joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450f4d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x471e40]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x450f8d
cmp byte [ebx], 0xa
jne 0x450f8d
or byte [eax + edi + 0x28], 4
jmp 0x450f92
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x451090
mov al, byte [edx]
cmp al, 0x1a
je 0x451072
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x450fc1
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x450fe6
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x450ff0
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x450fa3
jmp 0x451090
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45106d
cmp dword [ebp - 0xc], 0
je 0x45106d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x471e40]
test byte [eax + edi + 0x28], 0x48
je 0x451047
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x451032
mov byte [esi], dl
jmp 0x451043
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x471e40]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x451090
cmp byte [ebp - 1], 0xa
jne 0x451056
cmp esi, ebx
jne 0x451056
mov byte [esi], 0xa
jmp 0x45108f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044684e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x451090
mov byte [esi], 0xd
jmp 0x45108f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x471e40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45108c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x451090
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x451099
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x471e40]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4510dc
cmp word [esi], dx
jne 0x4510dc
or byte [edi + eax + 0x28], 4
jmp 0x4510e1
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x451234
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x451214
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x451123
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x451159
cmp eax, edx
jae 0x451165
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4510fb
jmp 0x451234
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x451210
cmp dword [ebp - 0x14], 0
je 0x451210
mov eax, dword [ebx*4 + 0x471e40]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4511e8
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4511b1
mov word [esi], cx
jmp 0x4511e4
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x471e40]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x471e40]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x471e40]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x451234
pop ebx
cmp word [ebp - 4], bx
jne 0x4511f9
cmp esi, dword [ebp + 0xc]
jne 0x4511f9
mov word [esi], bx
jmp 0x451231
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044684e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x451234
push 0xd
jmp 0x45122d
mov ecx, dword [ebx*4 + 0x471e40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45122b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x451234
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4529f5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00452971
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x452b6d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x452b6d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x452b1c
jg 0x452a4e
test eax, eax
je 0x452b12
push 1
push 0x1000
call fcn.004431b2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x452a74
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x452b09
push 0x8000
push ebx
call fcn.0043c365
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x452aa0
jg 0x452a9b
cmp ecx, 0x1000
jb 0x452aa0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004472b8
add esp, 0x10
cmp eax, 0xffffffff
je 0x452ae5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x452a9b
jl 0x452acc
test ecx, ecx
jne 0x452a8d
push dword [ebp - 0xc]
push ebx
call fcn.0043c365
push esi
call fcn.0044320f
add esp, 0xc
xor edi, edi
jmp 0x452b7e
cmp byte [edi + 0x24], 0
je 0x452afc
cmp dword [edi + 0x20], 5
jne 0x452afc
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x452b07
mov edi, dword [edi + 0x18]
jmp 0x452b09
xor edi, edi
push esi
call fcn.0044320f
pop ecx
jmp 0x452b7e
test ecx, ecx
jg 0x452ade
jl 0x452b1c
test eax, eax
jae 0x452ade
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044684e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x452b3f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x452ade
jmp 0x452b76
push ebx
call fcn.0043e1be
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x452ade
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x452b7e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x452b7b
mov edi, dword [edi + 0x18]
jmp 0x452b7e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0044684e
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x407e00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
inc esi
not esi
rol ecx, 0x19
neg esi
call fcn.00490628
dec esi
or ecx, dword [0x4f4f6f]
neg ebx
xor ecx, eax
mov dword [0x4f4cca], esi
neg edi
xchg esi, edx
call fcn.00403724
ror esi, 0x1e
call fcn.00406842
xor edx, esi
call fcn.0041b6f8
call fcn.00409ec8
xor edx, esi
call fcn.00498e42
rol esi, 0x1e
call fcn.0048ada8
xchg esi, edx
neg edi
add dword [0x4f4c3a], esi
xor ecx, eax
neg ebx
inc esi
neg esi
ror ecx, 0x19
not esi
dec esi
xor dword [0x4f4cb6], eax
sub edx, 0x6e1dc0c3
push esi
sub edi, dword [0x4f4e7d]
inc ecx
ror esi, 0x16
add eax, dword [0x4f4f1a]
call fcn.00418e57
ror eax, 0x12
not ebx
xor esi, edx
or eax, dword [0x4f4e40]
mov dword [0x4f4cbe], ecx
dec esi
rol edx, 2
or ebx, dword [0x4f4e96]

Function at 0x407ea0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor eax, dword [0x4f4e92]
add edi, dword [0x4f4ece]
call fcn.0048626c
call fcn.0046053d
ror edx, 2
inc esi
xor esi, edx
not ebx
rol eax, 0x12
call fcn.0045ddcb
rol esi, 0x16
dec ecx
mov eax, 0x7cc3b46a
xchg edx, esi
call fcn.0042aef5
xchg ecx, eax
sub edx, edi
or esi, dword [0x4f4f81]
not esi
rol ecx, 6
xor edi, 0xe9bda14b
add esi, ebx
add dword [0x4f4cfb], eax
xor eax, dword [0x4f4fa1]
sub esi, ebx
xor edi, 0xe9bda14b
ror ecx, 6
not esi
add edx, edi
xchg ecx, eax
call fcn.0045473d
xchg edx, esi
add eax, 0x44b611c0
xor ebx, dword [0x4f4f53]
sub edx, ebp
mov dword [0x4f4d20], ecx
call fcn.004511a8
xor dword [0x4f4d9d], 0x20389b3b
xor edi, 0xf21aee01
rol edx, 1
call fcn.0044925f
add ecx, dword [0x4f4f4d]
xor esi, ebp
neg esi
inc esi
rol esi, 0xe
xor edi, ecx
call fcn.0043e6d0
not edx
or edx, dword [0x4f4f7f]
sub eax, 0xdfd19f1d
xor edx, 0xf1988ec
call fcn.00412fa3
call fcn.0048f54d
xor edx, 0xf1988ec
add eax, 0xdfd19f1d
not edx
xor edi, ecx
ror esi, 0xe
dec esi
neg esi
xor esi, ebp
call fcn.00436d79
ror edx, 1
xor edi, 0xf21aee01
add dword [0x4f4c63], 0x83cc8a36
add edx, ebp
xor eax, 0xc14bc619
dec esi
sub ebx, edx
or dword [0x4f4ca5], edx
neg esi
add dword [0x4f4c69], ebx
and dword [0x4f4d76], ecx
sub eax, dword [0x4f4e4c]
xor eax, ebx
dec ebx
not esi
sub edi, 0xc7516a6f
not ebx
add eax, 0x91f2447
xor ecx, dword [0x4f4f1c]
xor ecx, 0xbdbabd4f
xor ebx, eax
sub eax, dword [0x4f4ef5]
ror edi, 0x14
xchg esi, eax
xor ecx, dword [0x4f4eb1]
xchg esi, eax
rol edi, 0x14
xor ebx, eax
xor ecx, 0xbdbabd4f
sub eax, 0x91f2447
invalid

Function at 0x408040
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
adc eax, 0x4f4cec
jmp 0xb8d589f4

Function at 0x408120
Capabilities:
Encrypt data using chaskey

Disassembly:
dec ebp
dec edi
add byte [edi + 0x5101e8c6], al
add eax, 0x22352b00
dec esi
dec edi
add bh, dh
fidiv word [ebx]
xlatb
Function at 0x44e7c5
Capabilities:
Get common file path

Disassembly:
push 0x70c
mov eax, 0x4add5e
call fcn.00473d21
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x718], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x628], ax
xor ebx, ebx
lea eax, [ebp - 0x626]
push ebx
push eax
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push dword [0x4f1f10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x70c]
call fcn.0044c27a
mov dword [ebp - 4], ebx
xor eax, eax
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00474cd0
cmp dword [0x4f1e08], 8
mov esi, 0x4f1df4
mov eax, esi
cmovae eax, dword [0x4f1df4]
push eax
lea eax, [ebp - 0x70c]
push eax
call fcn.0044f61b
add esp, 0x14
test eax, eax
je 0x44e92d
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
xor esi, esi
lea eax, [ebp - 0x41e]
push esi
push eax
inc ebx
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
push esi
push 0x4bb52c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
lea eax, [ebp - 0x70d]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x678]
call fcn.00411496
mov byte [ebp - 4], bl
lea eax, [ebp - 0x6a8]
push eax
mov ecx, 0x4f1df0
call fcn.0041ccc6
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp - 0x678]
push ecx
push eax
lea ecx, [ebp - 0x70c]
call fcn.0044cf9f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6a8]
call fcn.00401b80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x678]
call fcn.00401b80
jmp 0x44e981
cmp word [0x4f1570], 0
je 0x44e94b
push 0x4f1570
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x44e981
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.0044f6af
cmp dword [0x4f1e08], 8
lea eax, [ebp - 0x218]
cmovae esi, dword [0x4f1df4]
push esi
push eax
push eax
call fcn.0044f2d3
lea ecx, [ebp - 0x648]
call fcn.00410e1a
mov byte [ebp - 4], 6
cmp word [ebp - 0x218], 0
jne 0x44e99e
xor eax, eax
jmp 0x44e9ab
lea eax, [ebp - 0x218]
push eax
call fcn.00473c34
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.00414bbb
lea ecx, [ebp - 0x648]
call fcn.00414e5c
lea ecx, [ebp - 0x648]
call fcn.00412e33
push dword [ebp + 0x14]
lea ecx, [ebp - 0x648]
push dword [ebp - 0x718]
push 0x4cb558
push dword [ebp - 0x714]
push edi
call fcn.0041271a
test bl, bl
je 0x44ea05
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x648]
call fcn.004117c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70c]
call fcn.0044c5ca
call fcn.00473cd0
ret
Function at 0x44ff7a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x4ed0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x24c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
mov edi, dword [ebp + 0x10]
push 0x4cb558
push eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x248], edi
call esi
push 0x4cb558
push edi
call esi
lea eax, [ebp - 0x24c]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x450159
push edi
call fcn.00476d76
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x250], esi
call fcn.00474cd0
add esp, 0x10
push esi
push edi
xor edi, edi
push edi
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x450152
push 0x34
lea eax, [ebp - 0x238]
push edi
push eax
mov dword [ebp - 0x240], eax
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x4b6f58
push esi
mov dword [ebp - 0x244], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x450071
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
movzx eax, dx
shr ecx, 0x10
push ecx
push eax
shr edx, 0x10
push edx
push str._u._u._u._u
push dword [ebp - 0x23c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push 0x34
push edi
push dword [ebp - 0x240]
mov dword [ebp - 0x244], edi
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x450152
mov ebx, dword [ebp - 0x244]
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push edi
push eax
shr ebx, 2
call fcn.00474cd0
mov eax, dword [ebp - 0x240]
add esp, 0xc
test ebx, ebx
jle 0x450152
mov esi, eax
and dword [ebp - 0x23c], 0
test edi, edi
jle 0x4500ea
add esi, 4
push 4
lea eax, [ebp - 0x23c]
push esi
push eax
call fcn.00472fa0
movzx eax, word [ebp - 0x23c]
add esp, 0xc
push eax
lea eax, [ebp - 0x204]
test edi, edi
jne 0x45011f
push 0x4b9948
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x450134
push dword [ebp - 0x248]
push 0x4bb3a4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc edi
cmp edi, ebx
jl 0x4500dc
mov esi, dword [ebp - 0x250]
push esi
call fcn.00476d01
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00473c52
leave
Function at 0x46906a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, ecx
call ebx
sub eax, dword [esi + 0x74]
xor edi, edi
cmp eax, 0x7530
jbe 0x4690a7
mov eax, dword [esi + 0x68]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x6c], edi
call ebx
mov dword [esi + 0x74], eax
mov ecx, dword [esi + 0x64]
test ecx, ecx
jne 0x4690b3
mov eax, dword [esi + 0x5c]
jmp 0x4690ff
push 0xa
pop ebx
mov dword [ebp - 4], edi
test edi, edi
jne 0x4690fd
or eax, 0xffffffff
xor edx, edx
div ebx
mov edi, dword [esi + 0x5c]
cmp edi, eax
jbe 0x4690d5
shr edi, 1
shr ecx, 1
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], ecx
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x64]
imul eax, ebx
xor edx, edx
div ecx
xor edx, edx
imul eax, eax, 0x3e8
div ebx
imul ebx, ebx, 0xa
mov edi, eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 3
jb 0x4690b9
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46c3c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
mov edi, ecx
test ebx, ebx
je 0x46c3e8
push 1
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebx], eax
xor eax, eax
lea esi, [edi + 0x70]
push esi
push eax
push eax
push eax
push 2
push dword [edi + 0x10]
call fcn.00469ec8
add esp, 0x18
test eax, eax
jne 0x46c410
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x78], eax
xor al, al
jmp 0x46c4b2
push dword [esi]
call fcn.00474bb7
mov esi, eax
pop ecx
cmp esi, dword [edi + 0x6c]
je 0x46c428
push dword [edi + 0x6c]
call fcn.00472d16
pop ecx
push 0
mov dword [edi + 0x6c], esi
call fcn.00472d16
lea esi, [edi + 0x70]
push esi
push dword [edi + 0x6c]
push 0
push 0
push 2
push dword [edi + 0x10]
call fcn.00469ec8
add esp, 0x1c
test eax, eax
je 0x46c400
push 0
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
push 0
lea eax, [edi + 0x70]
push eax
push dword [eax]
push dword [edi + 0x6c]
push dword [ebp + 8]
call esi
test byte [ebp + 0x10], 1
jne 0x46c499
push 0
push dword [ebp + 8]
push 1
push 1
push 0x10001
push dword [edi + 0xc]
call fcn.00469c33
add esp, 0x18
test eax, eax
je 0x46c400
test ebx, ebx
je 0x46c4b0
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [ebx]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x46ce43
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46ce75
xor eax, eax
jmp 0x46cf27
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.004521fb
pop ecx
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp + 8]
jne 0x46ce6e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi + 0x2c]
call fcn.0046da2d
lea esi, [edi + 0x20]
mov ecx, esi
push dword [esi + 4]
push dword [esi]
call fcn.00455ca2
mov eax, dword [esi]
push 0
push 0x4cb3ac
mov ecx, edi
mov dword [esi + 4], eax
call fcn.00404c70
mov esi, dword [ebp - 4]
mov ecx, edi
mov byte [esi + ebx], 0
mov dword [edi + 0x38], esi
call fcn.0046cc85
push eax
push 0
mov ecx, edi
call fcn.0046cf2e
test eax, eax
je 0x46ce6e
mov ecx, edi
call fcn.0046cc85
push eax
push 9
mov ecx, edi
call fcn.0046cf2e
test eax, eax
je 0x46ce6e
push edi
mov ecx, edi
call fcn.0046d474
test eax, eax
je 0x46ce6e
push esi
call fcn.00473c4d
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x46e279
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x46ec1f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov ebx, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
jne 0x46ec42
xor al, al
jmp 0x46ecdc
push eax
call fcn.004521fb
pop ecx
push eax
push dword [ebp - 4]
mov dword [ebx + 0x40], eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46ec3b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b6f58
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46ec3b
push esi
mov esi, dword [ebp - 0xc]
push edi
push 0xd
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea edi, [ebx + 4]
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueW
pop edi
pop esi
test eax, eax
je 0x46ecda
mov eax, dword [ebp - 4]
shr eax, 2
xor ecx, ecx
push 4
pop edx
mov dword [ebx + 0x3c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004521fb
xor edx, edx
pop ecx
mov dword [ebx + 0x38], eax
cmp dword [ebx + 0x3c], edx
jbe 0x46ecda
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov eax, dword [eax + edx*4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, dword [ebx + 0x3c]
jb 0x46ecc8
mov al, 1
pop ebx
leave
ret 4