joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57f8a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x57faa4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x57faa4
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0054f9f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x57fa79
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x57fa68
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x57fa32
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x57fa2a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0054f9f0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.0057fac0
add esp, 0x18
test eax, eax
je 0x57fa2a
cmp byte [ebp - 0x68], 0
je 0x57f9ec
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x57fa2a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x57fa19
mov al, byte [esi + ecx]
test al, al
je 0x57fa19
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x57fa00
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x57f940
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x57faa4
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.00580a90
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
Function at 0x57fbe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x57fd5f
cmp dword [ebp + 0xc], 0x20
jb 0x57fd5f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.0054f9f0
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x5b7bac
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x57fd5f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x57fc70
sub ecx, edx
cmp ecx, 0x40
jne 0x57fd5f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x57fcac
mov al, byte [esi + ecx]
test al, al
je 0x57fcac
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x57fc96
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x57fce9
mov al, byte [esi + ecx]
test al, al
je 0x57fce9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x57fcd0
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.0054f9f0
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0057fd70
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x57fd5f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00580a90
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
Function at 0x580630
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.0046d5d0
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x58079d
cmp dword [ebp + 0xc], 0
je 0x58079d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00536330
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x580780
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.0054f9f0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x580775
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.0054f9f0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.00581000
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.00580a90
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x58078a
inc esi
cmp esi, 0x10
jl 0x580670
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
Function at 0x5807b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x580898
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0054f9f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x580898
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x580807
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x580898
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x580830
mov eax, dword [0x5ac51c]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x580845
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x580860
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
Function at 0x5808b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.0054f9f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0057fd70
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x58091a
mov al, byte [edi + ecx]
test al, al
je 0x58091a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x580901
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x58093b
inc eax
sub ecx, 1
jne 0x580930
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x580990
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x580985
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x580984
mov bl, byte [edi + ecx]
test bl, bl
je 0x580984
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x580970
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.0054f9f0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x5b7bac
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x580a4a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x580a14
test cl, cl
je 0x580a10
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x580a14
add eax, 2
add esi, 2
test cl, cl
jne 0x5809f4
xor eax, eax
jmp 0x580a19
sbb eax, eax
or eax, 1
test eax, eax
je 0x580a4a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x580a26
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x580a53
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x5b7bac
push str.SoftwareComMaster
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046ca4d
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5be75807
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x46cd597d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x40398b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4039a7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x403996
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x4039dd
cmp dword [ecx], edi
jne 0x4039d5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4039e5
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4039e5
cmp dword [ecx], edi
jne 0x4039e8
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00403e60
push edi
call fcn.004e1bac
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4088c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f216
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5640a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004e1dfa
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004df284
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [0x56e76c]
cmp dword [edi + 0x20], 0
jne 0x417d9b
push 0
push 0
push edi
push 0x4180e0
push 0
push 0
call fcn.00500ca9
add esp, 0x18
mov dword [edi + 0x20], eax
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x24]
call fcn.004181c0
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [edi + 0x1c]
pop edi
pop esi
test eax, eax
je 0x417dc8
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov esp, ebp
pop ebp
ret 4
Function at 0x41c160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5640a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x234], 0
call fcn.004fb2d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x41c1eb
xor ecx, ecx
jmp 0x41c203
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c1f4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402570
push 2
push 0
push esi
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.0040c0b0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41c24b
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402f10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1bb1
mov esp, ebp
pop ebp
ret 4

Function at 0x41daf0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x14], ecx
mov eax, edx
xor bl, bl
push edi
mov dword [ebp - 0xc], eax
cmp dword [ecx + 0x10], esi
je 0x41dc28
cmp dword [eax + 0x10], esi
je 0x41dc28
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.004023f0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
je 0x41dc28
push 0x56d3b8
push eax
call fcn.004e22ca
mov edi, eax
add esp, 8
test edi, edi
je 0x41dc28
mov ecx, dword [ebp - 0xc]
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004023f0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41dc12
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41dc12
mov eax, dword [ebp - 0x10]
push 0x56d3b8
push 0x100
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0xc], ecx
call fcn.004e22ca
mov esi, eax
add esp, 8
test esi, esi
je 0x41dc12
mov ecx, dword [ebp - 0x14]
call fcn.004023f0
push eax
push dword [ebp - 0xc]
push str.StringFileInfo_08lx_s
push 0x80
push esi
call fcn.0041dad0
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41dc10
mov edx, dword [ebp - 0x1c]
cmp word [edx], 0
jne 0x41dbf0
xor ecx, ecx
jmp 0x41dc04
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dbf5
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, 0x56e8a8
call fcn.00402570
mov bl, 1
push edi
call fcn.004e22c5
add esp, 4
test esi, esi
je 0x41dc28
push esi
call fcn.004e22c5
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e7b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x56e7f0], 0
push ebx
push esi
push edi
jne 0x41e81f
push 0x10
call fcn.004e1dfa
add esp, 4
mov esi, eax
mov dword [ebp - 8], esi
mov dword [0x56e7f0], esi
push 0
push 0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 4], 0
jne 0x41e81f
push 0
mov dword [esi + 8], fcn.0046b470
mov dword [esi + 0xc], 0x46b4c0
call fcn.0046b470
add esp, 4
mov dword [esi + 4], eax
mov dword [ebp - 4], 0x56e7f8
nop word [eax + eax]
mov esi, dword [0x56e7f8]
mov ebx, esi
mov edi, dword [0x56e7fc]
add ebx, 1
mov ecx, edi
mov dword [ebp - 8], edi
adc ecx, 0
mov eax, esi
mov edx, edi
mov edi, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov edi, dword [ebp - 8]
cmp eax, esi
jne 0x41e830
cmp edx, edi
jne 0x41e830
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424310
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521ab6
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5640a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x10], 0
je 0x424493
cmp dword [esi + 0x10], 0
jne 0x42439d
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004fb2d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, edi
je 0x42439d
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.00402670
cmp dword [esi + 0x14], 8
mov ecx, dword [esi + 0x10]
jb 0x4243aa
mov eax, dword [esi]
jmp 0x4243ac
mov eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x4243c2
push 1
push 0x53ca10
mov ecx, esi
call fcn.0040c6e0
cmp dword [esi + 0x14], 8
jb 0x4243cc
mov eax, dword [esi]
jmp 0x4243ce
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4243f0
cmp dword [esi + 0x14], 8
jb 0x4243e3
mov eax, dword [esi]
jmp 0x4243e5
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0041de60
add esp, 0xc
lea esi, [ebx + 4]
mov edi, eax
cmp esi, edi
je 0x424444
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x42441d
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402f10
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x424435
mov eax, dword [esi]
jmp 0x424437
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.004032f0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x424462
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402f10
cmp dword [esi + 0x14], 8
jb 0x42446a
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x424493
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x424495
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1bb1
mov esp, ebp
pop ebp
ret 8
Function at 0x4244c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5640a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push edi
mov edi, dword [ebp + 0xc]
push 0x200
push 0
push eax
call fcn.004fb2d0
add esp, 0xc
mov eax, 0x564a34
cmp dword [0x564a48], 8
cmovae eax, dword [0x564a34]
cmp dword [edi + 0x14], 8
jb 0x42450c
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x424514
mov esi, dword [esi]
push eax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0x53dff0
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
pop edi
pop esi
test eax, eax
jne 0x424544
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1bb1
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x204]
push eax
call fcn.00502950
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.004e1bb1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424600
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5640a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x200
push 0
push eax
call fcn.004fb2d0
add esi, 4
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x42463f
mov esi, dword [esi]
cmp dword [ebx + 0x14], 8
jb 0x424647
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x42464f
mov edi, dword [edi]
push esi
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0x53dff0
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x424682
xor edx, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1bb1
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.0050297a
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.004e1bb1
mov esp, ebp
pop ebp
ret 0x10