joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5edc78
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5edc8f
add esp, 0xfffffff0
call fcn.0040906c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004aef38
mov eax, dword [0x8c16f8]
cmp byte [eax], 0
jne 0x5edcbc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x8c2000]
cmp word [eax + 2], 0
jne 0x5edcd6
mov eax, dword [0x8c2000]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005eff14
mov eax, dword [0x8c2334]
cmp word [eax + 2], 0
jne 0x5edcf0
mov eax, dword [0x8c2334]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005f0118
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4db2fc]
call fcn.004e15a4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5f0624
mov dl, 1
mov eax, dword [0x47aeac]
call fcn.00408a94
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x47aeac]
call fcn.00408a94
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4dfe94]
call fcn.004eae00
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5eded8
mov eax, dword [0x8c1ca0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004eb204
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5f08e4
mov dl, 1
mov eax, dword [0x47aeac]
call fcn.00408a94
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x8c1ca0]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425cdc
test eax, eax
je 0x5ede0a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425ad4
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425cc0
test eax, eax
je 0x5ede22
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b8b4
push ebx
push 0x5ef8f0
call fcn.005e33dc
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x8c16f8]
cmp byte [eax], 0
jne 0x5ede73
mov eax, ebx
call fcn.005ee0c0
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005f0b1c
mov eax, ebx
call fcn.005f177c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5eded0
call fcn.004090c4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ee404
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5ee4a6
cmp dword [ebx + 0xac], 0
jne 0x5ee4a0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5ee340
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5ee4a0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5ee466
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5ee4a0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.0049e030
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5ee475
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5ee6e4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x8c9198]
cmp dword [eax + 0x188], 0
je 0x5ee85e
test bl, bl
jne 0x5ee7a9
cmp dword [esi + 0xb4], 0
jne 0x5ee79e
mov eax, esi
call fcn.005f15cc
push eax
push 0x5ee5d8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5ee76f
mov eax, dword [0x8c9198]
cmp byte [eax + 0xeb], 0
je 0x5ee76f
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5ee750
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ee76f
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ee758
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ee79e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0049e030
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ee77e
inc dword [esi + 0xb4]
jmp 0x5ee85e
cmp dword [esi + 0xb4], 0
jle 0x5ee85e
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5ee85e
cmp dword [esi + 0x58], 0
je 0x5ee813
mov eax, dword [0x8c9198]
cmp byte [eax + 0xeb], 0
je 0x5ee813
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5ee7f4
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ee813
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ee7fc
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ee842
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0049e030
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ee822
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5dfc50]
call fcn.0040d3dc
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5ef47c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5ef4d9
cmp byte [ebx + 0xeb], 0
jne 0x5ef4d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a918
mov eax, dword [esi]
test eax, eax
je 0x5ef4c6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ef4e6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040ab70
jmp 0x5ef4e6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040ab70
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5f0d04
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5f0d75
mov eax, esi
call fcn.0050e140
test al, al
je 0x5f0d75
mov eax, dword [ebx + 0x98]
call fcn.0050dd6c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f0d75
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x128]
test al, al
je 0x5f0d66
push 0
mov eax, dword [ebx + 0x98]
call fcn.0050dd6c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00504b68
jmp 0x5f0d75
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005f0b3c
pop esi
pop ebx
ret
Function at 0x5fb760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.0040b7f8
push eax
mov eax, esi
call fcn.0040b7f8
push eax
mov eax, ebx
call fcn.0040b7f8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x609124
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6092e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040abb8
mov eax, dword [ebp - 4]
call fcn.00608ae8
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x609179
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040bc7c
lea eax, [ebp - 0x3c]
push eax
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0060a398
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.0040abb8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00609c5c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x60926c
xor eax, eax
push ebp
push 0x609265
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00608ccc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0060938c
test al, al
je 0x609243
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a918
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x609243
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b7f8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x60923d
mov eax, dword [ebp - 8]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.0040b860
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc]
call fcn.00609124
dec ebx
cmp ebx, 0xffffffff
jne 0x6091f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60926c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00608ccc
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
ret
cmp dword [0x8bac28], 0
jne 0x609297
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00608cb8
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
jmp 0x6092c1
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1b]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00608cb8
push eax
call dword [0x8bac28]
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6092f0
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.0040a7f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret
Function at 0x6092f8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov esi, eax
mov ecx, 1
mov edx, ebx
mov eax, 0x609388
call fcn.0040be44
test eax, eax
jne 0x609331
mov eax, ebx
call fcn.0040b7f8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete al
jmp 0x609375
xor eax, eax
mov edx, dword [0x8c256c]
cmp dword [edx], 0
je 0x609375
mov eax, ebx
test eax, eax
je 0x609349
sub eax, 4
mov eax, dword [eax]
mov edx, eax
add edx, edx
mov word [ebp - 8], dx
mov word [ebp - 6], dx
mov eax, ebx
call fcn.0040b7f8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [0x8c256c]
mov eax, dword [eax]
call eax
test eax, eax
sete al
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6093f8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6094b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0060938c
test al, al
je 0x609492
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a918
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x609492
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040b860
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x60944b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6094b7
lea eax, [ebp - 0x2c]
call fcn.0040a790
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x6094c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x609578
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0060938c
test al, al
je 0x60955a
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a918
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x60955a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040b860
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x609513
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60957f
lea eax, [ebp - 0x2c]
call fcn.0040a790
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x609800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 5
call fcn.00407f88
lea eax, [ebx + 1]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.0040b7f8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.00608b4c
mov byte [ebx], al
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x609b6c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00608b04
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040b7f8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x609bcb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x8c2068]
mov dl, 1
mov eax, dword [0x4d5900]
call fcn.0042b0c4
call fcn.00409e94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x609bd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b7f8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x609c2c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x8c28e8]
mov dl, 1
mov eax, dword [0x4d5900]
call fcn.0042b0c4
call fcn.00409e94
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00608b4c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x609f18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x60a02f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00608ccc
xor eax, eax
push ebp
push 0x60a00a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0060938c
test al, al
je 0x609fee
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00609df8
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a918
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x609fee
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x609fea
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b860
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00609df8
pop ecx
inc edi
dec ebx
jne 0x609f9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60a011
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00608ccc
ret
Function at 0x60a040
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x60a281
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00608ccc
xor eax, eax
push ebp
push 0x60a257
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0060938c
test al, al
je 0x60a23b
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a918
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x60a23b
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x60a22f
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b860
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00609c5c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x60a22f
xor eax, eax
push ebp
push 0x60a228
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00608ccc
xor eax, eax
push ebp
push 0x60a20a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b860
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00608cd0
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b860
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00609c5c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x60a1e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00609f18
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0060a040
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60a1ee
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x60a0cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60a25e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00608ccc
ret
Function at 0x60f9b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x60f9ca
add esp, 0xfffffff0
call fcn.0040906c
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x60fb21
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 4], eax
xor edx, edx
mov eax, ebx
call fcn.00408a94
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b7f8
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
mov dword [ebx + 8], esi
test esi, esi
jne 0x60fa29
mov ecx, 0x60fb54
mov dl, 1
mov eax, dword [0x60eed8]
call fcn.0042afcc
call fcn.00409e94
mov eax, dword [ebx + 8]
push eax
call fcn.0040fd9c
pop ecx
mov esi, eax
mov dword [ebx + 4], esi
push esi
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x60fa70
mov eax, dword [ebx + 4]
push eax
call fcn.0040fdac
pop ecx
xor eax, eax
mov dword [ebx + 4], eax
mov ecx, 0x60fb90
mov dl, 1
mov eax, dword [0x60eed8]
call fcn.0042afcc
call fcn.00409e94
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x60fbe4
mov eax, dword [ebx + 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x60faaa
cmp dword [ebp - 0x14], 0
je 0x60faaa
cmp dword [ebp - 0x10], 0
jbe 0x60faaa
mov eax, dword [ebp - 0x14]
mov esi, eax
lea edi, [ebx + 0xc]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x60fbe8
mov eax, dword [ebx + 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x60fb03
cmp dword [ebp - 0x18], 0
je 0x60fb03
cmp dword [ebp - 0x10], 0
jbe 0x60fb03
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
mov eax, dword [ebp - 0x18]
movzx edi, word [eax]
mov eax, esi
shr eax, 0x10
movzx eax, ax
movzx edx, di
shl edx, 0x10
or eax, edx
lea ecx, [ebp - 0x1c]
mov edx, 8
call fcn.00424354
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x40]
call fcn.0040ab70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60fb28
lea eax, [ebp - 0x1c]
call fcn.0040a790
lea eax, [ebp - 4]
call fcn.0040a790
ret