joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44f883
test edi, edi
je 0x44f82a
cmp word [edi], 0
je 0x44f82a
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x44f7d5
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59d0a8
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
push 0x597154
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
push edi
jmp 0x44f86a
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x44f839
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59d0a8
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
je 0x44f8e8
test edi, edi
je 0x44f8c7
cmp word [edi], 0
je 0x44f8c7
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x44f8a4
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59d0b8
jmp 0x44f7f2
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x44f8d6
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59d0b8
jmp 0x44f856
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44f900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x44fa00
test edi, edi
je 0x44f9a9
cmp word [edi], 0
je 0x44f9a9
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x44f941
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59fbf0
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
push 0x59fbe8
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
push edi
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
push 0x59fbe0
jmp 0x44f9e9
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x44f9b8
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59fbf0
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x14

Function at 0x44fb30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
push 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], 0x401
mov ecx, esi
call fcn.00450b00
cmp byte [esi + 0x114], 0
lea eax, [esi + 4]
jne 0x44fb62
mov eax, dword [esi]
push 0x3ff
add eax, 4
push eax
push dword [ebp + 0x10]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp + 0xc], eax
mov ecx, edi
test eax, eax
je 0x44fc1c
call fcn.004502b0
cmp dword [edi + 0x120], 0
je 0x44fb9c
mov dword [edi + 0x120], 0
push 1
mov ecx, esi
mov dword [edi + 4], 0
call fcn.00450b00
cmp byte [esi + 0x114], 0
je 0x44fbba
add esi, 4
jmp 0x44fbbc
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
cmp byte [ebx + 0x128], al
je 0x44fbcf
add ebx, 0x18
jmp 0x44fbd2
mov ebx, dword [ebx + 0x14]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59fc34
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.004502b0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
Function at 0x44fc30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
push 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], 0x401
mov ecx, esi
call fcn.00450b00
cmp byte [esi + 0x114], 0
lea eax, [esi + 4]
jne 0x44fc62
mov eax, dword [esi]
push 0
push 0
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0x3ff
push 0
push ecx
add eax, 4
push eax
push dword [ebp + 0x14]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp + 0x10], eax
mov ecx, edi
test eax, eax
je 0x44fd28
call fcn.004502b0
cmp dword [edi + 0x120], 0
je 0x44fcab
mov dword [edi + 0x120], 0
push 1
mov ecx, esi
mov dword [edi + 4], 0
call fcn.00450b00
cmp byte [esi + 0x114], 0
je 0x44fcc9
add esi, 4
jmp 0x44fccb
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
cmp byte [ebx + 0x128], al
je 0x44fcde
add ebx, 0x18
jmp 0x44fce1
mov ebx, dword [ebx + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
mov ecx, dword [ebp + 8]
call fcn.00450c80
push 0x59fc20
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
lea ecx, [ebx + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
call fcn.004502b0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x10
Function at 0x451380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f5bb
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], ecx
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x138], edi
cmp dword [eax + 4], ebx
jbe 0x451408
mov esi, eax
mov eax, ebx
lea edi, [ebp - 0x138]
and eax, 1
mov ecx, esi
lea edi, [edi + eax*2]
call fcn.00450480
movzx eax, word [eax + ebx*2]
push eax
call fcn.004ed3d4
xor word [edi], ax
inc ebx
add esp, 4
cmp ebx, dword [esi + 4]
jb 0x4513d1
mov edi, dword [ebp - 0x138]
mov esi, dword [ebp - 0x144]
mov eax, 4
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov byte [ebp - 0x18], 1
push 1
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.00450b00
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
push str.Local_
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push 0x5971f4
push eax
call fcn.00450580
push str.mutex_file_
lea eax, [ebp - 0x134]
push 0x5971f4
push eax
call fcn.00450580
push edi
lea eax, [ebp - 0x134]
push str.0x_p
push eax
call fcn.00450580
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x128]
add esp, 0x24
cmp byte [ebp - 0x18], 0
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push esi
call fcn.004636b0
test al, al
jne 0x45152c
cmp dword [esi], 0
je 0x4514ed
nop dword [eax + eax]
mov esi, dword [esi]
add esi, 0x124
cmp dword [esi], 0
jne 0x4514e0
push 0x128
call fcn.004d7188
mov edi, eax
add esp, 4
mov ecx, edi
mov dword [ebp - 0x13c], edi
call fcn.0044fd40
push 0x59fd7c
push 0x5971f4
mov dword [edi + 0x124], 0
push edi
mov dword [esi], edi
call fcn.00450580
add esp, 0xc
xor bl, bl
jmp 0x45152e
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x451557
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x451557
push eax
call fcn.004e1b56
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 8

Function at 0x451e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x451e1f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x451e31
xor al, al
ret
shr eax, 4
not al
and al, 1
ret
Function at 0x451e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov cl, byte [esi + 0x11c]
lea eax, [esi + 0xc]
test cl, cl
jne 0x451e68
mov eax, dword [esi + 8]
cmp word [eax + 6], 0x3a
jne 0x451f00
lea eax, [esi + 0xc]
test cl, cl
jne 0x451e7d
mov eax, dword [esi + 8]
cmp word [eax + 8], 0
jne 0x451f00
push esi
lea ecx, [ebp - 0x258]
call fcn.0044fdf0
push 0x597154
lea eax, [ebp - 0x258]
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x24c]
cmp byte [ebp - 0x13c], 0
cmove eax, dword [ebp - 0x250]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x451ed2
xor bl, bl
jmp 0x451ed8
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x45201f
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
jmp 0x452012
push esi
lea ecx, [ebp - 0x130]
call fcn.0044fdf0
mov al, byte [esi + 0x11c]
lea ecx, [esi + 0xc]
test al, al
jne 0x451f1c
mov ecx, dword [esi + 8]
cmp word [ecx + 6], 0x3a
jne 0x451f45
lea ecx, [esi + 0xc]
test al, al
jne 0x451f2d
mov ecx, dword [esi + 8]
cmp word [ecx + 8], 0x5c
jne 0x451f45
lea ecx, [esi + 0xc]
test al, al
jne 0x451f3e
mov ecx, dword [esi + 8]
cmp word [ecx + 0xa], 0
je 0x451f8b
mov edi, dword [esi + 4]
test edi, edi
je 0x451f8b
test al, al
lea eax, [esi + 0xc]
jne 0x451f56
mov eax, dword [esi + 8]
cmp word [eax + edi*2 + 2], 0x5c
jne 0x451f8b
lea eax, [edi - 1]
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x12c], eax
call fcn.00450b00
cmp byte [ebp - 0x14], 0
lea eax, [ebp - 0x124]
cmove eax, dword [ebp - 0x128]
xor ecx, ecx
mov word [eax + edi*2 + 2], cx
cmp byte [ebp - 0x14], 0
lea eax, [ebp - 0x124]
cmove eax, dword [ebp - 0x128]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x451fb1
xor bl, bl
jmp 0x451ff6
mov al, byte [esi + 0x11c]
lea ecx, [esi + 0xc]
test al, al
jne 0x451fc1
mov ecx, dword [esi + 8]
cmp word [ecx + 6], 0x3a
jne 0x451ff0
lea ecx, [esi + 0xc]
test al, al
jne 0x451fd2
mov ecx, dword [esi + 8]
cmp word [ecx + 8], 0x5c
jne 0x451ff0
test al, al
je 0x451fe2
add esi, 0xc
jmp 0x451fe5
mov esi, dword [esi + 8]
cmp word [esi + 0xa], 0
jne 0x451ff0
mov bl, 1
jmp 0x451ff6
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x14], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x45201f
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x124]
cmp eax, ecx
je 0x45201f
push eax
call fcn.004e1b56
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x452800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f7a1
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
call fcn.00451e40
test al, al
je 0x4528c9
cmp byte [ebp + 0xc], 0
je 0x4528c2
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x452855
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x258]
push eax
call fcn.00451610
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 0
push eax
push 0x59fde4
mov ecx, edi
call fcn.00450c80
mov ecx, eax
call fcn.004510e0
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4528bb
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x4528bb
push eax
call fcn.004e1b56
add esp, 4
xor al, al
jmp 0x452a63
mov al, 1
jmp 0x452a63
lea ecx, [ebp - 0x134]
call fcn.004515b0
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00453190
test al, al
je 0x452958
cmp dword [ebp - 0x130], 2
jb 0x452942
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
test bl, bl
cmove eax, ecx
movzx edx, word [eax + 6]
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 8]
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 0xa]
cmp edx, 0x3a
jne 0x452942
cmp word [ebp - 0x380], 0x5c
jne 0x452942
test ax, ax
je 0x452958
push 0
push edi
lea ecx, [ebp - 0x134]
call fcn.00452800
test al, al
je 0x452a0a
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x452967
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea eax, [esi + 0xc]
jne 0x452a0e
cmp byte [esi + 0x11c], 0
jne 0x45298a
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x37c]
push eax
call fcn.00451610
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call fcn.00450c80
lea ecx, [ebp - 0x37c]
push ecx
push 0x59fdd4
mov ecx, eax
call fcn.004510e0
cmp byte [ebp - 0x260], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x452a0a
mov eax, dword [ebp - 0x374]
lea ecx, [ebp - 0x370]
cmp eax, ecx
je 0x452a0a
push eax
call fcn.004e1b56
add esp, 4
xor bl, bl
jmp 0x452a38
cmp byte [esi + 0x11c], 0
jne 0x452a1a
mov eax, dword [esi + 8]
push 1
push 0x10000000
add eax, 4
push 1
push eax
call fcn.00464b20
add esp, 0x10
mov ecx, esi
call fcn.00454130
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x452a61
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
cmp ecx, eax
je 0x452a61
push ecx
call fcn.004e1b56
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 8
Function at 0x454440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fa01
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x260], esi
call fcn.004594a0
mov ecx, eax
call fcn.004595f0
test al, al
je 0x454495
mov al, 1
jmp 0x454626
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x4544a4
mov eax, dword [edi + 8]
add eax, 4
mov dword [ebp - 0x26c], eax
call fcn.00463160
mov dword [ebp - 0x268], 0xffffffff
mov byte [ebp - 0x264], 1
lea eax, [ebp - 0x25c]
mov dword [ebp - 4], 0
push eax
push esi
mov ecx, edi
call fcn.00454650
test al, al
jne 0x4544f2
mov esi, dword [ebp - 0x25c]
xor eax, eax
cmp esi, 2
cmove esi, eax
xor bl, bl
jmp 0x454603
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor esi, esi
test eax, eax
jne 0x454601
cmp byte [edi + 0x11c], al
lea eax, [edi + 0xc]
mov ebx, dword [ebx + 0x20]
mov dword [ebp - 0x268], esi
jne 0x45451a
mov eax, dword [edi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x134]
push eax
call fcn.00451610
push 0x59fe48
lea ecx, [ebp - 0x258]
call fcn.0044fe90
mov edi, eax
push ebx
push 0x5986d4
push edi
mov byte [ebp - 4], 2
call fcn.00450580
push 0x599cb8
push 0x5971f4
push edi
call fcn.00450580
add esp, 0x18
lea eax, [edi + 0xc]
cmp byte [edi + 0x11c], 0
jne 0x454577
mov eax, dword [edi + 8]
mov edi, dword [ebp - 0x260]
lea ecx, [ebp - 0x134]
push ecx
add eax, 4
mov ecx, edi
push eax
call fcn.00450c80
mov ecx, eax
call fcn.004510e0
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4545c2
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x4545c2
push eax
call fcn.004e1b56
add esp, 4
mov byte [ebp - 4], 0
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4545ef
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4545ef
push eax
call fcn.004e1b56
add esp, 4
cmp ebx, 0x20
jg 0x4545fd
mov edx, ebx
mov ecx, edi
call fcn.00454e40
xor bl, bl
jmp 0x454603
mov bl, 1
mov dword [ebp - 4], 3
call fcn.00463160
cmp dword [eax + 0x248], 0
je 0x454624
mov ecx, dword [ebp - 0x26c]
push esi
call fcn.00466c10
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 8
Function at 0x4599c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5dfcb8]
push ebx
mov ebx, dword [ebp + 8]
test al, 1
jne 0x4599ff
or eax, 1
mov ecx, 0x5dfcc0
mov dword [0x5dfcb8], eax
call fcn.0044fd40
push 0x537fb0
call fcn.004d7173
add esp, 4
cmp byte [0x5debcc], 0
jne 0x459b78
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x459b71
push edi
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], 0
push 0
push eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x418], 0
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x459b70
push esi
push edi
call fcn.004e1b5b
mov esi, eax
add esp, 4
test esi, esi
je 0x459b6f
push esi
push edi
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x459b66
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push str.VarFileInfoTranslation
push esi
call edi
test eax, eax
je 0x459b66
cmp dword [ebp - 0x418], 4
jb 0x459b66
mov ecx, dword [ebp - 0x420]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x414]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.00419390
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
call edi
test eax, eax
je 0x459b66
mov eax, dword [ebp - 0x418]
cmp eax, 2
jbe 0x459b66
mov ecx, dword [ebp - 0x424]
cmp word [ecx + eax*2 - 2], 0
jne 0x459b5a
push ecx
mov ecx, 0x5dfcc0
call fcn.0044ff70
jmp 0x459b66
push eax
push ecx
mov ecx, 0x5dfcc0
call fcn.0044ffe0
push esi
call fcn.004e1b56
add esp, 4
pop esi
pop edi
mov byte [0x5debcc], 1
cmp byte [0x5dfddc], 0
mov eax, 0x5dfccc
mov ecx, ebx
cmove eax, dword [0x5dfcc8]
add eax, 4
push eax
call fcn.0044ff70
mov ecx, dword [ebp - 4]
mov al, byte [0x5debcc]
xor ecx, ebp
pop ebx
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x45b270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5300b1
mov eax, dword fs:[0]
push eax
sub esp, 0x790
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 5]
mov edi, dword [ebp + 8]
test al, al
jne 0x45b2bb
mov ecx, edi
call fcn.00450c80
push str.Win7
jmp 0x45b48c
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45b480
inc eax
cmp eax, 0x104
jae 0x45b480
cmp byte [esi + 0x370], 0
lea eax, [esi + 0x260]
jne 0x45b30c
mov eax, dword [esi + 0x25c]
add eax, 4
lea ecx, [ebp - 0x54c]
push eax
call fcn.0044fe90
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b330
sub ecx, edx
lea eax, [ebp - 0x540]
sar ecx, 1
cmp byte [ebp - 0x430], 0
push ecx
cmove eax, dword [ebp - 0x544]
lea ecx, [ebp - 0x21c]
push ecx
add eax, 4
push eax
call fcn.004e8041
add esp, 0xc
test eax, eax
jne 0x45b372
mov byte [esi + 0x1fae], 1
cmp byte [esi + 0x1fae], 0
jne 0x45b450
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x79c]
call fcn.00451610
lea ecx, [ebp - 0x674]
call fcn.004515b0
lea eax, [ebp - 0x674]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x79c]
call fcn.00453190
push 0x208
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp - 0x558]
lea ecx, [ebp - 0x668]
mov edi, dword [ebp - 0x66c]
test dl, dl
cmove ecx, edi
add ecx, 4
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b401
sub ecx, ebx
lea eax, [ebp - 0x668]
sar ecx, 1
test dl, dl
push ecx
cmove eax, edi
add eax, 4
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004e8041
add esp, 0xc
test eax, eax
jne 0x45b43a
mov byte [esi + 0x1fae], 1
lea ecx, [ebp - 0x674]
call fcn.00424a60
lea ecx, [ebp - 0x79c]
call fcn.00424a60
cmp byte [ebp - 0x430], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x45b47c
mov eax, dword [ebp - 0x544]
lea ecx, [ebp - 0x540]
cmp eax, ecx
je 0x45b47c
push eax
call fcn.004e1b56
add esp, 4
mov al, 1
jmp 0x45b49c
mov ecx, edi
call fcn.00450c80
push 0x5a0cec
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4