joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074fd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100df00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, 0x3d00
je 0x100751f9
test esi, 0x500
je 0x100750e8
test esi, 0x200
jne 0x100751f9
cmp dword [0x100ec560], 0
jne 0x100750d7
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._Common_
call dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
test esi, 0x100
je 0x10075040
push str.HNCHFT80.dll
jmp 0x1007504d
test esi, 0x400
je 0x10075062
push str.HNCHFTCOX70.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.HncFoundation.dll_HncLoadLibrary]
mov dword [0x100ec560], eax
test eax, eax
je 0x100751f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HFTStartDoc
push eax
call esi
push str.HFTTextOutPDF
push dword [0x100ec560]
mov dword [0x100ec550], eax
call esi
push str.HFTEndDoc
push dword [0x100ec560]
mov dword [0x100ec554], eax
call esi
mov ecx, dword [0x100ec550]
mov dword [0x100e9920], eax
test ecx, ecx
je 0x100751e3
cmp dword [0x100ec554], 0
je 0x100751e3
test eax, eax
jne 0x100750dd
jmp 0x100751e3
mov ecx, dword [0x100ec550]
push edi
call ecx
add esp, 4
jmp 0x100751f9
test esi, 0x1800
je 0x10075176
cmp dword [0x100ec560], 0
jne 0x100751f9
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._Common_
call dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
test esi, 0x800
je 0x10075127
push str.HNCHFTCSD60.dll
jmp 0x10075134
test esi, 0x1000
je 0x10075149
push str.ubiTUBE10.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.HncFoundation.dll_HncLoadLibrary]
mov dword [0x100ec560], eax
test eax, eax
je 0x100751f9
push str.HFTTextOutCSD
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100ed9cc], eax
jmp 0x100751df
test esi, 0x2000
je 0x100751f9
cmp dword [0x100ec560], 0
jne 0x100751f9
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._Common_
call dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
push str.HNCHFTEXTP.DLL
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.HncFoundation.dll_HncLoadLibrary]
mov dword [0x100ec560], eax
test eax, eax
je 0x100751f9
push str.HFTTextOutEXT
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100eda40], eax
test eax, eax
jne 0x100751f9
push dword [0x100ec560]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100ec560], 0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100be194
mov esp, ebp
pop ebp
ret
Function at 0x100793e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x674
mov eax, dword [0x100df00c]
xor eax, esp
mov dword [esp + 0x670], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x208
mov dword [esp + 0x18], eax
lea eax, [esp + 0x26c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x470]
push 0x104
push eax
push str._SharedDataTTFAll_
call dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov ecx, str..TTF
test ebx, ebx
mov eax, str..TTC
cmove eax, ecx
push eax
lea eax, [esp + 0x474]
push eax
lea eax, [esp + 0x270]
push str._s_s
push eax
call fcn.100934d0
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100794ff
mov ebx, dword [esp + 0x14]
nop word [eax + eax]
cmp word [esp + 0x44], 0x2e
jne 0x1007949f
test byte [esp + 0x18], 0x10
jne 0x100794d8
xor eax, eax
mov word [esp + 0x268], ax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x474]
push eax
lea eax, [esp + 0x270]
push 0x100c4e30
push eax
call fcn.100934d0
add esp, 0x10
lea eax, [esp + 0x268]
push dword [ebp + 0xc]
push eax
call ebx
lea eax, [esp + 0x18]
push eax
push esi
call edi
cmp eax, 1
je 0x10079490
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10079615
inc ebx
mov ecx, str..TTF
mov dword [esp + 0x10], ebx
cmp ebx, 1
jle 0x10079444
push 0x104
lea eax, [esp + 0x474]
push eax
push str._SharedDataTTF_AppName_
call dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
xor ebx, ebx
mov dword [esp + 0x10], ebx
test ebx, ebx
mov ecx, str..TTF
mov eax, str..TTC
cmove eax, ecx
push eax
lea eax, [esp + 0x474]
push eax
lea eax, [esp + 0x270]
push str._s_s
push eax
call fcn.100934d0
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100795eb
mov ebx, dword [esp + 0x14]
nop dword [eax + eax]
cmp word [esp + 0x44], 0x2e
jne 0x1007958f
test byte [esp + 0x18], 0x10
jne 0x100795c8
xor eax, eax
mov word [esp + 0x268], ax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x474]
push eax
lea eax, [esp + 0x270]
push 0x100c4e30
push eax
call fcn.100934d0
add esp, 0x10
lea eax, [esp + 0x268]
push dword [ebp + 0xc]
push eax
call ebx
lea eax, [esp + 0x18]
push eax
push esi
call edi
cmp eax, 1
je 0x10079580
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10079615
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 1
jle 0x10079530
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x670]
xor ecx, esp
call fcn.100be194
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x67c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100be194
mov esp, ebp
pop ebp
ret 8

Function at 0x10079630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10076920
Function at 0x1007cc90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], edx
push esi
push esi
push esi
mov ebx, ecx
push 0x61656868
push ebx
call dword [sym.imp.GDI32.dll_GetFontData]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007ccc1
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1007ce79
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1007ce79
push edi
push esi
push 0
push 0x61656868
push ebx
call dword [sym.imp.GDI32.dll_GetFontData]
cmp eax, 0xffffffff
je 0x1007ce79
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], esi
test ebx, ebx
jne 0x1007cd09
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
call fcn.10079930
mov edx, dword [ebp - 4]
mov dword [ebx], eax
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 4], ax
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 6], ax
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 5]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 8], ax
movzx ecx, byte [edx + 6]
movzx eax, byte [edx + 7]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0xa], ax
movzx ecx, byte [edx + 8]
movzx eax, byte [edx + 9]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0xc], ax
movzx ecx, byte [edx + 0xa]
movzx eax, byte [edx + 0xb]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0xe], ax
movzx ecx, byte [edx + 0xc]
movzx eax, byte [edx + 0xd]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x10], ax
movzx ecx, byte [edx + 0xe]
movzx eax, byte [edx + 0xf]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x12], ax
movzx ecx, byte [edx + 0x10]
movzx eax, byte [edx + 0x11]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x14], ax
movzx ecx, byte [edx + 0x12]
movzx eax, byte [edx + 0x13]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x16], ax
movzx ecx, byte [edx + 0x14]
movzx eax, byte [edx + 0x15]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x18], ax
movzx ecx, byte [edx + 0x16]
movzx eax, byte [edx + 0x17]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x1a], ax
movzx ecx, byte [edx + 0x18]
movzx eax, byte [edx + 0x19]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x1c], ax
mov edi, 1
movzx ecx, byte [edx + 0x1a]
movzx eax, byte [edx + 0x1b]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x1e], ax
movzx ecx, byte [edx + 0x1c]
movzx eax, byte [edx + 0x1d]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x20], ax
movzx ecx, byte [edx + 0x1e]
movzx eax, byte [edx + 0x1f]
shl cx, 8
or cx, ax
mov word [ebx + 0x22], cx
jmp 0x1007ce7b
xor edi, edi
test esi, esi
je 0x1007ce89
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007cea0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], edx
push esi
push esi
push esi
mov ebx, ecx
push 0x7078616d
push ebx
call dword [sym.imp.GDI32.dll_GetFontData]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007ced1
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1007d05d
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1007d05d
push edi
push esi
push 0
push 0x7078616d
push ebx
call dword [sym.imp.GDI32.dll_GetFontData]
cmp eax, 0xffffffff
je 0x1007d05d
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], esi
test ebx, ebx
jne 0x1007cf19
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
call fcn.10079930
mov edx, dword [ebp - 4]
mov dword [ebx], eax
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 4], ax
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 6], ax
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 5]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 8], ax
movzx ecx, byte [edx + 6]
movzx eax, byte [edx + 7]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0xa], ax
movzx ecx, byte [edx + 8]
movzx eax, byte [edx + 9]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0xc], ax
movzx ecx, byte [edx + 0xa]
movzx eax, byte [edx + 0xb]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0xe], ax
movzx ecx, byte [edx + 0xc]
movzx eax, byte [edx + 0xd]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x10], ax
movzx ecx, byte [edx + 0xe]
movzx eax, byte [edx + 0xf]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x12], ax
movzx ecx, byte [edx + 0x10]
movzx eax, byte [edx + 0x11]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x14], ax
movzx ecx, byte [edx + 0x12]
movzx eax, byte [edx + 0x13]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x16], ax
movzx ecx, byte [edx + 0x14]
movzx eax, byte [edx + 0x15]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x18], ax
movzx ecx, byte [edx + 0x16]
movzx eax, byte [edx + 0x17]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x1a], ax
movzx ecx, byte [edx + 0x18]
movzx eax, byte [edx + 0x19]
shl cx, 8
or cx, ax
movzx eax, cx
mov word [ebx + 0x1c], ax
mov edi, 1
movzx ecx, byte [edx + 0x1a]
movzx eax, byte [edx + 0x1b]
shl cx, 8
or cx, ax
mov word [ebx + 0x1e], cx
jmp 0x1007d05f
xor edi, edi
test esi, esi
je 0x1007d06d
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100aaf50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push 8
push eax
push ecx
mov esi, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, 8
je 0x100aaf75
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
movsx eax, word [ebp - 8]
mov dword [esi], eax
movsx eax, word [ebp - 6]
mov dword [esi + 4], eax
movsx eax, word [ebp - 4]
mov dword [esi + 8], eax
movsx eax, word [ebp - 2]
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100aead0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push 8
push eax
push ecx
mov esi, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, 8
je 0x100aeaf5
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
movsx eax, word [ebp - 8]
mov dword [esi], eax
movsx eax, word [ebp - 6]
mov dword [esi + 4], eax
movsx eax, word [ebp - 4]
mov dword [esi + 8], eax
movsx eax, word [ebp - 2]
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b1b90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bx, dx
test bx, bx
je 0x100b1bbe
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100b1bbd
mov dl, byte [ecx]
lea ecx, [ecx + 1]
mov al, dl
xor al, bl
mov byte [ecx - 1], al
movzx eax, dl
inc ax
add bx, ax
sub esi, 1
jne 0x100b1ba4
pop esi
pop ebx
pop ebp
ret
Function at 0x1003851
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
setne cl
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x1003892
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 2
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10038c5
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x10038cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x10042b4
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100e6a8
call fcn.01007000
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
jne 0x10042da
mov eax, 0x80070057
jmp 0x1004412
mov dword [ebp - 0x14], edi
xor ebx, ebx
inc ebx
test byte [0x1010cc4], bl
jne 0x1004306
or dword [0x1010cc4], ebx
mov dword [ebp - 4], edi
mov dword [0x1010cc0], edi
push 0x100e767
call fcn.01007266
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [0x1010cc0]
cmp eax, edi
jne 0x10043e3
mov dword [ebp - 4], ebx
mov esi, 0x104
push esi
mov ecx, 0x1010cc0
call fcn.0100390d
mov edi, dword [0x1010cc0]
mov dword [ebp - 0x18], edi
or dword [ebp - 4], 0xffffffff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1004356
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1004352
call esi
jmp 0x1004412
call esi
jmp 0x10043cc
mov ecx, esi
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
push ecx
add eax, edi
push eax
call fcn.01004101
test eax, eax
jne 0x1004377
mov eax, 0x80004005
jmp 0x1004412
push 0x10013bc
push esi
push edi
call fcn.01003a97
mov dword [ebp - 0x14], eax
test eax, eax
jl 0x1004412
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], 0xc
and dword [ebp - 0x28], 0
mov dword [ebp - 0x24], ebx
push 0
push 0x80
push 4
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
cmp ecx, 0xffffffff
jne 0x10043e7
test eax, eax
jle 0x1004412
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004412
mov edi, eax
jmp 0x1004391
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebx
je 0x1004401
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80070002
jmp 0x1004412
push 2
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1004423
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100e6ba
call fcn.01007000
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x18]
push eax
call fcn.010042b4
mov edi, eax
cmp edi, ebx
jl 0x1004569
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 4], ebx
mov esi, 0x1000
mov eax, esi
call fcn.01007020
mov dword [ebp - 0x10], esp
mov eax, esp
mov dword [ebp - 0x30], eax
or dword [ebp - 4], 0xffffffff
movzx ecx, word [ebp - 0x20]
push ecx
movzx ecx, word [ebp - 0x22]
push ecx
movzx ecx, word [ebp - 0x24]
push ecx
movzx ecx, word [ebp - 0x26]
push ecx
movzx ecx, word [ebp - 0x2a]
push ecx
movzx ecx, word [ebp - 0x2c]
push ecx
push dword [0x10100b0]
push 0x200
push ebx
lea ecx, [ebp - 0x34]
push ecx
push esi
push eax
call fcn.01003a02
add esp, 0x30
mov edi, eax
cmp edi, ebx
jl 0x1004569
cmp dword [ebp - 0x34], ebx
je 0x10044da
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push esi
push dword [ebp - 0x34]
call fcn.0100362d
mov edi, eax
cmp edi, ebx
jl 0x1004569
push dword [0x10100ac]
push esi
push dword [ebp - 0x30]
call fcn.01003a97
mov edi, eax
cmp edi, ebx
jl 0x1004569
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x30]
call fcn.01003a56
mov edi, eax
cmp edi, ebx
jl 0x1004569
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100453e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100452c
call esi
mov edi, eax
jmp 0x1004569
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x1004569
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x1004569
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea esp, [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004586
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1010100]
xor eax, dword [ebp + 4]
push esi
xor esi, esi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x11c]
push eax
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1004670
push ebx
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, esi
jne 0x10045e6
xor eax, eax
jmp 0x100466e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10045df
push edi
push ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x11c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100465f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x100141c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100465f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x10013f4
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100465f
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x10013ec
call fcn.01004423
add esp, 0xc
test eax, eax
jl 0x100465f
mov dword [ebp - 0x14], 1
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.0100708e
leave
ret
Function at 0x10047d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100e6cf
call fcn.01007000
sub esp, 0x128
mov eax, dword [0x1010100]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x10049b4
cmp dword [ebp + 0xc], ebx
je 0x10049b4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
push dword [0x1010070]
mov edi, 0x104
push edi
lea eax, [ebp - 0x120]
push eax
call fcn.010032e8
mov esi, eax
cmp esi, ebx
jl 0x10049a7
push 0x10015bc
push edi
lea eax, [ebp - 0x120]
push eax
call fcn.01003a97
mov esi, eax
cmp esi, ebx
jl 0x10049a7
push dword [ebp + 8]
push edi
lea eax, [ebp - 0x120]
push eax
call fcn.01003a97
mov esi, eax
cmp esi, ebx
jl 0x10049a7
lea eax, [ebp - 0x120]
push eax
push 0x100157c
call fcn.01004423
pop ecx
pop ecx
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
lea eax, [ebp - 0x120]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x1004919
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 2
jne 0x10048db
push dword [0x1010080]
push 0x1001550
call fcn.01004423
pop ecx
pop ecx
push dword [0x1010080]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100399f
mov esi, eax
jmp 0x10049a7
cmp esi, ebx
jne 0x1004919
inc dword [ebp - 0x1c]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01007020
mov dword [ebp - 0x10], esp
mov edi, esp
mov dword [ebp - 0x124], edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
je 0x1004935
push esi
call fcn.01003f7b
cmp esi, ebx
jle 0x10049a7
and esi, 0xffff
or esi, 0x80070000
jmp 0x10049a7
mov eax, dword [ebp - 0x1c]
mov byte [eax + edi - 1], bl
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100399f
mov esi, eax
cmp esi, ebx
jl 0x10049a7
push dword [ebp + 0xc]
push 0x1001530
call fcn.01004423
pop ecx
pop ecx
jmp 0x10049a7
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10049b9
mov eax, 0x80070057
lea esp, [ebp - 0x140]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp + 4]
call fcn.0100708e
pop edi
pop esi
pop ebx
leave
ret 0xc