joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0xfe
push eax
lea ecx, [ebp - 0x102]
push ecx
mov word [ebp - 0x104], ax
call fcn.00427b00
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
push 0
push 0
push 1
push 0
call esi
mov dword [edi + 4], eax
test eax, eax
jne 0x406721
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x406712
test eax, eax
jg 0x406701
mov esi, eax
jmp 0x40684f
and eax, 0xffff
or eax, 0xa0070000
mov esi, eax
jmp 0x40684f
test eax, eax
jg 0x40687d
mov esi, eax
jmp 0x40684f
push 0
push 0
push 1
push 0
call esi
mov dword [edi + 8], eax
test eax, eax
je 0x4066e9
mov edx, dword [edi + 0x34]
push edx
push str.EC7958E2DA87
push str.Global_ws__08X
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004266d6
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
push 0
push 1
push 0
call esi
mov dword [edi + 0xc], eax
test eax, eax
je 0x4066e9
mov edx, dword [edi + 0x34]
push edx
push str.79D469D3016B
push str.Global_ws__08X
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004266d6
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
push 0
push 1
push 0
call esi
mov dword [edi + 0x10], eax
test eax, eax
je 0x4066e9
mov edx, dword [edi + 0x34]
push edx
push str.0F83D85D15FE
push str.Global_ws__08X
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004266d6
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0
push 0
call esi
mov dword [edi + 0x14], eax
test eax, eax
je 0x4066e9
push str.C465B7B6_1460_42d1_BACD_3B221F33F532
push 0
push 1
push 0
call esi
mov dword [edi + 0x18], eax
test eax, eax
je 0x4066e9
push str.5DF82EFD_5306_4b45_BAF2_4EFB1505F321
push 0
push 1
push 0
call esi
mov dword [edi + 0x1c], eax
test eax, eax
je 0x4066e9
push 0
push 0
push edi
push 0x406980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
test eax, eax
je 0x4066e9
mov edx, dword [edi + 8]
push 0x7530
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80070102
cmp dword [edi + 0x2c], 0
jne 0x40686c
test esi, esi
jge 0x40686c
mov eax, dword [edi + 0x28]
push 0
push 0
push 0x466
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004265ea
mov esp, ebp
pop ebp
ret
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x40684f
Function at 0x406890
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esi + 0x2c], 1
jne 0x406925
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4068af
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x20], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
push 0x406dc0
push 0xd
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x4068e5
push eax
push eax
mov eax, dword [esi + 0x28]
push 0x466
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4068fa
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x24], 0
push 0
push 0
call edi
push eax
push 0x406f60
push 0xd
call ebx
pop edi
mov dword [esi + 0x24], eax
pop ebx
test eax, eax
jne 0x40692f
mov ecx, dword [esi + 0x28]
push eax
push eax
push 0x466
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
ret
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
ret

Function at 0x406930
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esi + 0x2c], 1
jne 0x40697b
mov eax, dword [esi + 0x24]
test eax, eax
je 0x40694b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x24], 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x406f60
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x40697b
push eax
push eax
mov eax, dword [esi + 0x28]
push 0x466
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
ret

Function at 0x407260
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [esi + 0x3c], 0
jne 0x4072b4
push ebx
push edi
call fcn.0042bbc1
cdq
mov ecx, 0x3a
idiv ecx
push 2
mov al, byte [edx + 0x4d0bbc]
movzx edx, al
push edx
mov byte [esi + 0x3c], al
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
mov byte [ebp - 4], al
movzx eax, byte [esi + 0x3c]
mov edi, dword [ebp - 4]
push 0
push edi
push eax
call ebx
movzx ecx, byte [esi + 0x3c]
push 0
push 2
push edi
push ecx
call ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408600
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
cmp dword [0x4d437c], esi
jne 0x40863e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x408634
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4d4378], eax
mov dword [0x4d437c], 1
mov eax, dword [0x4d4378]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40865a
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x408696
mov edx, dword [ebp + 8]
mov eax, dword [edx]
test eax, eax
jne 0x408689
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x408678
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
call ecx
jmp 0x408680
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
push edx
call eax
test eax, eax
je 0x408696
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
push edx
push eax
call edi
pop edi
pop esi
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4087d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e70e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4ce540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea esi, [edi + 0x4d8]
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], ax
mov dword [ebp - 4], ebx
mov dword [edi + 0x510], 1
mov dword [edi + 0x514], ebx
mov dword [edi + 0x518], ebx
mov dword [edi + 0x51c], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov eax, 0xffffff
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], eax
push ebx
mov eax, 0x4c664c
mov dword [edi + 0x18], ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0xa0], 1
mov dword [edi + 0xa4], 0xd9d9d9
mov dword [edi + 0xa8], 0xfe904d
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
mov dword [edi + 0xbc], ebx
mov dword [edi + 0x4d0], ebx
mov dword [edi + 0x4d4], ebx
call fcn.0040c1a0
push 0x80
lea ecx, [edi + 0x560]
push ebx
push ecx
mov dword [edi + 0x4f4], ebx
mov dword [edi + 0x4f8], 8
mov dword [edi + 0x4fc], ebx
mov dword [edi + 0x500], ebx
mov dword [edi + 0x558], ebx
mov dword [edi + 0x504], ebx
mov dword [edi + 0x508], ebx
mov dword [edi + 0x50c], ebx
mov dword [edi + 0x528], 1
mov dword [edi + 0x53c], ebx
mov dword [edi + 0x540], ebx
mov dword [edi + 0x544], ebx
call fcn.00427b00
mov dword [edi + 0x5e0], ebx
mov dword [edi + 0x5e4], ebx
mov dword [edi + 0x5e8], ebx
mov dword [edi + 0x5ec], ebx
mov dword [edi + 0x52c], ebx
mov dword [edi + 0x530], ebx
mov dword [edi + 0x534], ebx
mov dword [edi + 0x54c], ebx
mov dword [edi + 0x550], ebx
add esp, 0xc
mov dword [edi + 0x554], ebx
cmp dword [edi + 0x528], ebx
jne 0x4089dd
push ebx
lea eax, [edi + 0x510]
push eax
lea edx, [edi + 0x520]
push edx
call sub.gdiplus.dll_GdiplusStartup
push 0x30
lea esi, [edi + 0x5c]
push ebx
push esi
mov dword [edi + 0x524], ebx
call fcn.00427b00
mov eax, dword [edi + 4]
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
lea eax, [edi + 0x2c8]
add esp, 0xc
mov dword [esi], 0x30
mov dword [edi + 0x60], 0xb1
mov dword [edi + 0x80], eax
mov dword [edi + 0x8c], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408e60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x30e]
push ecx
mov word [ebp - 0x310], ax
call fcn.00427b00
add esp, 0xc
xor edx, edx
push 0x7e
push edx
lea eax, [ebp - 0x106]
push eax
mov word [ebp - 0x108], dx
call fcn.00427b00
add esp, 0xc
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x86]
push edx
mov word [ebp - 0x88], cx
call fcn.00427b00
mov ecx, dword [0x4d42ec]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x310]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x408f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x408f76
test eax, eax
jle 0x408f12
and eax, 0xffff
or eax, 0xa0070000
mov esi, eax
test esi, esi
jge 0x408f64
mov edx, dword [0x4d42ec]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
lea ecx, [ebp - 0x108]
push ecx
push 0xce
push edx
call edi
mov ecx, dword [0x4d42ec]
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0xcf
push ecx
call edi
push 0x30
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x88]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
test eax, eax
jle 0x408f12
and eax, 0xffff
or eax, 0x80070000
jmp 0x408f12
lea eax, [ebp - 0x310]
push eax
call fcn.0041a830
mov esi, eax
add esp, 4
test esi, esi
jl 0x408f18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004265ea
mov esp, ebp
pop ebp
ret
Function at 0x4099c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov byte [ebp - 0x44], 0
call fcn.00427b00
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
ja 0x409a41
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x409a21
test eax, eax
jle 0x409ac2
and eax, 0xffff
or eax, 0xa0070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
test eax, eax
jle 0x409ac2
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push esi
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
test eax, eax
jne 0x409a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x409a8a
test eax, eax
jle 0x409a6b
and eax, 0xffff
or eax, 0xa0070000
lea edx, [ebp - 0x44]
push edx
mov esi, eax
call fcn.00427598
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
test eax, eax
jle 0x409a6b
and eax, 0xffff
or eax, 0x80070000
jmp 0x409a6b
lea eax, [ebp - 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409aa0
sub eax, edx
push edi
mov edi, eax
push edi
call fcn.004261ca
mov esi, eax
add esp, 4
test esi, esi
jne 0x409ad0
pop edi
mov eax, 0x8007000e
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push edi
push 0
push esi
call fcn.00427b00
lea eax, [edi - 1]
push eax
lea ecx, [ebp - 0x44]
push ecx
push eax
push esi
call fcn.004275d5
mov ecx, dword [ebp - 4]
add esp, 0x1c
pop edi
mov dword [ebx], esi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004265ea
mov esp, ebp
pop ebp
ret

Function at 0x40ac90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x508]
push esi
lea esi, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00416a30
mov eax, dword [ebp - 4]
cmp eax, 8
jne 0x40acd5
mov eax, dword [edi + 0x50c]
mov esi, dword [eax + 0x28]
call fcn.00417e20
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40ad36
test esi, esi
jbe 0x40ad36
test eax, eax
jl 0x40ad36
push 0
push 3
jmp 0x40ad2a
cmp eax, 0xd
jne 0x40ad00
mov eax, dword [edi + 4]
push 0
push 2
push 0x469
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [edi + 0x508]
mov edx, dword [ecx]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40ad36
lea esi, [ebp - 4]
mov eax, edi
call fcn.0040b4b0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40ad36
test eax, eax
jl 0x40ad1b
push 0
push 3
jmp 0x40ad2a
test ecx, ecx
je 0x40ad36
cmp eax, 0xe0010008
je 0x40ad36
push 0
push 4
push 0x469
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [edi + 0x528], 0
jne 0x40ad57
mov eax, dword [edi + 4]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b8f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, eax
cmp dword [esi + 0x9c], 0
jne 0x40b9b4
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x40b981
cmp dword [esi + 0x10], 1
jne 0x40b981
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
cmp eax, 1
jne 0x40b981
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x40b93b
call fcn.00408ae0
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x40b9b4
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp dword [esi + 0x2c], eax
jne 0x40b965
cmp dword [esi + 0x30], ecx
je 0x40b9b4
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
call fcn.00408c00
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x40b9b4
lea edx, [esi + 0x5c]
push edx
push 0
push 0x433
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x8c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x8c], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40bdb0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [edi + 0x528], 0
push esi
jne 0x40be12
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
cmp eax, 1
jne 0x40be12
cmp dword [edi + 0x14], eax
jne 0x40be08
mov eax, dword [edi + 0x508]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x40bdf5
mov edx, dword [edi + 0x508]
mov eax, dword [edx]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0x508]
lea esi, [edi + 0x4c]
call fcn.00415d50
pop esi
ret
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
ret
Function at 0x40d940
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x4c]
xor al, al
cmp ecx, 0xffffffff
je 0x40dab5
cmp ecx, 0x7c
je 0x40dab5
xor esi, esi
cmp ecx, 0x29
jne 0x40d985
cmp dword [edi + 0x1c], esi
jne 0x40dab5
mov eax, 0x10000000
test dword [edi + 0x50], eax
jne 0x40d98a
push 5
call fcn.0049428d
add esp, 4
jmp 0x40daa0
mov eax, 0x10000000
cmp ecx, 0x2e
jne 0x40d9e8
push 0x14
call fcn.00427859
add esp, 4
cmp eax, esi
je 0x40d9b5
mov dword [eax], vtable.std::tr1::_Node_base.0
mov dword [eax + 4], 5
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
jmp 0x40d9b7
xor eax, eax
mov ecx, dword [edi + 0x28]
mov dword [eax + 0x10], ecx
mov edx, dword [edi + 0x28]
mov ecx, dword [edx + 0xc]
cmp ecx, esi
je 0x40d9d3
mov dword [eax + 0xc], ecx
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx + 0xc]
mov dword [edx + 0x10], eax
mov ecx, dword [edi + 0x28]
mov dword [ecx + 0xc], eax
mov dword [edi + 0x28], eax
mov eax, edi
call fcn.0040d890
jmp 0x40daa0
cmp ecx, 0x5c
jne 0x40da46
mov eax, edi
call fcn.0040d890
mov eax, dword [edi + 0x50]
and eax, 0x80
je 0x40da18
cmp byte [edi + 0x4a], 0x62
jne 0x40da18
lea esi, [edi + 0x24]
call fcn.0040edb0
mov eax, edi
call fcn.0040d890
jmp 0x40daa7
cmp eax, esi
je 0x40da3d
cmp byte [edi + 0x4a], 0x42
jne 0x40da3d
lea esi, [edi + 0x24]
call fcn.0040edb0
mov eax, dword [edi + 0x28]
or dword [eax + 8], 1
add eax, 8
mov eax, edi
call fcn.0040d890
jmp 0x40daa7
mov eax, edi
call fcn.0040eac0
jmp 0x40daa0
cmp ecx, 0x5b
jne 0x40da70
mov eax, edi
call fcn.0040d890
call fcn.0040ea50
cmp dword [edi + 0x4c], 0x5d
je 0x40da67
push 4
call fcn.0049428d
add esp, 4
mov eax, edi
call fcn.0040d890
jmp 0x40daa0
cmp ecx, 0x28
jne 0x40dab9
mov eax, edi
call fcn.0040d890
mov eax, edi
call fcn.0040eb70
cmp dword [edi + 0x4c], 0x29
mov bl, al
je 0x40da95
push 5
call fcn.0049428d
add esp, 4
mov eax, edi
call fcn.0040d890
test bl, bl
je 0x40daa7
mov eax, edi
call fcn.0040ec20
mov ecx, dword [edi + 0x4c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x40d953
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x5e
jne 0x40dacf
lea esi, [edi + 0x24]
call fcn.0040ed10
mov eax, edi
call fcn.0040d890
jmp 0x40daa7
cmp ecx, 0x24
jne 0x40dae5
lea esi, [edi + 0x24]
call fcn.0040ed60
mov eax, edi
call fcn.0040d890
jmp 0x40daa7
cmp ecx, 0x2a
je 0x40db41
cmp ecx, 0x2b
je 0x40db41
cmp ecx, 0x3f
je 0x40db41
cmp ecx, 0x7b
je 0x40db41
cmp ecx, 0x7d
jne 0x40db0f
test dword [edi + 0x50], eax
jne 0x40db0f
push 6
call fcn.0049428d
add esp, 4
jmp 0x40daa0
cmp ecx, 0x5d
jne 0x40db28
test dword [edi + 0x50], eax
jne 0x40db28
push 4
call fcn.0049428d
add esp, 4
jmp 0x40daa0
movzx edx, byte [edi + 0x4a]
push edx
lea eax, [edi + 0x24]
call fcn.0040ee00
mov eax, edi
call fcn.0040d890
jmp 0x40daa0
push 0xa
call fcn.0049428d
add esp, 4
jmp 0x40daa0
Function at 0x412b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00427b00
push 4
push 0x4c86d4
push esi
call fcn.00436ef4
add esp, 0x18
test eax, eax
jne 0x412bb3
lea edx, [esi + 8]
push edx
push 0x104
lea eax, [ebp - 0x20c]
jmp 0x412c11
push 0xc
push str.SystemRoot_
push esi
call fcn.00436e4e
add esp, 0xc
test eax, eax
jne 0x412c2c
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412be2
sub eax, edx
sar eax, 1
lea ecx, [esi + 0x18]
push ecx
mov edx, 0x104
sub edx, eax
push edx
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0049497a
add esp, 8
add eax, 2
push eax
call fcn.00426e9a
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
push esi
call fcn.00426e9a
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
Function at 0x412c40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x1fe
lea ecx, [ebp - 0x202]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
mov word [ebp - 0x204], ax
call fcn.00427b00
add esp, 0xc
cmp edi, esi
jne 0x412ca4
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push esi
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x412d00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x412cdf
test eax, eax
jle 0x412e62
and eax, 0xffff
or eax, 0xa0070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
test eax, eax
jle 0x412e62
and eax, 0xffff
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push esi
call fcn.004261ca
add esp, 4
mov dword [ebp - 0x20c], eax
test eax, eax
jne 0x412d1d
mov esi, 0x8007000e
jmp 0x412e4d
push esi
push 0
push eax
call fcn.00427b00
mov edx, dword [ebp - 0x20c]
add esp, 0xc
push edx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x412d75
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x412d66
test eax, eax
jg 0x412d55
mov esi, eax
jmp 0x412e4d
and eax, 0xffff
or eax, 0xa0070000
mov esi, eax
jmp 0x412e4d
test eax, eax
jg 0x412e10
mov esi, eax
jmp 0x412e4d
mov esi, dword [ebp - 0x20c]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x210]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x412d3d
mov eax, dword [ebp - 0x210]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04xFileVersion
lea ecx, [ebp - 0x204]
push 0x100
push ecx
call fcn.004266d6
add esp, 0x14
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x412d3d
mov eax, dword [ebp - 0x208]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004261ca
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x412e1e
mov esi, 0x8007000e
jmp 0x412e4d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x412e4d
mov ecx, dword [ebp - 0x208]
lea edx, [ecx + ecx + 2]
push edx
push 0
push eax
call fcn.00427b00
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x208]
mov edx, dword [ebx]
push eax
inc ecx
push ecx
push edx
call fcn.00426e9a
add esp, 0x18
xor esi, esi
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x412e60
push eax
call fcn.00427598
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004265ea
mov esp, ebp
pop ebp
ret