joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b7f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebx - 0xd7efb3c], eax
into
add byte [bx + si], al
pop edx
push ecx
or ecx, 0x7f99
sub ecx, 0x172db
xor ecx, 0xf564
or ecx, 0x873e
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x43b864
push ebx
push eax
add esp, 4
call 0x43b876
add byte [esp + esi + 0x4f], al
aaa
cmp eax, 0xc4833e3f
add al, 0x81
fldcw word [esi]
add byte [eax], al
xor ebx, 0x5961
call 0x43b892
add byte [edi], bh
xor dh, byte [ebx]
xor cl, byte [ebp + 0x34]
xor al, 0x48
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
invalid
test ebp, edi

Function at 0x43b7f1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebx - 0xd7efb3c], eax
into
add byte [bx + si], al
pop edx
push ecx
or ecx, 0x7f99
sub ecx, 0x172db
xor ecx, 0xf564
or ecx, 0x873e
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x43b864
push ebx
push eax
add esp, 4
call 0x43b876
add byte [esp + esi + 0x4f], al
aaa
cmp eax, 0xc4833e3f
add al, 0x81
fldcw word [esi]
add byte [eax], al
xor ebx, 0x5961
call 0x43b892
add byte [edi], bh
xor dh, byte [ebx]
xor cl, byte [ebp + 0x34]
xor al, 0x48
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
invalid
test ebp, edi

Function at 0x43b876
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebx - 0xd7efb3c], eax
into
add byte [bx + si], al
pop edx
push ecx
or ecx, 0x7f99
sub ecx, 0x172db
xor ecx, 0xf564
or ecx, 0x873e
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x43b864
push ebx
push eax
add esp, 4
call 0x43b876
add byte [esp + esi + 0x4f], al
aaa
cmp eax, 0xc4833e3f
add al, 0x81
fldcw word [esi]
add byte [eax], al
xor ebx, 0x5961
call 0x43b892
add byte [edi], bh
xor dh, byte [ebx]
xor cl, byte [ebp + 0x34]
xor al, 0x48
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
invalid
test ebp, edi

Function at 0x43b892
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebx - 0xd7efb3c], eax
into
add byte [bx + si], al
pop edx
push ecx
or ecx, 0x7f99
sub ecx, 0x172db
xor ecx, 0xf564
or ecx, 0x873e
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x43b864
push ebx
push eax
add esp, 4
call 0x43b876
add byte [esp + esi + 0x4f], al
aaa
cmp eax, 0xc4833e3f
add al, 0x81
fldcw word [esi]
add byte [eax], al
xor ebx, 0x5961
call 0x43b892
add byte [edi], bh
xor dh, byte [ebx]
xor cl, byte [ebp + 0x34]
xor al, 0x48
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
invalid
test ebp, edi

Function at 0x43b8c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ebx
jmp 0x43b8f4
call 0x43b900
add byte [esi], dh
cmp dword [ebx + 0x3d], ecx
inc ecx
xor eax, 0x5b04c483
push esi
push edi
add esp, 4
sub esi, 0x71d9
or esi, 0x17ee9
add esi, 0x53d7
pop esi
invalid
imul eax, dword [eax], 0
Function at 0x43b900
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ebx
jmp 0x43b8f4
call 0x43b900
add byte [esi], dh
cmp dword [ebx + 0x3d], ecx
inc ecx
xor eax, 0x5b04c483
push esi
push edi
add esp, 4
sub esi, 0x71d9
or esi, 0x17ee9
add esi, 0x53d7
pop esi
invalid
imul eax, dword [eax], 0
Function at 0x457df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x457e60
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x49c080]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x49c080]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x49c080]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x49c080]
sub ebx, 1
jne 0x457e07
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4596b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, edi
test edi, edi
jle 0x459777
test esi, esi
je 0x459777
push ebx
mov ebx, edi
sar edi, 2
and ebx, 3
test edi, edi
jle 0x4596f9
movzx ecx, word [esi]
dec edi
movzx edx, word [esi + 2]
add eax, ecx
mov ecx, eax
add esi, 4
shl ecx, 5
xor edx, ecx
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test edi, edi
jg 0x4596d5
sub ebx, 1
je 0x459735
sub ebx, 1
je 0x459722
sub ebx, 1
jne 0x459747
movzx ecx, word [esi]
add eax, ecx
movsx ecx, byte [esi + 2]
shl ecx, 2
xor ecx, eax
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x459745
movzx ecx, word [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x459745
movsx ecx, byte [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [eax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
pop ebx
shr ecx, 6
pop edi
add eax, ecx
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x45a920
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x168], 0
mov dword [ecx + 0x170], 0
mov dword [ecx + 0x174], 0
mov dword [ecx + 0x14], 0x67452301
mov dword [ecx + 0x18], 0xefcdab89
mov dword [ecx + 0x1c], 0x98badcfe
mov dword [ecx + 0x20], 0x10325476
mov dword [ecx + 0x24], 0xc3d2e1f0
ret
Function at 0x45a990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, ecx
test eax, eax
je 0x45ab3d
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
nop dword [eax]
mov ecx, dword [edx + 0x168]
dec eax
mov dword [ebp + 0xc], eax
mov al, byte [ebx]
inc ebx
mov dword [ebp + 8], ebx
mov byte [ecx + edx + 0x28], al
inc dword [edx + 0x168]
cmp dword [edx + 0x168], 0x40
jb 0x45ab21
lea ecx, [edx + 0x28]
mov edi, 0x10
mov esi, ecx
mov eax, dword [esi]
lea esi, [esi + 4]
bswap eax
mov dword [esi - 4], eax
sub edi, 1
jne 0x45a9e1
lea esi, [edi + 0x40]
mov eax, dword [ecx + 0x34]
lea ecx, [ecx + 4]
xor eax, dword [ecx + 0x1c]
xor eax, dword [ecx + 4]
xor eax, dword [ecx - 4]
rol eax, 1
mov dword [ecx + 0x3c], eax
sub esi, 1
jne 0x45a9f3
mov eax, dword [edx + 0x14]
mov dword [edx], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 4], eax
mov eax, dword [edx + 0x1c]
mov ebx, dword [edx + 4]
mov dword [edx + 8], eax
mov eax, dword [edx + 0x20]
mov edi, dword [edx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [edx + 0x24]
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x28
mov eax, dword [edx]
mov dword [ebp - 4], eax
cmp esi, 0x14
jae 0x45aa5d
mov eax, ebx
not eax
and eax, ecx
mov ecx, ebx
and ecx, edi
or eax, ecx
jmp 0x45aa7c
cmp esi, 0x28
jb 0x45aa76
cmp esi, 0x3c
jae 0x45aa76
mov eax, edi
or eax, ecx
mov ecx, edi
and ecx, dword [ebp - 0xc]
and eax, ebx
or eax, ecx
jmp 0x45aa7c
mov eax, ebx
xor eax, edi
xor eax, ecx
cmp esi, 0x14
jae 0x45aa88
mov ecx, 0x5a827999
jmp 0x45aaa5
cmp esi, 0x28
jae 0x45aa94
mov ecx, 0x6ed9eba1
jmp 0x45aaa5
cmp esi, 0x3c
sbb ecx, ecx
and ecx, 0xc4b8fb06
add ecx, 0xca62c1d6
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
add dword [ebp - 8], 4
rol ebx, 5
add ebx, dword [esi + edx]
add ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
add ebx, ecx
mov dword [ebp - 4], ebx
mov ecx, edi
add dword [ebp - 4], eax
inc esi
mov eax, dword [ebp - 0xc]
mov ebx, dword [edx]
mov dword [ebp - 0xc], edi
mov dword [edx + 0xc], edi
mov edi, dword [ebp - 0x14]
ror edi, 2
cmp dword [ebp - 8], 0x168
mov dword [ebp - 0x10], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [edx + 8], edi
mov dword [ebp - 0x14], ebx
mov dword [edx + 4], ebx
mov dword [edx], eax
mov dword [ebp - 0x18], esi
jb 0x45aa45
add dword [edx + 0x14], eax
mov eax, ebx
add dword [edx + 0x18], eax
mov eax, edi
add dword [edx + 0x1c], eax
mov eax, dword [edx + 0xc]
add dword [edx + 0x20], eax
mov eax, dword [edx + 0x10]
add dword [edx + 0x24], eax
mov ebx, dword [ebp + 8]
mov dword [edx + 0x168], 0
add dword [edx + 0x170], 8
mov eax, dword [ebp + 0xc]
adc dword [edx + 0x174], 0
test eax, eax
jne 0x45a9b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45ac80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov edi, 0x10
lea edx, [esi + 0x28]
mov ecx, edx
mov eax, dword [ecx]
lea ecx, [ecx + 4]
bswap eax
mov dword [ecx - 4], eax
sub edi, 1
jne 0x45ac95
lea ecx, [edi + 0x40]
mov eax, dword [edx + 0x34]
lea edx, [edx + 4]
xor eax, dword [edx + 0x1c]
xor eax, dword [edx + 4]
xor eax, dword [edx - 4]
rol eax, 1
mov dword [edx + 0x3c], eax
sub ecx, 1
jne 0x45aca7
mov eax, dword [esi + 0x14]
xor edx, edx
mov dword [esi], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi + 4]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
mov dword [esi + 0x10], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x28
nop dword [eax + eax]
mov eax, dword [esi]
mov dword [ebp - 4], eax
cmp edx, 0x14
jae 0x45ad18
mov eax, ebx
not eax
and eax, ecx
mov ecx, ebx
and ecx, edi
or eax, ecx
jmp 0x45ad37
cmp edx, 0x28
jb 0x45ad31
cmp edx, 0x3c
jae 0x45ad31
mov eax, edi
or eax, ecx
mov ecx, edi
and ecx, dword [ebp - 0xc]
and eax, ebx
or eax, ecx
jmp 0x45ad37
mov eax, ebx
xor eax, edi
xor eax, ecx
cmp edx, 0x14
jae 0x45ad43
mov ecx, 0x5a827999
jmp 0x45ad60
cmp edx, 0x28
jae 0x45ad4f
mov ecx, 0x6ed9eba1
jmp 0x45ad60
cmp edx, 0x3c
sbb ecx, ecx
and ecx, 0xc4b8fb06
add ecx, 0xca62c1d6
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 4]
add dword [ebp - 8], 4
rol ebx, 5
add ebx, dword [edx + esi]
add ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
add ebx, ecx
mov dword [ebp - 4], ebx
mov ecx, edi
add dword [ebp - 4], eax
inc edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [esi]
mov dword [ebp - 0xc], edi
mov dword [esi + 0xc], edi
mov edi, dword [ebp - 0x14]
ror edi, 2
cmp dword [ebp - 8], 0x168
mov dword [ebp - 0x10], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [esi + 8], edi
mov dword [ebp - 0x14], ebx
mov dword [esi + 4], ebx
mov dword [esi], eax
mov dword [ebp - 0x18], edx
jb 0x45ad00
add dword [esi + 0x14], eax
mov eax, ebx
add dword [esi + 0x18], eax
mov eax, edi
add dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
add dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0x24], eax
pop edi
mov dword [esi + 0x168], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b0e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4a00a0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x3c], esi
push dword [ebp + 0xc]
push eax
call fcn.0042ade0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x45b112
mov eax, dword [eax]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp ecx, 8
jb 0x45b134
inc ecx
push ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call fcn.004055d0
test edi, edi
jne 0x45b14c
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00466c90
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
je 0x45b20c
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00466c82
push dword [ebp + 0x10]
mov esi, eax
lea eax, [ebp - 0x20]
push dword [ebp + 0xc]
push eax
call fcn.0042ade0
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x45b188
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x45b1a6
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004055d0
push esi
lea ecx, [ebp - 0x20]
call fcn.00403e60
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0042acc0
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.00407390
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x45b1d8
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.00405140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
cmp eax, 8
jb 0x45b1ff
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004055d0
test esi, esi
je 0x45b20c
push esi
call fcn.00466c8b
add esp, 4
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00466c90
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45b220
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4a00a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
sub esp, 8
cmp dword [eax + 0x14], 0x10
mov edx, esp
jb 0x45b244
mov ecx, dword [eax]
jmp 0x45b246
mov ecx, eax
mov dword [edx], ecx
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0042ade0
mov esi, eax
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x45b264
mov esi, dword [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push dword [ebp + 0xc]
push eax
call fcn.0042ade0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x45b27e
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
mov eax, dword [ebp - 0xc]
setne bl
cmp eax, 8
jb 0x45b2a0
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004055d0
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
cmp ecx, 8
jb 0x45b2c9
inc ecx
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call fcn.004055d0
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00466c90
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45b450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov edx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
push 0xffffffffffffffff
lea esi, [edi + 4]
mov ecx, esi
call fcn.00421750
add esp, 4
test al, al
jne 0x45b4d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x45b4c4
cmp eax, 0x21
je 0x45b4c4
cmp eax, 5
jne 0x45b49d
mov eax, 0x3e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x14], 8
jb 0x45b4a5
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
lea eax, [ecx*2 + 0x3e9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x3ea
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x20], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45b6ca
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4a00a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x45b6ed
mov eax, dword [edi]
jmp 0x45b6ef
mov eax, edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x45b705
and dword [esi + 0x10], eax
jmp 0x45b792
push ebx
call fcn.00466c82
cmp dword [edi + 0x14], 8
pop ecx
mov dword [ebp - 0x58], eax
jb 0x45b717
mov edi, dword [edi]
push eax
push ebx
xor ebx, ebx
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45b78f
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45b78f
cmp dword [ebp - 0x5c], 4
jb 0x45b78f
mov ecx, dword [ebp - 0x60]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x54]
push str.StringFileInfo_04x_04xInternalName
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45b78f
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x45b78f
dec eax
mov ecx, esi
push eax
push dword [ebp - 0x68]
call fcn.0041c000
jmp 0x45b79e
mov dword [esi + 0x10], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466c90
mov esp, ebp
pop ebp
ret
Function at 0x45de28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x4a00a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx ecx, word [ebp + 0xc]
push ebx
mov dword [ebp - 0x20], eax
xor ebx, ebx
and dword [ebp - 0xc], ebx
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x10]
mov edi, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 8], 7
and edi, reloc.OLEAUT32.dll_SafeArrayDestroy
jns 0x45de72
dec edi
or edi, 0xfffffff0
inc edi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push ecx
inc eax
movzx eax, ax
push eax
push 6
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x45df02
push 2
call fcn.00419a10
pop ecx
test al, al
je 0x45dec8
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x29
push str.c:_buildbot_slaveworkdir_reposoperadesktopwindows_rc_l10n_handler_rc_l10n_handler.cc
lea ecx, [ebp - 0xdc]
call fcn.0041a260
add eax, 0x10
push str.Failed_to_find_string
push eax
call fcn.00405690
pop ecx
xor ebx, ebx
pop ecx
inc ebx
test bl, 1
je 0x45ded8
lea ecx, [ebp - 0xdc]
call fcn.0041a290
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00403e30
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404030
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466c90
mov esp, ebp
pop ebp
ret
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x45df50
push 2
call fcn.00419a10
pop ecx
test al, al
je 0x45df48
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x2f
push str.c:_buildbot_slaveworkdir_reposoperadesktopwindows_rc_l10n_handler_rc_l10n_handler.cc
lea ecx, [ebp - 0xdc]
call fcn.0041a260
add eax, 0x10
push str.Failed_to_load_string
push eax
call fcn.00405690
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
jmp 0x45decb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
jne 0x45df9e
push 2
call fcn.00419a10
pop ecx
test al, al
je 0x45df96
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x35
push str.c:_buildbot_slaveworkdir_reposoperadesktopwindows_rc_l10n_handler_rc_l10n_handler.cc
lea ecx, [ebp - 0xdc]
call fcn.0041a260
add eax, 0x10
push str.Failed_to_lock_string
push eax
call fcn.00405690
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
jmp 0x45decb
test edi, edi
jle 0x45dfb0
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub edi, 1
jne 0x45dfa2
movzx eax, word [ecx]
push eax
lea eax, [ecx + 2]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004046b0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
je 0x45ded8
push 0
push ecx
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.0041bdf0
add esp, 0x10
jmp 0x45dee3
Function at 0x45dfe3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4a00a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x48a670
xor edi, edi
push 0x86
push edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push ecx
push ecx
mov dword [ebp - 0x20], eax
mov esi, esp
mov eax, 0x48aba8
push eax
mov dword [esi], eax
call fcn.00401180
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push dword [ebp - 0x20]
push edi
push eax
call fcn.0042afd0
pop ecx
pop ecx
mov ecx, esp
push eax
call fcn.00403c20
push ebx
call fcn.004365d0
add esp, 0x1c
lea ecx, [ebp - 0x1c]
push 0
push 1
call fcn.00404030
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466c90
mov esp, ebp
pop ebp
ret
Function at 0x480152
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047ffcf

Function at 0x4837d9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483473
Function at 0x4016a0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Write file on windows

Disassembly:
mov eax, dword [0x4020cd]
sub esp, 0x2c
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
push edi
je 0x401767
lea eax, [esp + 0x14]
push 0x28
push eax
call fcn.00401c60
mov esi, dword [esp + 0x48]
push esi
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
jne 0x4016ea
push esi
call edi
mov byte [eax + esi - 1], 0
mov edi, dword [esp + 0x4c]
push esi
push str._sgenteert.dll
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401767
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4017b1
test ebp, ebp
jne 0x4017f7
push str.c:_temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push str._sgenteert.dll
push edi
mov ebp, 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, ebx
je 0x40170a
mov edi, dword [esp + 0x40]
mov al, byte [0x4020ca]
test al, al
je 0x40180f
mov ecx, dword [0x4020cd]
push 0x28
add edi, ecx
lea ecx, [esp + 0x18]
push ecx
call fcn.00401c60
mov eax, dword [edi]
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x44]
push edx
push eax
add edi, 4
push ecx
push edi
call fcn.004012b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret 0x10
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
lea ecx, [esp + 0x14]
mov edx, dword [edi]
push ecx
push edx
lea eax, [edi + 4]
push ebp
push eax
call fcn.004012b0
mov edx, dword [edi]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4017f7
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
cmp eax, ecx
jne 0x4017f7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40176b
push str.Cannot_create_gentee.dll_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret 0x10
mov edx, dword [0x4020d1]
mov eax, dword [esp + 0x44]
push edx
push edi
push eax
call fcn.00401cd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret 0x10