joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447b90
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x28
xor ecx, ecx
mov dword [esp + 0x15], ecx
mov dword [esp + 0x19], ecx
push ebx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x21], ecx
push ebp
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x29], ecx
push edx
lea eax, [esp + 0x14]
xor ebx, ebx
mov word [esp + 0x31], cx
push eax
mov dword [esp + 0x18], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x37], cl
call fcn.004322a0
mov ecx, dword [esp + 0x3c]
add esp, 8
push ecx
push ebx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, eax
cmp ebp, ebx
jne 0x447bfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x447c19
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x44]
mov ebx, dword [esi]
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x4c]
mov edx, dword [edi]
mov ecx, edx
sub ecx, ebx
jns 0x447c37
add ecx, esi
mov ebx, esi
sub ebx, ecx
dec ebx
lea ecx, [eax + 8]
cmp ecx, ebx
jle 0x447c5e
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x28
ret
mov ebx, dword [esp + 0x40]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x14], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x15], cl
mov ecx, eax
mov byte [esp + 0x17], al
lea eax, [esp + 0x10]
push 8
shr ecx, 8
push eax
mov eax, esi
mov byte [esp + 0x18], 0x98
mov byte [esp + 0x19], 0x76
mov byte [esp + 0x1a], 0x43
mov byte [esp + 0x1b], 0x21
mov byte [esp + 0x1e], cl
call fcn.00447ad0
mov eax, dword [edi]
add eax, 8
xor edx, edx
div esi
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
push ecx
push eax
mov eax, esi
call fcn.00447ad0
mov ecx, dword [edi]
mov edx, dword [esp + 0x64]
lea eax, [ecx + edx + 8]
xor edx, edx
div esi
add esp, 0x10
push ebp
mov dword [edi], edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x447f00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
lea eax, [ebp - 0x20]
xor edi, edi
push eax
mov dword [ebp - 4], 0xffffffff
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x447f39
mov eax, edi
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0xa
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, 0x80000000
mov bx, 0xfa0
bsf ecx, eax
dec bx
jne 0x447f53
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
sub eax, edx
cmp eax, ecx
jae 0x447f76
mov dword [ebp - 4], eax
dec dword [ebp - 8]
jne 0x447f40
mov ecx, dword [ebp - 0x20]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
test edx, edx
jne 0x447f9f
lea esp, [esp]
inc ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 3
test edx, edx
je 0x447f90
mov ebx, dword [ebp - 4]
mov eax, 0xcccccccd
imul ebx, ebx, 0x186a0
mul ecx
mov eax, edx
shr eax, 3
mov dword [ebp - 8], eax
mov eax, ebx
mov ebx, dword [ebp - 8]
xor edx, edx
div ebx
xor edx, edx
mov ebx, eax
div ecx
shr ecx, 1
cmp edx, ecx
jbe 0x447fcd
inc ebx
test ebx, ebx
jne 0x447fe9
mov eax, edi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
pop edi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
xor edx, edx
div ebx
mov edi, ebx
shr edi, 1
cmp edx, edi
mov ecx, eax
jbe 0x447ffb
inc eax
mov edx, dword [ebp + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
pop edi
mov dword [esi + 0xc], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4482d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push ebx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
cmp ebp, 0x7fffffff
je 0x44830d
lea ecx, [ebp + 1]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor edx, edx
mov dword [esp + 0x10], edx
xor ax, ax
out 0x70, al
xor ax, ax
in al, 0x71
mov word [esp + 0x10], ax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], edx
xor ax, ax
out 0x70, al
xor ax, ax
in al, 0x71
mov word [esp + 0x10], ax
mov edi, dword [esp + 0x10]
mov eax, edi
sub eax, ecx
cmp edi, ecx
jge 0x44834a
add eax, 0xa
jmp 0x44835b
mov dword [esp + 0x1c], ecx
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
mov ecx, dword [esp + 0x1c]
cmp eax, edx
je 0x448326
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
rdtsc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], edx
xor ax, ax
out 0x70, al
xor ax, ax
in al, 0x71
mov word [esp + 0x10], ax
mov esi, dword [esp + 0x10]
cmp esi, edi
jge 0x448395
mov eax, esi
sub eax, edi
add eax, 0xa
jmp 0x4483a0
mov ecx, esi
sub ecx, edi
xor eax, eax
test ecx, ecx
setg al
cmp eax, edx
je 0x448371
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
rdtsc
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp ebp, 0x7fffffff
je 0x4483c6
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
sub eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
sbb eax, ebx
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x20]
mov eax, 0x4f8b588f
mul ebx
mov ecx, ebx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov eax, 0x431bde83
mul ebx
shr edx, 0x12
lea eax, [edx + edx*4]
shr ecx, 0x10
shl eax, 1
sub ecx, eax
cmp ecx, 6
mov ebp, edx
jb 0x448431
inc edx
mov eax, dword [esp + 0x3c]
sub esi, edi
imul esi, esi, 0xf4240
mov dword [eax], ebx
mov dword [eax + 4], esi
pop edi
mov dword [eax + 8], ebp
pop esi
pop ebp
mov dword [eax + 0xc], edx
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x448ad0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x200c
call fcn.00459eb0
push esi
mov esi, dword [esp + 0x2018]
push edi
xor edi, edi
test esi, esi
jne 0x448afc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
add esp, 0x200c
ret
mov eax, dword [esp + 0x2018]
test eax, eax
je 0x448c0b
cmp eax, 0xffffffff
je 0x448c0b
push ebx
mov ebx, dword [esi + 4]
push ebp
add ebx, 4
push ebx
call fcn.00459619
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x448bfe
