joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push str.IsWow64Process
xor esi, esi
push str.kernel32
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 8], esi
test edi, edi
je 0x442eda
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x442eda
cmp dword [ebp - 8], esi
je 0x442eda
lea eax, [ebp - 0x14]
push eax
push 0x20119
jmp 0x442ee3
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x442f1c
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x442f2a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
Function at 0x4439f0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.0043a5b0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x443ad2
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443aa1
xor ecx, ecx
cmp ecx, 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push eax
push 0
push str.silence
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
xor eax, eax
cmp ecx, 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.0047cd06
mov esp, ebp
pop ebp
ret

Function at 0x444e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
test edi, edi
je 0x444f26
test edx, edx
je 0x444f26
push ebx
mov ebx, dword [edi + 0x3c]
add ebx, edi
je 0x444eab
lea eax, [ebx + 0x78]
test eax, eax
jne 0x444eb3
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
add eax, edi
push esi
mov ecx, dword [eax + 0x1c]
mov esi, dword [eax + 0x20]
add ecx, edi
add esi, edi
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 4], esi
xor esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x444f0a
lea esp, [esp]
movsx eax, word [ecx + esi*2]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push edx
mov eax, dword [eax + esi*4]
add eax, edi
push eax
call dword [sym.imp.MSVCR110.dll__stricmp]
add esp, 8
test eax, eax
je 0x444f13
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc esi
cmp esi, dword [ebp - 8]
jb 0x444ee0
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
pop esi
mov eax, dword [ecx + eax*4]
add eax, dword [ebx + 0x34]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4457a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x18]
or eax, 0x20019
push eax
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 1
xor bl, bl
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44580f
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push edi
push eax
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x44581d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
Function at 0x4460d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4860cb
mov eax, dword fs:[0]
push eax
mov eax, 0x103c
call fcn.0047d8d0
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push esi
push dword [edi]
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x1014], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x4462bd
mov ecx, dword [ebp - 0x1018]
cmp ecx, 1
jne 0x4461c5
cmp word [ebp - 0x810], ax
jne 0x446192
xor ecx, ecx
push ecx
lea eax, [ebp - 0x810]
push eax
mov ecx, ebx
call fcn.00401d60
mov eax, edi
jmp 0x4462bd
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
jmp 0x4461a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4461a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
mov ecx, ebx
call fcn.00401d60
mov eax, edi
jmp 0x4462bd
cmp ecx, 2
jne 0x4462b8
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x1030]
call fcn.00401e60
lea edx, [ebp - 0x1030]
lea ecx, [ebp - 0x1048]
mov dword [ebp - 4], 0
call fcn.00445830
cmp dword [eax + 0x14], 8
jb 0x446200
mov eax, dword [eax]
push 0x400
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp - 0x1034], 8
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov dword [ebp - 0x1014], eax
jb 0x446239
push dword [ebp - 0x1048]
call esi
mov eax, dword [ebp - 0x1014]
add esp, 4
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x101c], 8
mov dword [ebp - 0x1034], 7
mov dword [ebp - 0x1038], 0
mov word [ebp - 0x1048], cx
jb 0x446277
push dword [ebp - 0x1030]
call esi
mov eax, dword [ebp - 0x1014]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x101c], 7
mov dword [ebp - 0x1020], 0
mov word [ebp - 0x1030], cx
test eax, eax
je 0x4462b1
cmp eax, 0x400
ja 0x4462b1
lea eax, [ebp - 0x1010]
push eax
mov ecx, ebx
call fcn.004037a0
mov eax, edi
jmp 0x4462bd
mov eax, 0xea
jmp 0x4462bd
mov eax, 0x3f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret 8
Function at 0x4464a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x4465b0
cmp dword [esi + 4], 0
jl 0x4465b0
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
sar eax, 1
lea ebx, [esi + 0x2c]
lea eax, [eax*2 - 2]
mov dword [ebx], eax
mov eax, dword [esi + 0x20]
xor ecx, ecx
cmp eax, dword [esi + 0x24]
push ebx
cmove eax, ecx
push eax
lea ecx, [esi + 0x30]
push ecx
lea eax, [ebp - 8]
push 0
push eax
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
call fcn.00445720
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x44658b
mov ecx, dword [ebx]
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x20]
inc ecx
shr ecx, 1
inc ecx
sar eax, 1
cmp ecx, eax
jbe 0x44653d
lea eax, [ebp - 0xc]
push eax
push ecx
lea ecx, [esi + 0x20]
mov dword [ebp - 0xc], 0
call fcn.004465e0
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x20]
mov ecx, dword [ebp - 0x10]
sar eax, 1
cmp dword [ebp - 8], ecx
lea eax, [eax*2 - 2]
mov dword [ebx], eax
mov eax, 0x4000
cmove ecx, eax
mov eax, dword [esi + 0x20]
xor edx, edx
cmp eax, dword [esi + 0x24]
push ebx
cmove eax, edx
push eax
lea eax, [esi + 0x30]
push eax
push edx
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, ecx
push eax
lea ecx, [esi + 8]
call fcn.00445720
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4465b0
mov ecx, dword [ebx]
mov eax, dword [esi + 0x20]
inc ecx
shr ecx, 1
pop edi
xor edx, edx
pop esi
mov word [eax + ecx*2], dx
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x4465bb
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [esi + 0x20]
pop edi
mov word [eax], cx
mov dword [esi + 0x2c], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret

Function at 0x4467b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
sub edx, edi
sar edx, 1
mov esi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x4467e1
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
xor esi, eax
inc ecx
imul esi, esi, 0x1000193
cmp ecx, edx
jb 0x4467d0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x448e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485f1e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c33d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00447380
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00447380
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x448f44
test dl, 0x10
jne 0x448f44
mov eax, 1
jmp 0x448f46
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.00449020
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x450900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 8
mov edi, edx
jb 0x450917
mov eax, dword [esi]
jmp 0x450919
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
cmp eax, 1
jne 0x450944
test edi, edi
je 0x45093b
cmp edi, esi
je 0x45093b
push 0xffffffffffffffff
push 0
push esi
mov ecx, edi
call fcn.004019d0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str..exe
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.0040e140
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x45095e
mov eax, dword [eax]
push eax
call ebx
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
cmp eax, 1
sete al
cmp dword [ebp - 8], 8
mov byte [ebp - 1], al
jb 0x450981
push dword [ebp - 0x1c]
call ebx
mov al, byte [ebp - 1]
add esp, 4
test al, al
je 0x4509ba
test edi, edi
je 0x4509b1
push str..exe
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.0040e140
add esp, 4
mov ecx, edi
push eax
call fcn.00408f10
cmp dword [ebp - 8], 8
jb 0x4509b1
push dword [ebp - 0x1c]
call ebx
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4512f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x451315
mov esi, dword [edi]
jmp 0x451317
mov esi, edi
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x451338
mov edi, eax
movzx eax, byte [esi + ecx]
xor edx, eax
inc ecx
imul edx, edx, 0x1000193
cmp ecx, edi
jb 0x451324
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0x14]
mov ecx, esi
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x45134d
shr esi, 1
or eax, 0xffffffff
sub eax, esi
add ecx, eax
mov esi, dword [ebx + 8]
shl ecx, 3
mov dword [ebp - 8], ecx
mov esi, dword [ecx + esi]
lea esp, [esp]
add ecx, dword [ebx + 8]
mov eax, dword [ebx]
cmp dword [ecx], eax
je 0x45136e
mov eax, dword [ecx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x4513cb
cmp dword [edi + 0x14], 8
lea ecx, [esi + 8]
jb 0x45137f
mov eax, dword [edi]
jmp 0x451381
mov eax, edi
push dword [edi + 0x10]
push eax
push dword [ecx + 0x10]
push ecx
call fcn.0041a6e0
test eax, eax
je 0x451399
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
jmp 0x451360
cmp dword [esi + 0x1c], 8
mov ecx, dword [esi + 0x18]
lea eax, [esi + 8]
jb 0x4513a7
mov eax, dword [eax]
push ecx
push eax
push dword [edi + 0x10]
push ecx
mov ecx, edi
call fcn.0041a6e0
lea ecx, [ebp - 8]
test eax, eax
je 0x4513c4
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov ecx, dword [ecx]
jmp 0x4513cd
mov dword [ebp - 8], esi
mov ecx, dword [ecx]
jmp 0x4513cd
mov ecx, dword [ebx]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret 8
Function at 0x454aa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486f78
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
lea edx, [ebp - 0x30]
mov dword [ebp - 4], eax
call fcn.00454c50
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
test al, al
je 0x454afe
cmp dword [ebp - 0x20], 0
jne 0x454b4d
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.004558c0
cmp byte [ebp - 0x18], 0
je 0x454b1b
lea ecx, [ebp - 0x14]
call fcn.00455760
lea edx, [ebp - 0x30]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00454c50
test al, al
je 0x454c0c
cmp dword [ebp - 0x20], 0
je 0x454c0c
mov byte [ebp - 4], 0
cmp byte [ebp - 0x18], 0
je 0x454b4d
lea ecx, [ebp - 0x14]
call fcn.00455810
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x64]
call fcn.004509d0
mov edi, eax
lea eax, [ebp - 0x30]
cmp eax, edi
je 0x454b8c
cmp dword [ebp - 0x1c], 8
jb 0x454b6f
push dword [ebp - 0x30]
call esi
add esp, 4
xor eax, eax
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
call fcn.0040bcc0
cmp dword [ebp - 0x50], 8
jb 0x454b9a
push dword [ebp - 0x64]
call esi
add esp, 4
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
push eax
mov dword [ebp - 0x34], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
lea ecx, [ebp - 0x4c]
push dword [edi]
call fcn.00401e60
mov edx, ebx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00450c70
push edi
test al, al
jne 0x454be0
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor bl, bl
jmp 0x454be8
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov bl, 1
cmp dword [ebp - 0x38], 8
jb 0x454bf6
push dword [ebp - 0x4c]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
jmp 0x454c20
mov byte [ebp - 4], 0
cmp byte [ebp - 0x18], 0
je 0x454c1e
lea ecx, [ebp - 0x14]
call fcn.00455810
xor bl, bl
cmp dword [ebp - 0x1c], 8
jb 0x454c2e
push dword [ebp - 0x30]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
Function at 0x454eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp dword [ebx + 0x14], 8
mov eax, ecx
push edi
mov edi, dword [ebx + 0x10]
mov dword [ebp - 8], eax
jb 0x454ed8
mov esi, dword [ebx]
jmp 0x454eda
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x454ef9
movzx eax, byte [ecx + esi]
xor edx, eax
inc ecx
imul edx, edx, 0x1000193
cmp ecx, edi
jb 0x454ee5
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x14]
mov ecx, esi
and ecx, edx
mov edx, dword [ebp - 8]
cmp dword [edx + 0x18], ecx
ja 0x454f11
shr esi, 1
or eax, 0xffffffff
sub eax, esi
add ecx, eax
mov esi, dword [edx + 8]
lea edi, [ecx*8]
mov esi, dword [edi + esi]
mov edi, edi
mov ecx, dword [edx + 8]
mov eax, dword [edx]
cmp dword [ecx + edi], eax
je 0x454f30
mov eax, dword [ecx + edi + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x455004
cmp dword [ebx + 0x14], 8
lea ecx, [esi + 8]
jb 0x454f45
mov eax, dword [ebx]
jmp 0x454f47
mov eax, ebx
push dword [ebx + 0x10]
push eax
push dword [ecx + 0x10]
push ecx
call fcn.0041a6e0
mov edx, dword [ebp - 8]
test eax, eax
je 0x454f5f
mov esi, dword [esi]
jmp 0x454f20
mov eax, dword [edx + 8]
mov ecx, esi
add eax, edi
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx]
mov dword [ebp - 0x14], eax
mov edi, edi
cmp dword [eax], ecx
jne 0x454f78
mov eax, ecx
jmp 0x454f7d
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x454ff2
cmp dword [esi + 0x1c], 8
mov eax, dword [esi + 0x18]
lea edx, [esi + 8]
mov dword [ebp - 0xc], eax
jb 0x454f92
mov edx, dword [edx]
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], eax
jb 0x454fa2
mov edi, dword [ebx]
jmp 0x454fa4
mov edi, ebx
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
cmovb ebx, eax
test ebx, ebx
jne 0x454fd3
xor eax, eax
test eax, eax
jne 0x454ff2
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
cmp edx, ebx
jb 0x454ff2
cmp edx, ebx
setne al
test eax, eax
jne 0x454ff2
mov esi, dword [esi]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
jmp 0x454f70
mov ax, word [edi]
cmp ax, word [edx]
jne 0x454fe4
add edi, 2
add edx, 2
dec ebx
jmp 0x454fae
movzx eax, word [edi]
cmp ax, word [edx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x454fb2
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x455001
mov eax, dword [ebp + 8]
mov dword [eax + 4], esi
jmp 0x45500c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret 8
Function at 0x455950
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x45596e
mov eax, dword [esi]
jmp 0x455970
mov eax, esi
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x455991
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
push edi
push 1
push ebx
call dword [sym.imp.MSVCR110.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
je 0x455a62
cmp dword [esi + 0x14], 8
jb 0x4559b0
mov esi, dword [esi]
push edi
push ebx
push dword [ebp - 8]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x455a58
mov ebx, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push edi
mov dword [ebp - 0x14], 0
call ebx
test eax, eax
je 0x455a58
cmp dword [ebp - 0x14], 0
je 0x455a58
push 0x10
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x455a43
lea edx, [esi + 0xc]
mov dword [esi], 0
mov dword [edx], 0
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi + 4], eax
lea eax, [ebp - 0x10]
push eax
push edx
push 0x491ab4
push edi
mov dword [esi], edi
mov dword [esi + 8], ecx
mov dword [edx], 0
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret
Function at 0x455aa0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4c33d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, ecx
mov dword [ebp - 0x228], eax
movzx eax, word [edi + 4]
mov word [ebp - 0x224], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x222], ax
call esi
mov word [ebp - 0x220], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x21e], ax
movzx eax, word [edi + 4]
mov ebx, 0x4e4
mov word [ebp - 0x21c], ax
mov word [ebp - 0x21a], bx
call esi
mov word [ebp - 0x216], bx
mov ebx, dword [sym.imp.MSVCR110.dll__snwprintf_s]
mov word [ebp - 0x218], ax
xor esi, esi
movzx eax, word [ebp + esi*2 - 0x222]
movzx ecx, word [ebp + esi*2 - 0x224]
push 0x4a316c
push eax
push ecx
push str.StringFileInfo_04x_04x_ls
push 0x104
lea eax, [ebp - 0x20c]
push 0x104
push eax
add esi, 2
call ebx
add esp, 0x1c
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [edi]
mov dword [ebp - 0x214], 0
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x455b8a
mov edx, dword [ebp - 0x214]
test edx, edx
jne 0x455ba4
cmp esi, 8
jl 0x455b20
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret 8
cmp word [edx], 0
jne 0x455bce
mov ecx, dword [ebp - 0x228]
xor eax, eax
push eax
push edx
call fcn.00401d60
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd06
mov esp, ebp
pop ebp
ret 8
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x455bd3
mov ecx, dword [ebp - 0x228]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.00401d60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0047cd06
mov esp, ebp
pop ebp
ret 8