joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5f90
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f2c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x10], esp
push esi
push esi
push 3
push esi
push 1
push bind
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
jne 0x4c5fee
or eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x18], edi
jne 0x4c600c
or esi, 0xffffffff
jmp 0x4c60f8
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
jne 0x4c602d
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4c60ea
cmp word [esi], 0x5a4d
je 0x4c6048
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4c60ea
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x454c
je 0x4c6069
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4c60ea
mov ecx, dword [eax + 0xbc]
test ecx, ecx
jne 0x4c6087
push 0x714
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4c60ea
mov eax, dword [eax + 0xb8]
lea ecx, [ebp - 0x38]
add eax, esi
mov ebx, dword [eax + 8]
lea esi, [eax + 0xc]
call fcn.005111e1
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00511241
mov edi, dword [ebp - 0x34]
mov ecx, ebx
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x30], ebx
jge 0x4c6122
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00511214
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
test esi, esi
je 0x4c60f5
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x14]
test edi, edi
je 0x4c6103
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x4c610f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4c60d5
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x20]
push ecx
push edx
push 0x5971e8
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c60d5
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ecx, 0xd
mov dword [ebp - 0x14], 0
rep movsd dword es:[edi], dword [esi]
jmp 0x4c60d5
Function at 0x4c6160
Capabilities:
Get file version info

Disassembly:
sub esp, 0x8c
mov cl, byte [0x5bd31c]
mov al, 1
test al, cl
mov dword [esp], 0
mov dword [esp + 8], 0
jne 0x4c61a3
mov dl, cl
mov ecx, 0x5bd2f0
or dl, al
mov byte [0x5bd31c], dl
call fcn.005111e1
push 0x4c62c0
call fcn.004f9f1e
add esp, 4
push ebx
mov ebx, dword [esp + 0x98]
push esi
push edi
mov ecx, 0xd
xor eax, eax
mov edi, ebx
push 0x7e
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xa0]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.00421160
add esp, 0xc
cmp eax, 0xfffffffe
je 0x4c62ab
cmp eax, 0xffffffff
je 0x4c6292
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jg 0x4c6213
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4c62a1
pop edi
pop esi
mov eax, 0x450
pop ebx
add esp, 0x8c
ret
cmp dword [0x5bd2f8], esi
jge 0x4c623f
push 0xffffffffffffffff
push esi
mov ecx, 0x5bd2f0
call fcn.00511241
cmp dword [0x5bd2f8], esi
jge 0x4c623f
pop edi
pop esi
mov eax, 8
pop ebx
add esp, 0x8c
ret
mov eax, dword [0x5bd2f4]
lea ecx, [esp + 0x18]
push eax
push esi
push 0
push ecx
mov edi, eax
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4c6292
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push eax
push 0x5971e8
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c6292
mov esi, dword [esp + 0xc]
mov ecx, 0xd
mov edi, ebx
xor eax, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 0x8c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4c62a1
mov eax, 2
pop edi
pop esi
pop ebx
add esp, 0x8c
ret
pop edi
pop esi
mov eax, 0x6f
pop ebx
add esp, 0x8c
ret
Function at 0x4c6500
Capabilities:
Get file version info

Disassembly:
mov al, byte [0x5bd2e8]
sub esp, 0x31c
test al, 1
jne 0x4c6531
mov dl, al
mov ecx, 0x5bd308
or dl, 1
mov byte [0x5bd2e8], dl
call fcn.005111e1
push 0x4c66d0
call fcn.004f9f1e
add esp, 4
push ebx
mov ebx, dword [esp + 0x330]
push ebp
mov ebp, dword [esp + 0x330]
push esi
push edi
mov ecx, ebp
mov dword [esp + 0x10], 0
mov dword [ebx], 0
call fcn.0051286f
mov ecx, dword [esp + 0x330]
lea eax, [esp + 0x24]
push 0x104
push eax
push ecx
call fcn.00421160
add esp, 0xc
cmp eax, 0xfffffffe
je 0x4c66b2
cmp eax, 0xffffffff
je 0x4c669c
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jg 0x4c65ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebx], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
cmp dword [0x5bd310], esi
jge 0x4c65df
push 0xffffffffffffffff
push esi
mov ecx, 0x5bd308
call fcn.00511241
cmp dword [0x5bd310], esi
jge 0x4c65df
pop edi
pop esi
mov dword [ebx], 8
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
mov eax, dword [0x5bd30c]
mov ecx, dword [esp + 0x14]
push eax
push esi
lea edx, [esp + 0x2c]
push ecx
push edx
mov edi, eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4c6684
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c6684
mov edx, dword [esp + 0x334]
xor ecx, ecx
mov eax, dword [edx]
xor edx, edx
push eax
mov eax, dword [esp + 0x1c]
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x138]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.004fa1d7
add esp, 0x14
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
lea eax, [esp + 0x12c]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c6684
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c6674
push eax
mov ecx, ebp
call fcn.00512a6d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x31c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebx], eax
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x31c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebx], eax
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
pop edi
pop esi
mov dword [ebx], 0x6f
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
Function at 0x4c9960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f7f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5ab980]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov ecx, dword [0x5ab980]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.004c6940
lea ecx, [esi + 0x40]
mov byte [esp + 0x14], 2
call fcn.004c6bf0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x64], edi
mov dword [esi], edi
mov dword [esi + 0xc], 0x3c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4c997b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f7f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5ab980]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov ecx, dword [0x5ab980]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.004c6940
lea ecx, [esi + 0x40]
mov byte [esp + 0x14], 2
call fcn.004c6bf0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x64], edi
mov dword [esi], edi
mov dword [esi + 0xc], 0x3c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ce710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x550d88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x5ab980]
push ebx
push ebp
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x30]
mov bl, 3
mov byte [esp + 0x28], bl
mov edi, dword [ebp + 0x64]
test edi, edi
je 0x4ce88d
push esi
mov eax, edi
mov edi, dword [edi]
lea ecx, [esp + 0x10]
mov esi, dword [eax + 8]
lea eax, [esi + 8]
push eax
call fcn.00512a1d
mov esi, dword [esi + 0x48]
lea ecx, [esp + 0x10]
call fcn.00512e06
push str.PROGRAMSACCESSORIES
lea ecx, [esp + 0x14]
call fcn.0050e341
test eax, eax
jg 0x4ce884
cmp esi, 1
jle 0x4ce7f0
lea ebp, [esi - 1]
sub esi, ebp
push 0x5c
lea ecx, [esp + 0x14]
call fcn.0050e31f
test eax, eax
jle 0x4ce7e6
lea ecx, [esp + 0x20]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0050e2a7
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], bl
call fcn.005128e4
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.00512a1d
dec ebp
jne 0x4ce79e
mov ebp, dword [esp + 0x34]
cmp esi, 1
jne 0x4ce845
push str..LNK
lea ecx, [esp + 0x14]
call fcn.0050e341
test eax, eax
jle 0x4ce827
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.004222e0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
jmp 0x4ce87c
lea edx, [esp + 0x10]
push edx
call fcn.0041f9c0
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [ebp + 0xc]
push 0
push eax
call fcn.004059e0
jmp 0x4ce884
test esi, esi
jne 0x4ce884
push str..LNK
lea ecx, [esp + 0x14]
call fcn.0050e341
test eax, eax
jle 0x4ce884
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
call fcn.004222e0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [ebp + 0x28]
call fcn.00405950
test edi, edi
jne 0x4ce75e
pop esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.005128e4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.005128e4
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x4e6490
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x555790
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1bc], 0xffffffff
jne 0x4e64c9
mov ecx, dword [0x5b8ca8]
xor eax, eax
test ecx, ecx
setne al
mov dword [esi + 0x1bc], eax
mov edi, dword [esi + 0x1bc]
mov ecx, esi
neg edi
sbb edi, edi
and edi, 5
push edi
push 0x507d
call fcn.004e66b0
push edi
push 0x507e
mov ecx, esi
call fcn.004e66b0
push edi
push 0x507f
mov ecx, esi
call fcn.004e66b0
push edi
push 0x50ec
mov ecx, esi
call fcn.004e66b0
push edi
push 0x50fa
mov ecx, esi
call fcn.004e66b0
push edi
push 0x50fb
mov ecx, esi
call fcn.004e66b0
mov eax, dword [0x5ab980]
mov dword [esp + 0x10], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov bl, 2
cmp edi, 5
mov byte [esp + 0x58], bl
jne 0x4e6581
push str.idb_rr_blue
lea ecx, [esp + 0x10]
call fcn.00512a6d
lea ecx, [esp + 0x18]
push 0x5b5
push ecx
call fcn.00422640
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5c], 3
call fcn.00512a1d
mov byte [esp + 0x58], bl
lea ecx, [esp + 0x18]
jmp 0x4e65b8
push str.idb_ff_blue
lea ecx, [esp + 0x10]
call fcn.00512a6d
lea edx, [esp + 0x18]
push 0x5b6
push edx
call fcn.00422640
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5c], 4
call fcn.00512a1d
mov byte [esp + 0x58], bl
lea ecx, [esp + 0x18]
call fcn.005128e4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._x1__y1__img__s___x4__crhyperlink__u__s
push edx
call fcn.0050e6c7
mov eax, dword [esp + 0x24]
add esp, 0x10
lea edi, [esi + 0x1c0]
push eax
mov ecx, edi
call fcn.00516260
push 1
mov ecx, edi
call fcn.00491f40
push esi
lea ecx, [esp + 0x40]
call fcn.0051a41f
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x60], 5
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x1dc]
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call fcn.0051a28d
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
push 0xffffff
dec eax
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x28], eax
call fcn.00522dd5
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x1c]
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x58], bl
call fcn.0051a491
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 1
call fcn.005128e4
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 0
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret
Function at 0x4e9bc0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x555e28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov al, byte [ecx + 0x74]
mov dword [esp + 0x14], 0
test al, al
jne 0x4e9bf7
test dword [0x5bc5bc], 0x60000
je 0x4e9c87
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 1
push 0x40000000
push str.C:ASDLog.txt
mov dword [esp + 0x24], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e9c49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4e9c87
push 0
push 0
push eax
push 0
push 1
push 0x40000000
push str.C:ASDLog.txt
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4e9c87
push 0x598ccc
push 0x59960c
lea ecx, [esp + 0x24]
call fcn.0050e00f
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 8]
push 0
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4ea410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x555f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5ab980]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x28]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], 0
mov ebx, ecx
mov byte [esp + 0x13], 1
lea ecx, [ebx + 5]
push ecx
call fcn.00516a15
mov ecx, ebx
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
mov ecx, esi
test ebx, ebx
jle 0x4ea515
mov al, byte [edi + ebp]
cmp al, 0x20
je 0x4ea494
cmp al, 9
je 0x4ea494
mov byte [esp + 0x13], 0
jmp 0x4ea49c
mov dl, byte [esp + 0x13]
test dl, dl
jne 0x4ea50c
cmp al, 0x3b
je 0x4ea515
cmp al, 0x3e
je 0x4ea4b6
cmp al, 0x3c
jne 0x4ea509
mov edx, dword [esp + 0x2c]
cmp dword [edx + 0xc], 0
jle 0x4ea509
cmp al, 0x3e
jne 0x4ea4ba
mov byte [ecx], 0x3e
inc ecx
mov byte [ecx], 0
push esi
lea ecx, [esp + 0x18]
call fcn.00512a6d
lea ecx, [esp + 0x14]
call fcn.0050e8af
lea ecx, [esp + 0x14]
call fcn.0050e7b8
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4ea4f2
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00510f5f
push 0x5b0738
lea ecx, [esp + 0x18]
call fcn.00512a6d
mov al, byte [edi + ebp]
mov ecx, esi
cmp al, 0x3e
je 0x4ea50c
mov byte [ecx], al
inc ecx
inc edi
cmp edi, ebx
jl 0x4ea482
push esi
call fcn.00516a3e
mov edx, dword [esp + 0x30]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
mov esi, dword [edx + 0xc]
call fcn.005128e4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x4ec530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5565e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x54]
mov ecx, ebx
call fcn.00510e2a
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x58]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4ec5a4
lea ebp, [esi + 0x54]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, ebp
call fcn.00423e90
push eax
mov ecx, ebx
mov dword [esp + 0x24], 0
call fcn.00510fd7
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.005128e4
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4ec56a
lea ebx, [edi + 0x70]
push 1
mov ecx, ebx
call fcn.004ebc90
lea edx, [esi + 0x70]
mov ecx, ebx
push edx
call fcn.004ec7b0
lea ebx, [edi + 0x8c]
push 1
mov ecx, ebx
call fcn.004ebc90
lea eax, [esi + 0x8c]
mov ecx, ebx
push eax
call fcn.004eca10
lea ebx, [edi + 0xa8]
push 1
mov ecx, ebx
call fcn.004ebc90
lea ecx, [esi + 0xa8]
push ecx
mov ecx, ebx
call fcn.004eca10
lea edx, [esi + 0x50]
lea ecx, [edi + 0x50]
push edx
call fcn.00512a1d
mov cx, word [esi + 0x28]
sub esp, 0x18
mov eax, esp
mov dword [esp + 0x2c], esp
mov word [eax + 8], cx
mov dx, word [esi + 0x2a]
mov word [eax + 0xa], dx
mov cx, word [esi + 0x2c]
mov word [eax + 0xc], cx
mov dx, word [esi + 0x2e]
mov word [eax + 0xe], dx
mov ecx, dword [esi + 0x30]
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x34]
lea ecx, [edi + 0x20]
mov dword [eax + 0x14], edx
mov dword [eax], 0x563384
call fcn.004ed1c0
mov cx, word [esi + 0x40]
sub esp, 0x18
mov eax, esp
mov dword [esp + 0x2c], esp
mov word [eax + 8], cx
mov dx, word [esi + 0x42]
mov word [eax + 0xa], dx
mov cx, word [esi + 0x44]
mov word [eax + 0xc], cx
mov dx, word [esi + 0x46]
mov word [eax + 0xe], dx
mov ecx, dword [esi + 0x48]
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x4c]
lea ecx, [edi + 0x38]
mov dword [eax + 0x14], edx
mov dword [eax], 0x563384
call fcn.004ed1c0
mov cx, word [esi + 0x10]
sub esp, 0x18
mov eax, esp
mov dword [esp + 0x2c], esp
mov word [eax + 8], cx
mov dx, word [esi + 0x12]
mov word [eax + 0xa], dx
mov cx, word [esi + 0x14]
mov word [eax + 0xc], cx
mov dx, word [esi + 0x16]
mov word [eax + 0xe], dx
mov ecx, dword [esi + 0x18]
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x1c]
mov dword [eax + 0x14], edx
mov dword [eax], 0x563384
lea ecx, [edi + 8]
call fcn.004ed1c0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4

Function at 0x4ed3f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x4ed42a
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5aa990]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x4ed408
pop esi
ret
Function at 0x4ee670
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
push edi
push 0xa
pop edx
mov esi, eax
mov di, ax
shl esi, 0xd
shr di, 3
or esi, edi
and eax, 0xff
movzx edi, byte [ecx]
xor eax, edi
movzx ax, byte [eax + 0x5ab6a0]
xor eax, esi
inc ecx
dec edx
jne 0x4ee67d
pop edi
pop esi
ret

Function at 0x4ee719
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
push 0xa
xor eax, eax
pop edx
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x5bd35c]
xor eax, esi
inc ecx
dec edx
jne 0x4ee724
mov ecx, dword [esp + 0x10]
push 8
pop edx
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x5bd35c]
xor eax, esi
inc ecx
dec edx
jne 0x4ee743
pop edi
pop esi
ret
Function at 0x4eeb49
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, dword [esp + 0x18]
mov ebp, esp
sub esp, 0xcd4
mov dword [ecx], 0
push ebx
push esi
mov eax, dword [ebp + 0x10]
push edi
cmp eax, 1
mov dword [ebp - 8], 0xc30
je 0x4eeb7d
cmp eax, 2
je 0x4eebc1
mov eax, 0xe
jmp 0x4eed81
push 0
mov esi, dword [ebp + 8]
push esi
call fcn.004fb360
add esp, 8
cmp eax, 0xffffffff
jne 0x4eecb3
test byte [ebp + 0xc], 8
je 0x4eed7c
mov eax, dword [ebp + 0xc]
and eax, 7
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push esi
call fcn.004f00f8
cmp eax, 1
je 0x4eecb3
jmp 0x4eed81
xor edi, edi
mov esi, dword [ebp + 8]
mov al, byte [edi + esi]
test al, al
je 0x4eebe5
movsx eax, al
push eax
inc edi
call fcn.004fa873
add esp, 4
add al, 7
mov byte [ebp + edi - 0x41], al
cmp edi, 0x32
jl 0x4eebc6
push str.softwareclasses_vdsp
lea eax, [ebp - 0xa4]
mov byte [ebp + edi - 0x40], 0
push eax
call fcn.004fb270
add esp, 8
cmp byte [esi], 0x3a
jne 0x4eec38
xor eax, eax
cmp byte [esi + 4], 0x3a
je 0x4eec1e
mov cl, byte [eax + esi + 4]
inc eax
cmp byte [eax + esi + 4], 0x3a
mov byte [ebp + eax - 0xa5], cl
jne 0x4eec0b
mov byte [ebp + eax - 0xa4], 0
add eax, esi
lea ecx, [ebp - 0x40]
add eax, 5
push eax
push ecx
call fcn.004fb270
add esp, 8
lea eax, [ebp - 4]
lea ecx, [ebp - 0xa4]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4eec8b
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcd4]
push eax
lea edx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x40]
push edx
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4eec8b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4eecb3
mov eax, 0x2c
jmp 0x4eed81
test byte [ebp + 0xc], 8
je 0x4eed73
mov eax, dword [ebp + 0xc]
and eax, 7
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push esi
call fcn.004f00f8
cmp eax, 1
jne 0x4eed81
push 0x1ae
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x4eecd0
mov eax, 0x10
jmp 0x4eed81
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push 0
push esi
push ebx
call fcn.004effad
add esp, 0xc
cmp dword [ebp + 0x10], 3
jne 0x4eecef
push 0x11
jmp 0x4eecfb
cmp dword [ebp + 0x10], 4
jne 0x4eecf9
push 0x1a
jmp 0x4eecfb
push 0
push dword [ebp + 0x14]
lea ecx, [ebx + 0x104]
push ecx
call fcn.004effad
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov byte [ebx + 0x181], cl
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x182], ecx
push edi
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x186], ecx
mov dword [ebx + 0x1a6], ecx
mov dword [ebx + 0x1a2], ecx
mov dword [ebx + 0x1aa], edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0xcd4]
push eax
push edi
call fcn.004eed8a
add esp, 8
mov esi, eax
cmp esi, 1
je 0x4eed67
push edi
call fcn.004eeaeb
mov eax, esi
jmp 0x4eed81
mov ecx, dword [ebp + 0x18]
mov eax, 1
mov dword [ecx], edi
jmp 0x4eed81
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14