joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437470
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edx, dword [0x5a05c4]
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ebx, [esp + 0x18]
xor edx, ebp
mov dword [esp + 0x28], edx
push 3
push ecx
push eax
push ebx
call fcn.00447700
add esp, 0x10
cmp dword [esp + 0x1c], 0
je 0x43767d
mov esi, dword [esp + 0x18]
mov dword [esp + 0x24], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [esp + 0xc], eax
je 0x4374ee
push 0x55c812
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4374fe
mov ecx, eax
lea eax, [esp + 0x24]
push eax
push esi
call ecx
jmp 0x4374fa
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
jmp 0x437500
xor esi, esi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test eax, eax
je 0x437611
cmp eax, 0x15555556
mov dword [esp + 4], esi
mov dword [esp + 8], edi
jae 0x43769e
mov ebx, eax
shl ebx, 2
lea edi, [ebx + ebx*2]
push edi
call fcn.00527256
add esp, 4
mov dword [esp + 0x1c], eax
mov esi, eax
mov dword [esp + 0x18], eax
add eax, edi
mov edi, ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 4]
jmp 0x437597
test ebx, ebx
mov eax, esi
mov byte [esi + 0xb], bl
je 0x437582
mov ecx, ebx
mov dword [esp], eax
add ecx, ebx
push ecx
push dword [esp + 0x14]
push eax
call fcn.0052acc0
mov eax, dword [esp + 0xc]
add esp, 0xc
mov word [eax + ebx*2], 0
mov eax, dword [esp + 0x14]
add esi, 0xc
add eax, 4
add edi, 0xfffffffc
je 0x437601
mov dword [esp + 0x14], eax
mov eax, dword [eax]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esp + 0x10], eax
push eax
call fcn.00542114
add esp, 4
cmp eax, 0x7ffffff0
jae 0x437692
mov ebx, eax
cmp eax, 5
jb 0x437560
mov dword [esp], edi
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x437699
lea eax, [edi + edi]
push eax
call fcn.00527256
add esp, 4
or edi, 0x80000000
mov dword [esi], eax
mov dword [esi + 8], edi
mov edi, dword [esp]
mov dword [esi + 4], ebx
jmp 0x437569
mov dword [esp + 0x1c], esi
mov edi, dword [esp + 8]
mov esi, dword [esp + 4]
lea ebx, [esp + 0x18]
mov ecx, edi
push ebx
call fcn.00437210
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43762f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x43767d
mov eax, dword [esp + 0x1c]
cmp eax, esi
jne 0x437656
mov eax, esi
jmp 0x437670
cmp esi, edi
mov eax, edi
je 0x43766c
cmp byte [eax - 1], 0
lea edi, [eax - 0xc]
jns 0x437650
push dword [eax - 0xc]
call fcn.005272d6
add esp, 4
jmp 0x437650
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], esi
push eax
call fcn.005272d6
add esp, 4
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.00527311
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.00426c4c
call fcn.0053b598
lea ecx, [esp + 0x18]
call fcn.00428e9c
int3
Function at 0x43c280
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.0043bec0
test al, al
jne 0x43c29e
mov ecx, esi
call fcn.0043bec0
test al, al
je 0x43c2a3
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.00454290
Function at 0x43c730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [0x5a05c4]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, ebp
test ecx, ecx
mov dword [esp + 0x50], eax
je 0x43c76c
cmp byte [ecx + 0xb], 0
js 0x43c760
mov byte [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x43c76c
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
mov ecx, ebx
call fcn.0043bec0
test al, al
jne 0x43c8e2
push 0x557420
push ebx
call fcn.00453730
add esp, 8
xor esi, esi
test eax, eax
je 0x43c8e2
lea edi, [esp + 0x28]
mov dword [esp], eax
mov ecx, edi
call fcn.0043a060
push edi
push ebx
call fcn.00453de0
add esp, 8
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 4], ecx
lea ecx, [esp + 0x28]
call fcn.0040de20
mov ecx, dword [esp + 4]
mov eax, edi
not bl
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
cmp ecx, 1
sbb eax, 0
setl al
or al, bl
mov ebx, 0xffff
test al, 1
mov eax, 0
cmove ebx, ecx
mov ecx, dword [ebp + 0x10]
cmovne edi, esi
cmp ecx, ebx
mov dword [esp + 8], ecx
sbb eax, edi
cmovb ebx, ecx
cmovb edi, esi
lea ecx, [esp + 0x18]
add ebx, 1
adc edi, 0
push 0
push ebx
call fcn.00426e52
push 0xa0
push str..._.._base_files_file_util.cc
push str.ReadFileToStringWithMaxSize
lea eax, [esp + 0x34]
push eax
call fcn.0043e1b0
add esp, 0x10
lea ecx, [esp + 0xc]
push 0
lea eax, [esp + 0x2c]
push eax
call fcn.00449640
cmp byte [esp + 0x23], 0
lea eax, [esp + 0x18]
jns 0x43c85d
mov eax, dword [esp + 0x18]
push dword [esp]
push ebx
push 1
push eax
call fcn.0053f7e7
add esp, 0x10
test eax, eax
je 0x43c8e9
xor esi, esi
jmp 0x43c899
add edi, esi
push dword [esp]
push ebx
push 1
push edi
call fcn.0053f7e7
add esp, 0x10
mov edi, dword [esp + 4]
test eax, eax
je 0x43c8e9
mov ecx, dword [ebp + 0x10]
sub ecx, esi
cmp ecx, eax
jb 0x43c900
test esi, esi
mov ecx, 0x10000
cmove edi, esi
cmove ebx, ecx
add esi, eax
push dword [esp]
call fcn.0053f29e
add esp, 4
test eax, eax
jne 0x43c8e9
mov dword [esp + 4], edi
lea edi, [esp + 0x18]
lea eax, [esi + ebx]
mov ecx, edi
push 0
push eax
call fcn.00426e52
cmp byte [esp + 0x23], 0
jns 0x43c880
mov edi, dword [esp + 0x18]
jmp 0x43c880
xor ebx, ebx
jmp 0x43c972
mov edi, dword [esp]
push edi
call fcn.0053f2ca
add esp, 4
test eax, eax
mov dword [esp + 8], esi
sete bl
jmp 0x43c905
mov edi, dword [esp]
xor ebx, ebx
push edi
call fcn.0053f1a3
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43c956
mov eax, dword [ecx + 8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
movsd xmm0, qword [ecx]
movsd qword [esp + 0x28], xmm0
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 0x18]
movsd qword [ecx], xmm0
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
mov dword [esp + 0x20], eax
movsd qword [esp + 0x18], xmm0
push 0
push dword [esp + 0xc]
call fcn.00426e52
lea ecx, [esp + 0xc]
call fcn.00449730
cmp byte [esp + 0x23], 0
jns 0x43c972
push dword [esp + 0x18]
call fcn.005272d6
add esp, 4
mov ecx, dword [esp + 0x50]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ced0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x5a05c4]
xor edi, edi
xor eax, ebp
mov dword [esp + 0x10], eax
cmp dword [ecx + 0x40], 0
je 0x43d064
mov esi, ecx
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x43d079
mov eax, dword [esi + 0x5c]
test al, 0x10
jne 0x43cf31
test al, 8
je 0x43d062
movsd xmm0, qword [esi + 0x50]
movsd qword [esp + 8], xmm0
cmp byte [esi + 0x62], 0
je 0x43cfc8
mov edi, dword [esi + 0x10]
xor ebx, ebx
sub edi, dword [esi + 0xc]
jmp 0x43d013
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
je 0x43cf4b
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0x30]
cmp eax, 0xffffffff
je 0x43d027
lea eax, [esi + 0x48]
mov dword [esp + 4], eax
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x34]
lea ebx, [esp + 8]
mov edi, dword [ecx]
add edx, eax
push ebx
push edx
push eax
push dword [esp + 0x10]
call dword [edi + 0x10]
mov ebx, eax
mov edi, dword [esp + 8]
mov eax, dword [esi + 0x20]
sub edi, eax
push dword [esi + 0x40]
push edi
push 1
push eax
call fcn.005402cd
add esp, 0x10
cmp eax, edi
mov edi, 0xffffffff
jne 0x43d064
cmp ebx, 1
je 0x43cf60
cmp ebx, 2
je 0x43d064
push dword [esi + 0x40]
call fcn.0053f2f6
add esp, 4
test eax, eax
jne 0x43d064
jmp 0x43d062
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
sub edi, edx
test eax, eax
jle 0x43cfe8
mov ecx, dword [esi + 0x10]
xor ebx, ebx
sub ecx, dword [esi + 0xc]
imul ecx, eax
add edi, ecx
jmp 0x43d013
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x43d011
mov ecx, dword [esi + 0x44]
sub eax, dword [esi + 8]
mov ebx, dword [ecx]
push eax
push edx
push dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
call dword [ebx + 0x1c]
sub edi, eax
mov bl, 1
add edi, dword [esi + 0x24]
sub edi, dword [esi + 0x20]
jmp 0x43d013
xor ebx, ebx
neg edi
push 1
push edi
push dword [esi + 0x40]
call fcn.0053f9ea
add esp, 0xc
test eax, eax
je 0x43d02e
mov edi, 0xffffffff
jmp 0x43d064
test bl, bl
je 0x43d03d
movsd xmm0, qword [esp + 8]
movsd qword [esi + 0x48], xmm0
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x5c], 0
xor edi, edi
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004220c4
int3
Function at 0x43e1f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x5a05c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004376b0
mov esi, eax
mov ecx, eax
push 0x565dc1
call fcn.00437ac0
test al, al
jne 0x43e22e
mov ecx, esi
push str.vmodule
call fcn.00437ac0
test al, al
je 0x43e2c0
cmp dword [0x5a1db0], 0
jne 0x43e38b
mov eax, dword [0x5a1db4]
mov dword [0x5a1db0], eax
push 0x10
call fcn.00527256
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], str.vmodule
push str.vmodule
call fcn.00541da0
add esp, 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push edx
call fcn.00437b30
mov dword [ebp - 0x38], 0x565dc1
push 0x565dc1
call fcn.00541da0
add esp, 4
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
lea ebx, [ebp - 0x30]
mov ecx, esi
push eax
push ebx
call fcn.00437b30
mov ecx, edi
push 0x5a1db8
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0047d7f0
cmp byte [ebp - 0x25], 0
mov dword [0x5a1db4], edi
js 0x43e301
cmp byte [ebp - 0x11], 0
js 0x43e312
mov esi, dword [ebp + 8]
mov bl, 1
mov eax, dword [esi]
test al, 1
mov dword [0x59f3f4], eax
je 0x43e377
mov eax, dword [0x5a1dcc]
test eax, eax
je 0x43e31f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x5a1dbc]
mov dword [0x5a1dcc], 0
test ecx, ecx
jne 0x43e34e
and byte [0x59f3f4], 0xfe
jmp 0x43e329
push dword [ebp - 0x30]
call fcn.005272d6
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x43e2c0
push dword [ebp - 0x1c]
call fcn.005272d6
add esp, 4
jmp 0x43e2c0
mov ecx, dword [0x5a1dbc]
test ecx, ecx
jne 0x43e34e
push 0xc
call fcn.00527256
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x5a1dbc], eax
push dword [esi + 4]
call fcn.00427f50
cmp dword [esi + 0xc], 0
jne 0x43e370
mov eax, dword [0x5a1dbc]
cmp byte [eax + 0xb], 0
jns 0x43e369
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0043e390
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x43e390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x5a05c4]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x5a1dcc], 0
jne 0x43e58c
mov esi, dword [0x5a1dbc]
test esi, esi
je 0x43e3d1
test byte [0x59f3f4], 1
jne 0x43e4b6
jmp 0x43e58c
push 0xc
call fcn.00527256
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push edi
call fcn.00542114
add esp, 4
cmp eax, 0x7ffffff0
jae 0x43e5a3
mov ebx, eax
cmp eax, 5
jae 0x43e42b
mov eax, esi
test ebx, ebx
mov byte [esi + 0xb], bl
jne 0x43e457
jmp 0x43e46a
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x43e5aa
lea eax, [edi + edi]
push eax
call fcn.00527256
add esp, 4
or edi, 0x80000000
mov dword [esi], eax
mov dword [esi + 8], edi
mov dword [esi + 4], ebx
lea edi, [ebp - 0x218]
mov ecx, ebx
add ecx, ebx
push ecx
push edi
push eax
mov edi, eax
call fcn.0052acc0
mov eax, edi
add esp, 0xc
mov word [eax + ebx*2], 0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x43e47b
mov eax, dword [esi + 4]
mov ecx, esi
push eax
push 0x5c
call fcn.00428592
cmp eax, 0xffffffff
mov bl, 1
je 0x43e497
inc eax
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.004281fc
mov ecx, esi
push str.debug.log
call fcn.00427dd4
mov dword [0x5a1dbc], esi
test byte [0x59f3f4], 1
je 0x43e58c
cmp byte [esi + 0xb], 0
jns 0x43e4be
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 3
push 4
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5a1dcc], eax
inc eax
cmp eax, 1
ja 0x43e58c
lea esi, [ebp - 0x218]
mov word [ebp - 0x218], 0
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x43e58a
cmp eax, 0x104
ja 0x43e58a
mov ecx, dword [0x5a1dbc]
push esi
call fcn.00427f50
mov ecx, dword [0x5a1dbc]
movzx eax, byte [ecx + 0xb]
test al, al
js 0x43e52b
mov edx, ecx
jmp 0x43e530
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x43e548
push 0x555d86
call fcn.00427dd4
mov ecx, dword [0x5a1dbc]
push str.debug.log
call fcn.00427dd4
mov eax, dword [0x5a1dbc]
cmp byte [eax + 0xb], 0
jns 0x43e55f
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5a1dcc], eax
inc eax
cmp eax, 1
ja 0x43e58c
mov dword [0x5a1dcc], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00426c4c
call fcn.0053b598
int3
Function at 0x43fd90
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
add ecx, 0xc
mov dword [ebp - 0x14], ecx
call fcn.00456110
mov esi, dword [edi + 0x14]
test esi, esi
je 0x43fe97
imul eax, dword [ebp + 8], 0x5bd1e995
mov edx, esi
mov dword [ebp - 0x10], edi
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov eax, esi
shr eax, 1
and eax, 0x55555555
sub edx, eax
mov eax, edx
shr edx, 2
and eax, 0x33333333
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul edi, eax, 0x1010101
shr edi, 0x18
cmp edi, 1
jbe 0x43fe2e
cmp ecx, esi
mov ebx, ecx
mov edx, esi
jb 0x43fe35
mov esi, edx
mov eax, ecx
xor edx, edx
div esi
mov ebx, edx
jmp 0x43fe33
lea ebx, [esi - 1]
and ebx, ecx
mov edx, esi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x43fe97
mov esi, dword [eax]
test esi, esi
je 0x43fe97
lea eax, [edx - 1]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], eax
jmp 0x43fe6e
mov eax, dword [ebp + 8]
cmp dword [esi + 8], eax
je 0x43feaa
mov esi, dword [esi]
test esi, esi
je 0x43fe97
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x43fe60
cmp edi, 1
jbe 0x43fe90
cmp eax, edx
jb 0x43fe93
mov edi, edx
xor edx, edx
div edi
mov eax, edx
mov edx, edi
mov edi, dword [ebp - 0x18]
jmp 0x43fe93
and eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x43fe68
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, dword [0x5a43c0]
cmp esi, 1
ja 0x43ff15
push 0x5a43c0
call fcn.0043e0b0
add esp, 4
test al, al
je 0x43ff0f
mov esi, 0x5a43c4
mov dword [0x5a43c8], 0
mov dword [0x5a43c4], 0
mov ecx, 0x5a43c4
push 0
call fcn.00481630
push 0x5a43c0
push 0
push 0x5a43c4
push 0x5a43c0
call fcn.0043e160
add esp, 0x10
jmp 0x43ff15
mov esi, dword [0x5a43c0]
mov ecx, esi
call fcn.004815c0
mov edx, dword [ebp + 0xc]
mov edi, eax
mov ecx, esi
mov ebx, edx
push edx
call fcn.004815f0
mov eax, dword [ebx + 0x14]
push dword [ebp + 8]
push eax
call dword [eax + 4]
add esp, 8
mov ecx, esi
push edi
call fcn.004815f0
jmp 0x43fea0
Function at 0x452080
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x5a05c4]
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x4d
push str..._.._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.0043e1b0
add esp, 0x10
lea ecx, [ebp - 0x24]
push 0
push edi
call fcn.00449640
cmp byte [ebx + 0xb], 0
jns 0x4520c1
mov ebx, dword [ebx]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4521d9
mov esi, eax
test eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], 0
js 0x4521fb
push esi
call fcn.00527256
add esp, 4
mov edi, esi
mov ebx, eax
mov dword [ebp - 0x34], eax
add edi, eax
mov dword [ebp - 0x2c], edi
push esi
push 0
push eax
call fcn.0052b7c0
add esp, 0xc
mov dword [ebp - 0x30], edi
push ebx
push esi
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call sub.VERSION.dll_GetFileVersionInfoW
xor edi, edi
test eax, eax
je 0x4521bd
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x18]
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push ebx
push str.VarFileInfoTranslation
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4521bd
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4521bd
push 0x1c
call fcn.00527256
add esp, 4
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
mov dword [edi], 0x55e1b0
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x55e3a6
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x452203
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov edi, eax
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4521df
mov dword [ebp - 0x30], eax
push eax
call fcn.005272d6
add esp, 4
jmp 0x4521df
mov dword [edi], 0
lea ecx, [ebp - 0x24]
call fcn.00449730
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, edi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x34]
call fcn.00428e9c
int3
Function at 0x4523f0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x5a05c4]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 0x16]
mov dword [ebp - 0x230], eax
call edi
mov word [ebp - 0x224], ax
movzx eax, word [esi + 0x16]
mov dword [ebp - 0x22c], eax
movzx eax, word [esi + 0x14]
mov dword [ebp - 0x228], eax
call edi
lea edi, [ebp - 0x218]
mov word [ebp - 0x222], ax
push dword [ebp + 8]
push ebx
push dword [ebp - 0x230]
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.004525f0
add esp, 0x1c
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push ebx
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4524a7
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4524a7
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4525bb
movzx eax, word [ebp - 0x224]
push dword [ebp + 8]
push dword [ebp - 0x22c]
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.004525f0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x452507
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x452507
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4525bb
push dword [ebp + 8]
push 0x4e4
push dword [ebp - 0x228]
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.004525f0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x452560
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x452560
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4525bb
movzx eax, word [ebp - 0x222]
push dword [ebp + 8]
push 0x4e4
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.004525f0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4525e1
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4525e1
mov edx, dword [ebp - 0x220]
test edx, edx
je 0x4525e1
mov ecx, dword [ebp + 0xc]
dec edx
push edx
push eax
call fcn.004278e0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
jmp 0x4525c8

Function at 0x452750
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx edx, byte [ebp + 0xc]
pop ebp
jmp fcn.00452760
Function at 0x452b10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 1
pop ebp
jmp fcn.00452760

Function at 0x452b30
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x5a05c4]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x187
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push edi
call fcn.0043e1b0
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
push edi
call fcn.00449640
cmp byte [esi + 0xb], 0
jns 0x452b81
cmp dword [esi + 4], 0x103
jbe 0x452b7f
xor ebx, ebx
jmp 0x452b91
mov esi, dword [esi]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [ebp - 0x1c]
call fcn.00449730
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x452bb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x5a05c4]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x193
push str..._.._base_files_file_util_win.cc
push 0x55e3f7
push ebx
call fcn.0043e1b0
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
push ebx
call fcn.00449640
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x452bf9
mov eax, dword [edi]
cmp byte [esi + 0xb], 0
mov ecx, esi
jns 0x452c03
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
test eax, eax
jne 0x452c6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00454be0
add esp, 4
cmp byte [esi + 0xb], 0
mov dword [ebp - 0x30], eax
jns 0x452c2b
mov esi, dword [esi]
cmp byte [edi + 0xb], 0
jns 0x452c33
mov edi, dword [edi]
push 0
push 0
push 2
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x452c6a
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x452c68
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00454be0
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp eax, 0xfffffffc
cmovne ecx, eax
mov dword [esi], ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.00449730
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret