joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4154b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b52b
mov eax, dword fs:[0]
push eax
mov eax, 0x1218
call fcn.004481c0
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1224]
push eax
push 0x1000
lea ecx, [ebp - 0x1218]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4155fc
mov eax, dword [ebp - 0x1224]
shr eax, 2
xor ebx, ebx
mov dword [ebp - 0x1220], eax
test eax, eax
je 0x4155fc
jmp 0x415520
mov edi, dword [ebp + ebx*4 - 0x1218]
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x41564b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x121c], esi
push edi
push 0
push 0x410
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4155d0
push 0x208
lea ecx, [ebp - 0x218]
push ecx
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x4155c9
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415590
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x121c]
call fcn.00403400
mov eax, dword [0x4937b0]
mov esi, dword [ebp - 0x121c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41561a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4155ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, dword [ebp - 0x1220]
jb 0x415520
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415644
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x4155fe
push 0x80004005
call fcn.00401350
int3
Function at 0x415940
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.004154b0
test eax, eax
je 0x41598b
push 0
push 0x4748c4
push 0x474838
mov ecx, esi
call fcn.00426d28
call fcn.004154b0
test eax, eax
je 0x41598b
push 0
push 0x47480c
push 0x474798
mov ecx, esi
call fcn.00426d28
call fcn.004154b0
test eax, eax
jne 0x415aea
push ebx
push edi
lea ecx, [esi + 0xdf8]
call fcn.0040b2d0
lea ecx, [esi + 0xea0]
call fcn.0040b2d0
lea ecx, [esi + 0xf48]
call fcn.0040b2d0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor eax, eax
mov dword [0x493784], eax
mov dword [0x493788], eax
mov eax, dword [0x4937d0]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4159e4
mov ecx, dword [0x4937e4]
mov edx, dword [0x4937d0]
push 0
push ecx
push edx
call edi
mov eax, dword [0x4937cc]
push eax
call ebx
test eax, eax
je 0x415a02
mov ecx, dword [0x4937e0]
mov edx, dword [0x4937cc]
push 0
push ecx
push edx
call edi
mov eax, dword [0x4937d4]
push eax
call ebx
test eax, eax
je 0x415a20
mov ecx, dword [0x4937e8]
mov edx, dword [0x4937d4]
push 0
push ecx
push edx
call edi
mov eax, dword [0x4937c4]
push eax
call ebx
test eax, eax
je 0x415a3e
mov ecx, dword [0x4937d8]
mov edx, dword [0x4937c4]
push 0
push ecx
push edx
call edi
mov eax, dword [0x4937c8]
push eax
call ebx
test eax, eax
je 0x415a5c
mov ecx, dword [0x4937dc]
mov edx, dword [0x4937c8]
push 0
push ecx
push edx
call edi
mov eax, dword [0x49381c]
push eax
mov dword [0x4937a4], 0
call ebx
test eax, eax
je 0x415a84
mov ecx, dword [0x493818]
mov edx, dword [0x49381c]
push 0
push ecx
push edx
call edi
push 0x493580
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 8], 0
pop edi
pop ebx
jne 0x415ace
cmp dword [0x493578], 0
jne 0x415ab3
push 0
push 0x474780
push 0x47474c
mov ecx, esi
call fcn.00426d28
mov eax, dword [0x4937b0]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 4
cmp dword [0x493578], 0
jne 0x415aea
push 0
push 0x474780
push 0x474738
mov ecx, esi
call fcn.00426d28
pop esi
pop ebp
ret 4
Function at 0x417520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c238
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4914f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x10]
call fcn.00408390
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x4175af
mov ecx, dword [ebp - 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x417599
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x474b10
push 0x474b08
lea ecx, [ebp - 0x10]
call fcn.0040ba10
mov ecx, dword [ebp - 0x10]
push ecx
call edi
test eax, eax
je 0x4175f2
mov edx, dword [ebp - 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x41758d
push 0x474b00
push 0x474b10
lea ecx, [ebp - 0x10]
call fcn.0040ba10
mov ecx, dword [ebp - 0x10]
push ecx
call edi
test eax, eax
jne 0x4175cb
push 0x474af8
push 0x474b00
lea ecx, [ebp - 0x10]
call fcn.0040ba10
mov ecx, dword [ebp - 0x10]
push ecx
call edi
test eax, eax
jne 0x4175cb
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417650
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417670
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa04
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x26
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x604]
push edx
call esi
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
call esi
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0xa04]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.TencentQQ2012BinQQ.exe
lea ecx, [ebp - 0x604]
push ecx
call edi
lea edx, [ebp - 0x604]
push edx
lea eax, [ebp - 0x204]
push eax
call esi
lea ecx, [ebp - 0x204]
push ecx
call fcn.00417520
add esp, 4
test eax, eax
jne 0x417767
push str.TencentQQBinQQ.exe
lea edx, [ebp - 0x804]
push edx
call edi
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x204]
push ecx
call esi
lea edx, [ebp - 0x204]
push edx
call fcn.00417520
add esp, 4
test eax, eax
jne 0x417767
push str.TencentQQ2011BinQQ.exe
lea eax, [ebp - 0xa04]
push eax
call edi
lea ecx, [ebp - 0xa04]
push ecx
lea edx, [ebp - 0x204]
push edx
call esi
lea eax, [ebp - 0x204]
push eax
call fcn.00417520
add esp, 4
lea ecx, [ebp - 0x204]
push ecx
call fcn.00417520
add esp, 4
test eax, eax
je 0x41779a
lea edx, [ebp - 0x204]
push edx
push ebx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044665f
mov esp, ebp
pop ebp
ret
Function at 0x4184e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b940
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, 1
cmp dword [0x4938b0], ebx
je 0x4186d6
lea eax, [ebp - 0x20]
push eax
mov dword [0x4938b0], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
lea ecx, [ebp - 0x30]
push ebx
push ecx
call fcn.0045bd10
movzx edx, word [ebp - 0x30]
movzx eax, word [ebp - 0x2e]
imul edx, edx, 0x16d
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, word [ebp - 0x1e]
lea ecx, [edx + ecx*2]
movzx edx, word [ebp - 0x2a]
add ecx, edx
movzx edx, word [ebp - 0x20]
imul edx, edx, 0x16d
mov esi, eax
shl esi, 4
sub esi, eax
lea eax, [edx + esi*2]
movzx edx, word [ebp - 0x1a]
add eax, edx
sub eax, ecx
add esp, 0xc
cmp eax, 3
jge 0x4186d6
mov eax, dword [0x493888]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4186d6
xor esi, esi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x68]
call fcn.00465830
push esi
push str.tiptimes.txt
mov dword [ebp - 4], esi
call fcn.0045ec40
add esp, 8
push eax
lea ecx, [ebp - 0x34]
call fcn.00408390
mov ecx, dword [ebp - 0x34]
push esi
push 0x40
push ecx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], bl
call fcn.00465980
test eax, eax
je 0x418627
lea ecx, [ebp - 0x38]
call fcn.00403080
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.00465e10
mov eax, dword [ebp - 0x38]
push eax
call fcn.0044865a
add esp, 4
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.00465860
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418622
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 3
jge 0x4186a4
push 0
push 0x474ff8
push 0x474e90
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [0x493888]
push ebx
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x34]
push 0
push 0x1001
push edx
lea ecx, [ebp - 0x68]
add esi, ebx
call fcn.00465980
test eax, eax
je 0x4186a4
lea ecx, [ebp - 0x3c]
call fcn.00403080
push esi
lea eax, [ebp - 0x3c]
push 0x474e84
push eax
mov byte [ebp - 4], 3
call fcn.00403af0
mov ecx, dword [ebp - 0x3c]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x68]
call fcn.00465880
lea ecx, [ebp - 0x68]
call fcn.00465860
lea ecx, [ebp - 0x3c]
call fcn.00402b30
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4186c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0xffffffff
call fcn.00465820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
Function at 0x42480f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0042e07d
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x42483c
xor eax, eax
jmp 0x4248e2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x424835
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x424835
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042313e
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x424893
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x424882
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.0042352c
push edi
mov ebx, eax
call fcn.00423178
pop ecx
test ebx, ebx
je 0x4248d5
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00423c24
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00423cd8
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x42b004
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42b04b
call fcn.0042e07d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42b04b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42b067
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042ab7c
mov esi, eax
test edi, edi
je 0x42b065
test ebx, ebx
je 0x42b065
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42cd40
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46c776
call fcn.0044867f
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42cd65
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42cdab
lea ecx, [ebp - 0x10]
call fcn.00403080
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042c529
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004016b0
mov eax, esi
call fcn.00448757
ret 8
Function at 0x432bba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x432bde
cmp dword [edi + 0x54], 0
jne 0x432bde
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0042e07d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00432b7b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x434f64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x434fac
call fcn.0042e07d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x434fac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x434fef
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x434fd8
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x434fd8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x434fec
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44665f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4914f4]
jne 0x446669
repz ret
jmp fcn.0044e6c5
Function at 0x4532a2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044be6d
and dword [ebp - 4], 0
cmp dword [0x496378], 0
mov ebx, eax
jne 0x453353
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x453404
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x453404
push eax
call fcn.0044bdfb
mov dword [esp], 0x47de40
push edi
mov dword [0x496378], eax
call esi
push eax
call fcn.0044bdfb
mov dword [esp], 0x47de2c
push edi
mov dword [0x49637c], eax
call esi
push eax
call fcn.0044bdfb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x496380], eax
call esi
push eax
call fcn.0044bdfb
pop ecx
mov dword [0x496388], eax
test eax, eax
je 0x453353
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044bdfb
pop ecx
mov dword [0x496384], eax
mov eax, dword [0x496384]
cmp eax, ebx
je 0x4533ab
cmp dword [0x496388], ebx
je 0x4533ab
push eax
call fcn.0044be76
push dword [0x496388]
mov esi, eax
call fcn.0044be76
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4533ab
test edi, edi
je 0x4533ab
call esi
test eax, eax
je 0x4533a2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4533a2
test byte [ebp - 0xc], 1
jne 0x4533ab
or dword [ebp + 0x10], 0x200000
jmp 0x4533e4
mov eax, dword [0x49637c]
cmp eax, ebx
je 0x4533e4
push eax
call fcn.0044be76
pop ecx
test eax, eax
je 0x4533e4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4533e4
mov eax, dword [0x496380]
cmp eax, ebx
je 0x4533e4
push eax
call fcn.0044be76
pop ecx
test eax, eax
je 0x4533e4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x496378]
call fcn.0044be76
pop ecx
test eax, eax
je 0x453404
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x453406
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45b3f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dbf0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4914f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0045c530
mov dword [esi + 0x94], eax
mov dword [esi + 0x8c], eax
test eax, eax
je 0x45b572
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45b44d
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45b47d
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x98], 0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 1
jne 0x45b4eb
push 0
push str.Language
call fcn.0045b8f0
add esp, 8
push eax
lea ecx, [ebp - 0x14]
call fcn.00408390
mov ecx, dword [ebp - 0x14]
push ecx
call ebx
test eax, eax
jne 0x45b4cc
mov edx, dword [ebp - 0x14]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45b4eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x8c]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0045ad90
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0045eea0
mov ecx, dword [ebp - 0x10]
add esp, 0x10
push ecx
call ebx
test eax, eax
jne 0x45b52c
mov edx, dword [ebp - 0x10]
push 0x2260
push eax
push 0x473bb0
push edx
call fcn.0045b860
add esp, 0x10
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45b54c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45b572
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.0043267e
mov ecx, esi
call fcn.0045b010
mov dword [esi + 0x90], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b690
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x41c]
push ecx
push esi
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x40c], eax
cmp eax, 1
jae 0x45b6e8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0042316d
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x40c]
push edi
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45b812
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x414]
push edx
push str.VarFileInfoTranslation
xor esi, esi
push edi
mov dword [ebp - 0x410], 0x200
mov dword [ebp - 0x408], esi
call sub.VERSION.dll_VerQueryValueW
test dword [ebp - 0x410], 0xfffffffc
jbe 0x45b812
jmp 0x45b760
mov eax, dword [ebp - 0x414]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ebx
push ecx
push edx
lea eax, [ebp - 0x404]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.00449ec6
add esp, 0x14
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0x404]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x45b7e5
mov ecx, dword [ebp - 0x414]
movzx edx, word [ecx + esi*4]
push ebx
push 0x4e4
push edx
lea eax, [ebp - 0x404]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.00449ec6
add esp, 0x14
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0x404]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jg 0x45b825
push edi
call fcn.00423178
mov edx, dword [ebp - 0x410]
inc esi
shr edx, 2
add esp, 4
cmp esi, edx
jb 0x45b760
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x418]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.00423178
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0044665f
mov esp, ebp
pop ebp
ret