joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eaf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, edx
sub eax, edi
xor ecx, ecx
inc eax
xor esi, esi
shr eax, 1
xor ebx, ebx
cmp edi, edx
cmova eax, ecx
test eax, eax
je 0x41eb32
mov edx, eax
mov ecx, esi
lea edi, [edi + 2]
mov eax, esi
shl ecx, 6
shr eax, 2
inc ebx
add ecx, eax
movzx eax, word [edi - 2]
add eax, 0x9e3779b9
add eax, ecx
xor esi, eax
cmp ebx, edx
jne 0x41eb11
mov eax, 3
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
imul eax, eax, 0x7fffffff
pop edi
sub esi, eax
or esi, 0x40000000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x426e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x361
mov dword [ebp - 0x9c], 0x3610300
mov dword [ebp - 0x98], 0x4860483
lea eax, [ebp - 0x9a]
mov dword [ebp - 0x94], 0x9030903
mov dword [ebp - 0x90], 0x940093e
mov dword [ebp - 0x8c], 0x94c0949
mov dword [ebp - 0x88], 0x9830982
mov dword [ebp - 0x84], 0x9c009be
mov dword [ebp - 0x80], 0x9cc09c7
mov dword [ebp - 0x7c], 0x9d709d7
mov dword [ebp - 0x78], 0xa400a3e
mov dword [ebp - 0x74], 0xa830a83
mov dword [ebp - 0x70], 0xac00abe
mov dword [ebp - 0x6c], 0xacc0ac9
mov dword [ebp - 0x68], 0xb030b02
mov dword [ebp - 0x64], 0xb3e0b3e
mov dword [ebp - 0x60], 0xb400b40
mov dword [ebp - 0x5c], 0xb4c0b47
mov dword [ebp - 0x58], 0xb570b57
mov dword [ebp - 0x54], 0xb830b83
mov dword [ebp - 0x50], 0xbbf0bbe
mov dword [ebp - 0x4c], 0xbcc0bc1
mov dword [ebp - 0x48], 0xbd70bd7
mov dword [ebp - 0x44], 0xc030c01
mov dword [ebp - 0x40], 0xc440c41
mov dword [ebp - 0x3c], 0xc830c82
mov dword [ebp - 0x38], 0xcbe0cbe
mov dword [ebp - 0x34], 0xcc40cc0
mov dword [ebp - 0x30], 0xccb0cc7
mov dword [ebp - 0x2c], 0xcd60cd5
mov dword [ebp - 0x28], 0xd030d02
mov dword [ebp - 0x24], 0xd400d3e
mov dword [ebp - 0x20], 0xd4c0d46
mov dword [ebp - 0x1c], 0xd570d57
mov dword [ebp - 0x18], 0xf7f0f7f
mov dword [ebp - 0x14], 0x20e120d0
mov dword [ebp - 0x10], 0x309a3099
mov dword [ebp - 0xc], 0xfe23fe20
mov dword [ebp - 8], 0xffffffff
cmp dx, cx
jae 0x426f5a
add eax, 4
cmp word [eax], cx
jb 0x426f52
cmp cx, word [eax - 2]
jb 0x426f75
cmp cx, word [eax]
ja 0x426f75
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
Function at 0x429750
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 0xc], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041a2b0
push 0
mov dword [esi], eax
call fcn.004b3121
add esp, 4
sub eax, 0x1e13380
mov dword [edi], eax
sbb edx, 0
mov dword [edi + 4], edx
call fcn.0042b460
test al, al
je 0x4297ff
push str.wevtapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4297ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EvtCreateRenderContext
push ebx
call esi
push str.EvtRender
push ebx
mov dword [edi + 0x10], eax
call esi
push str.EvtFormatMessage
push ebx
mov dword [edi + 0x14], eax
call esi
push str.EvtQuery
push ebx
mov dword [edi + 0x18], eax
call esi
push str.EvtNext
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.EvtOpenPublisherMetadata
push ebx
mov dword [edi + 0x20], eax
call esi
push str.EvtClose
push ebx
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b460
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x50fe08]
cmp eax, dword [ecx + 4]
jle 0x42b4de
push 0x50fe08
call fcn.0048de6a
add esp, 4
cmp dword [0x50fe08], 0xffffffff
jne 0x42b4de
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x42b4ca
cmp dword [ebp - 0x114], 6
setae al
jmp 0x42b4cc
xor al, al
push 0x50fe08
mov byte [0x50fe0c], al
call fcn.0048de20
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [0x50fe0c]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
Function at 0x42d1a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x4c]
cmp eax, 0xffffffff
je 0x42d1be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x4c], 0xffffffff
mov eax, dword [edi + 0x88]
test eax, eax
je 0x42d1db
push eax
call fcn.004af74b
add esp, 4
mov dword [edi + 0x88], 0
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x42d1e7
mov eax, dword [edi + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [edi + 0x30], 8
lea ecx, [edi + 0x1c]
jb 0x42d1fd
mov ecx, dword [edi + 0x1c]
push ecx
call esi
mov eax, dword [edi + 0x94]
lea ecx, [edi + 0x94]
push eax
push dword [eax]
lea eax, [ebp - 4]
push eax
call fcn.00412440
push 0x28
push dword [edi + 0x94]
call fcn.0048d8eb
mov eax, dword [edi + 0x8c]
lea ecx, [edi + 0x8c]
add esp, 8
push eax
push dword [eax]
lea eax, [ebp - 4]
push eax
call fcn.00412440
push 0x28
push dword [edi + 0x8c]
call fcn.0048d8eb
mov ecx, dword [edi + 0x84]
add esp, 8
pop esi
cmp ecx, 0x10
jb 0x42d288
mov eax, dword [edi + 0x70]
inc ecx
cmp ecx, 0x1000
jb 0x42d27e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42d33a
mov eax, edx
push ecx
push eax
call fcn.0048d8eb
add esp, 8
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0xf
mov byte [edi + 0x70], 0
mov ecx, dword [edi + 0x6c]
cmp ecx, 0x10
jb 0x42d2d0
mov eax, dword [edi + 0x58]
inc ecx
cmp ecx, 0x1000
jb 0x42d2c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42d33a
mov eax, edx
push ecx
push eax
call fcn.0048d8eb
add esp, 8
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0xf
mov byte [edi + 0x58], 0
mov ecx, dword [edi + 0x48]
cmp ecx, 0x10
jb 0x42d312
mov eax, dword [edi + 0x34]
inc ecx
cmp ecx, 0x1000
jb 0x42d308
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42d33a
mov eax, edx
push ecx
push eax
call fcn.0048d8eb
add esp, 8
mov dword [edi + 0x44], 0
lea ecx, [edi + 0x1c]
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], 0
call fcn.0040c2c0
lea ecx, [edi + 4]
call fcn.0040c2c0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b0023
int3
Function at 0x42d340
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2478
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x30], 8
lea esi, [edi + 0x1c]
mov eax, esi
jb 0x42d37a
mov eax, dword [esi]
push eax
push 0x4ec6fc
mov edx, 0x6c
call fcn.0040ee00
add esp, 8
test al, al
je 0x42d4be
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x6c], 0
push 0
push eax
call fcn.004a5f00
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x42d3b6
mov eax, dword [esi]
push 0x4ec704
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004af49e
mov eax, dword [ebp - 0x6c]
add esp, 0xc
test eax, eax
je 0x42d4be
push eax
call fcn.004b9005
add esp, 4
test eax, eax
jne 0x42d4b3
mov ebx, dword [ebp - 0x6c]
push dword [ebp - 0x6c]
call fcn.004b9030
add esp, 4
test eax, eax
jne 0x42d4b3
push 0x40
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004a5f00
push dword [ebp - 0x6c]
lea eax, [ebp - 0x50]
push 0x3f
push eax
call fcn.004b9120
lea eax, [ebp - 0x50]
add esp, 0x18
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d420
sub eax, edx
cmp eax, 1
jle 0x42d4a0
dec eax
mov byte [ebp - 0x68], cl
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x58], 0
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], 0xf
call fcn.0040e3a0
push ebx
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
push ecx
lea eax, [ebp - 0x74]
push eax
lea ecx, [edi + 0x94]
call fcn.00413ef0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
cmp edx, 0x10
jb 0x42d4a0
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42d496
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42d4e9
push edx
push ecx
call fcn.0048d8eb
add esp, 8
push dword [ebp - 0x6c]
call fcn.004b9005
add esp, 4
test eax, eax
je 0x42d3e7
push dword [ebp - 0x6c]
call fcn.004af74b
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x42d4c6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
call fcn.004b0023
int3
Function at 0x42ea40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d25eb
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x82c], 0
push 0
push eax
call fcn.004a5f00
lea eax, [esi + 0x58]
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x42ea9a
mov eax, dword [eax]
push 0x4eb640
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.004af4fc
mov eax, dword [ebp - 0x82c]
add esp, 0xc
test eax, eax
je 0x42ebe9
push eax
call fcn.004b9005
add esp, 4
test eax, eax
jne 0x42ebdb
mov edi, dword [ebp - 0x82c]
push dword [ebp - 0x82c]
call fcn.004b9030
add esp, 4
test eax, eax
jne 0x42ebdb
push 0x800
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.004a5f00
add esp, 0xc
lea eax, [ebp - 0x810]
push dword [ebp - 0x82c]
push 0x7ff
push eax
call fcn.004b9120
lea eax, [ebp - 0x810]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42eb22
sub eax, edx
cmp eax, 1
jle 0x42ebc5
dec eax
mov byte [ebp - 0x828], cl
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x818], 0
push eax
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 0xf
call fcn.0040e3a0
push edi
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 0
push eax
push ecx
lea eax, [ebp - 0x834]
push eax
lea ecx, [esi + 0x8c]
call fcn.00413ef0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x814]
cmp edx, 0x10
jb 0x42ebc5
mov ecx, dword [ebp - 0x828]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ebbb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ec4c
push edx
push ecx
call fcn.0048d8eb
add esp, 8
push dword [ebp - 0x82c]
call fcn.004b9005
add esp, 4
test eax, eax
je 0x42ead4
push dword [ebp - 0x82c]
call fcn.004af74b
add esp, 4
cmp dword [esi + 0x84], 0x10
lea eax, [esi + 0x70]
jb 0x42ebf7
mov eax, dword [eax]
push eax
push 0
push str.count
push 0x4ec710
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push str.LoadHistory_count__d_
push 0x135
push 0x4ec650
push 4
push ecx
mov dword [esi + 0x54], eax
call fcn.00407ee0
add esp, 4
push eax
call fcn.00407910
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
call fcn.004b0023
int3
Function at 0x42ed60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d262b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
push dword [esi + 4]
push dword [esi]
call fcn.0042fb40
mov eax, dword [esi]
push 0x200
mov dword [esi + 4], eax
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004a5f00
add esp, 0x18
lea eax, [ebp - 0x214]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x42ef20
xor edi, edi
mov dword [ebp - 0x218], 0xf
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x21c], edi
mov byte [ebp - 0x22c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42edf3
sub ecx, edx
lea eax, [ebp - 0x214]
push ecx
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040e3a0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x21c], 0
je 0x42eeea
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x22c]
push ecx
cmp dword [esi + 8], eax
je 0x42ee3f
mov ecx, eax
call fcn.00429230
add dword [esi + 4], 0x18
jmp 0x42ee47
push eax
mov ecx, esi
call fcn.0042f980
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x218]
add edi, eax
cmp edx, 0x10
jb 0x42ee91
mov ecx, dword [ebp - 0x22c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ee87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ef3e
push edx
push ecx
call fcn.0048d8eb
add esp, 8
lea edx, [ebp - 0x214]
mov dword [ebp - 0x21c], 0
add edx, edi
mov dword [ebp - 0x218], 0xf
mov ecx, edx
mov byte [ebp - 0x22c], 0
lea ebx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42eec0
sub ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x22c]
call fcn.0040e3a0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x21c], 0
jne 0x42ee23
mov edx, dword [ebp - 0x218]
cmp edx, 0x10
jb 0x42ef20
mov ecx, dword [ebp - 0x22c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42ef16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ef3e
push edx
push ecx
call fcn.0048d8eb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret 4
call fcn.004b0023
int3
Function at 0x42f4f0
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d26f0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
call fcn.0042ed60
mov esi, dword [ebp - 0x38]
cmp esi, dword [ebp - 0x34]
je 0x42f640
nop
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x42f55a
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42f571
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0040e3a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x42f600
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42f600
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebx + 0x8c]
call fcn.00411950
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebx + 0x8c]
jne 0x42f600
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.00429230
push ebx
push 0x42d4f0
mov ecx, ebx
call fcn.0042ef50
test al, al
je 0x42f66a
push 0
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0042ec60
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x42f634
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42f62a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42f69e
push edx
push ecx
call fcn.0048d8eb
add esp, 8
add esi, 0x18
cmp esi, dword [ebp - 0x34]
jne 0x42f550
mov bl, 1
lea ecx, [ebp - 0x38]
call fcn.0042f8a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x42f69a
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42f690
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42f69e
push edx
push ecx
call fcn.0048d8eb
add esp, 8
xor bl, bl
jmp 0x42f642
call fcn.004b0023
int3
Function at 0x432150
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2b08
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x60], edi
push 0
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x60], esi
push 0x4ea2b7
jne 0x4321b0
mov dword [edi + 0x10], 0
mov ecx, edi
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
call fcn.0040e3a0
jmp 0x432311
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
call fcn.0040e3a0
mov dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x4321db
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x64], eax
test eax, eax
je 0x4322f2
lea esi, [eax + 1]
push esi
call fcn.0048d929
push esi
push 0
push eax
mov dword [ebp - 0x6c], eax
call fcn.004a5f00
mov ecx, dword [ebp - 0x60]
add esp, 0x10
cmp dword [ecx + 0x14], 0x10
jb 0x432212
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x6c]
push esi
push dword [ebp - 0x64]
push 0
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x4322e7
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], 0
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x68], 0
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x4322e7
xor esi, esi
test dword [ebp - 0x68], 0xfffffffc
jbe 0x4322e7
push 0x32
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004a5f00
mov eax, dword [ebp - 0x70]
lea ecx, [eax + esi*4]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04xFileDescription
lea eax, [ebp - 0x44]
push 0x32
push eax
call fcn.0040c260
add esp, 0x20
mov dword [ebp - 0x60], 0
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x4322bf
cmp dword [ebp - 0x64], 0
jne 0x4322cc
mov eax, dword [ebp - 0x68]
inc esi
shr eax, 2
cmp esi, eax
jb 0x432263
jmp 0x4322e7
mov edx, dword [ebp - 0x60]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4322d4
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.0040e3a0
push dword [ebp - 0x6c]
call fcn.0048d8c3
add esp, 4
movups xmm0, xmmword [ebp - 0x5c]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x4c]
movq qword [edi + 0x10], xmm0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret 8
Function at 0x433190
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
mov dword [ebp - 0x1ac], eax
push 0xd8
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x1a4]
push 0
push eax
call fcn.004a5f00
add esp, 0xc
lea eax, [ebp - 0x1a4]
push eax
push 0x6c
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor edi, edi
lea esi, [ebp - 0x1a4]
nop dword [eax]
xor eax, eax
mov word [esi + 4], ax
cmp word [esi], ax
je 0x43328b
push 0xc8
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004a5f00
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x64
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
lea eax, [ebp - 0xcc]
mov ecx, ebx
push eax
call fcn.00412150
test eax, eax
je 0x433243
inc edi
add esi, 8
cmp edi, 0x1b
jl 0x4331f0
jmp 0x43328b
lea ecx, [ebp - 0xcc]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433250
lea esi, [ebp - 0x1a4]
sub ecx, edx
lea esi, [esi + edi*8]
sar ecx, 1
mov edx, esi
lea edi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x433270
sub edx, edi
sar edx, 1
push edx
push esi
push ecx
push 0
mov ecx, ebx
call fcn.00427490
mov ecx, dword [ebp - 0x1a8]
push ebx
call fcn.0040c040
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1a8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
Function at 0x434810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2e98
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push 0x101
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4349f5
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x48]
call edi
test eax, eax
jne 0x4349ec
push dword [ebp - 0x44]
call fcn.0048d929
mov esi, eax
add esp, 4
test esi, esi
je 0x4349ec
lea eax, [ebp - 0x44]
push eax
push esi
push 0
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x48]
call edi
test eax, eax
jne 0x4349ec
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.0040e3a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov edi, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push 1
add edi, ecx
mov dword [ebp - 0x30], 0
push 0x4e7e00
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040e3a0
sub esp, 0xc
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esp
call fcn.00436260
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
add eax, ecx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x50]
call fcn.004362d0
add esp, 0x14
lea ecx, [ebp - 0x28]
push edi
push dword [eax]
lea eax, [ebp - 0x4c]
push eax
call fcn.0042c000
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x43498d
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x434983
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434a11
push edx
push ecx
call fcn.0048d8eb
add esp, 8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00483400
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
push str.subvalue
mov ecx, ebx
call fcn.00483fc0
mov ecx, eax
call fcn.00483ad0
lea ecx, [ebp - 0x40]
call fcn.00483a60
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4349ec
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4349e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434a16
push edx
push ecx
call fcn.0048d8eb
add esp, 8
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret
call fcn.004b0023
call fcn.004b0023
int3