joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x4a12f0]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x4a89fc], 0
push esi
je 0x4026f0
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.004383fa
add esp, 4
test eax, eax
je 0x40270e
push 0
mov ecx, eax
call fcn.00402520
mov dword [0x4a89fc], eax
jmp 0x402718
mov dword [0x4a89fc], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x402740
xor ecx, ecx
jmp 0x402754
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402745
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.00405350
mov ecx, dword [0x4a89fc]
lea eax, [esp + 4]
push eax
call fcn.00403360
cmp dword [esp + 0x18], 8
jb 0x402782
push dword [esp + 4]
call fcn.004383ae
add esp, 4
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret

Function at 0x403360
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x4a12f0]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, str._t_n_v_f_r
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
lea edx, [ecx + 2]
mov word [esp + 0x24], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4033b3
sub ecx, edx
sar ecx, 1
push ecx
push str._t_n_v_f_r
lea ecx, [esp + 0x2c]
call fcn.00405350
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 3
lea edx, [esp + 0x2c]
call fcn.00410d70
add esp, 8
cmp dword [esp + 0x38], 8
jb 0x4033f9
push dword [esp + 0x24]
call fcn.004383ae
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x403437
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.004028a0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 8
jb 0x40344a
push dword [esp + 0xc]
call fcn.004383ae
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 4

Function at 0x40a010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40a01e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x40a030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40a03e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40a052
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x40a060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4a12f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x40a1bd
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.00403b20
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x220], 0
push eax
call fcn.00404810
push 1
push 0
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0
push eax
lea ecx, [ebp - 0x230]
call fcn.00404930
cmp eax, 0xffffffff
je 0x40a10b
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x230]
call fcn.00405560
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.00408500
cmp esi, eax
je 0x40a12d
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00404810
cmp dword [ebp - 0x234], 8
jb 0x40a144
push dword [ebp - 0x248]
call fcn.004383ae
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x40a178
push dword [ebp - 0x230]
call fcn.004383ae
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x24c], 8
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x40a1ac
push dword [ebp - 0x260]
call fcn.004383ae
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
Function at 0x40a1d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4a12f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40a241
cmp word [ebp - 0x210], 0
je 0x40a241
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00403b20
lea eax, [ebp - 0x228]
mov ecx, esi
push eax
call fcn.00407bf0
cmp dword [ebp - 0x214], 8
jb 0x40a35f
push dword [ebp - 0x228]
jmp 0x40a357
xor eax, eax
mov dword [ebp - 0x22c], 7
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
call fcn.0040a060
test al, al
je 0x40a296
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x240]
push eax
call fcn.00404810
jmp 0x40a348
push 3
xor eax, eax
mov dword [ebp - 0x214], 7
push 0x49cbac
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.00405350
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.00404810
push 1
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
mov ecx, esi
call fcn.00404930
cmp eax, 0xffffffff
je 0x40a314
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00405560
cmp dword [ebp - 0x214], 8
jb 0x40a32b
push dword [ebp - 0x228]
call fcn.004383ae
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
cmp dword [ebp - 0x22c], 8
jb 0x40a35f
push dword [ebp - 0x240]
call fcn.004383ae
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
Function at 0x40a370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4a12f0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x40a39d
mov ebx, dword [edi]
jmp 0x40a39f
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40a3e1
test al, 0x10
je 0x40a3c3
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40a3cd
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00408000
cmp dword [edi + 0x14], 8
jb 0x40a3f7
mov eax, dword [edi]
jmp 0x40a3f9
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.00405610
test eax, eax
jne 0x40a41e
test esi, esi
je 0x40a468
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x40a46e
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0040a370
test al, al
jne 0x40a431
xor bl, bl
jmp 0x40a46e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40a46c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x40a45b
push edi
call fcn.0040a030
add esp, 4
test al, al
jne 0x40a46c
test esi, esi
je 0x40a468
mov ecx, ebx
call fcn.00413420
mov dword [esi], eax
xor bl, bl
jmp 0x40a46e
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x40a481
push dword [esp + 0x14]
call fcn.004383ae
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret

Function at 0x40a540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4a12f0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40a639
cmp eax, 0x104
ja 0x40a639
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.00403b20
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.00407bf0
mov ecx, eax
call fcn.00408500
cmp esi, eax
je 0x40a5c6
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00404810
cmp dword [ebp - 0x214], 8
jb 0x40a5dd
push dword [ebp - 0x228]
call fcn.004383ae
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
cmp dword [ebp - 0x244], 8
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x40a611
push dword [ebp - 0x258]
call fcn.004383ae
add esp, 4
cmp dword [ebp - 0x22c], 8
jb 0x40a628
push dword [ebp - 0x240]
call fcn.004383ae
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00439bb3
mov esp, ebp
pop ebp
ret
Function at 0x40c850
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x40c8a2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x40c8ba
mov ecx, esi
jmp 0x40c8bf
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x40c8ec
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x40c8ce
mov eax, dword [eax]
jmp 0x40c8b2
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x40c8de
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40cc30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x40cc84
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x40ccb3
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x40ccb3
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x40ccf7
cmp esi, eax
jne 0x40cca7
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x40cce1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x40cd13
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x40cd35
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.0040cd50
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x40cd1b
mov dword [ecx], edi
jmp 0x40cd35
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x40cd35
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0040cda0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
cmp byte [esi], 0
je 0x40d145
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x40d148
mov eax, dword [esi + 4]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x40d1d2
cmp byte [ebp + 0xc], 0
je 0x40d25b
cmp byte [esi], 0
je 0x40d172
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x40d175
mov eax, dword [esi + 4]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40d25b
cmp dword [0x4a8a98], 2
jg 0x40d1cb
push 2
push 0x89
push str.d:webapps_b_build_slave_repo_build_src_baseprocessprocess_win.cc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 2
call fcn.00412040
mov ecx, dword [ebp + 8]
add eax, 8
push ecx
push str.Error_waiting_for_process_exit__exit_code:
push eax
call fcn.00406030
add esp, 8
mov ecx, eax
call fcn.0040a650
test byte [esp + 0xc], 2
jmp 0x40d250
cmp dword [0x4a8a98], 2
jg 0x40d24b
push 1
push 2
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 2
call fcn.004098b0
mov dword [esp + 0xb4], str.d:webapps_b_build_slave_repo_build_src_baseprocessprocess_win.cc
mov dword [esp + 0xb8], 0x90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x90
push str.d:webapps_b_build_slave_repo_build_src_baseprocessprocess_win.cc
lea ecx, [esp + 0x18]
mov dword [esp + 0xc4], eax
call fcn.004122e0
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x18]
push ecx
push str.Unable_to_terminate_process__exit_code:
push eax
call fcn.00406030
add esp, 8
mov ecx, eax
call fcn.0040a650
test byte [esp + 0xc], 4
je 0x40d25b
lea ecx, [esp + 0x10]
call fcn.00412090
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40db70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 8], 4
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
push 0
push dword [ebp + 8]
mov dword [esp + 0x20], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x40dbe6
mov ecx, dword [esp + 4]
cmp ecx, 4
je 0x40dbc9
cmp ecx, 3
jne 0x40dbe1
cmp dword [esp + 8], 4
jne 0x40dbe1
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, edx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov esp, ebp
pop ebp
ret 8

Function at 0x40dbf0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.00439bd0
mov eax, dword [0x4a12f0]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40dd37
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x40dcc4
cmp word [esp + 0x10], ax
jne 0x40dc88
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00405350
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dc90
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00405350
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x40dd32
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x40dd17
cmp eax, 0x400
ja 0x40dd17
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.00408ae0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
Function at 0x40e680
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
cmp dword [edi + 0x14], 8
jb 0x40e692
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x40e6a9
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 1
push ebx
call fcn.0043a865
mov esi, eax
add esp, 8
test esi, esi
je 0x40e722
push esi
push ebx
push dword [ebp - 8]
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40e719
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40e719
cmp dword [ebp - 4], 0
je 0x40e719
push 0x10
call fcn.004383fa
add esp, 4
test eax, eax
je 0x40e722
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
push ecx
movzx ecx, word [edx]
push ecx
push esi
mov ecx, eax
call fcn.0040e4c0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0043858b
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e980
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4a12f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, ecx
mov dword [ebp - 0x224], eax
movzx eax, word [edi + 8]
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0xa]
mov word [ebp - 0x12], ax
call esi
mov word [ebp - 0x10], ax
movzx eax, word [edi + 0xa]
mov word [ebp - 0xe], ax
movzx eax, word [edi + 8]
mov word [ebp - 0xc], ax
mov eax, 0x4e4
mov word [ebp - 0xa], ax
call esi
mov word [ebp - 8], ax
xor esi, esi
mov eax, 0x4e4
mov word [ebp - 6], ax
lea ebx, [ebx]
movzx eax, word [ebp + esi*2 - 0x12]
movzx ecx, word [ebp + esi*2 - 0x14]
add esi, 2
push ebx
push eax
push ecx
push 0x49cf00
push 0x104
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0043a8a5
add esp, 0x1c
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [edi + 4]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40ea54
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x40ea6e
cmp esi, 8
jb 0x40e9f0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
cmp word [edx], 0
jne 0x40ea98
mov ecx, dword [ebp - 0x224]
xor eax, eax
push eax
push edx
call fcn.00405350
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40eaa0
mov ecx, dword [ebp - 0x224]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.00405350
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439bb3
mov esp, ebp
pop ebp
ret 8
Function at 0x413650
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
test bl, 1
push esi
mov esi, ecx
mov ecx, 3
cmovne eax, ecx
test bl, 2
mov ecx, 1
cmovne eax, ecx
mov ecx, ebx
and ecx, 4
mov dword [ebp - 8], ecx
mov ecx, 4
cmovne eax, ecx
test bl, 8
mov ecx, 2
cmovne eax, ecx
mov dword [ebp + 8], eax
push edi
test bl, 0x10
je 0x4136a9
mov dword [ebp + 8], 5
jmp 0x4136b1
test eax, eax
je 0x41380e
xor edx, edx
mov edi, 0x40000000
test bl, 0x40
mov eax, 4
cmovne edx, edi
test bl, 0x80
cmovne edx, eax
test bl, 0x20
je 0x4136d4
or edx, 0x80000000
test ebx, 0x4000
je 0x4136e2
or edx, 0x100
test ebx, 0x40000
je 0x4136f0
or edx, 0x20000000
mov ecx, ebx
shr ecx, 8
not ecx
and ecx, 1
test ebx, 0x200
jne 0x413705
or ecx, 2
test ebx, 0x8000
je 0x41370f
or ecx, eax
xor eax, eax
test ebx, 0x400
cmovne eax, edi
test ebx, 0x800
je 0x413727
or eax, 0x100
test ebx, 0x1000
je 0x413732
or eax, 2
test ebx, 0x2000
je 0x41373f
or eax, 0x4000000
test ebx, 0x20000
je 0x41374c
or eax, 0x2000000
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x413757
mov edi, dword [edi]
push 0
push eax
push dword [ebp + 8]
push 0
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp dword [esi], edi
je 0x4137b0
mov ecx, esi
call fcn.00409e70
test edi, edi
je 0x4137b0
cmp edi, 0xffffffff
je 0x4137b0
mov dword [esi], edi
call fcn.0040f430
mov dword [ebp + 8], eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x4a8a74]
mov dword [ebp - 4], eax
test ecx, ecx
jne 0x4137a3
call fcn.0040f650
mov ecx, dword [0x4a8a74]
push dword [ebp + 8]
mov eax, dword [ecx]
push dword [ebp - 4]
push esi
push edi
call dword [eax + 4]
mov eax, dword [esi]
test eax, eax
je 0x4137fe
cmp eax, 0xffffffff
je 0x4137fe
mov eax, ebx
mov dword [esi + 0x20], 0
shr eax, 0xa
and al, 1
cmp dword [ebp - 8], 0
mov byte [esi + 0x25], al
je 0x4137ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
mov byte [esi + 0x24], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test bl, 0xa
je 0x41380e
mov byte [esi + 0x24], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00413420
mov dword [esi + 0x20], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4