joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476f80
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48ade8]
cmp dword [eax + 0x30], 0
je 0x47702a
cmp dword [ebx + 0x94], 0
jne 0x477024
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x476f10
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x477024
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x476fea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x477024
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bb5c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x476ff9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x477b8c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x477bc1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004048c0
jmp 0x477bce
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404824
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x478cd8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x478d19
mov eax, esi
call fcn.0045eca4
test al, al
je 0x478d19
mov eax, dword [ebx + 0x84]
call fcn.0045e9a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x478d19
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045e9a0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x479b94
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff98
mov ebx, eax
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov eax, dword [0x487aa8]
cmp dword [eax], 5
jge 0x479c67
lea eax, [esp + 0x48]
mov edx, 0x20
call fcn.00407620
mov dword [esp + 0x48], 0x20
lea eax, [esp + 0x48]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x50]
xor edx, edx
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], edx
mov eax, dword [esp + 0x54]
xor edx, edx
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], edx
mov eax, dword [esp + 0x58]
xor edx, edx
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], edx
mov eax, dword [esp + 0x5c]
xor edx, edx
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], edx
mov eax, dword [esp + 0x60]
xor edx, edx
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], edx
mov eax, dword [esp + 0x64]
xor edx, edx
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], edx
jmp 0x479d0e
push 0x479d18
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x479d0e
push 0x479d28
push esi
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
mov dword [esp], edi
test edi, edi
je 0x479d08
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0x40
call fcn.004033f4
mov dword [esp + 8], 0x40
lea eax, [esp + 8]
push eax
call dword [esp + 4]
test eax, eax
je 0x479d08
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x60], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x64], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x70], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x74], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x68], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x6c], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x58], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x5c], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x78], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x7c], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x54], eax
push esi
call sub.kernel32.dll_FreeLibrary_1
add esp, 0x68
pop edi
pop esi
pop ebx
ret

Function at 0x47be64
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x487c9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47be8a
push 0
mov eax, dword [0x487c9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x47d208
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x4877d0
mov eax, dword [0x487e4c]
cmp dword [eax], 2
jne 0x47d362
push 0x47d378
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x47d239
push 0x47d378
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x47d362
push 0x47d384
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877dc], eax
push 0x47d39c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877e0], eax
push 0x47d3b0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877d4], eax
push 0x47d3c0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877d8], eax
push 0x47d3c8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877e4], eax
push 0x47d3d8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877e8], eax
push 0x47d3f4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877ec], eax
push 0x47d404
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877f0], eax
push 0x47d418
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877f4], eax
push 0x47d430
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877fc], eax
push 0x47d43c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4877f8], eax
push 0x47d44c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487800], eax
push 0x47d45c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487804], eax
push 0x47d478
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487808], eax
push 0x47d494
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48780c], eax
push 0x47d4ac
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487810], eax
cmp dword [ebx], 0
je 0x47d370
cmp dword [0x487800], 0
jne 0x47d374
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x47d6bc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x9c], edx
mov esi, eax
lea edi, [ebp - 0x94]
xor eax, eax
push ebp
push 0x47d90b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x94
call fcn.00407620
mov dword [edi], 0x94
push edi
call sub.kernel32.dll_GetVersionExA
mov eax, esi
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.00404a40
mov eax, dword [edi + 4]
mov dword [0x48ae58], eax
mov edx, dword [edi + 8]
mov dword [0x48ae5c], edx
mov edx, dword [edi + 0xc]
mov dword [0x48ae60], edx
xor ebx, ebx
cmp dword [edi + 0x10], 2
jne 0x47d805
sub eax, 3
je 0x47d761
dec eax
je 0x47d765
dec eax
je 0x47d769
dec eax
je 0x47d76d
jmp 0x47d76f
mov bl, 1
jmp 0x47d76f
mov bl, 3
jmp 0x47d76f
mov bl, 0xa
jmp 0x47d76f
mov bl, 0xd
cmp dword [edi + 4], 5
jne 0x47d77d
cmp dword [edi + 8], 1
jne 0x47d77d
mov bl, 0xb
cmp dword [edi + 4], 5
jne 0x47d78b
cmp dword [edi + 8], 2
jne 0x47d78b
mov bl, 0xc
mov eax, dword [esi]
mov edx, 0x47d924
call fcn.00404bdc
jne 0x47d8ed
mov dl, 1
mov eax, dword [0x4399d0]
call fcn.00439ad0
mov edi, eax
mov edx, 0x80000002
mov eax, edi
call fcn.00439b70
mov edx, 0x47d93c
mov eax, edi
call fcn.00439cf8
test al, al
je 0x47d7f9
mov edx, 0x47d984
mov eax, edi
call fcn.0043a0f8
test al, al
je 0x47d7f2
mov edx, 0x47d984
mov eax, edi
call fcn.00439fec
dec eax
jne 0x47d7f2
mov eax, esi
mov edx, 0x47d998
call fcn.00404824
mov eax, edi
call fcn.00439b40
mov eax, edi
call fcn.004039e4
jmp 0x47d8ed
cmp dword [edi + 4], 4
jne 0x47d8c5
cmp dword [edi + 8], 0
jne 0x47d8c5
mov bl, 2
lea eax, [ebp - 0x9c]
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.00404a40
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.0040b134
mov eax, dword [ebp - 0x98]
mov edx, 0x47d9b0
call fcn.00404bdc
jne 0x47d853
mov bl, 4
lea eax, [ebp - 0xa4]
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.00404a40
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0040b134
mov eax, dword [ebp - 0xa0]
mov edx, 0x47d9bc
call fcn.00404bdc
jne 0x47d88b
mov bl, 5
lea eax, [ebp - 0xac]
lea edx, [edi + 0x14]
mov ecx, 0x80
call fcn.00404a40
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.0040b134
mov eax, dword [ebp - 0xa8]
mov edx, 0x47d9c8
call fcn.00404bdc
jne 0x47d8ed
mov bl, 6
jmp 0x47d8ed
cmp dword [edi + 4], 4
jne 0x47d8df
cmp dword [edi + 8], 0xa
jne 0x47d8df
mov bl, 7
cmp word [edi + 0xc], 0x8ae
jne 0x47d8ed
mov bl, 8
jmp 0x47d8ed
cmp dword [edi + 4], 4
jne 0x47d8ed
cmp dword [edi + 8], 0x5a
jne 0x47d8ed
mov bl, 9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d912
lea eax, [ebp - 0xac]
mov edx, 6
call fcn.004047f4
ret
Function at 0x47df68
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, eax
mov dword [esp], 0xff
mov eax, dword [esp]
call fcn.0040bb90
mov dword [esp + 4], eax
push esp
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, esi
mov edx, dword [esp + 4]
call fcn.004049c8
mov eax, dword [esp + 4]
call fcn.0040bbec
mov dl, 1
mov eax, dword [0x4399d0]
call fcn.00439ad0
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00439b70
mov edx, 0x47e004
mov eax, ebx
call fcn.00439cf8
test al, al
je 0x47dff0
mov edx, 0x47e048
mov eax, ebx
call fcn.0043a0f8
test al, al
je 0x47dfe9
mov edx, 0x47e048
mov ecx, esi
mov eax, ebx
call fcn.00439f74
mov eax, ebx
call fcn.00439b40
mov eax, ebx
call fcn.004039e4
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x47e058
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp], 0xff
mov eax, dword [esp]
call fcn.0040bb90
mov dword [esp + 4], eax
push esp
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x47e08d
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0040bb7c
jmp 0x47e094
mov eax, ebx
call fcn.004047d0
mov eax, ebx
mov edx, dword [esp + 4]
call fcn.004049c8
mov eax, dword [esp + 4]
call fcn.0040bbec
pop ecx
pop edx
pop ebx
ret

Function at 0x47e0ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47e145
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404eb0
mov eax, 0x104
call fcn.0040bb90
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push edi
push esi
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x47e108
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404fc0
mov eax, dword [ebp - 8]
call fcn.0040bbec
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00418b74
test al, al
je 0x47e12f
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e14c
lea eax, [ebp - 0xc]
call fcn.004061d8
ret
Function at 0x47e20c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x47e2f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x47e308
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x47e2c3
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404c90
mov esi, eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x47e2a2
mov eax, dword [ebp - 0xc]
call fcn.0040ae5c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
mov eax, dword [ebp - 0x14]
call fcn.00402d68
jmp 0x47e2b8
mov ecx, 0x47e324
mov dl, 1
mov eax, dword [0x40a280]
call fcn.0040eaa0
call fcn.004041c4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47e2d9
mov ecx, 0x47e34c
mov dl, 1
mov eax, dword [0x40a280]
call fcn.0040eaa0
call fcn.004041c4
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e2fd
lea eax, [ebp - 4]
call fcn.004047d0
ret

Function at 0x47e374
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x47e40d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x47e41c
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x47e3f4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404c90
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
jne 0x47e3ef
mov ebx, dword [ebp - 0x14]
jmp 0x47e3f7
or ebx, 0xffffffff
jmp 0x47e3f7
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e414
lea eax, [ebp - 4]
call fcn.004047d0
ret
Function at 0x47e430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x47e4ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x47e4fc
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x47e4cd
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404c90
mov esi, eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x47e4c4
mov eax, dword [ebp - 0xc]
call fcn.0040ae5c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
mov eax, dword [ebp - 0x14]
call fcn.00402d68
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e4f1
lea eax, [ebp - 4]
call fcn.004047d0
ret
Function at 0x47f10c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404c80
mov eax, dword [ebp - 8]
call fcn.00404c80
xor eax, eax
push ebp
push 0x47f295
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004047d0
mov dword [ebp - 0x1c], 0xff
mov eax, dword [ebp - 4]
call fcn.00404a90
test eax, eax
jle 0x47f272
lea eax, [ebp - 4]
mov edx, 0x47f2ac
call fcn.00404a98
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00404ce8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x47f272
mov eax, dword [ebp - 0x14]
call fcn.00402d38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47f26b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00404ce8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47f252
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x47f2b0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47f22a
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.0040760c
movzx eax, ax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x3c]
mov ecx, 2
mov eax, 0x47f2d4
call fcn.0040c094
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.00404868
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.00404ce8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47f252
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.0040bb7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f272
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00402d68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f29c
lea eax, [ebp - 0x24]
call fcn.004047d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047f4
ret
Function at 0x484cc8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
mov eax, dword [ebp - 8]
call fcn.00404c80
xor eax, eax
push ebp
push 0x484e50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004047d0
mov dword [ebp - 0x1c], 0xff
mov eax, dword [ebp - 4]
call fcn.00404a90
test eax, eax
jle 0x484e2d
lea eax, [ebp - 4]
mov edx, 0x484e64
call fcn.00404a98
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00404ce8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x484e2d
mov eax, dword [ebp - 0x14]
call fcn.00402d38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x484e26
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00404ce8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x484e0d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x484e68
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x484de5
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.0040760c
movzx eax, ax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x3c]
mov ecx, 2
mov eax, 0x484e8c
call fcn.0040c094
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.00404868
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.00404ce8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x484e0d
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.0040bb7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e2d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00402d68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e57
lea eax, [ebp - 0x24]
call fcn.004047d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047f4
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4080a0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4080a4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.00402ab4
jmp 0x4011d3
mov eax, dword [0x4080a4]
test eax, eax
jne 0x4011c9
mov dword [0x4080a4], 1
mov dword [esp + 4], 0x40b014
mov dword [esp], 0x40b00c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x40801c], 1
mov eax, dword [0x4080a4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x40b008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x4080a4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4080a0
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00401f91
mov dword [esp], 0x4020ac
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x408074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.00401930
mov eax, dword [0x408004]
mov dword [esp + 4], 0x408008
mov dword [esp], eax
call fcn.004013c8
call fcn.0040176c
mov eax, dword [0x405014]
mov edx, dword [0x40800c]
mov dword [eax], edx
mov ecx, dword [0x40800c]
mov edx, dword [0x408008]
mov eax, dword [0x408004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403fb0
mov dword [0x408014], eax
mov eax, dword [0x408018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x408014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x40801c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x408014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret