joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b060
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x49b06f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49b081
xor al, al
ret
shr eax, 4
not al
and al, 1
ret

Function at 0x49b090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov cl, byte [edi + 0x11c]
lea eax, [edi + 0xc]
test cl, cl
jne 0x49b0b7
mov eax, dword [edi + 8]
cmp word [eax + 6], 0x3a
jne 0x49b14f
lea eax, [edi + 0xc]
test cl, cl
jne 0x49b0cc
mov eax, dword [edi + 8]
cmp word [eax + 8], 0
jne 0x49b14f
push edi
lea ecx, [ebp - 0x24c]
call fcn.00499b00
push 0x785c68
lea eax, [ebp - 0x24c]
push 0x791e68
push eax
call fcn.0049a160
add esp, 0xc
lea eax, [ebp - 0x240]
cmp byte [ebp - 0x130], 0
cmove eax, dword [ebp - 0x244]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49b121
xor bl, bl
jmp 0x49b127
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x130], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x49b270
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
jmp 0x49b263
push edi
lea ecx, [ebp - 0x128]
call fcn.00499b00
mov al, byte [edi + 0x11c]
lea ecx, [edi + 0xc]
test al, al
jne 0x49b16b
mov ecx, dword [edi + 8]
cmp word [ecx + 6], 0x3a
jne 0x49b194
lea ecx, [edi + 0xc]
test al, al
jne 0x49b17c
mov ecx, dword [edi + 8]
cmp word [ecx + 8], 0x5c
jne 0x49b194
lea ecx, [edi + 0xc]
test al, al
jne 0x49b18d
mov ecx, dword [edi + 8]
cmp word [ecx + 0xa], 0
je 0x49b1dc
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x49b1dc
test al, al
lea eax, [edi + 0xc]
jne 0x49b1a5
mov eax, dword [edi + 8]
cmp word [eax + ecx*2 + 2], 0x5c
jne 0x49b1dc
push esi
lea esi, [ecx - 1]
push ecx
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x124], esi
call fcn.0049a590
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
xor ecx, ecx
mov word [eax + esi*2 + 4], cx
pop esi
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49b202
xor bl, bl
jmp 0x49b247
mov al, byte [edi + 0x11c]
lea ecx, [edi + 0xc]
test al, al
jne 0x49b212
mov ecx, dword [edi + 8]
cmp word [ecx + 6], 0x3a
jne 0x49b241
lea ecx, [edi + 0xc]
test al, al
jne 0x49b223
mov ecx, dword [edi + 8]
cmp word [ecx + 8], 0x5c
jne 0x49b241
test al, al
je 0x49b233
add edi, 0xc
jmp 0x49b236
mov edi, dword [edi + 8]
cmp word [edi + 0xa], 0
jne 0x49b241
mov bl, 1
jmp 0x49b247
shr ebx, 4
and bl, 1
cmp byte [ebp - 0xc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x49b270
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x49b270
push eax
call fcn.005cff1c
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x49bb20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e907b
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
call fcn.0049b090
test al, al
lea eax, [esi + 0xc]
je 0x49bbd2
cmp byte [esi + 0x11c], 0
jne 0x49bb6b
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x138]
push eax
call fcn.0049a8e0
lea eax, [ebp - 0x138]
mov dword [ebp - 4], 0
push eax
push 0x791fb0
mov ecx, edi
call fcn.0049c7f0
mov ecx, eax
call fcn.0049ca90
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x138], vtable.t_str.0
jne 0x49bbce
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x12c]
cmp eax, ecx
je 0x49bbce
push eax
call fcn.005cff1c
add esp, 4
xor al, al
jmp 0x49bc4d
cmp byte [esi + 0x11c], 0
jne 0x49bbde
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49bbfa
shr eax, 4
not al
test al, 1
je 0x49bbfa
mov al, 1
jmp 0x49bc4d
push ecx
lea ecx, [ebp - 0x490]
call fcn.004a91b0
push 1
push esi
push edi
lea ecx, [ebp - 0x490]
mov dword [ebp - 4], 2
call fcn.004a9310
test al, al
jne 0x49bc3e
mov ecx, edi
call fcn.0049c7f0
push 0x791fd0
push 0x791e68
push eax
call fcn.0049a160
add esp, 0xc
xor bl, bl
jmp 0x49bc40
mov bl, 1
lea ecx, [ebp - 0x490]
call fcn.004a9250
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 8
Function at 0x49f190
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov byte [ebp - 0x415], 0
push 0
push eax
call fcn.005c0be0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x49f3f1
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0
push 0
push eax
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x41c], 0
call fcn.005c0be0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x49f3f1
push esi
call fcn.005cff37
mov ebx, eax
add esp, 4
mov dword [ebp - 0x42c], ebx
test ebx, ebx
je 0x49f3f1
push ebx
push esi
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x49f3d2
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x424]
push eax
push str.VarFileInfoTranslation
push ebx
call esi
test eax, eax
je 0x49f3d2
cmp dword [ebp - 0x41c], 4
jb 0x49f3d2
mov ecx, dword [ebp - 0x424]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x414]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.004a1f00
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call esi
test eax, eax
je 0x49f3d2
mov ecx, dword [ebp - 0x41c]
cmp ecx, 2
jbe 0x49f3d2
mov eax, dword [ebp - 0x428]
push edi
mov edi, 0x786008
cmp word [eax + ecx*2 - 2], 0
jne 0x49f358
test eax, eax
cmovne edi, eax
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49f311
sub esi, ecx
mov ecx, 0x8030b8
sar esi, 1
mov dword [0x8030b4], esi
inc esi
push esi
call fcn.0049a590
cmp byte [0x8031cc], 0
lea eax, [esi + esi]
mov ecx, 0x8030bc
cmove ecx, dword [0x8030b8]
push eax
push edi
lea eax, [ecx + 4]
push eax
call fcn.005c0660
add esp, 0xc
jmp 0x49f3ca
test eax, eax
cmovne edi, eax
xor esi, esi
test eax, eax
cmovne esi, ecx
mov ecx, 0x8030b8
push esi
mov dword [0x8030b4], esi
call fcn.0049a590
cmp byte [0x8031cc], 0
lea eax, [esi + esi]
mov ebx, 0x8030bc
mov edx, ebx
cmove edx, dword [0x8030b8]
push eax
push edi
lea eax, [edx + 4]
push eax
call fcn.005c0660
mov esi, dword [0x8030b4]
add esp, 0xc
mov ecx, 0x8030b8
lea eax, [esi + 1]
push eax
call fcn.0049a590
cmp byte [0x8031cc], 0
cmove ebx, dword [0x8030b8]
xor eax, eax
mov word [ebx + esi*2 + 4], ax
mov ebx, dword [ebp - 0x42c]
mov byte [ebp - 0x415], 1
pop edi
push ebx
call fcn.005cff1c
mov al, byte [ebp - 0x415]
add esp, 4
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4a23c0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e96a0
mov eax, dword fs:[0]
push eax
sub esp, 0x92c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
push 0
push 0
push 0
push edi
lea ecx, [ebp - 0x934]
call fcn.0049a8e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 0xffffffff
je 0x4a2443
shr eax, 4
not al
test al, 1
jne 0x4a2567
lea ecx, [ebp - 0x934]
call fcn.0049b090
test al, al
je 0x4a2572
push edi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.004a4400
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x803550
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a2567
nop dword [eax + eax]
mov edx, 0x788204
mov ecx, 0x80357c
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4a24c6
test ax, ax
je 0x4a24c2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4a24c6
add ecx, 4
add edx, 4
test ax, ax
jne 0x4a24a0
xor eax, eax
jmp 0x4a24cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a254c
mov eax, 0x792098
mov ecx, 0x80357c
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4a2506
test dx, dx
je 0x4a2502
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4a2506
add ecx, 4
add eax, 4
test dx, dx
jne 0x4a24e0
xor eax, eax
jmp 0x4a250b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a254c
push 0x80357c
push edi
lea eax, [ebp - 0x810]
push 0x7928cc
push eax
call fcn.004a4400
add esp, 0x10
test byte [0x803550], 0x10
je 0x4a253f
lea ecx, [ebp - 0x810]
call fcn.004a23c0
jmp 0x4a254c
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call ebx
push 0x803550
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a2490
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
push 0
push edi
call ebx
mov esi, eax
jmp 0x4a2574
xor esi, esi
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4a25a0
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x4a25a0
push eax
call fcn.005cff1c
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4a2680
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e96eb
mov eax, dword fs:[0]
push eax
sub esp, 0xa50
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004a25c0
test al, al
jne 0x4a26c0
xor eax, eax
jmp 0x4a28a8
xor esi, esi
lea ecx, [ebp - 0x934]
push esi
push esi
push esi
push esi
push esi
push edi
call fcn.0049a8e0
mov dword [ebp - 4], esi
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a275c
shr eax, 4
not al
test al, 1
je 0x4a275c
push esi
push esi
push esi
push esi
push esi
push edi
lea ecx, [ebp - 0xa58]
call fcn.0049a8e0
push esi
lea ecx, [ebp - 0xa58]
mov byte [ebp - 4], 1
call fcn.0049b290
cmp byte [ebp - 0x93c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4a287a
mov eax, dword [ebp - 0xa50]
lea ecx, [ebp - 0xa4c]
cmp eax, ecx
je 0x4a287a
push eax
call fcn.005cff1c
add esp, 4
jmp 0x4a287a
lea ecx, [ebp - 0x934]
call fcn.0049b090
test al, al
je 0x4a2878
push edi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.004a4400
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x8031d8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a286d
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
mov edx, 0x788204
mov ecx, 0x803204
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4a27e6
test ax, ax
je 0x4a27e2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4a27e6
add ecx, 4
add edx, 4
test ax, ax
jne 0x4a27c0
xor eax, eax
jmp 0x4a27eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a2856
mov ecx, 0x792098
mov eax, 0x803204
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4a2826
test dx, dx
je 0x4a2822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a2826
add eax, 4
add ecx, 4
test dx, dx
jne 0x4a2800
xor eax, eax
jmp 0x4a282b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a2856
push 0x803204
push edi
lea eax, [ebp - 0x810]
push 0x7928cc
push eax
call fcn.004a4400
add esp, 0x10
lea ecx, [ebp - 0x810]
mov dl, 1
call fcn.004a2680
push 0x8031d8
push esi
call ebx
test eax, eax
jne 0x4a27b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
jmp 0x4a287a
xor esi, esi
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4a28a6
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x4a28a6
push eax
call fcn.005cff1c
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4a28e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4a2920
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.005cff37
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4a29a1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x785c68
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4a29a1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x4a299f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x4a29ae
push esi
call fcn.005cff1c
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.005c0be0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4a2e86
push 0x792954
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005cfead
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.004a28e0
add esp, 0x10
test al, al
je 0x4a2e86
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x4a2e74
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x4a5e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e9a38
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x7ce4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x4a5f01
push 0x60
call fcn.0047f370
mov ecx, eax
mov dword [ecx + 4], 0
mov dword [ecx + 0x30], esi
mov dword [ecx], 0
mov dword [ecx + 8], 0x11
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0xa
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0xc], 0x3f400000
mov dword [ecx + 0x10], 0x3e800000
mov dword [ecx + 0x14], 0x40100000
mov dword [ecx + 0x18], 0x26
mov dword [ecx + 0x1c], 0
lea eax, [ecx + 0x34]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [ebp - 0x10], eax
mov dword [eax + 0x10], esi
lea eax, [ecx + 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], esi
mov dword [ebp - 0x10], eax
mov eax, ecx
mov dword [ecx + 0x5c], esi
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a6930
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4a6970
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.005cff37
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4a69cb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x785c68
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4a69cb
mov ecx, dword [ebp - 8]
mov bl, 1
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test esi, esi
je 0x4a69d8
push esi
call fcn.005cff1c
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6d80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e9b18
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7f9d6c], 0
jne 0x4a6e7a
push 0x18
call fcn.005be217
mov dword [ebp - 0x48], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [eax], xmm0
mov ecx, eax
movq qword [eax + 0x10], xmm0
call fcn.004dd0e0
mov dword [ebp - 4], 0xffffffff
mov dword [0x7f9d6c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a6e10
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00474450
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
call fcn.004ddb20
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4a6e7a
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4a6e70
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a6f48
push ecx
push edx
call fcn.005be247
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 2
lea ecx, [eax + 7]
call fcn.004de300
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.004dbb30
mov edx, eax
mov byte [ebp - 4], 3
call fcn.004b3150
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov edi, eax
call fcn.004743f0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x20], 1
jb 0x4a6edb
mov esi, dword [esi]
mov eax, 3
mov dword [ebp - 0x1c], esi
cmp edi, eax
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], 0
cmovl eax, edi
mov byte [0x801dea], 1
mov byte [0x801de8], 1
mov byte [0x7d1c46], 1
mov byte [0x801de9], 0
mov dword [0x801dec], eax
call fcn.004decb0
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x41], al
call fcn.004743f0
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
call fcn.005c44be
int3
Function at 0x4a8050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4a815c
test edi, edi
je 0x4a8106
cmp word [edi], 0
je 0x4a8106
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4a80a3
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0049c7f0
mov ecx, eax
call fcn.0049c950
mov ecx, dword [ebp + 8]
call fcn.0049c7f0
push 0x793258
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
lea ecx, [ebx + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
push 0x785c68
push 0x791e68
push esi
call fcn.0049a160
push edi
push 0x791e68
push esi
call fcn.0049a160
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x4a8115
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0049c7f0
mov ecx, eax
call fcn.0049c950
mov ecx, dword [ebp + 8]
call fcn.0049c7f0
push 0x793258
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
lea ecx, [edi + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
je 0x4a822b
test edi, edi
je 0x4a81e5
cmp word [edi], 0
je 0x4a81e5
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4a8181
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0
call fcn.0049c7f0
mov ecx, eax
call fcn.0049c950
mov ecx, dword [ebp + 8]
call fcn.0049c7f0
push 0x793294
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
lea ecx, [ebx + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
push 0x785c68
push 0x791e68
push esi
call fcn.0049a160
push edi
push 0x791e68
push esi
call fcn.0049a160
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x4a81f4
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
call fcn.0049c7f0
push 0x793294
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
lea ecx, [edi + 4]
push ecx
push 0x791e68
push esi
call fcn.0049a160
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14