joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4345e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4345f7
xor eax, eax
pop esi
pop ebx
ret
cmp byte [0x4a4fc8], 0
jne 0x434605
call fcn.0043458c
or eax, 0xffffffff
xor edx, edx
mov dl, byte [ebx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x4ae1a0]
shr eax, 8
xor edx, eax
mov eax, edx
inc ebx
dec esi
test esi, esi
jne 0x434608
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x434630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00404ec8
test eax, eax
jle 0x434674
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
movzx edi, bx
shr edi, 8
xor ecx, edi
and ecx, 0xff
mov cx, word [ecx*2 + 0x4a4dc8]
shl ebx, 8
and bx, 0xffff
xor cx, bx
mov ebx, ecx
inc edx
dec eax
jne 0x434647
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x434f50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004035a4
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a4
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
shl eax, 3
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x434fc1
inc dword [ebp - 0x5c]
mov dword [ebp - 0x64], esi
test ebx, ebx
jbe 0x435015
mov esi, 0x40
sub esi, dword [ebp - 0x54]
cmp esi, ebx
ja 0x434ffb
mov ecx, esi
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, dword [ebp - 0x64]
call fcn.00402dc0
mov edi, 0x40
sub edi, dword [ebp - 0x54]
sub ebx, edi
add dword [ebp - 0x64], edi
push ebp
call fcn.00434694
pop ecx
jmp 0x435011
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, dword [ebp - 0x64]
mov ecx, ebx
call fcn.00402dc0
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x434fc8
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x43502a
push ebp
call fcn.00434694
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.00434694
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00402dc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435090
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4350b0
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x43509e
pop edi
pop esi
pop ebx
ret
Function at 0x4350e8
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004350b4
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004350b4
mov esi, eax
xor eax, eax
mov ecx, dword [0x4ae5ac]
mov edx, dword [0x4ae5b0]
mov dword [esp + 4], edx
mov edx, dword [0x4ae5b4]
mov dword [esp + 8], edx
mov edx, dword [0x4ae5b8]
mov dword [esp + 0xc], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
add ebx, edi
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
add esi, edi
dec edx
jne 0x435134
mov eax, ebx
call fcn.004350b4
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.004350b4
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x435198
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004350b4
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004350b4
mov esi, eax
mov eax, 0xc6ef3720
mov ecx, dword [0x4ae5ac]
mov edx, dword [0x4ae5b0]
mov dword [esp + 4], edx
mov edx, dword [0x4ae5b4]
mov dword [esp + 8], edx
mov edx, dword [0x4ae5b8]
mov dword [esp + 0xc], edx
mov edx, 0x20
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
sub esi, edi
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
sub ebx, edi
sub eax, 0x9e3779b9
dec edx
jne 0x4351e7
mov eax, ebx
call fcn.004350b4
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.004350b4
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x435454
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x4a4fdc]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x4354bb
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x435481
cmp dword [ebp - 8], 0
je 0x43550b
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x4354f6
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x435505
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x44a588
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404e5c
add esp, 0x104
pop ebx
ret

Function at 0x44b9fc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404e5c
add esp, 0x104
pop ebx
ret

Function at 0x44ba30
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404e5c
add esp, 0x104
pop ebx
ret
Function at 0x44bb80
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44bcf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.0040ade4
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040ade4
push dword [ebp - 0x14]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f88
mov eax, dword [ebp - 0xc]
call fcn.004050c8
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x44bcdd
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x44bc35
cmp esi, 4
jne 0x44bc35
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x44bcdd
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x44bcbf
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.0040ade4
push dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.0040ade4
push dword [ebp - 0x20]
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404f88
mov eax, dword [ebp - 0x18]
call fcn.004050c8
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bcff
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404c10
ret
Function at 0x44d6f8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44d7e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4ae784], bl
mov eax, 0x4ae788
mov edx, esi
call fcn.00404c40
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x449aa0]
call fcn.004142cc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.00402b80
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.0040ade4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x44d7f8
call fcn.0040c03c
mov eax, dword [ebp - 4]
call fcn.004050c8
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp dword [0x4af008], 0
je 0x44d7bf
add bl, 0xfb
sub bl, 5
jae 0x44d7bf
push 0x242010
push 0x44d82c
mov eax, esi
call fcn.004050c8
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d7e9
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404c10
lea eax, [ebp - 4]
call fcn.00404bec
ret

Function at 0x44d9f8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x44d9c0
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x44da90
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00416454
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x44da18
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x44daef
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00416454
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x44db74
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x44dc52
mov eax, ebx
call fcn.00404ec8
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x44dc4b
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44dc31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44dc13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004050c8
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402dc0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dc1a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x44dc58
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
add esp, 0xffffffac
test al, al
je 0x44dca4
push esp
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [0x4ae774]
call fcn.004050c8
push eax
push 0
push 0x220
push 0
push 0
push 0
call sub.kernel32.dll_GetCommandLineA_1
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
add esp, 0x54
ret

Function at 0x44de40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x4a9dd8]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x449b64]
call fcn.0044dcb8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44df10
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44defa
cmp word [ebp - 4], 0x5a4d
jne 0x44defa
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004196f4
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44defa
cmp dword [ebp - 8], 0
je 0x44defa
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004196f4
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44defa
cmp dword [ebp - 0xc], 0x4550
jne 0x44defa
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44defa
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44df17
mov eax, dword [ebp - 0x10]
call fcn.00403d10
ret
Function at 0x44df20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44e0b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x449b64]
call fcn.0044dcb8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44e09a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44e084
cmp word [ebp - 4], 0x5a4d
jne 0x44e084
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004196f4
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44e084
cmp dword [ebp - 8], 0
je 0x44e084
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004196f4
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44e084
cmp dword [ebp - 0xc], 0x4550
jne 0x44e084
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0044dd30
test al, al
je 0x44e080
test byte [ebp - 0x15], 0x20
je 0x44e080
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0044a370
mov eax, dword [ebp - 0x2c]
call fcn.004050c8
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x44e079
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x44e0c8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x44e05e
push 0xa
push 0x44e0d4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x44e05e
mov byte [ebp - 1], 2
jmp 0x44e062
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e084
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e0a1
mov eax, dword [ebp - 0x10]
call fcn.00403d10
ret
Function at 0x44e304
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x44e30d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44e527
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404bec
mov eax, esi
call fcn.00404bec
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.004050c8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x44e50c
mov eax, dword [ebp - 4]
call fcn.00402a88
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x44e505
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.004050c8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x44e4ec
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x44e538
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44e436
push 0x44e55c
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.0040adbc
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0040adbc
push dword [ebp - 0x24]
push 0x44e578
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404f88
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004050c8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44e436
cmp dword [ebp - 0xc], 1
jbe 0x44e436
mov eax, dword [ebp - 0x18]
call fcn.0040b908
mov ecx, eax
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.00404cdc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x44e58c
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44e4ec
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.00407c04
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.00407c04
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.0040aca8
push dword [ebp - 0x28]
push 0x44e598
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.0040aca8
push dword [ebp - 0x2c]
push 0x44e598
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.0040aca8
push dword [ebp - 0x30]
push 0x44e598
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.0040aca8
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.00404f88
mov eax, dword [esi]
mov edx, 0x44e5a4
call fcn.00405014
jne 0x44e4ec
mov eax, esi
call fcn.00404bec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e50c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00402ab8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e52e
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404c10
ret
Function at 0x44ef9c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov eax, dword [0x4a9444]
mov edx, dword [eax]
call dword [edx + 8]
push 0x44f0a8
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x24], eax
push 0x44f0b4
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x44f099
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44f0c4
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x44f0dc
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x44f0f4
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
push 0x44f104
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x44f120
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x44f130
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x44f140
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x18], eax
push 0x44f150
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
call fcn.0044ef80
test al, al
je 0x44f05f
push ebp
call fcn.0044ef20
pop ecx
jmp 0x44f066
push ebp
call fcn.0044ee00
pop ecx
mov edx, 0x44eb04
mov eax, dword [0x4a9444]
call fcn.00417b1c
push ebp
call fcn.0044ebc0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f0a0
cmp dword [ebp - 0x24], 0
je 0x44f098
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret