]
lea eax, [ebp - 0x104]
push ecx
push str.attempt_to__s_data_at_address__08X
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x104]
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call esi
push 0x602a28
lea eax, [ebp - 0x504]
push eax
call esi
mov eax, dword [edi]
push dword [eax + 0xc]
push dword [eax]
lea eax, [ebp - 0x504]
push str.Code_______08X_r_nAddress____08X_r_n
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax - 0x504]
push eax
call ebx
add esp, 0x10
push 0
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.0059bf90
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
push dword [ebp - 0x508]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0059ca15
leave
ret
Function at 0x4d0b4b
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0xdc]
sub esp, 0x15c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xd8], eax
mov eax, dword [ebp + 0xe4]
push ebx
push edi
mov edi, dword [ebp + 0xe8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x70]
xor ebx, ebx
push ecx
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov byte [edi], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4d0ca5
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, 0x4000
ja 0x4d0beb
mov esi, 0x6734c0
push esi
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4d0be5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x602a2c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4d0be5
mov ecx, dword [ebp - 0x78]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
jmp 0x4d0bf1
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
cmp dword [ebp - 0x78], ebx
je 0x4d0c56
cmp dword [ebp - 0x74], ebx
je 0x4d0c56
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp + 0x98]
push str._i._i._i._i
push eax
call esi
lea eax, [ebp + 0x98]
push eax
call fcn.0059bf90
add esp, 0x1c
jmp 0x4d0c4f
push 0x5f5834
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x98]
push eax
call fcn.0059bf90
pop ecx
cmp eax, 0xf
jb 0x4d0c30
jmp 0x4d0c68
push str.N_A
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x70]
push eax
call fcn.0059bf90
pop ecx
jmp 0x4d0c7c
cmp byte [ebp + eax - 0x70], 0x5c
je 0x4d0c82
dec eax
cmp eax, ebx
jg 0x4d0c74
jmp 0x4d0c83
inc eax
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp + 0x98]
push ecx
lea eax, [ebp + eax - 0x70]
push eax
push dword [ebp - 0x7c]
push str._08x__12s__s__s_r_n
push edi
call esi
add esp, 0x18
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp + 0xd8]
pop edi
xor ecx, ebp
pop ebx
call fcn.0059ca15
add ebp, 0xdc
leave
ret
Function at 0x4d0cbc
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
push edi
mov edi, dword [ebp + 0xa0]
push pe_nt_image_headers32
xor ebx, ebx
lea eax, [ebp - 0x74]
push eax
push ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov byte [edi], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4d0d94
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, 0x4000
ja 0x4d0d53
mov esi, 0x6774c0
push esi
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4d0d4d
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x602a2c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4d0d4d
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
jmp 0x4d0d59
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
pop esi
cmp dword [ebp - 0x7c], ebx
je 0x4d0d85
cmp dword [ebp - 0x78], ebx
je 0x4d0d85
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._i._i._i._i
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x4d0d91
push 0x60c1e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
pop edi
xor ecx, ebp
pop ebx
call fcn.0059ca15
add ebp, 0x98
leave
ret

Function at 0x4d0dab
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
push esi
push edi
mov edi, dword [ebp + 0x1b0]
xor esi, esi
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.004d113f
pop ecx
pop ecx
test eax, eax
je 0x4d0e17
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.004d0b4b
pop ecx
pop ecx
test eax, eax
je 0x4d0e0c
push 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0059bf90
pop ecx
push eax
lea eax, [ebp - 0x50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x78]
lea esi, [ecx + eax]
jmp 0x4d0dd0
mov ecx, dword [ebp + 0x1a4]
pop edi
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0x1a8
leave
ret
Function at 0x4d113f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [0x67b4c0], 0
jne 0x4d1160
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
mov dword [0x67b4c0], eax
push ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x2c
push 0
push edi
call fcn.0059cb30
push 0x1c
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.004d0fbd
mov ebx, eax
sub ebx, 0x1c
add esp, 0x18
neg ebx
sbb ebx, ebx
inc ebx
jne 0x4d1190
xor eax, eax
jmp 0x4d120c
mov ecx, 0x1000
push esi
mov edx, 0x2000
mov eax, 0x10000
cmp dword [ebp - 0x20], ecx
je 0x4d1210
cmp dword [ebp - 0x20], edx
je 0x4d11bf
cmp dword [ebp - 0x20], eax
jne 0x4d1228
xor ecx, ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x28], eax
jmp 0x4d1239
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], edx
mov eax, dword [ebp - 0x2c]
push dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x14]
mov dword [edi + 4], eax
call fcn.004d102b
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x18], eax
pop ecx
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret
mov esi, dword [ebp - 0x30]
mov dword [edi + 0x1c], esi
mov esi, dword [ebp - 0x24]
mov dword [edi + 0x24], esi
mov esi, dword [ebp - 0x1c]
mov dword [edi + 0x20], esi
mov esi, dword [ebp - 0x18]
mov dword [edi + 0x28], esi
cmp dword [ebp - 0x20], ecx
je 0x4d11d4
cmp dword [ebp - 0x20], edx
je 0x4d11d4
cmp dword [ebp - 0x20], eax
jne 0x4d1209
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov dword [edi], edx
mov edx, dword [ebp - 0x28]
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
jmp 0x4d1209