joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4883bf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0047b4d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x48845a
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x5f42e8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x48845a
cmp eax, 1
je 0x48847b
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x48845a
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x488427
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x488456
xor eax, eax
inc eax
jmp 0x48849a
cmp edi, eax
jae 0x48845e
xor eax, eax
jmp 0x48849a
cmp eax, esi
jae 0x488465
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov eax, dword [0x5f42e8]
jmp 0x48847e
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4885f7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
je 0x488622
cmp eax, 1
je 0x488622
jle 0x48862a
cmp eax, 3
jle 0x488622
cmp eax, 4
jne 0x48862a
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x488655
call fcn.004804a4
mov dword [eax], 0x16
call fcn.004804ad
mov dword [eax], ebx
or eax, 0xffffffff
jmp 0x4887ce
inc eax
cmp byte [eax], bl
jne 0x488644
lea ecx, [eax + 1]
cmp byte [ecx], bl
je 0x488655
mov byte [eax], 0x20
mov eax, ecx
cmp byte [eax], bl
jne 0x488644
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00484600
mov dword [ebp - 0x68], esi
mov esi, dword [0x62f940]
add esp, 0xc
cmp esi, ebx
je 0x48869b
lea ecx, [esi - 1]
mov edx, ecx
mov eax, ecx
sar edx, 5
mov edx, dword [edx*4 + 0x62f960]
and eax, 0x1f
lea eax, [eax + eax*8]
cmp byte [edx + eax*4 + 4], bl
jne 0x48869b
dec esi
dec ecx
cmp esi, ebx
jne 0x48867b
lea eax, [esi + esi*4 + 4]
mov word [ebp - 0x36], ax
push edi
movzx eax, ax
push 1
push eax
call fcn.004818d4
cmp esi, ebx
mov dword [ebp - 0x34], eax
pop ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
pop ecx
mov dword [ebp - 8], ebx
lea ecx, [eax + 4]
lea edx, [eax + esi + 4]
jle 0x488702
mov eax, dword [ebp - 8]
mov edi, eax
sar edi, 5
mov edi, dword [edi*4 + 0x62f960]
and eax, 0x1f
lea eax, [eax + eax*8]
lea edi, [edi + eax*4]
mov al, byte [edi + 4]
test al, 0x10
jne 0x4886ee
mov byte [ecx], al
mov eax, dword [edi]
mov dword [edx], eax
jmp 0x4886f3
mov byte [ecx], bl
or dword [edx], 0xffffffff
inc dword [ebp - 8]
inc ecx
add edx, 4
cmp dword [ebp - 8], esi
jl 0x4886c7
mov eax, dword [ebp - 0x34]
cmp byte [ebp - 1], bl
je 0x488733
lea ecx, [eax + 4]
xor edx, edx
lea eax, [eax + esi + 4]
cmp esi, 3
jge 0x488719
mov edi, esi
jmp 0x48871c
push 3
pop edi
cmp edx, edi
jge 0x48872c
mov byte [ecx], bl
or dword [eax], 0xffffffff
inc edx
inc ecx
add eax, 4
jmp 0x488710
mov dword [ebp - 0xc], 8
call fcn.004804a4
mov dword [eax], ebx
call fcn.004804ad
mov dword [eax], ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
push dword [ebp - 0x34]
mov edi, eax
call fcn.0047a8b4
cmp esi, ebx
pop ecx
jne 0x488783
push edi
call fcn.004804b6
pop ecx
or eax, 0xffffffff
jmp 0x4887cc
cmp dword [ebp + 8], 2
jne 0x48878f
push ebx
call fcn.0047e101
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
jne 0x4887bc
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x24]
call esi
jmp 0x4887c5
cmp dword [ebp + 8], 4
je 0x4887b5
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x488aaa
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x5f4694], ebx
push esi
push edi
jne 0x488b2a
push str.user32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x488b65
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x5f4694], eax
je 0x488b65
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x5f4698], eax
call esi
cmp dword [0x5f42e8], 2
mov dword [0x5f469c], eax
jne 0x488b2a
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x5f46a4], eax
je 0x488b2a
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x5f46a0], eax
mov eax, dword [0x5f46a0]
test eax, eax
je 0x488b6f
call eax
test eax, eax
je 0x488b56
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x5f46a4]
test eax, eax
je 0x488b56
test byte [ebp - 8], 1
jne 0x488b6f
cmp dword [0x5f42f4], 4
jb 0x488b69
or byte [ebp + 0x12], 0x20
jmp 0x488b8e
xor eax, eax
jmp 0x488b9e
or byte [ebp + 0x12], 4
jmp 0x488b8e
mov eax, dword [0x5f4698]
