joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4192c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
mov eax, 0xb082
mov word [ebp - 0xac], ax
mov ecx, dword [0x55c92c]
mov dword [ebp - 0x10c], ecx
mov edx, dword [0x55c92c]
xor eax, eax
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xbc], 0x3411
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + ecx + 0x5534a]
mov ecx, dword [ebp - 0x10c]
add ecx, 0x6d4c8
and eax, ecx
mov dword [ebp - 0x10c], eax
movzx esi, word [ebp - 0xac]
movzx edi, word [ebp - 0xac]
add edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
sub edi, eax
or esi, edi
movzx edx, byte [ebp - 0x81]
or esi, edx
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
mov ecx, 0x76863
sub ecx, dword [ebp - 0x10c]
and ecx, dword [ebp - 0x10c]
mov esi, ecx
xor edi, edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
mov ebx, eax
xor eax, eax
push 0
push 0
push 0
push 0
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
push 0
push 0
push 0
mov dword [ebp - 0x150], eax
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
mov ecx, dword [ebp - 0x150]
add ecx, eax
xor edx, edx
sub ecx, dword [ebp - 0x70]
sbb edx, dword [ebp - 0x6c]
and ebx, ecx
mov eax, dword [ebp - 0x14c]
and eax, edx
or esi, ebx
or edi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub eax, 0x75625
sub eax, dword [ebp - 0x10c]
sub eax, 0x59ee
xor ecx, ecx
or esi, eax
or edi, ecx
mov edx, dword [ebp - 0x10c]
sub edx, 0x15e54
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x10c], esi
mov ecx, dword [ebp - 0x70]
add ecx, 0x6f97f
mov edx, dword [ebp - 0x6c]
adc edx, 0
and ecx, 0x47828
and edx, 0
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
add eax, 0x64dd9
xor esi, esi
or ecx, eax
or edx, esi
mov dword [ebp - 0x10c], ecx
mov esi, dword [ebp - 0x10c]
xor esi, 0xf9d3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
movzx ecx, word [ebp - 0xac]
add eax, ecx
or esi, eax
mov dword [ebp - 0x10c], esi
mov edx, 0x9ba3
mov word [ebp - 0xac], dx
mov al, byte [ebp - 0x81]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x419480
Capabilities:
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
mov dword [ebp - 0x10c], 0x71f46
mov dword [ebp - 0xbc], 0x33870
mov ax, word [0x55c92c]
mov word [ebp - 0xac], ax
movzx ecx, word [0x55c970]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x88], 0
movzx edx, byte [0x55c8eb]
mov dword [ebp - 0x14], edx
mov eax, dword [0x55c92c]
mov dword [ebp - 0xf4], eax
mov esi, dword [ebp - 0x10c]
add esi, 0x500d2
and esi, 0x479f1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
sub eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
add eax, ecx
or esi, eax
mov dword [ebp - 0x10c], esi
cmp dword [ebp - 0x10c], 0x71f1
je 0x419549
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
movzx edx, byte [ebp - 0x81]
cmp eax, edx
je 0x419549
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
test eax, eax
jne 0x419598
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x10c]
jne 0x419598
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
movzx ecx, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0x42476]
sub edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea edx, [edx + eax + 0xa7802]
movzx eax, word [ebp - 0xac]
mov ecx, dword [ebp - 0x10c]
lea ecx, [eax + ecx + 0x2c424]
shl edx, cl
mov dword [ebp - 0x10c], edx
jmp 0x4195fd
mov esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
or esi, 0x53282
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
movzx edx, byte [ebp - 0x81]
add eax, edx
and eax, 0x1ce33
or esi, eax
movzx eax, byte [ebp - 0x81]
add eax, dword [ebp - 0x10c]
or esi, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x1e13e
and ecx, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
and ecx, edx
or esi, ecx
mov word [ebp - 0xac], si
mov ax, word [ebp - 0xac]
pop esi
mov esp, ebp
pop ebp
ret 0x24
Function at 0x43dd10
Capabilities:
Get disk information
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov byte [ebp - 0x81], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xbc], 0x290a2
mov dword [ebp - 0x144], 0
mov eax, dword [0x55c92c]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x14], 0x60d24
mov ecx, dword [ebp - 0x10c]
and ecx, 0x29656
movzx edx, byte [ebp - 0x81]
add edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
or ecx, edx
mov eax, dword [ebp - 0x10c]
add eax, 0x81893
and eax, dword [ebp - 0x10c]
and eax, 0x78db3
and eax, 0x525c6
or ecx, eax
movzx edx, word [ebp - 0xac]
or ecx, edx
mov dword [ebp - 0x10c], ecx
movzx eax, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
sub ecx, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
sub ecx, edx
mov eax, dword [ebp - 0x10c]
lea ecx, [ecx + eax + 0x20c82]
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
and ecx, edx
or ecx, 0x7c753
xor esi, esi
mov edi, dword [ebp - 0x70]
add edi, 0x2ef7c
mov ebx, dword [ebp - 0x6c]
adc ebx, 0
movzx eax, word [ebp - 0xac]
cdq
sub edi, eax
sbb ebx, edx
mov eax, dword [ebp - 0x10c]
xor edx, edx
and edi, eax
and ebx, edx
or ecx, edi
or esi, ebx
mov dword [ebp - 0x10c], ecx
movzx eax, word [ebp - 0xac]
cmp dword [ebp - 0x10c], eax
jne 0x43de92
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
cmp eax, 0x77648
jne 0x43de92
cmp dword [ebp - 0x10c], 0
jne 0x43de92
movzx ecx, word [ebp - 0xac]
cmp ecx, dword [ebp - 0x10c]
je 0x43de92
movzx esi, word [ebp - 0xac]
add esi, 0x412fb
movzx edx, word [ebp - 0xac]
sub esi, edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
add esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub esi, eax
sub esi, 0x677bc
mov dword [ebp - 0x10c], esi
jmp 0x43df08
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov edi, eax
add edi, 0x3f5d9
sub edi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
add edi, dword [ebp - 0x10c]
add eax, edi
or esi, eax
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
or esi, eax
or esi, 0x627a4
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
add edx, 0x47a2a
and ecx, edx
or esi, ecx
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x10c]
sub eax, 0x30cb0
mov word [ebp - 0xac], ax
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movzx ecx, word [ebp - 0xac]
sub ecx, dword [ebp - 0x10c]
and eax, ecx
mov edx, dword [ebp - 0x10c]
add edx, 0x8563d
sub edx, dword [ebp - 0x10c]
sub edx, 0x35e9f
or eax, edx
movzx ecx, byte [ebp - 0x81]
or eax, ecx
or eax, 0x463d9
or eax, 0x66c2c
mov byte [ebp - 0x81], al
mov ax, word [ebp - 0xac]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43ff1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f70d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043ee70
and dword [ebp - 0x14], 0
cmp dword [0x55d324], 0
mov dword [ebp - 0x18], eax
jne 0x43ffce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x440076
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x440076
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x55d324], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x55d328], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x55d32c], eax
call edi
push eax
call esi
mov dword [0x55d334], eax
test eax, eax
je 0x43ffce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x55d330], eax
mov eax, dword [0x55d330]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x440027
cmp dword [0x55d334], ecx
je 0x440027
push eax
call esi
push dword [0x55d334]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x440027
test ebx, ebx
je 0x440027
call edi
test eax, eax
je 0x44001e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44001e
test byte [ebp - 8], 1
jne 0x440027
or dword [ebp + 0x10], 0x200000
jmp 0x44005a
mov eax, dword [0x55d328]
cmp eax, dword [ebp - 0x18]
je 0x44005a
push eax
call esi
test eax, eax
je 0x44005a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44005a
mov eax, dword [0x55d32c]
cmp eax, dword [ebp - 0x18]
je 0x44005a
push eax
call esi
test eax, eax
je 0x44005a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x55d324]
call esi
test eax, eax
je 0x440076
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x440078
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00440286
leave
ret

Function at 0x440286
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f70d0]
jne 0x440290
repz ret
jmp fcn.004414f6
Function at 0x401a00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x401a34
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.00403540
lea eax, [ebx + 1]
cmp eax, 2
jb 0x401a2d
mov dword [esi], ebx
call fcn.00407340
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x403ef0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.005083f0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x78
call fcn.00504e46
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x5d9e0c]
mov ecx, dword [0x5dc534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x403fae
mov ecx, esi
push ebx
push 0x5d9de8
push edi
call fcn.00404060
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5d9e0c
call fcn.00505151
add esp, 4
cmp dword [0x5d9e0c], 0xffffffff
jne 0x403f89
xorps xmm0, xmm0
movups xmmword [0x5d9df8], xmm0
movups xmmword [0x5d9de8], xmm0
mov dword [0x5d9e08], 0
push 0x5d9de8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x5d9e0c
call fcn.00505100
add esp, 4
jmp 0x403f89
Function at 0x40f9b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x40f9dc
test eax, eax
jne 0x40f9dc
xor eax, eax
cmp dword [esi + 0xc], 0
jne 0x40f9dc
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x40fa2c
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x40f9fb
call fcn.00407340
push dword [esi]
call fcn.00412ca0
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x40fa21
call fcn.00407340
push dword [esi + 4]
call fcn.00412ca0
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
xorps xmm0, xmm0
movlps qword [esi + 8], xmm0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x40fa73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x40fa57
call fcn.00407340
push dword [esi]
call fcn.00412ca0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40fa66
mov dword [esi], ebx
call fcn.00407340
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x40fabc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jb 0x40faa2
call fcn.00407340
push dword [esi + 4]
call fcn.00412ca0
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40fab2
mov dword [esi + 4], ebx
call fcn.00407340
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40fbd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x40fc60
mov edi, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov ebx, eax
call esi
lea ecx, [ebp - 0x14]
push 2
push 0
push 0
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x40fc64
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x40fc71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x40fc4b
mov dword [ebp - 0x18], eax
call fcn.00407340
push dword [esi]
call fcn.00412ca0
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x40fc6a
mov dword [esi], ebx
mov esi, eax
call fcn.00407340
mov eax, esi
jmp 0x40fc6a
mov bl, 1
jmp 0x40fc76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410640
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
pop ebp
ret 4

Function at 0x410660
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
pop ebp
ret 4

Function at 0x410d26
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
call fcn.0040fb60
test al, al
je 0x410d4c
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.00410df6
mov ebx, dword [esi + 0x30]
test ebx, ebx
je 0x410db3
mov dword [ebp - 0x10], edi
mov edi, dword [esi + 0x34]
cmp ebx, edi
je 0x410d7a
mov ecx, ebx
call fcn.00410260
add ebx, 0xc
cmp ebx, edi
jne 0x410d69
mov ebx, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
sub eax, ebx
cmp eax, 0x1000
mov edi, dword [ebp - 0x10]
jb 0x410d9b
mov ecx, dword [ebx - 4]
add ebx, 0xfffffffc
sub ebx, ecx
cmp ebx, 0x20
jae 0x410df0
add eax, 0x23
mov ebx, ecx
push eax
push ebx
call fcn.00504e76
add esp, 8
xorps xmm0, xmm0
movlps qword [esi + 0x30], xmm0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x410dc3
push eax
call fcn.0050b736
add esp, 4
mov ecx, edi
call fcn.00410e1a
lea ecx, [esi + 0x18]
call fcn.00403540
lea ecx, [esi + 0x14]
call fcn.00403540
lea ecx, [esi + 0x10]
call fcn.00403540
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0040fad0
call fcn.0050b58a
int3
Function at 0x4152e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x5ce440]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x415348
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x415348
cmp dword [ebp - 0x14], 4
jne 0x415348
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005051b5
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x415360
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.005057a0
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.005083f0
add esp, 0xc
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x101c], 0x800
lea eax, [ebp - 0x101c]
lea ecx, [ebp - 0x1018]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x4154c0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1018]
cmp eax, 2
je 0x41541a
mov edi, 0x3f4
cmp eax, 1
jne 0x4154c0
push ebx
call fcn.005102e1
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x14]
cmp eax, edi
jae 0x415489
sub esp, 0xc
mov al, byte [ebp - 0x1010]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
mov ecx, esi
jmp 0x415482
lea esi, [ebp - 0x1010]
push 0x800
push 0xff
push esi
call fcn.005083f0
add esp, 0xc
push 0x400
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x101c], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x4154c0
push esi
call fcn.005102e1
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x14]
cmp eax, edi
mov edx, esi
jae 0x41549d
sub esp, 0xc
mov al, byte [ebp - 0x1014]
mov byte [esp + 4], al
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.004065d0
jmp 0x4154be
mov ecx, esi
cmp eax, 8
jb 0x415492
mov esi, dword [ecx]
mov dword [ecx + 0x10], edi
mov eax, edi
add eax, edi
push eax
push ebx
jmp 0x4154af
mov esi, ecx
cmp eax, 8
jb 0x4154a6
mov esi, dword [ecx]
mov dword [ecx + 0x10], edi
mov eax, edi
add eax, edi
push eax
push edx
push esi
call fcn.00507e70
add esp, 0xc
mov word [esi + edi*2], 0
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005051b5
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x416ca0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 0xc]
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 8]
push 0x4c
push str....._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.00407310
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.0041d330
mov dword [esp + 4], 0xffffffff
cmp dword [esi + 0x14], 8
jb 0x416d0b
mov esi, dword [esi]
mov ebx, dword [ebp + 8]
lea eax, [esp + 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x416d4d
js 0x416e9e
mov edi, eax
cmp eax, 0x1000
jb 0x416d5a
lea eax, [edi + 0x23]
push eax
call fcn.00504e46
add esp, 4
test eax, eax
je 0x416ea3
mov ebx, eax
add ebx, 0x23
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x416d65
mov dword [ebx], 0
mov esi, ebx
jmp 0x416e80
push edi
call fcn.00504e46
add esp, 4
mov ebx, eax
push edi
push 0
push ebx
call fcn.005083f0
add esp, 0xc
push ebx
push edi
push dword [esp + 0xc]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x416e4f
mov dword [esp + 8], 0
mov dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x416e4f
mov esi, dword [esp + 8]
test esi, esi
je 0x416e4f
add edi, ebx
push 0x1c
call fcn.00504e46
add esp, 4
mov ecx, dword [esi]
mov dword [eax], 0x579720
movd xmm0, edi
mov edi, eax
movd xmm1, ebx
punpckldq xmm1, xmm0
pshufd xmm0, xmm1, 0x14
movdqu xmmword [eax + 4], xmm0
mov dword [eax + 0x14], ecx
mov dword [esp + 8], 0
mov dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xc]
push eax
push 0x579916
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x416e41
mov esi, edi
lea edi, [esp + 0x18]
push str.::VerQueryValue_data__kRoot__fixed_file_info__dummy_size_
push 0x29
push str....._base_file_version_info_win.cc
push edi
call fcn.00407bc0
add esp, 0x10
mov ecx, edi
call fcn.00407cf0
mov ecx, edi
mov edi, esi
call fcn.00407d00
mov eax, dword [esp + 8]
mov dword [edi + 0x18], eax
mov esi, dword [ebp + 8]
mov dword [esi], edi
jmp 0x416e80
mov esi, dword [ebp + 8]
mov dword [esi], 0
test ebx, ebx
je 0x416e80
cmp edi, 0x1000
jb 0x416e76
mov eax, dword [ebx - 4]
add ebx, 0xfffffffc
sub ebx, eax
cmp ebx, 0x20
jae 0x416ea3
add edi, 0x23
mov ebx, eax
push edi
push ebx
call fcn.00504e76
add esp, 8
lea ecx, [esp + 0x20]
call fcn.0041d350
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005051b5
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004054c0
call fcn.0050b58a
int3
Function at 0x419e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp + 0xc]
mov eax, dword [0x5ce440]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 0x20]
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x579bc0]
movsd qword [esp + 0x14], xmm0
mov eax, dword [0x5d9e8c]
mov ecx, dword [0x5dc534]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x419f8e
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
movsd qword [esp], xmm1
mov dword [esp + 0xc], 0
mov ecx, 0x5d9e68
call fcn.0043039e
sub esp, 0x10
mov ebx, dword [esp + 0x18]
mov dword [esi], 0
movsd xmm0, qword [0x578450]
movsd qword [esi + 0x10], xmm0
mov byte [esi], 0
cmp ebx, 0xf
jbe 0x419f5a
mov al, byte [esp + 0x1c]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], ebx
mov ecx, esi
call fcn.00407350
sub esp, 0xc
mov ebx, dword [esp + 0x18]
test ebx, ebx
jns 0x419f71
jmp 0x419f79
mov dword [esi + 0x10], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00507e70
mov byte [esi + ebx], 0
mov eax, dword [esp + 0x10]
mov byte [eax + ebx], 0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005051b5
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], 0x5d9e8c
call fcn.00505151
movsd xmm1, qword [ebp + 0xc]
cmp dword [0x5d9e8c], 0xffffffff
jne 0x419ef6
mov dword [0x5d9e68], 1
xorps xmm0, xmm0
movlps qword [0x5d9e6c], xmm0
mov byte [0x5d9e74], 0x65
movaps xmm0, xmmword [0x579bd0]
movups xmmword [0x5d9e78], xmm0
mov dword [0x5d9e88], 0
mov dword [esp], 0x5d9e8c
call fcn.00505100
movsd xmm1, qword [ebp + 0xc]
jmp 0x419ef6