joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474950
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x587f20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4730db
je 0x47312e
cmp ebx, 0x20
jbe 0x473134
cmp ebx, 0x40
jbe 0x47317a
jmp 0x47321b
test ebx, ebx
je 0x473124
add eax, 0x10
test ax, 0xff0
je 0x473110
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4e8ac0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4e8bc0]
jmp 0x4730f8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4730f8
pxor xmm1, xmmword [0x587f30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x587f30]
pxor xmm2, xmmword [0x587f40]
pxor xmm3, xmmword [0x587f50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x587f30]
pxor xmm2, xmmword [0x587f40]
pxor xmm3, xmmword [0x587f50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x47327a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x587bc8], 0
je 0x47496a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4730a0
jmp fcn.00409f60
Function at 0x474970
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4046bc
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409f60
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.004736a0
jmp 0x404680
cmp byte [0x587bc8], 0
je 0x47498b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4730a0
jmp 0x404680

Function at 0x475830
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x47584a
mov ecx, 0x14
jmp 0x475853
shl ecx, 2
add ecx, 0xe10
mov dword [0x587cec], ecx
ret
Function at 0x490d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490dbe
sub esp, 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
xor eax, eax
jmp 0x490dad
mov dword [esp + 4], edx
mov esi, ebx
and esi, 0xff
xor ecx, esi
shr ebx, 8
mov esi, ebp
shl esi, 0x18
mov dword [esp], esi
mov edi, eax
mov eax, ecx
mov esi, 0x1b3
mul esi
shl ecx, 8
mov esi, dword [esp + 4]
imul esi, esi, 0x1b3
add esi, edx
inc edi
mov edx, edi
mov edi, dword [esp]
or ebx, edi
shr ebp, 8
add esi, ecx
mov ecx, eax
mov eax, edx
mov edx, esi
cmp eax, 8
jl 0x490d67
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
add esp, 8
ret
call fcn.004736a0
jmp fcn.00490d40

Function at 0x490dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x490e2b
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xor eax, eax
jmp 0x490e1d
mov ebp, ebx
and ebp, 0xff
xor ecx, ebp
mov ebp, eax
mov eax, ecx
mov esi, 0x1b3
mov edi, edx
mul esi
shl ecx, 8
imul edi, edi, 0x1b3
add edi, edx
inc ebp
shr ebx, 8
lea edx, [ecx + edi]
mov ecx, eax
mov eax, ebp
cmp eax, 4
jl 0x490df0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
ret
call fcn.004736a0
jmp fcn.00490dd0
Function at 0x4acd30
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ace09
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4acdeb
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4acdeb
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.0047bc50
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
movzx edx, byte [eax + 6]
sub ecx, dword [esp + 8]
test dl, dl
je 0x4acdbd
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004ae8e0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004acae0
jmp 0x4acde7
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004acae0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004ae8e0
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004ae8e0
add esp, 0x10
ret
call fcn.004736a0
jmp fcn.004acd30
Function at 0x4b4ae0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x587cec]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b4b2c
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.004736a0
jmp fcn.004b4ae0
Function at 0x4070db
Capabilities:
Set registry value

Disassembly:
push 0x218
mov eax, 0x50f481
call fcn.004ae2cc
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
jne 0x4070fb
xor eax, eax
jmp 0x407272
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004eec50
add esp, 0xc
call fcn.00407a58
lea ecx, [ebp - 0x219]
test al, al
je 0x407175
call fcn.00406438
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x220]
call fcn.004082cd
push esi
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x219]
call fcn.00405f62
push eax
lea ecx, [ebp - 0x220]
call fcn.004087b6
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.004083a8
jmp 0x407270
call fcn.00406594
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x224]
push eax
push 0x20006
push edi
lea ecx, [ebp - 0x219]
call fcn.00406e96
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407270
call fcn.004077b8
push eax
lea ecx, [ebp - 0x220]
call fcn.00405cab
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x219]
test esi, esi
je 0x4071f6
push esi
push eax
call fcn.00406e28
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004076c3
add esp, 0x10
jmp 0x40720c
push eax
call fcn.00406e5f
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004076c3
add esp, 0xc
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
mov ebx, dword [esi - 0xc]
jle 0x40722d
push ebx
lea ecx, [ebp - 0x220]
call fcn.00407659
mov esi, dword [ebp - 0x220]
lea eax, [ebx + ebx]
push eax
push esi
push 1
push edi
lea ecx, [ebp - 0x219]
call fcn.00406196
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.00407ce0
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.00407cc8
mov eax, edi
call fcn.004ae276
ret

Function at 0x407546
Capabilities:
Delete registry value

Disassembly:
push 0xc
mov eax, 0x50f4b1
call fcn.004ae298
cmp dword [ebp + 8], 0
jne 0x40755f
xor eax, eax
jmp 0x4075e4
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
call fcn.004078b1
pop ecx
pop ecx
test eax, eax
jne 0x407579
inc eax
jmp 0x4075e4
call fcn.00407a58
test al, al
je 0x4075ac
lea ecx, [ebp - 0x10]
call fcn.004082cd
push 1
lea ecx, [ebp + 0xb]
mov dword [ebp - 4], esi
call fcn.00406204
push eax
lea ecx, [ebp - 0x10]
call fcn.00408e31
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004083a8
jmp 0x4075e2
lea eax, [ebp - 0x18]
push eax
push 0x20006
push esi
lea ecx, [ebp + 0xb]
call fcn.00406639
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4075e2
lea ecx, [ebp + 0xb]
call fcn.0040655d
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, esi
call fcn.004ae261
ret
Function at 0x4078b1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x42c
mov eax, 0x50f4ed
call fcn.004ae2cc
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
jne 0x4078d1
xor eax, eax
jmp 0x407a52
xor edi, edi
test ebx, ebx
je 0x4078d9
mov dword [ebx], edi
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004eec50
add esp, 0xc
call fcn.00407a58
lea ecx, [ebp - 0x421]
test al, al
je 0x407950
call fcn.004067b6
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x430]
call fcn.004082cd
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x421]
call fcn.00407043
push eax
lea ecx, [ebp - 0x430]
call fcn.00409145
lea ecx, [ebp - 0x430]
mov edi, eax
call fcn.004083a8
jmp 0x407a50
call fcn.00406a94
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x434]
push eax
push 0x20019
push edi
lea ecx, [ebp - 0x421]
call fcn.004061cd
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407a50
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
push edi
push edi
lea ecx, [ebp - 0x421]
call fcn.00406526
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x434]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407a50
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00405cd4
inc esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], esi
call fcn.00407b22
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.00405cd4
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 2
call fcn.00407b22
push edi
push dword [ebp - 0x428]
lea ecx, [ebp - 0x42c]
call fcn.0040761f
test eax, eax
js 0x407a34
mov edi, esi
test ebx, ebx
je 0x407a34
mov dword [ebx], esi
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.00407cc8
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.00407cc8
mov eax, edi
call fcn.004ae276
ret
Function at 0x40901b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x5552e0], 0
push esi
mov esi, 0x5552e0
jne 0x409042
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push esi
push 2
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [ebp + 8]
push esi
call fcn.00405cd4
mov eax, dword [ebp + 8]
pop esi
leave
ret 4

Function at 0x40c63f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
mov edi, dword [ebx]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x20]
call fcn.0040c9cb
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x40c690
mov edi, dword [edi]
cmp edi, ebx
jne 0x40c657
xor eax, eax
xor edx, edx
jmp 0x40c694
mov eax, dword [edi + 0x10]
cdq
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c699
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [eax + ebx + 0x78]
add esi, ebx
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
add eax, ebx
mov ecx, dword [esi + 0x1c]
add edx, ebx
add ecx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
cmp dword [esi + 0x18], edi
jbe 0x40c704
mov ecx, dword [eax + edi*4]
movzx eax, word [edx + edi*2]
add ecx, ebx
mov edx, dword [ebp - 4]
push dword [ebp + 0x10]
push ecx
mov eax, dword [edx + eax*4]
xor edx, edx
add eax, ebx
mov dword [ebp - 0x10], eax
adc edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
call fcn.00501e5a
pop ecx
pop ecx
test eax, eax
je 0x40c70d
mov eax, dword [ebp - 8]
inc edi
mov edx, dword [ebp - 0xc]
cmp edi, dword [esi + 0x18]
jb 0x40c6cd
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x40c708
Function at 0x411987
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x550548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x20d]
call fcn.00410bda
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004eec50
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411a47
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x411a47
lea ecx, [ebp - 0x20d]
call fcn.004102f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411a47
and dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push 1
call eax
test eax, eax
je 0x411a47
mov dword [edi + 0x3f8], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ae250
leave
ret
Function at 0x414e12
Capabilities:
Get file version info

Disassembly:
push 0x20
mov eax, 0x50fe06
call fcn.004ae298
lea eax, [ebp - 0x14]
xor ebx, ebx
and dword [ebp - 0x14], ebx
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x414fb1
push esi
call fcn.004ae3fd
mov edi, eax
pop ecx
test edi, edi
je 0x414fb1
mov eax, dword [ebp + 8]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x414faa
call fcn.0041508e
mov ebx, dword [ebp + 0xc]
test al, al
je 0x414f5e
call fcn.0041500c
test al, al
jne 0x414f5e
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x414f5e
xor esi, esi
test dword [ebp + 8], 0xfffffffc
mov dword [ebp - 0x1c], esi
jbe 0x414f5e
call fcn.004077b8
push eax
lea ecx, [ebp - 0x18]
call fcn.00405cab
mov ecx, dword [ebp - 0x28]
and dword [ebp - 4], 0
movzx eax, word [ecx + esi*4 + 2]
push eax
movzx eax, word [ecx + esi*4]
push eax
lea eax, [ebp - 0x18]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.004076c3
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
and dword [ebp - 0x24], 0
add esp, 0x10
and dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x414f22
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00407cc8
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
inc esi
shr eax, 2
mov dword [ebp - 0x1c], esi
cmp esi, eax
jb 0x414eb4
jmp 0x414f5e
push dword [ebp - 0x20]
mov ecx, ebx
push dword [ebp - 0x24]
call fcn.00407d54
push 0x2e
push 0x2c
mov ecx, ebx
call fcn.00415170
push 0x20
mov ecx, ebx
call fcn.004150f0
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
mov dword [ebp - 0x10], 1
call fcn.00407cc8
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x414fa7
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x2c]
and dword [ebp - 0x2c], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x519a04
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x414fa7
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
call fcn.004076c3
xor ebx, ebx
add esp, 0x18
inc ebx
jmp 0x414faa
mov ebx, dword [ebp - 0x10]
push edi
call fcn.004ae3c7
pop ecx
mov al, bl
call fcn.004ae261
ret
Function at 0x4163fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004ae3d0
mov eax, dword [0x550548]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x4000
push ebx
push eax
call fcn.004eec50
add esp, 0xc
mov dword [ebp - 0x4008], ebx
test esi, esi
je 0x4164d6
test edi, edi
je 0x4164d6
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4164d6
cmp eax, 0x3fff
ja 0x4164d6
lea ecx, [ebp - 0x4004]
push ecx
push eax
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4164d6
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x519a04
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4164d6
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push ebx
push edi
call fcn.004eec50
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00409e01
xor eax, eax
add esp, 0x28
inc eax
jmp 0x4164d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae250
leave
ret

Function at 0x4165ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x416657
cmp dword [ebp + 0xc], 0
je 0x416657
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x416657
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x416657
and dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x416651
push esi
push dword [ebp + 0xc]
push edi
call fcn.004ee150
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x416651
mov al, 1
jmp 0x416659
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop edi
pop esi
leave
ret
Function at 0x41a349
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x50ffc5
call fcn.004ae33a
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x41a3c6
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x41a3c6
call fcn.004195d1
mov esi, eax
jmp 0x41a49d
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41a3e9
call fcn.004195d1
jmp 0x41a490
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x41a3df
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x41a419
mov esi, 0x8007000e
jmp 0x41a492
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0041944e
jmp 0x41a43f
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x41a412
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x41a3df
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0041a210
mov esi, eax
test edi, edi
je 0x41a49d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x41a4b6
lea ecx, [ebp - 0x418]
call fcn.00419980
mov eax, esi
call fcn.004ae287
ret 0x10
Function at 0x41ade0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x41adf3
push 0xd
pop eax
jmp 0x41ae37
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x41ae06
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x41adfe
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41ae3c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x41ae4e
push 0xd
pop eax
jmp 0x41ae80
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41ae57
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc