joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44305c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x44306b
xor eax, eax
pop esi
pop ebx
ret
cmp byte [0x58f2b8], 0
jne 0x443079
call fcn.00443000
or eax, 0xffffffff
xor edx, edx
mov dl, byte [ebx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5a41c0]
shr eax, 8
xor edx, eax
mov eax, edx
inc ebx
dec esi
test esi, esi
jne 0x44307c
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x4430a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00405138
test eax, eax
jle 0x4430e8
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
movzx edi, bx
shr edi, 8
xor ecx, edi
and ecx, 0xff
mov cx, word [ecx*2 + 0x58f0b8]
shl ebx, 8
and bx, 0xffff
xor cx, bx
mov ebx, ecx
inc edx
dec eax
jne 0x4430bb
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4439c4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.00403774
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.00403774
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
shl eax, 3
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x443a35
inc dword [ebp - 0x5c]
mov dword [ebp - 0x64], esi
test ebx, ebx
jbe 0x443a89
mov esi, 0x40
sub esi, dword [ebp - 0x54]
cmp esi, ebx
ja 0x443a6f
mov ecx, esi
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, dword [ebp - 0x64]
call fcn.00402f44
mov edi, 0x40
sub edi, dword [ebp - 0x54]
sub ebx, edi
add dword [ebp - 0x64], edi
push ebp
call fcn.00443108
pop ecx
jmp 0x443a85
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, dword [ebp - 0x64]
mov ecx, ebx
call fcn.00402f44
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x443a3c
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x443a9e
push ebp
call fcn.00443108
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.00443108
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00402f44
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443b04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x443b24
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x443b12
pop edi
pop esi
pop ebx
ret
Function at 0x443b5c
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.00443b28
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.00443b28
mov esi, eax
xor eax, eax
mov ecx, dword [0x5a45cc]
mov edx, dword [0x5a45d0]
mov dword [esp + 4], edx
mov edx, dword [0x5a45d4]
mov dword [esp + 8], edx
mov edx, dword [0x5a45d8]
mov dword [esp + 0xc], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
add ebx, edi
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
add esi, edi
dec edx
jne 0x443ba8
mov eax, ebx
call fcn.00443b28
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.00443b28
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x443c0c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.00443b28
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.00443b28
mov esi, eax
mov eax, 0xc6ef3720
mov ecx, dword [0x5a45cc]
mov edx, dword [0x5a45d0]
mov dword [esp + 4], edx
mov edx, dword [0x5a45d4]
mov dword [esp + 8], edx
mov edx, dword [0x5a45d8]
mov dword [esp + 0xc], edx
mov edx, 0x20
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
sub esi, edi
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
sub ebx, edi
sub eax, 0x9e3779b9
dec edx
jne 0x443c5b
mov eax, ebx
call fcn.00443b28
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.00443b28
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45ab90
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004050cc
add esp, 0x104
pop ebx
ret

Function at 0x45c570
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004050cc
add esp, 0x104
pop ebx
ret

Function at 0x45c5a4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004050cc
add esp, 0x104
pop ebx
ret
Function at 0x45d104
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d260
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call fcn.0045a864
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.0040c0a4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.0040c0a4
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00405140
mov eax, dword [ebp - 8]
call fcn.00405338
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x45d245
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x45d1a6
cmp esi, 4
jne 0x45d1a6
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x45d245
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x45d227
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.0045a864
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.0040c0a4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.0040c0a4
mov edx, dword [ebp - 0x14]
pop eax
call fcn.00405140
mov eax, dword [ebp - 0x10]
call fcn.00405338
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d267
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404e80
ret
Function at 0x45e49c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45e597
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5a47a8], bl
mov eax, 0x5a47ac
mov edx, esi
call fcn.00404eb0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x4596d4]
call fcn.0041d3f4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.00402cec
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.0040c0a4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x45e5ac
call fcn.0040d570
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp byte [0x593be8], 0
jne 0x45e54a
mov eax, ebx
add al, 0xfd
sub al, 7
jb 0x45e574
cmp dword [0x5a5044], 0
je 0x45e574
add bl, 0xfb
sub bl, 5
jae 0x45e574
push 0x242010
push 0x45e5e0
mov eax, esi
call fcn.00405338
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e59e
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404e80
lea eax, [ebp - 4]
call fcn.00404e5c
ret

Function at 0x45e8c8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x45e890
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x45e9c4
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x45e9e6
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x45e934
call sub.user32.dll_EnumWindows
mov dl, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x45ea64
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0x80000001
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00420360
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x45e9ec
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x45eac9
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00420360
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x45eb4c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x45ec2a
mov eax, ebx
call fcn.00405138
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x45ec23
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ec09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45ebeb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405338
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402f44
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ebf2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x45ec30
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x45ecf7
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x45eccc
cmp byte [0x593be0], 0
je 0x45ec75
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.00405054
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.0042f63c
jmp 0x45ec84
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405054
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403774
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x5a4798]
call fcn.00405338
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ecfe
lea eax, [ebp - 0x5c]
call fcn.00404e5c
lea eax, [ebp - 4]
call fcn.00404e5c
ret
Function at 0x45eee8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x59fc44]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x459dfc]
call fcn.0045ed04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45efb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45efa2
cmp word [ebp - 4], 0x5a4d
jne 0x45efa2
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004247e8
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45efa2
cmp dword [ebp - 8], 0
je 0x45efa2
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004247e8
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45efa2
cmp dword [ebp - 0xc], 0x4550
jne 0x45efa2
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45efa2
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45efbf
mov eax, dword [ebp - 0x10]
call fcn.00403f0c
ret
Function at 0x45efc8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f15f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x459dfc]
call fcn.0045ed04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45f142
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45f12c
cmp word [ebp - 4], 0x5a4d
jne 0x45f12c
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004247e8
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45f12c
cmp dword [ebp - 8], 0
je 0x45f12c
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004247e8
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45f12c
cmp dword [ebp - 0xc], 0x4550
jne 0x45f12c
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.0045ed7c
test al, al
je 0x45f128
test byte [ebp - 0x15], 0x20
je 0x45f128
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0045a70c
mov eax, dword [ebp - 0x2c]
call fcn.00405338
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45f121
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x45f170
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x45f106
push 0xa
push 0x45f17c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x45f106
mov byte [ebp - 1], 2
jmp 0x45f10a
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f12c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f149
mov eax, dword [ebp - 0x10]
call fcn.00403f0c
ret
Function at 0x45f398
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x45f3a1
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f5c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404e5c
mov eax, esi
call fcn.00404e5c
test ebx, ebx
je 0x45f5a9
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.00405338
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x45f5a9
mov eax, dword [ebp - 4]
call fcn.0040b930
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45f5a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.00405338
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45f589
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45f5d4
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45f4d3
push 0x45f5f8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.0040c07c
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0040c07c
push dword [ebp - 0x24]
push 0x45f614
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004051f8
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00405338
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45f4d3
cmp dword [ebp - 0xc], 1
jbe 0x45f4d3
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0040ce28
mov ecx, eax
mov eax, edi
mov edx, ebx
call fcn.00404f4c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45f628
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45f589
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.004085e8
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.004085e8
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.0040bf68
push dword [ebp - 0x28]
push 0x45f634
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.0040bf68
push dword [ebp - 0x2c]
push 0x45f634
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.0040bf68
push dword [ebp - 0x30]
push 0x45f634
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.0040bf68
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.004051f8
mov eax, dword [esi]
mov edx, 0x45f640
call fcn.00405284
jne 0x45f589
mov eax, esi
call fcn.00404e5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f5a9
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00402c24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f5cb
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404e80
ret
Function at 0x45f814
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x45f876
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405338
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45f84c
and ebx, 0xfffffffe
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesA
mov edx, edi
lea eax, [ebp - 4]
call fcn.00405054
mov eax, dword [ebp - 4]
call fcn.0040c7e0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f87d
lea eax, [ebp - 4]
call fcn.00404e5c
ret

Function at 0x4604f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x15], 0
mov eax, dword [0x594118]
call fcn.0047fb68
xor eax, eax
push ebp
push 0x460632
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x594118]
mov edx, dword [eax]
call dword [edx + 8]
push 0x460640
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x46064c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x460613
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46065c
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x460674
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x46068c
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x46069c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x4606b8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x4606c8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x4606d8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x4606e8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
call fcn.0045c044
test al, al
je 0x4605d3
push ebp
call fcn.00460494
pop ecx
jmp 0x4605da
push ebp
call fcn.00460358
pop ecx
mov edx, 0x45fc50
mov eax, dword [0x594118]
call fcn.00421d28
cmp byte [ebp - 0x15], 0
jne 0x4605f6
push ebp
call fcn.0045fd0c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46061a
cmp dword [ebp - 0x28], 0
je 0x460612
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret