joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a64a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b663b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
mov byte [edi], al
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
movups xmm0, xmmword [esi + 4]
movups xmmword [edi + 4], xmm0
movq xmm0, qword [esi + 0x14]
movq qword [edi + 0x14], xmm0
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
mov dword [ebp - 4], 2
mov dword [edi + 0x1c], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
movups xmm0, xmmword [esi + 0x1c]
movups xmmword [edi + 0x1c], xmm0
movq xmm0, qword [esi + 0x2c]
movq qword [edi + 0x2c], xmm0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], al
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], ecx
push 0x38
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
call fcn.00677616
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x3c], eax
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x3c], ecx
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov ecx, dword [edi + 0x40]
mov dword [edi + 0x40], eax
mov dword [esi + 0x40], ecx
movzx eax, byte [esi + 0x44]
mov byte [edi + 0x44], al
movzx eax, byte [esi + 0x45]
mov byte [edi + 0x45], al
movzx eax, byte [esi + 0x46]
mov byte [edi + 0x46], al
mov eax, edi
movups xmm0, xmmword [esi + 0x48]
movups xmmword [edi + 0x48], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b3ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b7ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov edi, dword [eax + 4]
add edi, esi
mov ecx, edi
call fcn.00467d60
mov eax, dword [ebp + 8]
mov dword [edi + 0x38], eax
mov eax, dword [edi + 0x30]
mov dword [edi + 0x3c], 0
mov ebx, dword [eax + 4]
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.004b5730
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4b3b6f
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 8]
test eax, eax
je 0x4b3b6c
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov al, byte [ebp + 0xb]
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x4b3b88
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00467ce0
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + esi + 0xc], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b4580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6af370
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00677616
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00662b52
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b95c6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
lea edi, [esi + 8]
mov dword [esi], vtable.CAT::ReportProcessingJob.0
mov byte [edi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ecx + 4]
test eax, eax
je 0x4c3d92
lock inc dword [eax + 4]
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [ebp - 4], 0
call fcn.0044e6a0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.0044e6a0
push 4
mov byte [ebp - 4], 2
call fcn.00677616
add esp, 4
mov dword [eax], vtable.ReportUtilsProviderImpl.0
mov dword [esi + 0x24], eax
xor al, al
mov byte [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
xchg byte [edi], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4ca870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x114]
test eax, eax
je 0x4ca8af
cmp edi, dword [esi + 0x98]
jne 0x4ca8af
push 1
push 0
push 0
push eax
push 0x74f01c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4ca8af
mov dword [esi + 0xa0], 1
mov eax, dword [esi + 0x11c]
test eax, eax
je 0x4ca8e4
cmp edi, dword [esi + 0x9c]
jne 0x4ca8e4
push 1
push 0
push 0
push eax
push 0x74f01c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4ca8e4
mov dword [esi + 0xa0], 1
pop edi
pop esi
pop ebp
ret 4

Function at 0x4cc410
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x4cc497
cmp dword [esi + 0x78], 0
je 0x4cc497
mov eax, dword [esi + 0x84]
test eax, eax
je 0x4cc497
push edi
push eax
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x4cc496
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4cc496
cmp word [esi + 0x150], 0
push ebx
lea ebx, [esi + 0x150]
jne 0x4cc46f
push 0x64
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [esi + 0x78]
lea eax, [ebp - 0x194]
push ebx
push str._s___d
push eax
call fcn.004cd650
add esp, 0x10
lea eax, [ebp - 0x194]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006773ff
mov esp, ebp
pop ebp
ret

Function at 0x4d37b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d3815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x791068
push eax
lea ecx, [esp + 0xc]
call fcn.004d2f40
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], str.C:devjenkinsworkspacemonitor_win_buildexternals_boostmt_v142win32include_boost_1_80_boost_asio_detail_impl_win_tss_ptr.ipp
mov dword [esp + 0x14], str.win_tss_ptr_create
mov dword [esp + 0x18], 0x2e
mov dword [esp + 0x1c], 0x1a
test al, 1
je 0x4d3815
cmp eax, 1
jne 0x4d381c
cmp dword [esp + 4], 0
setne al
test al, al
jne 0x4d381c
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
mov edx, 0x74f80c
push eax
lea ecx, [esp + 8]
call fcn.004d3760
int3
Function at 0x4d6660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 0x79], 0
mov dword [edi], vtable.std::_Associated_state_struct_CAT::EventResult_.0
je 0x4d6684
cmp dword [edi + 0x74], 0
jne 0x4d6684
lea eax, [edi + 0x18]
push eax
call fcn.00661e01
add esp, 4
lea eax, [edi + 0x48]
push ebx
push eax
call fcn.00661f6f
lea eax, [edi + 0x18]
push eax
call fcn.00661c5c
lea eax, [edi + 0x10]
push eax
call fcn.006618ba
mov ebx, dword [edi + 0xc]
add esp, 0xc
test ebx, ebx
je 0x4d66cd
cmp byte [ebx + 4], 0
je 0x4d66c2
push esi
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
push 8
push ebx
call fcn.006779b1
add esp, 8
test byte [ebp + 8], 1
pop ebx
je 0x4d66e2
push 0x80
push edi
call fcn.006779b1
add esp, 8
mov eax, edi
pop edi
pop ebp
ret 4
Function at 0x4d7450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bb5c0
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x104], ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x110], 0
call fcn.004486f0
mov edx, ebx
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.004ce770
push eax
push str.Processing_of_event...__0
push 1
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0044f2f0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4d750f
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4d7505
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d76c7
push edx
push ecx
call fcn.006779b1
add esp, 8
mov esi, dword [ebp - 0x104]
xor eax, eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0xfc]
push ebx
push eax
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
call fcn.00477940
mov dword [ebp - 4], 2
lea eax, [ebp - 0x114]
push dword [ebp - 0x40]
lea ecx, [esi + 0x48]
push ebx
push eax
call fcn.004d6ce0
push 4
mov byte [ebp - 4], 3
add esi, 4
call fcn.00677616
add esp, 4
mov ebx, eax
mov dword [ebp - 0x108], ebx
push esi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x118], ebx
mov dword [edi], 0
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0x104]
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 5
push dword [ebp - 0x100]
mov dword [ebp - 0x110], 7
push eax
call fcn.004d7f20
push eax
mov ecx, edi
call fcn.0046c760
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x100], eax
test eax, eax
je 0x4d75ed
cmp byte [eax + 4], 0
je 0x4d75e2
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x100]
push 8
push eax
call fcn.006779b1
add esp, 8
mov dword [ebp - 4], 4
jmp 0x4d7622
cmp dword [edi], 0
je 0x4d763a
call fcn.004486f0
push str.Event_was_successfully_processed.
push 1
mov ecx, eax
call fcn.0044e9d0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push ebx
call fcn.006779b1
mov esi, dword [ebp - 0x114]
add esp, 8
test esi, esi
je 0x4d7669
mov ecx, esi
call fcn.005379a0
push 0x28
push esi
call fcn.006779b1
add esp, 8
lea ecx, [ebp - 0xfc]
call fcn.00451aa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret 8
call fcn.00682da2
int3
Function at 0x4d7ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bb6e5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x78efc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], edi
push 4
mov dword [ebp - 4], edi
lea esi, [eax + 4]
call fcn.00677616
add esp, 4
mov ebx, eax
mov dword [ebp - 0x14], ebx
push esi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x4d80eb
push 4
lea esi, [ecx + 0xc]
call fcn.00677616
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
push esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp - 0x14]
mov esi, dword [esi + 0xd8]
nop
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push edi
call fcn.006779b1
add esp, 8
cmp esi, 6
je 0x4d80e5
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push dword [ebp + 0xc]
push eax
mov ecx, dword [ecx + 0x24]
call fcn.004d99d0
push eax
lea ecx, [ebp - 0x28]
call fcn.0046c760
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x4d80df
cmp byte [edi + 4], 0
je 0x4d80d4
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 8
push edi
call fcn.006779b1
add esp, 8
cmp dword [ebp - 0x28], 0
jne 0x4d811e
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4d811e
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4d811e
mov ecx, dword [esi + 0x1c]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push ebx
call fcn.006779b1
jmp 0x4d813f
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.0046c6f0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push ebx
call fcn.006779b1
mov edi, dword [ebp - 0x24]
add esp, 8
test edi, edi
je 0x4d816a
cmp byte [edi + 4], 0
je 0x4d815f
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp + 8]
push 8
push edi
call fcn.006779b1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dd450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov al, byte [0x7a9624]
xor edx, edx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
nop
test al, al
jne 0x4dd46d
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi + 8], 2
jne 0x4dd47c
xor al, al
mov ecx, 0x7a9624
xchg byte [ecx], al
mov ecx, dword [0x7a9620]
push ebx
test ecx, ecx
je 0x4dd49f
mov eax, dword [ecx]
lea edx, [ebp - 0xc]
push esi
push edx
call dword [eax + 4]
mov edx, 1
cmp dword [eax], 0
je 0x4dd49f
mov bl, dl
jmp 0x4dd4a1
xor bl, bl
test dl, 1
je 0x4dd4d0
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x4dd4cf
cmp byte [edi + 4], 0
je 0x4dd4c4
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 8
push edi
call fcn.006779b1
add esp, 8
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4df120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bc276
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x268], esi
push 0x20a
lea eax, [ebp - 0x234]
mov dword [ebp - 0x268], esi
push 0
push eax
call fcn.00679eb0
add esp, 0xc
lea eax, [ebp - 0x234]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4df2ee
call fcn.004486f0
push ecx
lea ecx, [ebp - 0x318]
mov ebx, eax
call fcn.004b2e70
lea eax, [ebp - 0x308]
mov dword [ebp - 4], 0
push str.CSIDL_SYSTEM
push eax
call fcn.004b47f0
add esp, 8
lea ecx, [ebp - 0x13]
mov edx, 0x25
call fcn.004e7d50
mov ecx, eax
mov dword [ebp - 0x24c], 0
xor edx, edx
lea eax, [ebp - 0x13]
mov dword [ebp - 0x23c], edx
mov edi, 0xf
mov dword [ebp - 0x238], edi
mov byte [ebp - 0x24c], dl
mov byte [ebp - 4], dl
cmp ecx, eax
je 0x4df212
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x24c]
call fcn.0044daa0
mov edi, dword [ebp - 0x238]
mov edx, dword [ebp - 0x23c]
cmp edi, 0x10
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x24c]
push edx
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.004e4f80
mov byte [ebp - 4], 0
add esp, 0xc
mov edx, dword [ebp - 0x238]
cmp edx, 0x10
jb 0x4df275
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4df26b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df353
push edx
push ecx
call fcn.006779b1
add esp, 8
lea eax, [ebp - 0x264]
mov dword [ebp - 0x23c], 0
push eax
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
call fcn.004b2de0
lea ecx, [ebp - 0x318]
call fcn.004b03c0
lea eax, [ebp - 0x264]
mov dword [ebp - 4], 3
push eax
push str.Unable_to_resolve_path_for_CS_ID__0_
push ecx
mov ecx, ebx
call fcn.004e45a0
lea ecx, [ebp - 0x264]
call fcn.0044a090
mov dword [esi], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x4df335
mov dword [esi], 0
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x234]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov dword [ebp - 4], 0xffffffff
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4df317
sub ecx, edx
lea eax, [ebp - 0x234]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0044d800
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
call fcn.00682da2
int3
Function at 0x4df620
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bc396
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x9c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], 0
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x8c], eax
mov eax, edi
jb 0x4df67a
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x90], eax
test eax, eax
jne 0x4df69f
push dword [ebp - 0x8c]
mov ecx, esi
call fcn.0044d190
jmp 0x4df85d
push eax
call fcn.00677c3e
add esp, 4
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
jb 0x4df6bd
mov edi, dword [edi]
push eax
push dword [ebp - 0x90]
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov edi, dword [ebp - 0x98]
test eax, eax
je 0x4df847
push 0
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0
push eax
push 0x743380
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4df847
mov ecx, dword [ebp - 0x94]
cmp dword [ecx], 0xfeef04bd
jne 0x4df847
movzx eax, word [ecx + 0xc]
mov dword [ebp - 0x9c], eax
movzx eax, word [ecx + 0xe]
mov dword [ebp - 0xa0], eax
movzx eax, word [ecx + 8]
mov dword [ebp - 0x8c], eax
movzx eax, word [ecx + 0xa]
lea ecx, [ebp - 0x28]
push str._0._1._2._3
mov dword [ebp - 0x90], eax
call fcn.0044d100
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.004657c0
lea edx, [ebp - 0x8c]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.004657c0
lea edx, [ebp - 0xa0]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.004657c0
lea edx, [ebp - 0x9c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.004657c0
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 6
push ecx
lea eax, [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0xb4]
call fcn.0044fb00
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 7
push eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00466ac0
add esp, 4
mov dword [ebp - 0xa4], 2
lea ecx, [ebp - 0xb4]
call fcn.0044d720
push fcn.0044bb60
push 4
push 0x18
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 2
push eax
call fcn.00677646
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4df831
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4df827
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4df87a
push edx
push ecx
call fcn.006779b1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x4df854
push dword [ebp - 0x8c]
mov ecx, esi
call fcn.0044d190
push edi
call fcn.00677c39
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
call fcn.00682da2
int3