joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ea45
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x502204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 4
pop eax
push 0x800
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x804]
push ecx
push eax
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebx], ecx
call fcn.0044eee0
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0046e070
add esp, 0x14
xor eax, eax
push eax
push 0x80000000
push eax
push eax
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x42eb40
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea eax, [ebp - 0x814]
push 0
push eax
lea eax, [ebp - 0x810]
push eax
push 0x20000013
push esi
call edi
test eax, eax
je 0x42eb40
cmp dword [ebp - 0x810], 0xc8
jne 0x42eb40
push 0
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0x20000005
push esi
call edi
test eax, eax
je 0x42eb40
mov eax, dword [ebp - 0x80c]
inc eax
push eax
call fcn.0046c3ce
push dword [ebp - 0x80c]
mov dword [ebx], eax
push eax
push esi
call fcn.0042fd6d
mov edi, eax
add esp, 0x10
test edi, edi
je 0x42eb46
mov ecx, dword [ebx]
mov byte [edi + ecx], 0
jmp 0x42eb56
mov edi, dword [ebp - 0x808]
cmp dword [ebx], 0
je 0x42eb56
push dword [ebx]
call fcn.00459651
and dword [ebx], 0
pop ecx
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c8c5
leave
ret
Function at 0x42f881
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x502204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
push edi
push 0
push eax
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x42f923
push 0x4d4478
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0045958b
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0042f7ee
add esp, 0x14
test al, al
je 0x42f923
movzx eax, word [ebp - 0x10a]
push eax
movzx eax, word [ebp - 0x10c]
push eax
movzx eax, word [ebp - 0x10e]
push eax
movzx eax, word [ebp - 0x110]
push eax
push 0x4d4488
push dword [ebp + 0xc]
push esi
call fcn.00413e40
add esp, 0x1c
mov al, 1
jmp 0x42f925
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044c8c5
leave
ret

Function at 0x42f933
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 4], 0xbb8
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x42f9ad
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [ebp - 4]
push 4
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 8
push edi
call esi
push ebx
push 0x84200000
push ebx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x42f9a9
mov bl, 1
push eax
call esi
push edi
call esi
pop esi
pop edi
mov al, bl
pop ebx
leave
ret
Function at 0x42fd6d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x42fd9d
add esi, ecx
add ebx, ecx
sub edi, ecx
je 0x42fda5
test eax, eax
je 0x42fda5
test ecx, ecx
jne 0x42fd7f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x430110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
jne 0x43011d
xor al, al
pop ebp
ret
mov dword [ebp + 0xc], 0x4d4898
pop ebp
jmp fcn.00430150

Function at 0x430150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x502204]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x100
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0044eee0
add esp, 0xc
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push dword [ebp - 0x10c]
call fcn.00430130
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43023d
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push esi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x108]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43023d
lea edx, [ebp - 0x104]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x430213
sub edx, esi
lea eax, [ebp - 0x104]
push edx
push eax
mov ecx, edi
call fcn.00404170
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
Function at 0x4912e1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00490ee2

Function at 0x4912ec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00491065

Function at 0x49bfda
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b769

Function at 0x49bfe5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b9a8

Function at 0x49c2c8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049c19e
Function at 0x4ab0a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x502204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4ab196
push 0x4e48a4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004788b9
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.004ab1b0
add esp, 0x10
test al, al
je 0x4ab196
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x4ab184
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret

Function at 0x4ab1b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ab1f0
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.0046c3ce
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4ab271
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4e5734
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4ab271
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x4ab26f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x4ab27e
push esi
call fcn.00459651
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4abac0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x502204]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
push esi
push edi
push 4
mov esi, ecx
mov dword [esp + 0x14], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [eax], 0
call fcn.004a60e0
push esi
lea ecx, [esp + 0x14]
call fcn.004a5ed0
mov edi, dword [esp + 0x18]
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4abb3e
shr eax, 4
not al
and al, 1
je 0x4abb3e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4abc52
lea ecx, [esp + 0x10]
call fcn.004b7370
test al, al
jne 0x4abb56
mov edi, dword [esp + 0x18]
xor esi, esi
jmp 0x4abc54
push esi
lea eax, [esp + 0x24]
push 0x4e5568
push eax
call fcn.00404d60
add esp, 0xc
lea eax, [esp + 0x20]
push 0x51ef10
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4abc47
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
mov edx, 0x4e5578
mov ecx, 0x51ef3c
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4abbc6
test ax, ax
je 0x4abbc2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4abbc6
add ecx, 4
add edx, 4
test ax, ax
jne 0x4abba0
xor eax, eax
jmp 0x4abbcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4abc30
mov eax, 0x4e557c
mov ecx, 0x51ef3c
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4abc06
test dx, dx
je 0x4abc02
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4abc06
add ecx, 4
add eax, 4
test dx, dx
jne 0x4abbe0
xor eax, eax
jmp 0x4abc0b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4abc30
push 0x51ef3c
push esi
lea eax, [esp + 0x28]
push 0x4e5584
push eax
call fcn.00404d60
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.004abac0
push 0x51ef10
push edi
call ebx
test eax, eax
jne 0x4abb90
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [esp + 0x18]
mov esi, eax
test edi, edi
je 0x4abc61
push edi
call fcn.00459651
add esp, 4
mov ecx, dword [esp + 0x824]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
Function at 0x4abc90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x502204]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
push esi
push edi
push 4
mov edi, ecx
mov dword [esp + 0x14], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [eax], 0
call fcn.004a60e0
push edi
lea ecx, [esp + 0x14]
call fcn.004a5ed0
mov eax, dword [esp + 0x18]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 0xffffffff
je 0x4abd0c
shr eax, 4
not al
and al, 1
jne 0x4abe21
lea ecx, [esp + 0x10]
call fcn.004b7370
test al, al
jne 0x4abd20
xor esi, esi
jmp 0x4abe2a
push edi
lea eax, [esp + 0x24]
push 0x4e5540
push eax
call fcn.00404d60
add esp, 0xc
lea eax, [esp + 0x20]
push 0x51ecc0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4abe21
nop
mov edx, 0x4e5550
mov ecx, 0x51ecec
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4abd86
test ax, ax
je 0x4abd82
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4abd86
add ecx, 4
add edx, 4
test ax, ax
jne 0x4abd60
xor eax, eax
jmp 0x4abd8b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4abe06
mov eax, 0x4e5554
mov ecx, 0x51ecec
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4abdc6
test dx, dx
je 0x4abdc2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4abdc6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4abda0
xor eax, eax
jmp 0x4abdcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4abe06
push 0x51ecec
push edi
lea eax, [esp + 0x28]
push 0x4e555c
push eax
call fcn.00404d60
add esp, 0x10
test byte [0x51ecc0], 0x10
je 0x4abdfb
lea ecx, [esp + 0x20]
call fcn.004abc90
jmp 0x4abe06
push 4
push 0
lea eax, [esp + 0x28]
push eax
call ebx
push 0x51ecc0
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4abd50
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
push 0
push edi
call ebx
mov esi, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4abe3b
push eax
call fcn.00459651
add esp, 4
mov ecx, dword [esp + 0x824]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
Function at 0x4abe70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x103c
call fcn.0044c8e0
mov eax, dword [0x502204]
xor eax, esp
mov dword [esp + 0x1038], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [esp + 0x28], vtable.t_str.0
mov ebx, ecx
mov dword [esp + 0x38], esi
push 4
mov dword [esp + 0x40], ebx
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x34], 0
mov dword [eax], 0
call fcn.004a60e0
push esi
lea ecx, [esp + 0x2c]
call fcn.004a5ed0
push 4
mov dword [esp + 0x1c], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
mov dword [eax], 0
call fcn.004a60e0
push ebx
lea ecx, [esp + 0x1c]
call fcn.004a5ed0
mov eax, dword [esp + 0x30]
mov bl, 1
add eax, 4
mov byte [esp + 0x14], 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4abf9b
shr eax, 4
not al
and al, bl
je 0x4abf9b
push ecx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.004b6bb0
test al, al
jne 0x4abf59
lea ecx, [esp + 0x10]
call fcn.004a7c70
xor bl, bl
lea ecx, [esp + 0x10]
call fcn.004a7cc0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4abf73
push eax
call fcn.00459651
add esp, 4
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4abf84
push ecx
call fcn.00459651
add esp, 4
mov ecx, dword [esp + 0x1044]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
call fcn.004b7370
test al, al
je 0x4abf57
lea ecx, [esp + 0x18]
call fcn.004b7370
test al, al
jne 0x4abfc8
push ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.004b71c0
test al, al
je 0x4abf57
push esi
lea eax, [esp + 0x44]
push 0x4e54e4
push eax
call fcn.00404d60
add esp, 0xc
lea eax, [esp + 0x40]
push 0x51e128
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4abf59
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax]
mov edx, 0x4e54f4
mov ecx, 0x51e154
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4ac036
test ax, ax
je 0x4ac032
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4ac036
add ecx, 4
add edx, 4
test ax, ax
jne 0x4ac010
xor eax, eax
jmp 0x4ac03b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4ac0cb
mov eax, 0x4e54f8
mov ecx, 0x51e154
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4ac076
test dx, dx
je 0x4ac072
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4ac076
add ecx, 4
add eax, 4
test dx, dx
jne 0x4ac050
xor eax, eax
jmp 0x4ac07b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4ac0cb
push 0x51e154
push dword [esp + 0x3c]
lea eax, [esp + 0x48]
push 0x4e5500
push eax
call fcn.00404d60
push 0x51e154
push dword [esp + 0x50]
lea eax, [esp + 0x858]
push 0x4e550c
push eax
call fcn.00404d60
add esp, 0x20
lea edx, [esp + 0x40]
lea ecx, [esp + 0x840]
call fcn.004abe70
neg al
sbb al, al
and bl, al
push 0x51e128
push esi
call edi
test eax, eax
jne 0x4ac000
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4abf59
Function at 0x4ade20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x502204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x428], ecx
push 0
push eax
xor bl, bl
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4adfd4
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], 0
push 0
push eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x418], 0
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4adfd4
push edi
call fcn.0046c3ce
mov esi, eax
add esp, 4
test esi, esi
je 0x4adfd4
push esi
push edi
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4adfb8
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push str.VarFileInfoTranslation
push esi
call edi
test eax, eax
je 0x4adfb8
cmp dword [ebp - 0x418], 4
jb 0x4adfb8
mov ecx, dword [ebp - 0x420]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x414]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.00413200
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
call edi
test eax, eax
je 0x4adfb8
mov eax, dword [ebp - 0x418]
cmp eax, 2
jbe 0x4adfb8
mov edx, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x428]
cmp word [edx + eax*2 - 2], 0
jne 0x4adfaf
push edx
call fcn.004a5ed0
push esi
mov bl, 1
call fcn.00459651
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
push eax
push edx
call fcn.004a5e00
mov bl, 1
push esi
call fcn.00459651
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret
Function at 0x4b2e50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], vtable.t_str.0
push 4
mov ebx, dword [edi + 8]
add ebx, 4
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [eax], 0
call fcn.004a60e0
push ebx
lea ecx, [esp + 0x14]
call fcn.004a5ed0
cmp dword [esp + 0x14], 2
mov esi, dword [esp + 0x18]
jb 0x4b2edb
cmp word [esi + 6], 0x3a
jne 0x4b2edb
call fcn.004b23d0
test al, al
jne 0x4b2ec3
push esi
call fcn.00459651
add esp, 4
xor bl, bl
jmp 0x4b2eea
mov ecx, ebx
call fcn.004b20f0
push esi
test eax, eax
jne 0x4b2ee0
call fcn.00459651
add esp, 4
xor bl, bl
jmp 0x4b2eea
test esi, esi
je 0x4b2ee8
push esi
call fcn.00459651
add esp, 4
mov bl, 1
mov ecx, edi
call fcn.004b7370
test al, al
jne 0x4b3014
mov eax, dword [edi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b2f95
shr eax, 4
not al
and al, 1
je 0x4b2f95
test bl, bl
je 0x4b3014
mov eax, dword [edi + 8]
add eax, 4
push eax
call fcn.004c1710
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4b2f37
mov dword [eax], ebx
test ebx, ebx
je 0x4b3014
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 8]
call fcn.004a7c10
push 0x4e9018
mov edi, eax
push 0x4e3d38
push edi
call fcn.004a4cb0
push ebx
push 0x4e3cfc
push edi
call fcn.004a4cb0
push 0x4e9028
push 0x4e3d38
push edi
call fcn.004a4cb0
lea eax, [esi + 4]
push eax
push 0x4e3d38
push edi
call fcn.004a4cb0
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4b2fa2
mov dword [eax], 1
mov esi, dword [edi + 8]
push 4
mov dword [esp + 0x14], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [eax], 0
call fcn.004a60e0
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x14]
call fcn.004a5ed0
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push str.b_rN0R
call fcn.004a7c10
mov ecx, eax
call fcn.004a71c0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b3009
push eax
call fcn.00459651
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b5800
Capabilities:
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], vtable.t_str.0
push 4
mov dword [esp + 0x10], ebx
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [eax], 0
call fcn.004a60e0
lea ecx, [esp + 0x10]
call fcn.004a60e0
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004b6f50
mov edi, dword [ebp + 8]
test al, al
je 0x4b5871
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.004b71c0
test al, al
je 0x4b5969
mov eax, dword [esi + 8]
mov ecx, dword [ebx + 8]
add eax, 4
push 0xb
push eax
lea eax, [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, dword [esi + 8]
test eax, eax
jne 0x4b596d
push 4
mov dword [esp + 0x34], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x3c], 0
mov dword [eax], 0
call fcn.004a60e0
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x34]
call fcn.004a5ed0
mov esi, dword [esp + 0xc]
push 4
mov dword [esp + 0x24], vtable.t_str.0
mov esi, dword [esi + 8]
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 0
mov dword [eax], 0
call fcn.004a60e0
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x24]
call fcn.004a5ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.004a7c10
mov ecx, eax
call fcn.004a7410
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call fcn.004a7c10
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
push ecx
push 0x4e76d0
mov ecx, eax
call fcn.004a7090
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4b5958
push eax
call fcn.00459651
add esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4b5969
push eax
call fcn.00459651
add esp, 4
xor bl, bl
jmp 0x4b5996
push 0x80
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esi + 8]
sub esp, 8
add ecx, 4
call fcn.004b9340
add esp, 8
mov ecx, esi
call fcn.004b7110
mov bl, 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b59a7
push eax
call fcn.00459651
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc