joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494ba0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x649ffc]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.0059fabb
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x494c18
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00475aa0
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.00462ee0
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x494d57
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x494c6a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00475aa0
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.00462ee0
add esp, 0x1c
mov esi, 0x4d
jmp 0x494d57
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x494caa
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00475aa0
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.00462ee0
add esp, 0x1c
mov esi, 0x4d
jmp 0x494d4d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x494cd8
jg 0x494cbe
cmp edi, 0x100000
jbe 0x494cd8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.00462ee0
add esp, 0xc
mov esi, 0x4d
jmp 0x494d4d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x494cf0
lea esi, [eax + 0x1b]
jmp 0x494d4d
test edi, edi
je 0x494d34
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x494d91
mov eax, dword [esp + 0x10]
test eax, eax
je 0x494d8d
add esi, eax
cmp esi, edi
jb 0x494d00
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.004949a0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x649004]
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x494d72
push eax
call fcn.00595b6f
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0056e987
add esp, 0x120
ret
mov edi, esi
jmp 0x494d34
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00475aa0
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.00462ee0
add esp, 0x1c
mov esi, 0x4d
jmp 0x494d4d
Function at 0x49ad30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.004655f0
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x49ae98
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x49adac
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x49ae11
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x49add0
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x49ae3d
mov eax, dword [esi + 4]
push 1
push 0x5cd6dc
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5cd6dd
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x49ae16
push dword [esp + 0x28]
call fcn.004655f0
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x49ae68
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x649004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x49c960
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0056f680
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100c]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x1008], 1
push edx
lea edx, [ebp - 0x1008]
mov dword [ebp - 0x100c], 0x800
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x49ca70
mov ecx, dword [ebp - 0x1008]
cmp ecx, 1
jne 0x49ca03
lea edx, [ebp - 0x804]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x49c9d1
sub edx, ecx
lea eax, [ebp - 0x804]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00409cd1
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x49ca6b
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x49ca54
cmp eax, 0x400
ja 0x49ca54
lea eax, [ebp - 0x1004]
mov ecx, edi
push eax
call fcn.0040982a
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0xea
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056e987
mov esp, ebp
pop ebp
ret 8

Function at 0x49cb00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49cb10
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 8
Function at 0x49dbb0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x49dbc1
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x49dbe1
or eax, 0xffffffff
or edx, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
test edx, edx
jg 0x49dbf9
jl 0x49dbf1
test eax, eax
jae 0x49dbf9
or eax, 0xffffffff
mov edx, accept
mov esp, ebp
pop ebp
ret

Function at 0x49dee0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b99b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, esi
cmp dword [esi + 0x14], 8
jb 0x49df18
mov ebx, dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49df2e
shr al, 4
and al, 1
jmp 0x49dfbf
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0049f000
cmp dword [esi + 0x14], 8
mov ecx, esi
mov dword [ebp - 4], 2
jb 0x49df4a
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae edi, dword [ebp - 0x28]
cmp edx, dword [esi + 0x10]
jne 0x49df78
test edx, edx
je 0x49dfaf
sub edi, ecx
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x49df78
add ecx, 2
sub edx, 1
jne 0x49df63
xor bl, bl
jmp 0x49dfb5
lea eax, [ebp - 0x28]
push eax
call fcn.0049dee0
add esp, 4
test al, al
je 0x49dfaf
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x49dfb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x49dfaf
push esi
call fcn.0049e380
add esp, 4
test al, al
jne 0x49dfb3
xor bl, bl
jmp 0x49dfb5
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.0049ea70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret
Function at 0x49e380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x49e38e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49e3a1
shr eax, 4
and al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x49e3b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9aa1
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x49e473
cmp eax, 0x104
ja 0x49e473
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00409872
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x260]
call fcn.0049ea30
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.0049f680
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040e1e0
lea ecx, [ebp - 0x248]
call fcn.0049ea70
lea ecx, [ebp - 0x260]
call fcn.0049ea70
lea ecx, [ebp - 0x230]
call fcn.00409de3
mov al, 1
jmp 0x49e475
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret

Function at 0x49e550
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9af1
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x49e641
xor eax, eax
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49e5c3
sub eax, edx
lea ecx, [ebp - 0x234]
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00409cd1
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x264]
call fcn.0049ea30
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.0049f680
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040e1e0
lea ecx, [ebp - 0x24c]
call fcn.0049ea70
lea ecx, [ebp - 0x264]
call fcn.0049ea70
lea ecx, [ebp - 0x234]
call fcn.00409de3
mov al, 1
jmp 0x49e643
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret

Function at 0x49e7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x49e7ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x49e7c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9b58
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x649ffc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x49e7f0
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor esi, esi
mov dword [ebp + 8], esi
test edi, edi
je 0x49e82d
lea ecx, [ebp + 8]
call fcn.0049ddf0
cmp edi, 0xffffffff
je 0x49e82a
mov esi, edi
mov dword [ebp + 8], esi
call fcn.004aebf0
jmp 0x49e82d
mov esi, dword [ebp + 8]
test esi, esi
je 0x49e850
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49e850
mov esi, dword [ebp - 0x10]
cmp esi, edi
je 0x49e853
or esi, 0xffffffff
lea ecx, [ebp + 8]
mov dword [ebp - 4], 6
call fcn.0049ddf0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49fb40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1001c
call fcn.0056f680
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x5fcb08
push eax
call fcn.0049e660
add esp, 8
mov dword [ebp - 0x10018], eax
test eax, eax
jne 0x49fb87
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret
push ebx
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.00598609
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x49fd43
push edi
nop word [eax + eax]
test esi, esi
je 0x49fd1c
mov edx, dword [esi + 0x14]
mov eax, edx
mov edi, dword [esi + 0x10]
sub eax, edi
mov dword [ebp - 0x1001c], edi
mov dword [ebp - 0x1000c], edx
cmp ebx, eax
ja 0x49fbfd
lea eax, [edi + ebx]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x49fbe1
mov eax, dword [esi]
add edi, eax
lea eax, [ebp - 0x10004]
push ebx
push eax
push edi
call fcn.00586e70
add esp, 0xc
mov byte [edi + ebx], 0
jmp 0x49fd1c
mov eax, accept
sub eax, edi
cmp eax, ebx
jb 0x49fd63
lea ecx, [edi + ebx]
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x49fc21
mov ecx, accept
jmp 0x49fc4e
mov eax, edx
shr eax, 1
mov dword [ebp - 0x10008], eax
mov eax, accept
sub eax, dword [ebp - 0x10008]
cmp edx, eax
jbe 0x49fc41
mov ecx, accept
jmp 0x49fc4e
mov eax, dword [ebp - 0x10008]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x10008], ecx
push eax
mov ecx, esi
call fcn.00403c57
lea ecx, [edi + ebx]
mov dword [ebp - 0x10014], eax
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp - 0x10008]
mov dword [esi + 0x14], ecx
lea ecx, [eax + edi]
mov dword [ebp - 0x10008], ecx
add ecx, ebx
cmp dword [ebp - 0x1000c], 0x10
mov dword [ebp - 0x10010], ecx
jb 0x49fced
push dword [ebp - 0x1001c]
mov edi, dword [esi]
push edi
push eax
call fcn.005868f0
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005868f0
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov ecx, dword [ebp - 0x1000c]
inc ecx
mov byte [eax], 0
cmp ecx, 0x1000
jb 0x49fce1
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x49fd68
mov edi, edx
push ecx
push edi
call fcn.0056e998
add esp, 8
jmp 0x49fd14
push edi
push esi
push eax
call fcn.005868f0
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005868f0
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov byte [eax], 0
mov eax, dword [ebp - 0x10014]
mov dword [esi], eax
push dword [ebp - 0x10018]
lea eax, [ebp - 0x10004]
push 0x10000
push 1
push eax
call fcn.00598609
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x49fbb0
pop edi
push dword [ebp - 0x10018]
call fcn.0059740b
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop ebx
pop esi
call fcn.0056e987
mov esp, ebp
pop ebp
ret
call fcn.00403bc1
call fcn.0058ac68
int3
Function at 0x4a5330
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 8
jb 0x4a5344
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4a5420
push 1
push ebx
call fcn.00595ec0
mov edi, eax
add esp, 8
test edi, edi
je 0x4a5420
push edi
push ebx
push dword [ebp - 4]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4a5417
lea eax, [ebp - 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 8]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a5417
cmp dword [ebp + 8], 0
je 0x4a5417
push 0x14
call fcn.0056e9a6
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
test esi, esi
je 0x4a540c
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi], vtable.FileVersionInfoWin.0
mov dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4a53e7
push eax
call fcn.00595b6f
add esp, 4
mov dword [esi + 4], edi
lea ecx, [ebp - 0xc]
mov dword [esi + 0x10], 0
push ecx
lea eax, [esi + 0x10]
push eax
push 0x5fbab0
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.00595b6f
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5430
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba4a6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [ebp - 0x218], cx
lea ecx, [ebp - 0x218]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4a5602
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a54b0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00409cd1
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x248]
call fcn.0049ea30
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00409de3
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x250]
lea ebx, [ebp - 0x248]
cmovae ebx, dword [ebp - 0x248]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x4a55f3
push 1
push esi
call fcn.00595ec0
mov edi, eax
add esp, 8
test edi, edi
je 0x4a55f3
push edi
push esi
push dword [ebp - 0x250]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4a55ea
lea eax, [ebp - 0x258]
mov dword [ebp - 0x24c], 0
push eax
lea eax, [ebp - 0x24c]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a55ea
cmp dword [ebp - 0x24c], 0
je 0x4a55ea
push 0x14
call fcn.0056e9a6
mov esi, eax
add esp, 4
mov dword [ebp - 0x254], esi
test esi, esi
je 0x4a55f3
mov eax, dword [ebp - 0x24c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi], vtable.FileVersionInfoWin.0
mov dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4a55c9
push eax
call fcn.00595b6f
add esp, 4
mov dword [esi + 4], edi
lea ecx, [ebp - 0x254]
mov dword [esi + 0x10], 0
push ecx
lea eax, [esi + 0x10]
push eax
push 0x5fbab0
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
jmp 0x4a55f5
push edi
call fcn.00595b6f
add esp, 4
xor esi, esi
lea ecx, [ebp - 0x248]
call fcn.0049ea70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret
Function at 0x4a5620
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba4db
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], ecx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x24c], eax
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 8]
mov word [ebp - 0x20], ax
movzx eax, word [ecx + 0xc]
mov word [ebp - 0x1e], ax
call esi
mov ecx, dword [ebp - 0x244]
mov word [ebp - 0x1c], ax
movzx eax, word [ecx + 0xc]
mov word [ebp - 0x1a], ax
movzx eax, word [ecx + 8]
mov word [ebp - 0x18], ax
mov eax, 0x4e4
mov word [ebp - 0x16], ax
call esi
mov word [ebp - 0x14], ax
xor ecx, ecx
mov eax, 0x4e4
mov word [ebp - 0x12], ax
push dword [ebp - 0x24c]
movzx eax, word [ebp + ecx*2 - 0x1e]
lea esi, [ecx + 2]
push eax
movzx eax, word [ebp + ecx*2 - 0x20]
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.0041239d
add esp, 0x1c
mov dword [ebp - 0x248], 0
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x244]
push dword [eax + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a573f
mov edx, dword [ebp - 0x248]
test edx, edx
jne 0x4a5790
mov ecx, esi
cmp esi, 8
jb 0x4a56d1
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x5fa498
mov word [edi], ax
call fcn.00409cd1
lea ecx, [ebp - 0x240]
call fcn.00409de3
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret 8
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a5795
sub eax, esi
lea ecx, [ebp - 0x240]
sar eax, 1
push eax
push edx
call fcn.00409cd1
movups xmm0, xmmword [ebp - 0x240]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
movups xmmword [edi], xmm0
mov word [ebp - 0x240], ax
movq xmm0, qword [ebp - 0x230]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
jmp 0x4a5766