mov eax, dword [esi]
mov dword [ebp], eax
mov ecx, dword [esi + 4]
mov esi, dword [esi + 8]
mov edx, ecx
shr ecx, 2
lea edi, [ebp + 4]
rep movsd dword es:[edi], dword [esi]
push 0
lea eax, [esp + 0x1c]
push eax
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x202c]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov dword [esp + 0x10], eax
je 0x448bf1
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x2000
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [esp + 0x10], eax
je 0x448bf1
cmp dword [esp + 0x14], 4
jb 0x448bf1
mov eax, dword [esp + 0x2028]
test eax, eax
je 0x448bae
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x2030]
test esi, esi
je 0x448bbf
mov edx, dword [esp + 0x20]
mov dword [esi], edx
mov edi, dword [esp + 0x202c]
test edi, edi
je 0x448bf1
mov eax, dword [esi]
push eax
call fcn.00459619
add esp, 4
test eax, eax
mov dword [edi], eax
je 0x448bf1
mov ecx, dword [esi]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x24]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.0045932f
mov edi, dword [esp + 0x14]
add esp, 4
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 0x200c
ret
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
add esp, 0x200c
ret
Function at 0x44a750
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push esi
push edi
je 0x44a806
mov edi, dword [esp + 0x14]
test edi, edi
je 0x44a806
mov esi, dword [esp + 0x18]
cmp esi, 1
jl 0x44a806
push 0x25
push ebx
call fcn.004590c0
add esp, 8
test eax, eax
je 0x44a7d2
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x44a7c5
cmp eax, esi
jg 0x44a7c9
push 0x25
push edi
call fcn.004590c0
add esp, 8
test eax, eax
je 0x44a7bf
push esi
push edi
call fcn.0044a340
add esp, 8
xor ecx, ecx
test eax, eax
setge cl
pop edi
pop esi
pop ebx
dec ecx
mov eax, ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp eax, esi
jle 0x44a806
pop edi
pop esi
mov eax, 1
pop ebx
ret
lea edx, [esi - 1]
push edx
push ebx
push edi
call fcn.00458f80
mov eax, ebx
add esp, 0xc
mov byte [edi + esi - 1], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44a7f0
sub eax, edx
xor ecx, ecx
cmp eax, esi
setge cl
pop edi
pop esi
pop ebx
mov eax, ecx
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x44af90
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0x25
push ebp
xor ebx, ebx
call fcn.004590c0
add esp, 8
test eax, eax
je 0x44b001
mov eax, dword [esp + 0x14]
lea esi, [eax + eax*4]
shl esi, 1
cmp esi, 0x410
jge 0x44afbe
mov esi, 0x410
push esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x44afd4
mov esi, 0x4099
jmp 0x44b03e
push edi
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esi - 1]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
pop edi
jle 0x44b001
dec esi
cmp eax, esi
jg 0x44b001
mov ebp, ebx
push ebp
call fcn.0045c02e
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x44b03e
call fcn.0045bfa9
cmp dword [eax], 7
je 0x44b039
call fcn.0045bfa9
cmp dword [eax], 2
je 0x44b039
call fcn.0045bfa9
cmp dword [eax], 8
je 0x44b039
call fcn.0045bfa9
cmp dword [eax], 0xc
jne 0x44b03e
mov esi, 0x401d
test ebx, ebx
je 0x44b04b
push ebx
call fcn.0045932f
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x44b060
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44b0d3
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0xc]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffe
pop esi
add esp, 8
ret
or eax, 0xffffffff
add esp, 8
ret
Function at 0x44b0e0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
je 0x44b141
cmp byte [esi], 0
je 0x44b141
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b13a
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x44b1c3
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x20006
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [esp + 0x14]
jne 0x44b17f
mov eax, dword [esp + 0x18]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x44b1c3
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x44b1ba
push str.SHDeleteKeyA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44b1ba
push edi
push ebx
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x44b1c3
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
ret
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x44b1d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
or edx, 0x20019
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0
push eax
push ecx
mov dword [esp + 0x18], 0
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b2a9
mov ecx, dword [esi]
mov edx, dword [esp + 0x24]
push ebx
mov ebx, ecx
shr ecx, 2
push edi
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
test eax, eax
je 0x44b285
lea ecx, [esp + 0x10]
push ecx
push edx
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x30]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x44b26c
pop edi
pop ebx
mov eax, 0xfffffffe
pop esi
add esp, 8
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], eax
pop ebx
mov dword [esi], ecx
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], 0x1020001
pop ebx
mov dword [esi], 0
xor eax, eax
pop esi
add esp, 8
ret
or eax, 0xffffffff
pop esi
add esp, 8
ret
Function at 0x44b2f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
push esi
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x43
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
stosb byte es:[edi], al
push 0x10e
lea eax, [esp + 0xc]
push eax
push ecx
xor esi, esi
call fcn.0044a750
add esp, 0xc
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x44b372
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x44b382
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44b36d
mov eax, 0x400f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x44b37d
mov eax, 0x4010
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, 0x4021
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44ba30
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
xor ebx, ebx
mov dword [esp + 0x34], 0x9c
call esi
test eax, eax
jne 0x44ba81
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x94
call esi
test eax, eax
jne 0x44ba81
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x34]
cmp eax, 6
jae 0x44ba96
cmp eax, 5
jne 0x44bad0
cmp dword [esp + 0x38], 2
jne 0x44bad0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44bac3
lea ecx, [esp + 0xc]
push ecx
call eax
cmp word [esp + 0xc], 9
jne 0x44bad0
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44bae0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
push esi
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov esi, 0xffffff9d
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x44bb34
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call edi
test eax, eax
jne 0x44bb34
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
dec eax
je 0x44bbd0
dec eax
jne 0x44bc08
mov eax, dword [esp + 0xc]
cmp eax, 6
jb 0x44bb6b
mov cl, byte [esp + 0xa2]
xor edx, edx
cmp cl, 1
setne dl
add edx, 0xa
mov esi, edx
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x44bbb6
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x44bb93
mov dl, byte [esp + 0xa2]
xor eax, eax
cmp dl, 1
setne al
add eax, 8
mov esi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x44bba5
mov esi, 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x44bc08
mov esi, 3
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x44bc08
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x44bc08
mov esi, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 4
jne 0x44bc08
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x44bbec
mov esi, 7
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x44bbfe
mov esi, 6
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x5a
jne 0x44bc08
mov esi, 5
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44c250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
push 0x20019
push 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x18], 0
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44c316
mov ecx, dword [ebx]
mov edx, dword [esp + 0x20]
push esi
mov esi, ecx
shr ecx, 2
push edi
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
test eax, eax
je 0x44c2ff
lea ecx, [esp + 0x10]
push ecx
push edx
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x2c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x44c2e6
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], eax
pop esi
mov dword [ebx], ecx
xor eax, eax
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
add esp, 8
ret
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x44c430
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], 0x9c
call esi
test eax, eax
jne 0x44c47f
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call esi
test eax, eax
je 0x44c4f0
cmp dword [esp + 0x14], 5
jb 0x44c4f0
lea eax, [esp + 0x24]
mov dword [esp + 8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44c495
sub eax, edx
mov dword [esp + 0xc], eax
je 0x44c4f0
push 0xc
lea edx, [esp + 0x28]
push str.Service_Pack
push edx
call fcn.0045c0d0
add esp, 0xc
test eax, eax
jne 0x44c4f0
mov dl, byte [esp + 0x30]
mov cl, 0x20
cmp dl, cl
mov eax, 0xc
jne 0x44c4d9
jmp 0x44c4d0
mov dl, byte [esp + eax + 0x25]
inc eax
cmp dl, cl
je 0x44c4d0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + eax + 0x28]
push 0x4696c0
push edx
call fcn.00458f3f
add esp, 0xc
mov eax, dword [esp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44c500
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
xor ebx, ebx
mov dword [esp + 0x34], 0x9c
call esi
test eax, eax
jne 0x44c551
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x94
call esi
test eax, eax
jne 0x44c551
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x34]
cmp eax, 6
jae 0x44c586
cmp eax, 5
jne 0x44c57b
mov eax, dword [esp + 0x38]
cmp eax, 2
je 0x44c586
cmp eax, 2
jae 0x44c5d6
mov ebx, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x44c5d1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44c5b3
lea ecx, [esp + 0xc]
push ecx
call eax
mov ax, word [esp + 0xc]
cmp ax, 9
jne 0x44c5cc
mov ebx, 2
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x44c5d6
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c5e0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebp
push edi
mov edi, dword [esp + 0x14]
or ebp, 0xffffffff
test edi, edi
mov dword [esp + 8], 0
jne 0x44c603
pop edi
mov eax, 0x57
pop ebp
add esp, 8
ret
push ebx
push esi
lea eax, [esp + 0x10]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x44c6be
push esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44c6c6
mov ecx, dword [esp + 0x10]
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x44c6a3
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x469b10
xor esi, esi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44c6a3
cmp dword [esp + 0x1c], 0x34
jne 0x44c6ab
mov ecx, dword [esp + 0x14]
cmp dword [ecx], 0xfeef04bd
jne 0x44c6ab
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x44c681
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x44c68e
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
push ebx
xor ebp, ebp
call fcn.0045932f
add esp, 4
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebx
call fcn.0045932f
add esp, 4
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret