joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x407288
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40729a
call fcn.0041aecc
mov eax, dword [0x420abf]
shl eax, 2
mov dword [0x420ac3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
mov dword [0x420ac7], edx
call fcn.00412a38
pop edx
call fcn.004108ac
call fcn.00412a3c
push 0x420a68
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x420ac7], eax
push 0
jmp 0x41c3f4
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x6c]
mov eax, dword [esi + 0x10]
and eax, 1
mov dword [0x42360c], eax
call fcn.004182ec
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.004188f4
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call fcn.00413c28
mov eax, dword [esi + 0x44]
mov dword [esp], eax
call fcn.00413c38
mov dword [0x42b864], 1
mov dword [0x42b868], esi
lea eax, [esp + 0x10]
mov dword [0x42b830], eax
call fcn.0041cd00
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x42b834], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x42b83c], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0041b384
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov edi, dword [esi + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0041b3d4
mov dword [esp + 4], 0
mov dword [esp], 0x42b864
call fcn.0041c23c
test byte [esi + 0x10], 1
je 0x41c4df
mov eax, dword [0x42b83c]
nop word cs:[eax + eax]
inc eax
mov cl, byte [eax - 1]
cmp cl, 9
je 0x41c4c4
cmp cl, 0x22
je 0x41c503
cmp cl, 0x20
je 0x41c4c4
dec eax
mov edx, 0x20
jmp 0x41c518
mov eax, dword [0x42b848]
mov ecx, dword [0x42b84c]
mov edx, dword [0x42b850]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [esi + 0x18]
jmp 0x41c59b
mov cl, byte [eax]
mov edx, 0x22
jmp 0x41c518
mov cl, byte [eax + 1]
inc eax
xor ch, ch
test cl, cl
je 0x41c52c
cmp cl, 9
je 0x41c52a
movsx edi, cl
cmp edi, edx
jne 0x41c514
mov ch, cl
lea edi, [eax + 1]
cmp ch, 0x22
cmovne edi, eax
jmp 0x41c545
inc edi
mov al, byte [edi]
cmp al, 9
je 0x41c544
cmp al, 0x20
je 0x41c544
mov ebx, dword [esi + 0x18]
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
mov eax, 0xa
test byte [esp + 0x44], 1
je 0x41c583
movzx eax, word [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], 0
call ebx
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0041b1a0
add esp, 0x5c
pop esi
pop edi
pop ebx
ret
Function at 0x40a06c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, esp
mov dword [eax], 0xfffffff5
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov dword [ebp - 4], eax
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_GetFileType
sub esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
sub eax, 3
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
je 0x40a132
jmp 0x40a0a7
mov eax, dword [ebp - 0x14]
sub eax, 2
mov dword [ebp - 0x1c], eax
je 0x40a0fe
jmp 0x40a0b4
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x20], eax
jne 0x40a15b
jmp 0x40a0c5
mov dword [0x423da8], 3
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
mov edx, esp
mov dword [edx + 0xc], ecx
mov dword [edx], eax
mov dword [edx + 0x10], 0
mov dword [edx + 8], 3
mov dword [edx + 4], 0x420f80
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x24], eax
jmp 0x40a165
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_GetConsoleMode
sub esp, 8
cmp eax, 0
je 0x40a126
mov dword [0x423da8], 1
jmp 0x40a130
mov dword [0x423da8], 2
jmp 0x40a165
call sub.KERNEL32.DLL_GetConsoleOutputCP
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfde9
jne 0x40a14f
mov dword [0x423da8], 3
jmp 0x40a159
mov dword [0x423da8], 2
jmp 0x40a165
mov dword [0x423da8], 2
add esp, 0x38
pop ebp
ret
Function at 0x40a16c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, 0x104c
call fcn.004108b0
sub esp, 0x104c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a195
jmp 0x40a377
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00412c88
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
jne 0x40a1b7
jmp 0x40a377
mov eax, dword [ebp - 0x1014]
sub eax, 1
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2]
cmp eax, 0xa
setne dl
and dl, 1
movzx eax, dl
mov dword [0x423da4], eax
cmp dword [0x423da8], 0
jne 0x40a1ed
call fcn.0040a06c
mov eax, esp
mov dword [eax], 0xfffffff5
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [0x423da8]
mov ecx, eax
sub ecx, 3
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x101c], ecx
je 0x40a304
jmp 0x40a21e
mov eax, dword [ebp - 0x1018]
sub eax, 2
mov dword [ebp - 0x1020], eax
je 0x40a281
jmp 0x40a231
mov eax, dword [ebp - 0x1018]
sub eax, 1
mov dword [ebp - 0x1024], eax
jne 0x40a377
jmp 0x40a248
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1014]
lea esi, [ebp - 0x1014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteConsoleW
sub esp, 0x14
mov dword [ebp - 0x1028], eax
jmp 0x40a377
lea eax, [ebp - 0x1010]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1014]
mov esi, esp
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edx
mov dword [esi + 8], ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0x1000
mov dword [esi + 4], 0
mov dword [esi], 0
call sub.KERNEL32.DLL_WideCharToMultiByte
sub esp, 0x20
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1014]
lea esi, [ebp - 0x1014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x102c], eax
jmp 0x40a377
mov eax, 0x1000
lea ecx, [ebp - 0x1010]
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1000
mov dword [ebp - 0x1030], eax
call fcn.0040fc24
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call fcn.00413048
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1014]
lea esi, [ebp - 0x1014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x1034], eax
add esp, 0x104c
pop esi
pop edi
pop ebp
ret
Function at 0x40a828
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
add esp, 4
pop ebp
ret
Function at 0x40c998
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x260]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00412ffc
lea ecx, [0x420fc8]
lea edx, [ebp - 0x260]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x268], eax
call fcn.0040bc08
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, esp
mov dword [esi + 8], ecx
mov dword [esi], edx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [ebp - 0x26c], eax
call sub.KERNEL32.DLL_FindFirstFileExA
sub esp, 0x18
mov ecx, 0xffffffff
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], ecx
jne 0x40ca4a
mov dword [ebp - 0xc], 0
jmp 0x40cbcb
mov dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x15c]
and eax, 0x10
cmp eax, 0
je 0x40cb81
lea eax, [0x420fca]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00412fac
cmp eax, 0
je 0x40cb7f
lea eax, [0x420fcc]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00412fac
cmp eax, 0
je 0x40cb7f
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00412ffc
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
add ecx, 0x2c
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x270], eax
call fcn.0040bc08
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [ebp - 0x274], eax
call esi
cmp eax, 0
jne 0x40cb26
jmp 0x40cbaa
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x14], 0
je 0x40cb7d
mov eax, 1
lea ecx, [ebp - 0x260]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [ebp - 0x278], eax
call fcn.0040c998
mov ecx, dword [ebp - 0x264]
add ecx, eax
mov dword [ebp - 0x264], ecx
jmp 0x40cb7f
jmp 0x40cb81
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_FindNextFileA
sub esp, 8
cmp eax, 0
jne 0x40cba5
jmp 0x40cbaa
jmp 0x40ca54
mov eax, dword [ebp - 0x160]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_FindClose
sub esp, 4
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0xc]
add esp, 0x28c
pop esi
pop edi
pop ebp
ret
Function at 0x40cbd8
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0xc1059ed8
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x367cd507
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x3070dd17
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0xf70e5939
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xffc00b31
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x68581511
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0x64f98fa7
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0xbefa4fa4
add esp, 4
pop ebp
ret

Function at 0x40cc48
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x6a09e667
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0x5be0cd19
add esp, 4
pop ebp
ret
Function at 0x40d464
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax], 0xc1059ed8
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 8], 0x367cd507
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x10], 0x3070dd17
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x18], 0xf70e5939
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x20], 0xffc00b31
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x28], 0x68581511
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x30], 0x64f98fa7
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x38], 0xbefa4fa4
add esp, 4
pop ebp
ret

Function at 0x40d514
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x6a09e667
mov dword [eax], 0xf3bcc908
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 8], 0x84caa73b
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x10], 0xfe94f82b
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x18], 0x5f1d36f1
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x20], 0xade682d1
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x28], 0x2b3e6c1f
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x30], 0xfb41bd6b
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x38], 0x137e2179
add esp, 4
pop ebp
ret
Function at 0x40df90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x100
mov dword [eax], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x12c], eax
call fcn.0040c048
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x120]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
sub esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
ja 0x40e016
mov dword [ebp - 0x10], 0
jmp 0x40e158
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call fcn.00410654
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 0x18]
mov esi, esp
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi], ecx
mov dword [esi + 4], 0
call sub.VERSION.DLL_GetFileVersionInfoA
sub esp, 0x10
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x18]
lea esi, [ebp - 0x120]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], ecx
mov dword [edi], edx
mov dword [edi + 4], 0x421410
mov dword [ebp - 0x130], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x40e0bb
cmp dword [ebp - 0x120], 4
jne 0x40e0bb
mov eax, dword [ebp - 0x11c]
movzx eax, word [eax]
shl eax, 0x10
mov ecx, dword [ebp - 0x11c]
movzx ecx, word [ecx + 2]
or eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x40e0c5
mov dword [ebp - 0x124], 0x40904e4
lea eax, str.StringFileInfo_08XFileDescription
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004149a8
lea ecx, [ebp - 0x11c]
lea edx, [ebp - 0x118]
mov esi, dword [ebp - 0x18]
lea edi, [ebp - 0x120]
mov ebx, esp
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [ebx], esi
mov dword [ebp - 0x134], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x40e144
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00412ffc
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00410664
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4116c4
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e3a], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e39], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e38], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e37], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e36], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e35], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x421e34], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEF]
mov byte [0x421e33], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x4117cf
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x4117d1
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x4117e4
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.004120ae
cmp dword [0x4216d0], ecx
jne 0x4118e9
mov ecx, fcn.00412432
cmp dword [0x4216d4], ecx
jne 0x4118e9
mov ecx, fcn.0041262a
cmp dword [0x4216d8], ecx
jne 0x4118e9
mov ecx, fcn.00412944
cmp dword [0x4216dc], ecx
jne 0x4118e9
mov ecx, 0x4109e4
cmp dword [0x4216e0], ecx
jne 0x4118e9
xor eax, eax
mov ecx, 0x4109f4
cmp dword [0x4216e4], ecx
jne 0x4118e9
mov ecx, dword [0x425224]
test ecx, ecx
jne 0x4118e9
call fcn.004116c4
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x4118e9
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0x425224], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.004120ae
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret