joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0664
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5427d4]
cmp dword [eax + 0x30], 0
je 0x4c070e
cmp dword [ebx + 0x94], 0
jne 0x4c0708
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4c05f4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4c0708
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4c06ce
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4c0708
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d9ac
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4c06dd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4c1270
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4c12a5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404990
jmp 0x4c12b2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048f4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4c23a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4c23e5
mov eax, esi
call fcn.004a8400
test al, al
je 0x4c23e5
mov eax, dword [ebx + 0x84]
call fcn.004a80fc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c23e5
push 0
mov eax, dword [ebx + 0x84]
call fcn.004a80fc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4c855c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebp, dword [esp + 0x14]
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
xor edi, edi
mov ebx, dword [esp + 0xc]
shr ebx, 0x10
mov eax, ebx
shl eax, 0x10
mov ebx, eax
mov eax, edi
shl eax, 0x10
sub ebx, eax
mov eax, ebx
xor edx, edx
div ebp
imul ebp
mov ebx, eax
push 4
push 0x3000
push ebp
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
je 0x4c85da
cmp esi, ebx
je 0x4c85da
push 0x8000
push 0
push esi
call sub.kernel32.dll_VirtualFree_1
inc edi
jmp 0x4c8653
test esi, esi
jne 0x4c865c
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp dword [esp + 0x40], 0x118
jb 0x4c8650
mov eax, dword [esp + 0x48]
and eax, 4
cmp eax, 4
jne 0x4c8650
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
cmp edx, dword [ebx + 4]
jne 0x4c8650
cmp eax, dword [ebx]
jne 0x4c8650
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
cmp edx, dword [ebx + 0x114]
jne 0x4c8650
cmp eax, dword [ebx + 0x110]
jne 0x4c8650
lea eax, [ebx + 8]
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031b0
je 0x4c865c
inc edi
xor ebx, ebx
cmp edi, 0x14
jle 0x4c8593
xor eax, eax
test esi, esi
je 0x4c86c2
cmp esi, ebx
jne 0x4c86de
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebx + 8]
mov edx, dword [esp]
call fcn.00403104
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov dword [edx], 1
jmp 0x4c86de
test ebx, ebx
je 0x4c86de
inc dword [ebx + 0x108]
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov ecx, dword [ebx + 0x108]
mov dword [edx], ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4cbb84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cbc00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53d58c]
cmp dword [eax], 2
jne 0x4cbbd4
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405110
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040518c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x4cbbea
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbc07
lea eax, [ebp - 4]
call fcn.00404ff0
ret
Function at 0x4cbd48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4cbd62
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 1], 1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
call fcn.004048a0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00404d7c
mov edx, eax
mov eax, ebx
call fcn.004cba1c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4cbeaa
xor eax, eax
push ebp
push 0x4cbea3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00404d7c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4cbe75
mov ax, word [0x4cbecc]
mov word [ebp - 0x12], ax
cmp byte [ebp + 0x10], 0
je 0x4cbdf3
mov ax, word [0x4cbed0]
or ax, word [ebp - 0x12]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0xc]
cmp eax, 0xf
ja 0x4cbdff
bt dword [ebp - 0x12], eax
jb 0x4cbe0c
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.004cb974
mov edx, dword [ebp - 0x10]
shr edx, 0
inc edx
mov eax, dword [ebp + 0xc]
call fcn.00404f08
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, edi
call fcn.00404d7c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4cbe64
mov eax, dword [ebp + 0xc]
call fcn.004048a0
cmp byte [ebp + 8], 0
je 0x4cbe59
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.004cb8ec
jmp 0x4cbe64
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
dec edx
shr edx, 0
mov eax, dword [ebp + 0xc]
call fcn.00404f08
jmp 0x4cbe8c
cmp byte [ebp + 8], 0
je 0x4cbe88
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.004cb8ec
jmp 0x4cbe8c
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbebf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [ebp + 8], 0
je 0x4cbebb
mov edx, esi
mov eax, ebx
call fcn.004cb7f4
jmp 0x4cbebf
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cbed4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.004cc850
test al, al
jne 0x4cbef7
mov edx, esi
mov eax, ebx
call fcn.004cbf88
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov eax, esi
call fcn.00404d7c
mov edx, eax
mov eax, ebx
call fcn.004cba1c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4cbf77
xor eax, eax
push ebp
push 0x4cbf70
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
xor eax, eax
mov al, byte [ebp + 0x10]
push eax
push 0
mov eax, edi
call fcn.00404d7c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cbf59
mov edx, esi
mov eax, ebx
call fcn.004cb870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbf80
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, esi
mov eax, ebx
call fcn.004cb870
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4cbfbc
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push esp
push 2
push 0
mov eax, edi
call fcn.00404d7c
mov edx, eax
mov eax, esi
call fcn.004cba1c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4cc01a
mov eax, ebp
call fcn.00404d7c
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test bl, bl
jne 0x4cc023
mov ecx, ebp
mov edx, edi
mov eax, esi
call fcn.004cb8ec
jmp 0x4cc023
mov edx, edi
mov eax, esi
call fcn.004cb870
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cc02c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4cc179
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00404d7c
mov edx, eax
mov eax, esi
call fcn.004cba1c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete bl
test bl, bl
je 0x4cc154
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp dword [ebp - 0x10], 0
je 0x4cc128
mov edi, dword [ebp - 0x10]
dec edi
cmp edi, 0
jb 0x4cc128
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00404f08
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404d7c
push eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x18]
call fcn.00404d7c
call fcn.0040a2d4
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404f08
push dword [ebp - 4]
push 0x4cc194
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404c3c
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.004cc02c
mov ebx, eax
test bl, bl
je 0x4cc128
dec edi
cmp edi, 0xffffffff
jne 0x4cc0b2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
test bl, bl
je 0x4cc15e
mov eax, dword [ebp - 4]
call fcn.00404d7c
mov edx, eax
mov eax, esi
call fcn.004cba1c
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
jmp 0x4cc15e
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004cb870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc180
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004048c4
ret

Function at 0x4cc198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.00404d7c
mov edx, eax
mov eax, ebx
call fcn.004cba1c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x4cc203
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404d7c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4cd0ac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cd26c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403220
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x53b28c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x53b290], eax
mov eax, dword [ebp - 0x24]
mov dword [0x53b294], eax
mov eax, dword [0x53d58c]
cmp dword [eax], 2
sete byte [0x53adbc]
push 0x4cd278
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.004ce08c
cmp byte [0x53adbc], 0
jne 0x4cd138
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004ce0bc
test al, al
je 0x4cd138
mov eax, dword [ebp - 0x4c]
mov dword [0x542f58], eax
jmp 0x4cd13f
xor eax, eax
mov dword [0x542f58], eax
call fcn.004cce24
and eax, 0x7f
cmp eax, 0x10
ja case.0x4cd150.0
jmp dword [eax*4 + 0x4cd157]
mov byte [0x53ada8], 1
jmp case.0x4cd150.0
mov byte [0x53adac], 1
jmp case.0x4cd150.0
mov byte [0x53adb0], 1
jmp case.0x4cd150.0
mov byte [0x53adb4], 1
jmp case.0x4cd150.0
mov byte [0x53adb8], 1
jmp case.0x4cd150.0
mov byte [0x53adc0], 1
mov byte [0x53adc4], 1
jmp case.0x4cd150.0
mov byte [0x53adc0], 1
mov byte [0x53adc8], 1
jmp case.0x4cd150.0
mov byte [0x53adc0], 1
mov byte [0x53adc8], 1
mov byte [0x53adcc], 1
jmp case.0x4cd150.0
mov byte [0x53add0], 1
jmp case.0x4cd150.0
mov byte [0x53add4], 1
jmp case.0x4cd150.0
mov byte [0x53add8], 1
jmp case.0x4cd150.0
mov byte [0x53addc], 1
jmp case.0x4cd150.0
mov byte [0x53ade0], 1
jmp case.0x4cd150.0
mov byte [0x53ade4], 1
jmp case.0x4cd150.0
mov byte [0x53ade8], 1
jmp case.0x4cd150.0
mov byte [0x53adec], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd273
lea eax, [ebp - 4]
call fcn.004048a0
ret

Function at 0x4ce068
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x4ce086
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4ce07e
test al, 0x10
je 0x4ce082
xor eax, eax
jmp 0x4ce088
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x4ce0bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ce163
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4ce14d
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404f08
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ce14d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4ce174
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ce14d
cmp dword [ebp - 8], 0x34
jne 0x4ce14d
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce16a
lea eax, [ebp - 0x10]
call fcn.004048a0
ret

Function at 0x4ce178
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4ce18d
add esp, 0xfffffff0
call fcn.00403cf0
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4ce1c2
mov ecx, dword [0x53cff4]
mov dl, 1
mov eax, dword [0x4cd9f4]
call fcn.0040d8f0
call fcn.0040421c
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404f08
mov eax, dword [ebx + 4]
call fcn.00404d7c
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoA
call fcn.0040efd4
mov eax, ebx
call fcn.004ce7bc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4ce20a
call fcn.00403d48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4cf768
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004cf724
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cf7dc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x542f88], eax
mov ebx, 0x4cf6b0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4cf7dc
xor eax, eax
push ebp
push 0x4cf7d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf7dc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf7e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.004cf724
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cf84f
mov ebx, dword [0x542f88]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4cf84f
xor eax, eax
push ebp
push 0x4cf848
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf84f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d2c48
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2d1c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404938
lea eax, [ebp - 8]
call fcn.00404dcc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4d2d06
mov eax, ebx
call fcn.004027ac
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4d2cff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4d2ce9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4d2d2c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4d2ce9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2d06
mov eax, dword [ebp - 0x10]
call fcn.004027cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2d23
lea eax, [ebp - 8]
call fcn.004048a0
ret
Function at 0x4e0a1c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov edi, 0x53b6d8
test ebp, ebp
je 0x4e0b00
mov ebx, eax
mov eax, ebp
mov esi, 3
xor edx, edx
div esi
lea eax, [eax + eax*2]
mov dword [esp], eax
mov esi, ebx
add esi, dword [esp]
jmp 0x4e0a97
xor eax, eax
mov al, byte [ebx]
shl eax, 8
xor edx, edx
mov dl, byte [ebx + 1]
or eax, edx
shl eax, 8
xor edx, edx
mov dl, byte [ebx + 2]
or eax, edx
add ebx, 3
mov edx, eax
and edx, 0x3f
mov dl, byte [edi + edx]
mov byte [ecx + 3], dl
shr eax, 6
mov edx, eax
and edx, 0x3f
mov dl, byte [edi + edx]
mov byte [ecx + 2], dl
shr eax, 6
mov edx, eax
and edx, 0x3f
mov dl, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
mov al, byte [edi + eax]
mov byte [ecx], al
add ecx, 4
cmp esi, ebx
ja 0x4e0a4a
sub ebp, dword [esp]
dec ebp
je 0x4e0aa6
dec ebp
je 0x4e0aca
jmp 0x4e0b00
xor eax, eax
mov al, byte [ebx]
shl eax, 4
mov edx, eax
and edx, 0x3f
mov dl, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
mov al, byte [edi + eax]
mov byte [ecx], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x4e0b00
xor eax, eax
mov al, byte [ebx]
shl eax, 8
xor edx, edx
mov dl, byte [ebx + 1]
or eax, edx
shl eax, 2
mov edx, eax
and edx, 0x3f
mov dl, byte [edi + edx]
mov byte [ecx + 2], dl
shr eax, 6
mov edx, eax
and edx, 0x3f
mov dl, byte [edi + edx]
mov byte [ecx + 1], dl
shr eax, 6
mov al, byte [edi + eax]
mov byte [ecx], al
mov byte [ecx + 3], 0x3d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e0ec0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4e0ed5
add esp, 0xfffffff0
call fcn.00403cf0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004048f4
mov eax, esi
call fcn.00404d7c
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4e0f21
mov ecx, dword [0x53d3b8]
mov dl, 1
mov eax, dword [0x4e0ce8]
call fcn.004ca778
call fcn.0040421c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4e0f48
call fcn.00403d48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4e10b0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.00404b7c
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, dword [esp]
call fcn.00404f08
mov eax, esi
call fcn.00404b7c
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x4e11f7
mov ebx, 1
mov eax, esi
call fcn.00404b7c
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x4e112f
mov eax, esi
call fcn.00404b7c
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
lea edx, [esp + 4]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
call fcn.00402ac0
jmp 0x4e1146
lea edx, [esp + 4]
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
mov ecx, 3
call fcn.00402ac0
mov al, byte [esp + 4]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x4e127c
mov dl, byte [ecx + edx]
mov byte [esp + 7], dl
and al, 3
mov ebp, eax
and ebp, 0xff
shl ebp, 4
mov dl, byte [esp + 5]
mov eax, edx
and al, 0xf0
and eax, 0xff
shr eax, 4
or ebp, eax
mov eax, 0x4e127c
mov al, byte [eax + ebp]
mov byte [esp + 8], al
and dl, 0xf
mov ebp, edx
and ebp, 0xff
shl ebp, 2
mov al, byte [esp + 6]
mov edx, eax
and dl, 0xc0
and edx, 0xff
shr edx, 6
or ebp, edx
mov edx, 0x4e127c
mov dl, byte [edx + ebp]
mov byte [esp + 9], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x4e127c
mov al, byte [edx + eax]
mov byte [esp + 0xa], al
mov eax, dword [esp]
call fcn.00404dd4
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [esp + 7]
mov ecx, 4
call fcn.00402ac0
inc ebx
dec edi
jne 0x4e10fc
mov eax, esi
call fcn.00404b7c
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x4e123d
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.00404b7c
mov ebx, eax
mov eax, dword [esp]
call fcn.00404dd4
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.00404b7c
mov ebx, eax
mov eax, dword [esp]
call fcn.00404dd4
mov byte [eax + ebx - 1], 0x3d
jmp 0x4e126a
mov eax, esi
call fcn.00404b7c
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x4e126a
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.00404b7c
mov ebx, eax
mov eax, dword [esp]
call fcn.00404dd4
mov byte [eax + ebx - 1], 0x3d
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret