joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ddd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40de7b
cmp word [ebp - 0x210], 0
je 0x40de7b
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x40de3f
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040b8a0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40de50
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040b8a0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x214], 7
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.0040dc90
mov ecx, esi
test al, al
je 0x40deca
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.00404730
jmp 0x40dee1
sub esp, 8
mov eax, esp
mov dword [eax], 0x474f20
mov dword [eax + 4], 3
call fcn.0040b8a0
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x40deff
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.004048f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0043834d
mov esp, ebp
pop ebp
ret

Function at 0x40dff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40e0e4
cmp eax, 0x104
ja 0x40e0e4
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00405d80
sub esp, 8
lea eax, [ebp - 0x228]
cmp dword [ebp - 0x214], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x228]
mov dword [ecx], eax
mov eax, dword [ebp - 0x218]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x258]
call fcn.0040b8a0
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x40e084
mov ecx, dword [eax]
jmp 0x40e086
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x240]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.0040b8a0
lea ecx, [ebp - 0x240]
call fcn.0040c270
lea eax, [ebp - 0x240]
mov ecx, esi
push eax
call fcn.00408b60
lea ecx, [ebp - 0x240]
call fcn.00404640
lea ecx, [ebp - 0x258]
call fcn.00404640
lea ecx, [ebp - 0x228]
call fcn.00404640
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0043834d
mov esp, ebp
pop ebp
ret
Function at 0x40e550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x40e576
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x40e571
mov eax, dword [ebx]
jmp 0x40e573
mov eax, ebx
mov byte [eax], 0
call fcn.0040c150
test al, al
je 0x40e587
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.0040df20
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40e5a1
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.0043833f
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.0044a658
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40e616
mov eax, dword [ebp + 8]
nop
test ebx, ebx
je 0x40e5ec
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00402a80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40e62c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.0044a658
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40e5d0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00449489
add esp, 4
test eax, eax
jne 0x40e62f
mov byte [ebp - 1], 1
jmp 0x40e633
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.00449896
add esp, 4
test esi, esi
je 0x40e649
push esi
call fcn.00438348
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f3e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x47bbb0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40f51b
cmp byte [edi + 0x3d], 0
je 0x40f51b
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40f42d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + 0x38]
lea ebx, [esp + 0x14]
cmp ecx, 0x10
lea esi, [esp + 0x14]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x40f52f
mov dword [esp + 0xc], esi
xor eax, eax
sub eax, 0
je 0x40f4a2
sub eax, 1
je 0x40f4a6
sub eax, 2
je 0x40f4f4
xor bl, bl
jmp 0x40f4f6
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x40f4d9
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00449e58
mov ecx, dword [esp + 0x38]
add esp, 0x10
mov edx, dword [esp + 0x14]
cmp esi, eax
jne 0x40f49e
cmp byte [edi + 0x3d], 0
je 0x40f4f4
test esi, esi
jne 0x40f464
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00403b30
jmp 0x40f45c
mov bl, 1
cmp ecx, 0x10
jb 0x40f507
inc ecx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00402d50
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x28]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [esp + 0x20]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
jmp 0x40f48f
Function at 0x4159f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x47c534]
mov dword [ebp - 0x80c], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x415a70
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, ebx
je 0x415a2b
mov ebx, eax
mov dword [ebp - 0x80c], ebx
jmp 0x415a4a
int3
mov ecx, ebx
mov edx, 0x47c534
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x415a70
push ebx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov ebx, dword [0x47c534]
mov dword [ebp - 0x80c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x415a7c
int3
push 0x800
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.00439ae0
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x800
call fcn.0043833f
add esp, 4
lea esi, [ebp - 0x808]
mov ebx, eax
mov ecx, 0x200
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043834d
mov esp, ebp
pop ebp
ret

Function at 0x415ae0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x141c
call fcn.00438470
mov eax, dword [0x47bbb0]
xor eax, esp
mov dword [esp + 0x1418], eax
mov eax, dword [0x47c534]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0xc], eax
push edi
mov ecx, 0x200
lea edi, [esp + 0x20]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00438348
add esp, 4
call fcn.00415990
mov esi, eax
push esi
mov dword [esp + 0x10], esi
call fcn.0040c6c0
push eax
lea ecx, [esp + 0x1c]
call fcn.00416220
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea ecx, [esp + 0x14]
call fcn.004161a0
push dword [esp + 0xc]
mov ecx, 0x300
lea edi, [esp + 0x824]
mov esi, 0x47dd90
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ebx, 0x100
nop dword [eax + eax]
xor dl, dl
lea esi, [esp + 0x828]
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [esp + edi*8 + 0x20]
test ecx, ecx
je 0x415bbd
cmp dword [esi - 8], 0
je 0x415bbd
mov eax, dword [esp + edi*8 + 0x24]
cmp eax, dword [esi]
jne 0x415bbd
mov eax, dword [esi - 4]
test eax, eax
je 0x415bbd
push ecx
mov dword [esp + edi*8 + 0x24], 0
call eax
add esp, 4
mov dl, 1
inc edi
add esi, 0xc
cmp edi, 0x100
jl 0x415b90
dec ebx
test ebx, ebx
jle 0x415bd2
test dl, dl
jne 0x415b80
push 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x1424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043834d
mov esp, ebp
pop ebp
ret
Function at 0x415c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x47c534]
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x415c23
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x415c28
call fcn.004159f0
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], 0
call fcn.00415990
mov esi, eax
push esi
call fcn.0040c6c0
push eax
lea ecx, [esp + 0x14]
call fcn.00416220
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea ecx, [esp + 0xc]
call fcn.004161a0
mov ebx, dword [0x4808f4]
xor ecx, ecx
inc ebx
lea eax, [ebx + ecx]
movzx edx, al
lea eax, [edx + edx*2]
cmp dword [eax*4 + 0x47dd90], 0
je 0x415c84
inc ecx
cmp ecx, 0x100
jl 0x415c66
jmp 0x415caf
mov eax, dword [ebp + 8]
lea ecx, [edx + edx*2]
mov dword [ecx*4 + 0x47dd94], eax
mov dword [ecx*4 + 0x47dd90], 1
mov dword [edi + 4], edx
mov eax, dword [ecx*4 + 0x47dd98]
mov dword [0x4808f4], edx
mov dword [edi + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [edi + 4], 0xffffffff
jne 0x415cbd
int3
cmp dword [edi + 4], 0x100
jl 0x415cc7
int3
mov dword [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x416220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [0x480908]
mov esi, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
test edi, edi
jne 0x416255
mov dword [esi], edi
mov eax, esi
mov dword [esi + 8], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x47c534]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x41626e
call fcn.004159f0
mov ecx, eax
mov eax, dword [edi + 0x14]
lea ecx, [ecx + eax*8]
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 0x18]
je 0x416280
xor ecx, ecx
jmp 0x416282
mov ecx, dword [ecx]
mov dword [esi], ecx
test ecx, ecx
je 0x41629c
lea eax, [esp + 8]
push eax
push 0x20
push 0
push dword [ebp + 8]
call fcn.00416080
mov dword [esi + 4], eax
pop edi
mov dword [esi + 8], 0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x416570
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00407480
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4165a0
mov eax, dword [eax]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp ecx, 8
jb 0x4165c2
inc ecx
push ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call fcn.004048f0
test edi, edi
jne 0x4165db
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043834d
mov esp, ebp
pop ebp
ret 0xc
test ebx, ebx
je 0x41669f
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043833f
push dword [ebp + 0x10]
mov esi, eax
lea eax, [ebp - 0x20]
push dword [ebp + 0xc]
push eax
call fcn.00407480
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x416617
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x416635
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004048f0
push esi
lea ecx, [ebp - 0x20]
call fcn.00405d80
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00407350
add esp, 8
mov ecx, ebx
push eax
call fcn.00403bd0
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x41666b
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.00402d50
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
cmp eax, 8
jb 0x416692
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004048f0
test esi, esi
je 0x41669f
push esi
call fcn.00438348
add esp, 4
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043834d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4166c0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
sub esp, 8
cmp dword [eax + 0x14], 0x10
mov edx, esp
jb 0x4166e4
mov ecx, dword [eax]
jmp 0x4166e6
mov ecx, eax
mov dword [edx], ecx
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00407480
mov esi, eax
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x416704
mov esi, dword [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push dword [ebp + 0xc]
push eax
call fcn.00407480
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41671e
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
mov eax, dword [ebp - 0xc]
setne bl
cmp eax, 8
jb 0x416740
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004048f0
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
cmp ecx, 8
jb 0x416769
inc ecx
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call fcn.004048f0
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0043834d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419510
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, edi
test edi, edi
jle 0x4195d7
test esi, esi
je 0x4195d7
push ebx
mov ebx, edi
sar edi, 2
and ebx, 3
test edi, edi
jle 0x419559
movzx ecx, word [esi]
dec edi
movzx edx, word [esi + 2]
add eax, ecx
mov ecx, eax
add esi, 4
shl ecx, 5
xor edx, ecx
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test edi, edi
jg 0x419535
sub ebx, 1
je 0x419595
sub ebx, 1
je 0x419582
sub ebx, 1
jne 0x4195a7
movzx ecx, word [esi]
add eax, ecx
movsx ecx, byte [esi + 2]
shl ecx, 2
xor ecx, eax
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x4195a5
movzx ecx, word [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x4195a5
movsx ecx, byte [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [eax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
pop ebx
shr ecx, 6
pop edi
add eax, ecx
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x41b5d5
Capabilities:
Check for sandbox and av modules
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0x45ef28
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x41b5e9
pop ebp
ret
push esi
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x41b7d9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41b60b
mov eax, dword [eax]
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41b634
xor eax, eax
jmp 0x41b7d7
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov ebx, eax
test ebx, ebx
jne 0x41b71c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80070057
jne 0x41b67b
push ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov ebx, eax
test ebx, ebx
jne 0x41b71c
cmp byte [0x4809b0], 0
je 0x41b71c
cmp dword [0x480944], 0
je 0x41b71c
cmp byte [0x480990], 0
mov al, byte [0x480948]
je 0x41b6ad
xor esi, esi
cmp al, 4
jae 0x41b6e0
test al, al
jmp 0x41b6de
cmp al, 4
jae 0x41b6b5
test al, al
jne 0x41b71c
mov ecx, dword [0x480934]
xor esi, esi
mov edx, SysReAllocString
mov eax, esi
and ecx, edx
or eax, ecx
je 0x41b71e
mov ecx, dword [0x48093c]
mov eax, ecx
and eax, edx
cmp esi, dword [0x480938]
jne 0x41b71e
cmp eax, ecx
jne 0x41b71e
mov eax, 0x474fbc
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push esi
push 0x1fa
push 0x1fba
push 0x475580
push 0x475570
push dword [0x48099c]
push dword [0x480998]
call fcn.0041ad80
add esp, 0x34
jmp 0x41b71e
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x41b733
test eax, eax
jne 0x41b7ce
cmp byte [0x4809b0], 0
je 0x41b7ce
cmp dword [0x480944], 0
je 0x41b7ce
cmp byte [0x480990], 0
mov al, byte [0x480948]
je 0x41b763
cmp al, 4
jae 0x41b794
test al, al
jmp 0x41b792
cmp al, 4
jae 0x41b76b
test al, al
jne 0x41b7ce
mov ecx, dword [0x480934]
mov edx, SysReAllocString
and ecx, edx
mov eax, esi
or eax, ecx
je 0x41b7ce
mov ecx, dword [0x48093c]
mov eax, ecx
and eax, edx
cmp esi, dword [0x480938]
jne 0x41b7ce
cmp eax, ecx
jne 0x41b7ce
mov eax, 0x474fbc
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push esi
push 0x1f8
push 0x1fba
push 0x475580
push 0x475570
push dword [0x48099c]
push dword [0x480998]
call fcn.0041ad80
add esp, 0x34
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x41ba35
Capabilities:
Get file version info
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x47bbb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x17c], eax
push edi
test esi, esi
je 0x41bc29
xor edi, edi
cmp word [esi], di
je 0x41bc29
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41bc29
push edi
push esi
mov dword [ebp - 0x174], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x41bb48
push edi
call fcn.0043833f
pop ecx
push eax
push edi
xor edi, edi
mov dword [ebp - 0x170], eax
push edi
push esi
call sub.VERSION.dll_GetFileVersionInfoW
mov esi, dword [ebp - 0x170]
test eax, eax
je 0x41bb3f
lea eax, [ebp - 0x178]
mov dword [ebp - 0x16c], edi
push eax
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x178], edi
push eax
push 0x474e1c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41bb3f
mov edx, dword [ebp - 0x16c]
movzx eax, word [edx + 0xc]
push eax
movzx eax, word [edx + 0xe]
push eax
movzx eax, word [edx + 8]
push eax
movzx eax, word [edx + 0xa]
push eax
lea eax, [ebp - 0x1c]
push str._d._d._d._d
push eax
call fcn.004045f0
mov ecx, dword [ebp - 0x168]
add esp, 0x18
push eax
call fcn.00408b60
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.004046c0
mov dword [ebp - 0x174], 1
push esi
call fcn.00438348
pop ecx
jmp 0x41bb4a
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x164]
push edi
push eax
push 0x40
lea eax, [ebp - 0x68]
push eax
push ebx
call esi
test eax, eax
je 0x41bc1a
cmp dword [ebp - 0x164], 0x40
jne 0x41bc1a
push edi
push edi
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x164]
mov edi, 0xf8
push eax
push edi
lea eax, [ebp - 0x160]
push eax
push ebx
call esi
test eax, eax
je 0x41bc1a
cmp dword [ebp - 0x164], edi
jne 0x41bc1a
mov eax, dword [ebp - 0x158]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x168], eax
xor eax, eax
push 9
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x168]
push eax
call fcn.0043d9cb
pop ecx
test eax, eax
je 0x41bbd7
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x24]
inc eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x1c]
push str._04d__02d__02d__02d:_02d:_02d_GMT
push eax
call fcn.004045f0
mov ecx, dword [ebp - 0x17c]
add esp, 0x20
push eax
call fcn.00408b60
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004046c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x174]
jmp 0x41bc2b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043834d
mov esp, ebp
pop ebp
ret