joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438920
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [ecx + 4]
sub esp, 0x114
lea eax, [esp + 0xc]
push esi
push 0x104
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x4389cb
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4389cb
push edi
push esi
call fcn.004246fe
add esp, 4
mov edi, eax
lea ecx, [esp + 0x14]
push edi
push esi
push 0
push ecx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4389c1
lea edx, [esp + 0x10]
lea eax, [esp + 8]
push edx
push eax
push 0x496478
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4389c1
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push str.v._d._d._d._d
push 0x4a04d0
call fcn.0042fee0
add esp, 0x18
push edi
call fcn.004242d0
add esp, 4
pop edi
pop esi
add esp, 0x114
ret

Function at 0x43a790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483ed3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov dword [esp + 8], ebx
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
push ebx
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x38], ebx
call fcn.0043c220
add esp, 0x10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.0043c740
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0043c550
cmp dword [esp + 0x14], ebx
jne 0x43a897
lea eax, [esp + 0x30]
push ebx
push eax
lea ecx, [esp + 0x10]
call fcn.0043c810
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 2
call fcn.0043c7f0
test eax, eax
je 0x43a88a
push str.Layer
lea ecx, [esp + 0x34]
call fcn.0043c7f0
push eax
call dword [sym.imp.kernel32.dll_lstrcmpi]
test eax, eax
jne 0x43a85a
push 0x78
call fcn.004246fe
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x28], 3
je 0x43a851
mov ecx, eax
call fcn.00442f10
mov byte [esp + 0x28], 2
jmp 0x43a86c
xor eax, eax
mov byte [esp + 0x28], 2
jmp 0x43a86c
lea ecx, [esp + 0x30]
call fcn.0043c7f0
push eax
call fcn.0040aa40
add esp, 4
mov esi, eax
cmp esi, ebx
je 0x43a88a
mov edx, dword [esi]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call dword [edx + 4]
test al, al
jne 0x43a8bb
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0043c550
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.0043c550
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.0043c550
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.0043c550
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x43cb20
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
call fcn.0043d8c0
call fcn.0043db20
mov esi, dword [0x496428]
mov edi, dword [esp + 0xc]
test esi, esi
je 0x43cb61
mov eax, dword [esp + 0x10]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
lea ecx, [esi + 0xc]
call fcn.0042f140
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x14], ecx
mov ecx, esi
call fcn.0043d310
mov ecx, esi
call fcn.0043d290
test eax, eax
jne 0x43cb71
pop edi
pop esi
ret 0x10
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
test eax, eax
jne 0x43cb81
pop edi
pop esi
ret 0x10
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax]
pop edi
pop esi
ret 0x10

Function at 0x43cc70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov al, byte [0x4a0588]
push esi
test al, al
jne 0x43ccd9
mov ecx, 0x4a0560
call fcn.00430590
test al, al
jne 0x43ccd9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0043d100
mov esi, eax
add esp, 8
test esi, esi
je 0x43ccd9
lea edx, [esp + 0x18]
push edi
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push edx
push esi
mov dword [esp + 0x34], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
test edi, edi
pop edi
je 0x43ccdd
mov eax, dword [esp + 0x14]
pop esi
pop ecx
ret
Function at 0x43cce0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x484048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [0x4a0588]
push esi
xor esi, esi
push edi
test al, al
mov dword [esp + 8], esi
jne 0x43cdf1
mov ecx, 0x4a0560
call fcn.00430590
test al, al
jne 0x43cdf1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call fcn.0043d100
mov edi, eax
add esp, 8
cmp edi, esi
jne 0x43cd41
mov edx, dword [esp + 0x2c]
push edx
jmp 0x43cdf6
push ebx
push ebp
lea ecx, [esp + 0x10]
call fcn.0042ee00
mov ebp, dword [esp + 0x30]
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x2c]
push eax
push esi
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x50], esi
call ebx
mov esi, eax
test esi, esi
jne 0x43cd9f
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.0042f4d0
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
push ebp
push edi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0042f540
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
pop ebx
test esi, esi
jne 0x43cde0
mov esi, dword [esp + 0x20]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0042ee10
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0042efa0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0042efa0
mov eax, dword [esp + 0x2c]
push eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.0042f030
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43ce20
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4a0588]
push esi
test al, al
jne 0x43ce88
mov ecx, 0x4a0560
call fcn.00430590
test al, al
jne 0x43ce88
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0043d100
mov esi, eax
add esp, 8
test esi, esi
je 0x43ce88
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x1c]
push edi
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push eax
push esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x43ce88
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x43ce90
Capabilities:
Set registry value

Disassembly:
push esi
mov ecx, 0x4a0560
call fcn.00430590
test al, al
jne 0x43cedd
mov eax, dword [esp + 8]
push eax
call fcn.0043d0a0
mov esi, eax
add esp, 4
test esi, esi
je 0x43cedd
mov edx, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push edx
push esi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
ret
xor eax, eax
pop esi
ret
Function at 0x43cef0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
mov ecx, 0x4a0560
call fcn.00430590
test al, al
jne 0x43cf88
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x43cf26
call fcn.0043cfe0
mov esi, eax
test esi, esi
je 0x43cf88
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
jmp 0x43cf74
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x43cf4b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0043d0a0
mov esi, eax
add esp, 4
test esi, esi
je 0x43cf88
push ebx
push esi
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
jmp 0x43cf74
mov edx, dword [esp + 0x10]
push edx
call fcn.0043d0a0
mov esi, eax
add esp, 4
test esi, esi
je 0x43cf88
push edi
call dword [sym.imp.kernel32.dll_lstrlen]
inc eax
push eax
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x43d6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4840e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0xc]
xor edi, edi
mov ecx, esi
mov dword [esp + 0x10], edi
xor bl, bl
call fcn.00430580
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.0042ee00
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
mov dword [esp + 0x38], edi
call fcn.0042f570
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042f0e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0042efa0
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
push edi
push edx
call fcn.0047d2f6
add esp, 8
test eax, eax
jne 0x43d724
mov bl, 1
cmp dword [esp + 0x10], ebp
jge 0x43d77e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
call fcn.0042f570
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042f0e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 0
call fcn.0042efa0
test bl, bl
je 0x43d710
lea ecx, [esp + 0x14]
call fcn.0042f6a0
lea ecx, [esp + 0x14]
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042efa0
mov eax, esi
jmp 0x43d791
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042efa0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x43d7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
lea esi, [ecx + 0xc]
xor ebx, ebx
push edi
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.00430580
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.0042ee00
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.0042f570
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042f0e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0042efa0
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
push edi
push edx
call fcn.0047d2f6
add esp, 8
test eax, eax
je 0x43d877
cmp dword [esp + 0x10], ebp
jge 0x43d88c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20
push ecx
mov ecx, esi
call fcn.0042f570
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042f0e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0042efa0
mov edx, dword [esp + 0x14]
push edi
push edx
call fcn.0047d2f6
add esp, 8
test eax, eax
jne 0x43d830
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042efa0
mov al, 1
jmp 0x43d89f
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0042efa0
xor al, al
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x43d8c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
xor dl, dl
cmp eax, 2
mov eax, dword [esp + 4]
mov ecx, 1
jne 0x43d8f8
cmp eax, 5
mov byte [0x4a0589], cl
jae 0x43d8fe
mov byte [0x4a0589], dl
cmp eax, 5
ja 0x43d918
jne 0x43d90b
cmp dword [esp + 8], ecx
jae 0x43d918
mov byte [0x4a058a], dl
add esp, 0x94
ret
mov byte [0x4a058a], cl
add esp, 0x94
ret
Function at 0x447f69
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0042ee00
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
push 0
push 0
push eax
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.0043c790
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.0043ad30
mov edx, dword [0x496428]
mov eax, dword [esp + 0x30]
push 0
push 0
mov ebx, dword [edx + 0x34]
push eax
mov ecx, edi
call fcn.0043c790
push eax
call fcn.0043a8f0
mov ecx, dword [esp + 0x34]
add esp, 4
push eax
push ecx
push edi
mov ecx, esi
call fcn.0043ab50
push eax
push 0
lea ecx, [esp + 0x1c]
call fcn.004305a0
push eax
mov ecx, ebx
call fcn.0043e9e0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0042efa0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x44d220
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x44d22a
mov eax, dword [eax + 4]
push esi
push eax
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
jne 0x44d23c
xor al, al
pop esi
ret 4
push 1
call dword [sym.imp.user32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x44d256
call dword [sym.imp.user32.dll_CloseClipboard]
xor al, al
pop esi
ret 4
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
jne 0x44d26d
call dword [sym.imp.user32.dll_CloseClipboard]
xor al, al
pop esi
ret 4
mov ecx, dword [esp + 8]
push eax
call fcn.0042f140
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_CloseClipboard]
mov al, 1
pop esi
ret 4

Function at 0x44d330
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.user32.dll_GetKeyState]
push 1
xor esi, esi
call edi
test ax, ax
jge 0x44d348
mov esi, 1
push 4
call edi
test ax, ax
jge 0x44d354
or esi, 0x10
push 2
call edi
test ax, ax
jge 0x44d360
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x44d36c
or esi, 4
push 0x11
call edi
test ax, ax
jge 0x44d378
or esi, 8
mov eax, esi
pop edi
pop esi
ret
Function at 0x44df30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
call fcn.0044def0
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.kernel32.dll_FindResourceA]
and edi, 0xffff
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44df65
mov ebp, 1
jmp 0x44dfa5
push 0x496ff8
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44df7b
mov ebp, 2
jmp 0x44dfa5
push 0x496ff4
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44df91
mov ebp, 3
jmp 0x44dfa5
push 0x496ff0
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x44dfda
mov ebp, 4
push esi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x44dfda
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
test eax, eax
je 0x44dfda
mov ecx, dword [esp + 0x10]
push ebp
push edi
push eax
call fcn.0044dff0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
Function at 0x452180
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x484a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x452217
push 0x2584
call fcn.004246fe
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x4521e0
push edi
push fcn.004520e0
push 0x4520b0
lea edi, [eax + 4]
push 0x64
push 0x60
push edi
mov dword [eax], 0x64
call fcn.004247eb
mov edx, edi
pop edi
jmp 0x4521e2
xor edx, edx
mov eax, dword [esi + 4]
mov dword [esi + eax*4 + 8], edx
mov dword [esi + 0x30], edx
mov eax, 0x60
mov ecx, dword [esi + 4]
mov ecx, dword [esi + ecx*4 + 8]
add ecx, eax
add eax, 0x60
mov dword [edx + 0x30], ecx
cmp eax, 0x2580
mov edx, ecx
jl 0x4521f1
mov dword [edx + 0x30], 0
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 8]
mov edx, dword [eax + 0x30]
mov dword [esi + 0x30], edx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x452320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov ebx, ecx
jne 0x452335
mov eax, dword [0x496428]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0x10]
push 0x4973fc
and ecx, 0xffff
push ecx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x45235a
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
push edi
push esi
mov dword [ebx + 0xc], eax
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x452379
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
test eax, eax
mov dword [ebx + 4], eax
jne 0x45238f
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, ebx
push edx
call fcn.004523f0
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
Function at 0x454920
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x454996
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x454996
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x454996
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x454984
mov edx, esi
cmp edi, ebx
jb 0x45498e
add edx, ebx
cmp edi, edx
jbe 0x4549a0
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x454976
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x454b50
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.user32.dll_wvsprintfA]
mov esi, eax
mov eax, dword [0x4a07cc]
test eax, eax
je 0x454b86
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.kernel32.dll_lstrcat]
mov ecx, dword [0x4a06a0]
lea edx, [esp + 4]
push 0
push edx
lea eax, [esp + 0x10]
push esi
push eax
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret

Function at 0x455010
Capabilities:
Get file version info

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x45508b
push esi
call fcn.004246fe
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45508b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x496478
push edi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45508b
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push ebx
push str._s_v._d._d._d._d_r_n
call fcn.00454b50
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x45aa40
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x484d36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0xb]
push edi
xor ebx, ebx
push 0x18
mov dword [esp + 0x14], esi
mov byte [esi + 4], al
mov byte [esi + 5], cl
mov byte [esi + 0xc], bl
call fcn.004246fe
mov dword [eax + 4], ebx
mov dword [eax + 0x14], 1
mov edx, dword [0x4a0b4c]
add esp, 4
cmp edx, ebx
mov ecx, eax
jne 0x45aaa6
mov dword [0x4a0b4c], eax
mov dword [eax], ebx
mov edx, dword [0x4a0b4c]
xor ecx, ecx
mov dword [edx + 8], ebx
mov edx, dword [0x4a0b48]
inc edx
cmp ecx, ebx
mov dword [0x4a0b48], edx
je 0x45aac0
push ecx
call fcn.004242d0
add esp, 4
mov edi, dword [0x4a0b4c]
push 0x18
call fcn.004246fe
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [eax], eax
mov eax, dword [esi + 8]
mov dword [eax + 8], eax
mov cl, byte [esp + 0x13]
mov eax, 0x64
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x13]
mov dword [esi + 0x1c], ebx
push 0x18
mov dword [esp + 0x24], ebx
mov byte [esi + 0x20], al
mov byte [esi + 0x21], cl
mov byte [esi + 0x28], bl
call fcn.004246fe
mov dword [eax + 4], ebx
mov dword [eax + 0x14], 1
mov edx, dword [0x4a0b44]
add esp, 8
cmp edx, ebx
mov ecx, eax
jne 0x45ab36
mov dword [0x4a0b44], eax
mov dword [eax], ebx
mov edx, dword [0x4a0b44]
xor ecx, ecx
mov dword [edx + 8], ebx
mov edx, dword [0x4a0b40]
inc edx
cmp ecx, ebx
mov dword [0x4a0b40], edx
je 0x45ab50
push ecx
call fcn.004242d0
add esp, 4
mov edi, dword [0x4a0b44]
push 0x18
call fcn.004246fe
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x24]
add esp, 4
mov dword [eax + 8], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 1
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
call fcn.0045eb80
mov ecx, dword [esp + 0x14]
mov dword [esi], 0x48a470
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret