joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474a3e
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [ebp - 4], ebx
add esi, 4
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x474b4e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0x50
jb 0x474b36
push ebx
lea eax, [ebp - 4]
push eax
push 0x50
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x474b36
cmp dword [ebp - 4], 0x50
jne 0x474b36
cmp dword [esi], 0x424b4c48
jne 0x474b36
mov ecx, dword [ebp - 8]
cmp dword [esi + 0x18], ecx
jne 0x474b36
mov eax, dword [esi + 0x24]
cmp eax, ecx
ja 0x474b36
mov edx, dword [esi + 0x28]
add eax, edx
cmp eax, ecx
ja 0x474b36
lea eax, [edx + 1]
push eax
call fcn.0048eb44
pop ecx
push ebx
push ebx
push dword [esi + 0x24]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 0x28]
mov dword [ebp - 4], ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x474b36
mov ecx, dword [esi + 0x28]
cmp dword [ebp - 4], ecx
jne 0x474b36
cmp dword [esi + 0x2c], 1
jne 0x474b36
mov dl, byte [esi + 0x30]
mov eax, ebx
test ecx, ecx
jle 0x474b21
xor byte [eax + edi], dl
inc eax
cmp eax, ecx
jl 0x474b19
mov eax, dword [esi + 0x28]
mov ecx, dword [ebp + 0xc]
mov byte [edi + eax], bl
mov dword [ecx + 0x54], edi
mov eax, dword [esi + 0x28]
xor ebx, ebx
mov dword [ecx + 0x58], eax
inc ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x474b4e
test edi, edi
je 0x474b4e
push edi
call fcn.0048eb4d
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x474c89
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], ebx
jb 0x474cb3
mov eax, dword [esi]
jmp 0x474cb5
mov eax, esi
lea ecx, [ebp - 0x48]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x44], eax
test eax, eax
je 0x474d7d
push edi
push eax
call fcn.0048f28d
mov edi, eax
pop ecx
mov dword [ebp - 0x58], edi
test edi, edi
je 0x474d7c
cmp dword [esi + 0x14], 8
jb 0x474ce7
mov esi, dword [esi]
push edi
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x474d75
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x4d3c8c
push edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x474d75
cmp dword [ebp - 0x4c], ebx
je 0x474d75
mov eax, dword [ebp - 0x50]
push 0x3a
movzx ecx, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx esi, word [eax + 0xc]
xor eax, eax
push eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push eax
mov dword [ebp - 0x44], ecx
call fcn.004921d0
push esi
push edi
push ebx
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x40]
push eax
call fcn.00405113
mov ecx, dword [ebp - 0x54]
add esp, 0x28
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040509a
mov edi, dword [ebp - 0x58]
mov bl, 1
push edi
call fcn.0048f255
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 8
Function at 0x477a3e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
xor edi, edi
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x477aff
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x477a92
sub ecx, edx
sar ecx, 1
je 0x477ac7
cmp word [ebp + ecx*2 - 0x212], 0x5c
jne 0x477ac7
lea ecx, [ecx*2 - 2]
cmp ecx, 0x20a
jae 0x477b0d
xor eax, eax
mov word [ebp + ecx - 0x210], ax
push 0x6c
call fcn.00449b05
mov esi, eax
pop ecx
test esi, esi
je 0x477af9
push 0x160
sub esp, 0x18
lea eax, [ebp - 0x210]
mov ecx, esp
push eax
call fcn.0040513a
mov ecx, esi
call fcn.00476d11
mov dword [0x4eeed8], eax
jmp 0x477aff
mov dword [0x4eeed8], edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048f059
leave
ret
call fcn.00492b3a
int3

Function at 0x4781a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50], ebx
cmp dword [esi + 0x14], 8
jb 0x4781c5
mov eax, dword [esi]
jmp 0x4781c7
mov eax, esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x4781e9
push 0x4d3c88
mov ecx, ebx
call fcn.0040513a
mov eax, ebx
jmp 0x4782c6
push edi
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x44], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048eb44
mov edi, eax
pop ecx
mov dword [ebp - 0x54], edi
test edi, edi
je 0x478251
push dword [ebp - 0x44]
push 0
push edi
call fcn.00418743
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x478222
mov esi, dword [esi]
push edi
push dword [ebp - 0x58]
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x478251
and dword [ebp - 0x4c], 0
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x4d3c8c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x478261
push 0x4d3c88
mov ecx, ebx
call fcn.0040513a
mov eax, ebx
jmp 0x4782c5
mov eax, dword [ebp - 0x48]
push dword [ebp - 0x54]
mov cx, word [eax + 0xa]
mov bx, word [eax + 8]
mov di, word [eax + 0xe]
mov si, word [eax + 0xc]
mov word [ebp - 0x42], cx
call fcn.0048eb4d
xor eax, eax
push 0x3a
push eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push eax
call fcn.004921d0
movzx eax, si
push eax
movzx eax, di
push eax
movzx eax, bx
push eax
movzx eax, word [ebp - 0x42]
push eax
push str._d._d._d._d
lea eax, [ebp - 0x40]
push 0x1e
push eax
call fcn.004933e0
mov ecx, dword [ebp - 0x50]
add esp, 0x2c
lea eax, [ebp - 0x40]
push eax
call fcn.0040513a
mov eax, dword [ebp - 0x50]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x4783c4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x4c5de0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [ebp - 0x18], 0x30
pop edi
setne al
xor ecx, ebp
call fcn.0048f059
leave
ret
Function at 0x47ad7e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], ebx
jb 0x47ada9
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
jmp 0x47adae
mov eax, esi
mov dword [ebp - 0x20], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47adc1
shr al, 4
and al, 1
jmp 0x47ae30
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.0047a416
push esi
lea ecx, [ebp - 0x1c]
call fcn.00409665
test eax, eax
je 0x47ae26
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.0047ad7e
pop ecx
pop ecx
test al, al
je 0x47ae26
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47ae24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp eax, 0xb7
jne 0x47ae15
push esi
call fcn.0047b0b6
pop ecx
test al, al
jne 0x47ae24
mov eax, dword [ebp - 0x20]
test edi, edi
je 0x47ae26
push eax
call fcn.00480220
pop ecx
mov dword [edi], eax
jmp 0x47ae26
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0047a0fe
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x47ae3f
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [esi + 0x10], 0x104
mov ebx, eax
mov dword [ebp - 0x234], ebx
jb 0x47ae71
xor al, al
jmp 0x47b0a8
cmp byte [ebp + 0xc], al
jne 0x47af01
lea ecx, [ebp - 0x25c]
call fcn.004801ff
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.0047b0dc
pop ecx
pop ecx
test al, al
je 0x47aee0
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.0047b0dc
pop ecx
pop ecx
test al, al
je 0x47aec9
cmp byte [ebp - 0x254], bl
je 0x47aec9
cmp dword [esi + 0x14], 8
jb 0x47aebb
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
jmp 0x47aee2
cmp dword [esi + 0x14], 8
jb 0x47aed3
mov eax, dword [esi]
jmp 0x47aed5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x47aef4
mov bl, 1
lea ecx, [ebp - 0x25c]
call fcn.0048021f
mov al, bl
jmp 0x47b0a8
lea ecx, [ebp - 0x25c]
call fcn.0048021f
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x20e]
xor ecx, ecx
push eax
mov word [ebp - 0x210], cx
call fcn.004921d0
add esp, 0xc
cmp byte [0x4eef30], bl
je 0x47af6a
call fcn.0047fa34
cmp eax, 1
jg 0x47af57
xor ebx, ebx
inc ebx
push ebx
push 0x58
push str.file_util_win.cc
lea ecx, [ebp - 0x30c]
call fcn.0047f53f
add eax, 8
push str.copying
push eax
call fcn.00422b72
pop ecx
pop ecx
test bl, 1
je 0x47af6a
lea ecx, [ebp - 0x30c]
and ebx, 0xfffffffe
call fcn.0047f588
cmp dword [esi + 0x14], 8
jb 0x47af72
mov esi, dword [esi]
lea ecx, [ebp - 0x210]
movzx eax, word [esi]
mov word [ecx], ax
lea esi, [esi + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x47af78
and dword [ebp - 0x230], 0
push edi
push 6
xor eax, eax
cmp byte [ebp + 0xc], 0
pop ecx
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov eax, 0x414
mov dword [ebp - 0x22c], 3
mov word [ebp - 0x220], ax
pop edi
jne 0x47afd5
mov eax, 0x1494
mov word [ebp - 0x220], ax
cmp byte [0x4eef30], 0
je 0x47b022
call fcn.0047fa34
cmp eax, 1
jg 0x47b00f
push 1
push 0x62
push str.file_util_win.cc
lea ecx, [ebp - 0x30c]
or ebx, 2
call fcn.0047f53f
add eax, 8
push str.Performing_shell_operation
push eax
call fcn.00422b72
pop ecx
pop ecx
test bl, 2
je 0x47b022
lea ecx, [ebp - 0x30c]
and ebx, 0xfffffffd
call fcn.0047f588
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp byte [0x4eef30], 0
mov esi, eax
je 0x47b083
call fcn.0047fa34
cmp eax, 1
jg 0x47b073
push 1
push 0x65
push str.file_util_win.cc
lea ecx, [ebp - 0x30c]
or ebx, 4
call fcn.0047f53f
push esi
add eax, 8
push str.Done:
push eax
call fcn.00422b72
pop ecx
pop ecx
mov ecx, eax
call fcn.0045b4d8
test bl, 4
je 0x47b083
lea ecx, [ebp - 0x30c]
call fcn.0047f588
cmp dword [ebp - 0x21e], 0
jne 0x47ae6a
test esi, esi
je 0x47b0a5
cmp esi, 2
je 0x47b0a5
cmp esi, 0x402
je 0x47b0a5
xor eax, eax
jmp 0x47b0a8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x47b0b6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x47b0c4
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47b0d8
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x47b186
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x47b21a
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.0040513a
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x258]
call fcn.0047a0b4
mov ecx, eax
call fcn.0047a8f4
push eax
mov ecx, esi
call fcn.0047a13d
lea ecx, [ebp - 0x240]
call fcn.0047a0fe
lea ecx, [ebp - 0x258]
call fcn.0047a0fe
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.00405ac5
mov al, 1
jmp 0x47b21c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048f059
leave
ret

Function at 0x47b33b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x47b349
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x47b4f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x47b50b
mov eax, dword [eax]
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
call fcn.0047b35a
cmp dword [ebp + 8], esi
je 0x47b54e
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47b54e
mov esi, dword [ebp - 4]
cmp esi, dword [ebp + 0x10]
je 0x47b551
or esi, 0xffffffff
lea ecx, [ebp + 8]
call fcn.0047ac34
mov eax, esi
pop esi
leave
ret

Function at 0x47e315
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00492280
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0047a87b
test al, al
je 0x47e343
xor al, al
jmp 0x47e392
push 0x4d457c
push esi
call fcn.0047b2bf
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47e33f
push ebx
mov ebx, 0x10000
jmp 0x47e371
test edi, edi
je 0x47e371
push eax
lea eax, [ebp - 0x10004]
push eax
mov ecx, edi
call fcn.00420541
push esi
push ebx
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.00494199
add esp, 0x10
test eax, eax
jne 0x47e35e
push esi
call fcn.0047e29d
pop ecx
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048f059
leave
ret
Function at 0x47eb99
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x47ebcb
cmp byte [ebp + 0x10], 0
je 0x47ebcb
push 0xea60
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
leave
ret
Function at 0x47ebd0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.004921d0
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp byte [edi + 8], 0
mov eax, 0x4d3c88
cmove eax, dword [ebp - 0x64]
xor ebx, ebx
xor ecx, ecx
inc ebx
cmp byte [edi + 1], cl
mov dword [ebp - 0x64], eax
push 5
pop eax
cmovne eax, ecx
mov word [ebp - 0x3c], ax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x40], ebx
test eax, eax
jne 0x47ec2b
cmp dword [edi + 0x14], ecx
jne 0x47ec2b
cmp dword [edi + 0x18], ecx
je 0x47ec41
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x40], 0x101
mov dword [ebp - 0x2c], eax
xor esi, esi
cmp dword [edi + 0xc], ecx
mov eax, 0x1000004
cmovne esi, eax
cmp byte [edi + 0x1c], cl
je 0x47ec59
or esi, 0x1000000
lea ecx, [ebp - 0x14]
call fcn.0048585b
cmp dword [edi + 4], 0
je 0x47ece3
and dword [ebp + 0xc], 0
push 0
push dword [edi + 4]
lea eax, [ebp + 0xc]
push eax
or esi, 0x400
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x47ecd2
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.004858b6
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x47ec9a
mov ecx, dword [ecx]
push eax
xor edx, edx
lea eax, [ebp - 0x6c]
push eax
movzx eax, byte [edi + 2]
push edx
push dword [ebp + 0xc]
push esi
push eax
push edx
push edx
push ecx
push edx
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ecx, dword [ebp - 0x18]
mov esi, eax
lea eax, [ebp - 0x28]
push eax
call fcn.004858d4
push dword [ebp + 0xc]
call sub.USERENV.dll_DestroyEnvironmentBlock
test esi, esi
jne 0x47ed2c
xor bl, bl
lea ecx, [ebp - 0x14]
call fcn.0048586b
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.004858b6
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x47ecfa
mov ecx, dword [ecx]
push eax
xor edx, edx
lea eax, [ebp - 0x6c]
push eax
movzx eax, byte [edi + 2]
push edx
push edx
push esi
push eax
push edx
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x28]
neg ebx
push eax
sbb bl, bl
call fcn.004858d4
inc bl
jne 0x47ecd2
xor ebx, ebx
inc ebx
cmp dword [edi + 0xc], 0
je 0x47ed5a
push dword [ebp - 0x14]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x47ed51
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.0047eb99
add esp, 0xc
jmp 0x47ecd2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [edi], 0
je 0x47ed6a
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x47ecd4
lea ecx, [ebp - 0x14]
call fcn.0048592e
mov dword [esi], eax
jmp 0x47ecd4
Function at 0x47f028
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x47f03a
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x47f0bb
push edi
push 1
push ebx
call fcn.0048f217
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x47f0b8
push edi
push ebx
push dword [ebp - 4]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x47f0b1
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push str.VarFileInfoTranslation
xor esi, esi
push edi
mov dword [ebp + 8], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47f0b1
cmp dword [ebp + 8], esi
je 0x47f0b1
push 0x14
call fcn.00449b05
pop ecx
test eax, eax
je 0x47f0ad
mov edx, dword [ebp + 8]
movzx ecx, word [edx + 2]
push ecx
movzx ecx, word [edx]
push ecx
push edi
mov ecx, eax
call fcn.0047ef74
mov esi, eax
mov eax, esi
jmp 0x47f0ba
push edi
call fcn.0048f255
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47f0bf
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x47f14b
push esi
push 1
push edi
call fcn.0048f217
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47f148
push esi
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x47f141
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
xor edi, edi
push esi
mov dword [ebp - 4], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47f141
cmp dword [ebp - 4], edi
je 0x47f141
push 0x14
call fcn.00449b05
pop ecx
test eax, eax
je 0x47f13d
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
push ecx
movzx ecx, word [edx]
push ecx
push esi
mov ecx, eax
call fcn.0047ef74
mov edi, eax
mov eax, edi
jmp 0x47f14a
push esi
call fcn.0048f255
pop ecx
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x47f207
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x224], eax
mov ax, word [ebx + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov ax, word [ebx + 0xc]
push edi
mov word [ebp - 0x12], ax
call esi
mov word [ebp - 0x10], ax
mov ax, word [ebx + 0xc]
mov word [ebp - 0xe], ax
mov ax, word [ebx + 8]
mov edi, 0x4e4
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], di
call esi
mov word [ebp - 6], di
mov word [ebp - 8], ax
xor edi, edi
push dword [ebp - 0x228]
movzx eax, word [ebp + edi*2 - 0x12]
movzx ecx, word [ebp + edi*2 - 0x14]
push eax
push ecx
push str.StringFileInfo_04x_04x_ls
push 0x104
lea eax, [ebp - 0x21c]
push 0x104
push eax
add edi, 2
call fcn.00493320
and dword [ebp - 0x220], 0
add esp, 0x1c
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebx + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47f2d7
mov esi, dword [ebp - 0x220]
test esi, esi
jne 0x47f2ef
cmp edi, 8
jb 0x47f272
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 8
push esi
call fcn.00405113
pop ecx
mov ecx, dword [ebp - 0x224]
push eax
push esi
call fcn.0040509a
mov al, 1
jmp 0x47f2de