test eax, eax
je 0x488b8e
call eax
mov ebx, eax
test ebx, ebx
je 0x488b8e
mov eax, dword [0x5f469c]
test eax, eax
je 0x488b8e
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x5f4694]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x489f5e
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0047b4d0
mov eax, dword [0x5d66b4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0048350b
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x48a091
push 2
push esi
push dword [ebp + 8]
call fcn.0048350b
add esp, 0xc
cmp eax, ebx
je 0x48a091
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x48a031
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00484600
push 0x8000
push dword [ebp + 8]
call fcn.0048a960
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x489fe7
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.004819f8
add esp, 0xc
cmp eax, 0xffffffff
je 0x48a007
sub edi, eax
test edi, edi
jg 0x489fdf
jmp 0x48a01f
call fcn.004804ad
cmp dword [eax], 5
jne 0x48a01c
call fcn.004804a4
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0048a960
pop ecx
pop ecx
jmp 0x48a079
jge 0x48a079
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048350b
push dword [ebp + 8]
call fcn.00487b8f
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x48a079
call fcn.004804a4
mov dword [eax], 0xd
call fcn.004804ad
mov edi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0048350b
add esp, 0xc
mov eax, esi
pop edi
jmp 0x48a093
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004845e7
leave
ret
Function at 0x48a51b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x48a534
or eax, 0xffffffff
jmp 0x48a595
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x48a591
push 0x3d
push esi
call fcn.0048857c
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x48a591
cmp esi, eax
je 0x48a591
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x5f4308]
sete cl
cmp eax, dword [0x5f430c]
mov dword [ebp - 8], ecx
jne 0x48a577
mov edi, eax
call fcn.0048a4ba
mov dword [0x5f4308], eax
cmp eax, ebx
jne 0x48a5d0
cmp dword [ebp + 0xc], ebx
je 0x48a599
cmp dword [0x5f4310], ebx
je 0x48a599
call fcn.00488a1a
test eax, eax
je 0x48a5d0
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x48a5a2
xor eax, eax
jmp 0x48a594
push 4
call fcn.0047d172
cmp eax, ebx
pop ecx
mov dword [0x5f4308], eax
je 0x48a591
mov dword [eax], ebx
cmp dword [0x5f4310], ebx
jne 0x48a5d0
push 4
call fcn.0047d172
cmp eax, ebx
pop ecx
mov dword [0x5f4310], eax
je 0x48a591
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x5f4308]
call fcn.0048a46d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x48a631
cmp dword [esi], ebx
je 0x48a631
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0047a8b4
cmp dword [ebp - 8], ebx
pop ecx
jne 0x48a614
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x48a672
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x48a60b
mov eax, edi
shl eax, 2
push eax
push dword [0x5f4308]
call fcn.0047ddbc
cmp eax, ebx
pop ecx
pop ecx
je 0x48a672
jmp 0x48a66d
cmp dword [ebp - 8], ebx
jne 0x48a6dd
cmp edi, ebx
jge 0x48a640
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x5f4308]
call fcn.0047ddbc
cmp eax, ebx
pop ecx
pop ecx
je 0x48a591
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x5f4308], eax
cmp dword [ebp + 0xc], ebx
je 0x48a6c7
push dword [ebp - 4]
call fcn.0047e470
inc eax
inc eax
push eax
call fcn.0047d172
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x48a6c7
push dword [ebp - 4]
push esi
call fcn.0047e370
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x48a6c0
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0047a8b4
pop ecx
cmp dword [ebp - 8], ebx
je 0x48a6d5
push dword [ebp - 4]
call fcn.0047a8b4
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x48a594
push dword [ebp - 4]
call fcn.0047a8b4
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x48a59e
Function at 0x48a6f0
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x5aa0e0
call fcn.0047e1a8
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x5f4778], edi
jne 0x48a734
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x48a71f
mov dword [0x5f4778], ebx
jmp 0x48a734
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x48a734
mov dword [0x5f4778], 2
mov eax, dword [0x5f4778]
cmp eax, ebx
jne 0x48a754
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
jmp 0x48a817
cmp eax, 2
je 0x48a75d
cmp eax, edi
jne 0x48a785
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x48a770
mov eax, dword [0x5f4660]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x48a78c
xor eax, eax
jmp 0x48a817
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0047b4d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x48a7bf
cmp esi, edi
jne 0x48a7d5
push dword [ebp - 0x20]
call fcn.0047d172
pop ecx
mov esi, eax
cmp esi, edi
je 0x48a785
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x48a808
cmp dword [ebp + 0x14], edi
jne 0x48a7f2
push edi
push edi
jmp 0x48a7f8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x48a814
push esi
call fcn.0047a8b4
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0047e1e3
ret
Function at 0x48a820
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x5aa0f0
call fcn.0047e1a8
xor esi, esi
cmp dword [0x5f477c], esi
jne 0x48a864
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x48a84f
mov dword [0x5f477c], edi
jmp 0x48a864
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x48a864
mov dword [0x5f477c], 2
mov eax, dword [0x5f477c]
cmp eax, 2
je 0x48a945
cmp eax, esi
je 0x48a945
cmp eax, 1
jne 0x48a8a9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x48a892
mov eax, dword [0x5f4660]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x48a8b0
xor eax, eax
jmp 0x48a957
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0047b4d0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x48a8e6
cmp edi, esi
jne 0x48a901
lea eax, [ebx + ebx]
push eax
call fcn.0047d172
pop ecx
mov edi, eax
cmp edi, esi
je 0x48a8a9
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x48a934
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x48a91e
push esi
push esi
jmp 0x48a924
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x48a940
push edi
call fcn.0047a8b4
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x48a957
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0047e1e3
ret
Function at 0x48c280
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x48c351
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [eax + 1]
mov edx, dword [esi + 0x158]
push edx
push esi
call fcn.0048c360
mov edx, dword [esi + 0x154]
xor eax, eax
xor ecx, ecx
push esi
mov al, byte [edx + esi + 0x16c]
mov cl, byte [edx + esi + 0x16d]
shl eax, 5
xor eax, ecx
xor ecx, ecx
mov cl, byte [edx + esi + 0x16e]
shl eax, 5
xor eax, ecx
mov ecx, eax
shl ecx, 8
sub ecx, eax
lea ecx, [ecx + ecx*4]
shl ecx, 5
sub ecx, eax
mov eax, ecx
shr eax, 5
and eax, 0x3fff
mov cx, word [esi + eax*2 + 0xd16c]
mov word [esi + edx*2 + 0x1516c], cx
mov dx, word [esi + 0x154]
mov word [esi + eax*2 + 0xd16c], dx
mov cx, word [esi + 4]
mov edx, dword [esi + 0x154]
inc cx
mov word [esi + edx*2 + 0x2e16a], cx
inc word [esi + eax*2 + 0x47168]
mov eax, dword [esi + 0x154]
xor ecx, ecx
mov dx, ax
mov cx, word [eax + esi + 0x16c]
mov word [esi + ecx*2 + 0x4f168], dx
call fcn.0048c1d0
add esp, 0xc
dec edi
jne 0x48c298
pop edi
pop esi
ret

Function at 0x490515
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.oleaut32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x49056d
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x49056d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x49056d
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x490596
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.oleaut32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x490604
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4905fb
cmp dword [ebp - 0xc], 4
jne 0x4905fb
cmp dword [ebp - 0x10], edi
je 0x4905fb
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [0x5d794c], edi
xor eax, eax
jmp 0x49062c
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [0x5d794c], edi
jge 0x490627
mov dword [0x5d794c], edi
call fcn.00490571
test eax, eax
je 0x490627
emms
mov dword [0x5d794c], 1
mov eax, dword [0x5d794c]
pop edi
leave
ret
Function at 0x49070c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x490743
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x490765
cmp dword [ebp - 0x20], 4
ja 0x49076f
jne 0x49075f
cmp dword [ebp - 0x1c], 0xa
jb 0x49075f
cmp word [ebp - 0x18], 0x55d
jae 0x49076f
mov byte [ebp + 0x73], 1
jmp 0x49076f
cmp dword [ebp - 0x14], 2
jne 0x490785
test bl, bl
je 0x4907a0
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x490790
dec eax
je 0x490789
sub eax, 3
jne 0x490785
cmp byte [ebp + 0x73], 0
je 0x4907b1
xor eax, eax
jmp 0x4907b9
call fcn.0049062f
jmp 0x4907b9
cmp byte [ebp + 0x73], 0
jne 0x490785
call fcn.00490667
and eax, 4
jmp 0x4907b9
cmp dword [ebp + 0x7c], 0xa
je 0x4907b1
push dword [ebp + 0x7c]
call dword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
jmp 0x4907b9
call fcn.00490667
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x49c850
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x58ee00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x5aa598
mov dword [esi + 4], 0x5aa594
mov dword [esp + 0x20], 4
call fcn.0049b310
mov ecx, esi
call fcn.0049b390
mov ecx, esi
call fcn.0049b410
xor ebx, ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 8], bl
mov eax, dword [esi + 0x28]
mov ecx, dword [eax]
lea edi, [esi + 0x24]
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x2c], 3
call fcn.0049bf00
mov eax, dword [edi + 4]
push eax
call fcn.004796fd
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x18]
push eax
push ecx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.0049bf00
mov eax, dword [edi + 4]
push eax
call fcn.004796fd
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0xc]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
mov byte [esp + 0x2c], 1
call fcn.0049be40
mov eax, dword [edi + 4]
push eax
call fcn.004796fd
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [esi + 4], 0x5aa4c0
add esp, 4
mov ecx, esi
mov dword [0x5f1ccc], ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.004c27a0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x49c9b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x58ee39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004c2780
xor ebx, ebx
mov eax, esi
mov dword [esi + 4], 0x5aa4c0
mov dword [esp + 0x18], ebx
mov dword [0x5f1ccc], eax
lea edi, [esi + 0xc]
mov ecx, edi
mov byte [esp + 0x18], 1
mov dword [esi], 0x5aa598
mov dword [esi + 4], 0x5aa594
call fcn.004f4da0
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x18]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.004f4da0
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x24]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.004f4da0
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 8], bl
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x49e300
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x58ef61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x5aa5e0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], 0xf
mov byte [eax + 0x5c], cl
mov dword [eax + 0x54], 0x599e5c
mov dword [eax + 0x44], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x48], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4b0710
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4b07db
cmp byte [ebx], 0
je 0x4b07db
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b0730
sub eax, edx
cmp eax, 3
jb 0x4b0747
cmp byte [ebx + 1], 0x3a
jne 0x4b0747
add ebx, 3
push ebp
push esi
push edi
mov edi, ebx
mov eax, ebx
mov dword [esp + 0x10], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b0755
sub eax, edx
lea ebp, [eax + 1]
push ebp
call fcn.0047a448
mov esi, eax
mov al, byte [ebx]
add esp, 4
test al, al
je 0x4b07cf
mov dword [esp + 0x18], 0
lea ebx, [ebx]
mov al, byte [edi]
cmp al, 0x2f
je 0x4b078a
cmp al, 0x5c
jne 0x4b07ba
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push eax
push ebx
push esi
call fcn.0047a2a0
add esp, 0xc
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov al, byte [edi + 1]
inc edi
inc ecx
test al, al
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
jne 0x4b0780
push esi
call fcn.004796fd
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret