joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x404de8
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x404dd7
jg 0x404d40
test edx, edx
je 0x404dd7
nop dword [eax]
call fcn.00406140
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404d94
jg 0x404d57
test esi, esi
je 0x404d94
cmp ebx, eax
jg 0x404d67
jl 0x404d61
cmp edi, esi
jae 0x404d67
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004a84b0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x404dbb
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x404dd1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x404d40
jl 0x404dd1
test edi, edi
jne 0x404d40
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x404e0a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x404e0c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x404e8a
jg 0x404e1f
test esi, esi
je 0x404e8a
test eax, eax
jl 0x404e6e
jg 0x404e29
test ebx, ebx
je 0x404e6e
cmp edi, eax
jg 0x404e39
jl 0x404e33
cmp esi, ebx
jae 0x404e39
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004a84b0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x404e8a
jg 0x404e71
test esi, esi
je 0x404e8a
jmp 0x404e71
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x404e8a
push eax
push esi
push 1
push edx
call fcn.004ac136
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x404ed2
jl 0x404ec5
test ecx, ecx
jne 0x404ed2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404f92
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00406160
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404f3e
jg 0x404efd
test esi, esi
je 0x404f3e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x404f15
mov eax, dword [esp + 0x10]
jl 0x404f0f
cmp eax, esi
jae 0x404f15
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004a84b0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x404f5f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x404f7b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x404ee4
jl 0x404f7b
test ecx, ecx
jne 0x404ee4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x404fd1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x404fd1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.004a84b0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x405040
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x404ff7
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x405029
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004ac37f
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x405054
cmp edi, eax
ja 0x405005
test ecx, ecx
je 0x405040
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004ac37f
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4053d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x507254]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x405400
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40543c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40543c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405526
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x405464
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405497
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004ab423
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4054f9
sub eax, 1
je 0x4054f9
sub eax, 2
jne 0x405526
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004ab423
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405516
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004ac136
add esp, 0x10
cmp edi, eax
jne 0x405526
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x405427
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
Function at 0x405dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x507254]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x405e7c
cmp byte [esi + 0x3d], 0
je 0x405e7c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x405e6a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x405e32
sub eax, 1
je 0x405e36
sub eax, 2
jne 0x405e6a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405e53
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004ac136
add esp, 0x10
cmp edi, eax
jne 0x405e6a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004a6256
mov esp, ebp
pop ebp
ret

Function at 0x4062f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce3e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x507254]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004a6295
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00490646
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408530
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
push esi
push 0x4eb8b0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [esi]
test eax, eax
jne 0x40863b
push 0x4dfb58
push 0xfffe
call fcn.004a62ca
push 0xfffe
mov edi, eax
push 0
push edi
call fcn.004a8a30
add esp, 0x14
push 0x7fff
push edi
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x408628
push 0x5c
push edi
call fcn.004a7ff0
add esp, 8
test eax, eax
je 0x408628
mov edx, eax
mov ecx, 0x7fff
sub edx, edi
sar edx, 1
push str.log.dll
sub ecx, edx
push ecx
push eax
call fcn.004ac8ea
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
push edi
call fcn.004a62c5
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x408726
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LogInit
push eax
call edi
test eax, eax
je 0x40864f
call eax
push str.LogApplySettings
push dword [esi]
call edi
push str.LogSetSettingsFile
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.LogEnable
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.LogSetLevel
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.LogSetPath
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.LogSetType
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.LogSetMode
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.LogSetMaxSize
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
push str.LogSetDepth
push dword [esi]
mov dword [esi + 0x20], eax
call edi
push str.LogWrite
push dword [esi]
mov dword [esi + 0x24], eax
call edi
push str.LogIsEnabled
push dword [esi]
mov dword [esi + 0x28], eax
call edi
push str.LogMonitorSettings
push dword [esi]
mov dword [esi + 0x2c], eax
call edi
push str.LogGetLevel
push dword [esi]
mov dword [esi + 0x30], eax
call edi
push str.LogUninitDeskMetrics
push dword [esi]
mov dword [esi + 0x44], eax
call edi
push str.LogTrackEvent
push dword [esi]
mov dword [esi + 0x34], eax
call edi
push str.LogTrackEventData
push dword [esi]
mov dword [esi + 0x38], eax
call edi
push str.LogRemoveModule
push dword [esi]
mov dword [esi + 0x3c], eax
call edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x40], eax
mov eax, esi
je 0x408728
pop edi
pop esi
ret
mov eax, esi
pop edi
mov dword [esi + 0x28], 0x408770
pop esi
ret
Function at 0x40a9f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce3e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x507254]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004a6295
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00490646
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e5a0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x3c
mov eax, dword [0x507254]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push dword [ecx]
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40e5e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
mov edx, eax
mov esi, 0x507d40
xor ecx, ecx
movq xmm1, xmm0
jmp 0x40e5ff
movaps xmm0, xmmword [esp + 0x10]
mov esi, 0x507cf0
movq xmm1, qword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 8]
mov eax, dword [ebp + 8]
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm1
mov dword [eax + 0x18], ecx
mov ecx, dword [esi + 4]
cmp ecx, dword [0x507cf4]
jne 0x40e62c
test edx, edx
jne 0x40e62c
mov ecx, dword [esp + 0x3c]
pop esi
xor ecx, esp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
push esi
push edx
mov edx, str.QueryServiceStatus_failed
lea ecx, [esp + 0x18]
call fcn.0040de90
add esp, 8
lea eax, [esp + 0x10]
push 0x503698
push eax
call fcn.004a8436
int3
Function at 0x40e9c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x507254]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x24]
xorps xmm0, xmm0
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x28]
lea esi, [esp + 0x10]
push esi
push eax
push 0
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x1c]
movaps xmmword [esp + 0x1c], xmm0
push dword [ecx]
push 0
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x40ea4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, esi
mov dword [edi + 4], 0x507d40
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [edi], 0
mov dword [edi + 4], 0x507cf0
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
Function at 0x41bf20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d03dd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x507254]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, edx
mov dword [ebp - 0x30], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ecx, eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x41bfb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [esi], eax
mov dword [esi + 4], 0x507d40
mov eax, dword [esi + 4]
jmp 0x41bfc7
mov dword [esi], 0
mov eax, 0x507cf0
mov dword [esi + 4], 0x507cf0
mov eax, dword [eax + 4]
cmp eax, dword [0x507cf4]
jne 0x41c0d9
cmp dword [esi], 0
jne 0x41c0d9
test ecx, ecx
je 0x41c0d9
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edx, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x41c001
lea ebx, [edx + ecx]
jmp 0x41c068
jbe 0x41c06b
mov eax, dword [ebp - 0x18]
sub eax, edx
cmp ecx, eax
jbe 0x41c050
push ecx
push ecx
lea ecx, [ebp - 0x20]
call fcn.0042d440
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jmp 0x41c06b
sub ecx, dword [ebp - 0x24]
push ecx
push 0
push ebx
mov dword [ebp - 0x24], ecx
call fcn.004a8a30
mov edx, dword [ebp - 0x20]
add esp, 0xc
add ebx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
push edx
sub ebx, edx
push ebx
push 0
push dword [ebp - 0x30]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41c092
mov dword [esi], 0
mov eax, 0x507cf0
mov dword [esi + 4], 0x507cf0
jmp 0x41c0a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov dword [esi + 4], 0x507d40
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x507cf4]
jne 0x41c0c7
cmp dword [esi], 0
jne 0x41c0c7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x18]
mov dword [edi], eax
mov dword [edi + 8], ecx
jmp 0x41c0ea
mov eax, dword [ebp - 0x20]
mov ecx, eax
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x18]
mov dword [edi], eax
mov dword [edi + 8], ecx
jmp 0x41c0ea
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 8], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
Function at 0x41ff90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x507254]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x41ffc5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x420003
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x420003
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4200cf
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x42002d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42003a
push dword [esi + 0x4c]
push edi
jmp 0x420078
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4200a2
sub eax, 1
je 0x4200a2
sub eax, 2
jne 0x4200cf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004b45bb
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x4200d4
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x4200bf
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.004ac136
add esp, 0x10
cmp ebx, eax
jne 0x4200cf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x41ffed
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004a6256
mov esp, ebp
pop ebp
ret 4
Function at 0x422760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x507254]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x422824
cmp byte [esi + 0x3e], 0
je 0x422824
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x422812
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4227da
sub eax, 1
je 0x4227de
sub eax, 2
jne 0x422812
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4227fb
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004ac136
add esp, 0x10
cmp edi, eax
jne 0x422812
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6256
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004a6256
mov esp, ebp
pop ebp
ret