joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4732f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004040e4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x66c21c]
cmp byte [edx + 0xc], 0
je 0x473354
mov edx, dword [0x66c1f0]
cmp dword [edx], 2
jne 0x473354
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x473358
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x473410
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004732f0
test al, al
je 0x4733f2
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405ec0
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4733f2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 4]
call fcn.0040627c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00405fc8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4733ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473417
lea eax, [ebp - 0x2c]
call fcn.00405dd0
lea eax, [ebp - 4]
call fcn.00405dd0
ret

Function at 0x473614
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00472e44
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040627c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x473673
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x66bc2c]
mov dl, 1
mov eax, dword [0x472cd0]
call fcn.0044f4e8
call fcn.00405728
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47367c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040627c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4736d4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x66c244]
mov dl, 1
mov eax, dword [0x472cd0]
call fcn.0044f4e8
call fcn.00405728
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00472e74
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x476f98
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x477181
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e68
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004067a8
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x477156
xor edx, edx
push ebp
push 0x47714f
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
je 0x47704c
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x47701e
mov eax, dword [ebp - 8]
call fcn.004067c8
inc eax
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.00476ee4
mov eax, dword [ebp - 4]
test eax, eax
je 0x47702a
sub eax, 4
mov eax, dword [eax]
inc eax
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 1
call fcn.00476ee4
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, 0x10
call fcn.00476ee4
test esi, esi
je 0x47713c
lea eax, [ebp - 0x18]
mov ecx, 0x477198
mov edx, esi
call fcn.00406104
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004067a8
mov eax, dword [ebp - 0xc]
call fcn.004067c8
add eax, eax
add eax, 0x14
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47713c
xor edx, edx
push ebp
push 0x477135
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
je 0x477118
xor edx, edx
push ebp
push 0x477111
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov dword [eax], 0x14
mov dword [eax + 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.004067c8
mov ecx, eax
add ecx, ecx
mov edx, ebx
add edx, 0x14
mov eax, dword [ebp - 0xc]
call fcn.0040d904
mov eax, dword [ebp - 0x14]
push eax
push 0xf
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x4770fa
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477118
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47713c
cmp dword [ebp - 0x14], 0
je 0x477134
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477156
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477188
lea eax, [ebp - 0x18]
call fcn.00405dd0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040660c
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4773e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4775a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x779a3c], 0
jne 0x477443
push 0x4775b8
call fcn.0040e100
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x779a3c], eax
push 0x4775b8
call fcn.0040e100
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x779a40], eax
call sub.kernel32.dll_GetACP_1
mov dword [ebp - 8], eax
lea edx, [ebp - 0x28]
lea eax, [ebp - 8]
mov ecx, 2
call fcn.004773c0
test eax, eax
je 0x477464
mov ebx, dword [ebp - 0x28]
jmp 0x477469
mov ebx, 1
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x20
call fcn.0040d87c
lea eax, [ebp - 4]
mov edx, 6
call fcn.0040650c
mov eax, dword [ebp - 4]
test eax, eax
je 0x477491
sub eax, 4
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jne 0x4774b3
lea eax, [ebp - 4]
call fcn.00405dd0
jmp 0x4774be
mov edx, eax
dec edx
lea eax, [ebp - 4]
call fcn.0040650c
call sub.kernel32.dll_GetACP_1
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00449f28
mov dword [ebp - 8], eax
lea edx, [ebp - 0x28]
lea eax, [ebp - 8]
mov ecx, 2
call fcn.004773c0
test eax, eax
je 0x477553
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x47751d
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00449d7c
push dword [ebp - 0x2c]
push 0x4775d8
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00449e68
push dword [ebp - 0x30]
mov eax, esi
mov edx, 3
call fcn.00406180
jmp 0x477585
mov eax, edi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00449e68
push dword [ebp - 0x34]
push 0x4775d8
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.00449e68
push dword [ebp - 0x38]
mov eax, esi
mov edx, 3
call fcn.00406180
jmp 0x477585
lea edx, [ebp - 0x3c]
mov eax, ebx
call fcn.00449d7c
push dword [ebp - 0x3c]
push 0x4775d8
call sub.kernel32.dll_GetACP_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.00449e68
push dword [ebp - 0x40]
mov eax, esi
mov edx, 3
call fcn.00406180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4775af
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.00405df4
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4776d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040d87c
mov dword [ebp - 0x3c], 0x3c
call fcn.00440d64
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x47772d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x4c7
je 0x47772d
xor eax, eax
call fcn.00474524
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x477a48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ecx, ecx
test eax, eax
je 0x477a88
test edx, edx
je 0x477a88
dec edx
test edx, edx
jl 0x477a88
inc edx
movzx ecx, cx
shr ecx, 8
movzx ebx, byte [eax]
movzx esi, bl
xor ecx, esi
and ecx, 0xff
movzx ecx, word [ecx*2 + 0x661980]
movzx ebx, bl
shl ebx, 8
and bx, 0xffff
xor cx, bx
inc eax
dec edx
jne 0x477a5a
mov eax, ecx
pop esi
pop ebx
ret

Function at 0x477b04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
test edi, edi
jne 0x477b14
xor esi, esi
jmp 0x477b16
mov esi, edx
or ebx, 0xffffffff
test esi, esi
jbe 0x477b49
cmp byte [0x661b80], 0
jne 0x477b2b
call fcn.00477aa8
movzx eax, byte [edi]
xor eax, ebx
and eax, 0xff
mov eax, dword [eax*4 + 0x779a4c]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc edi
dec esi
test esi, esi
jne 0x477b2b
xor ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x478474
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.0040d87c
mov esi, ebx
test esi, esi
jne 0x47849d
xor ebx, ebx
jmp 0x47849f
mov ebx, edi
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.0040d87c
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.0040d87c
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x478503
inc dword [ebp - 0x5c]
test ebx, ebx
jbe 0x478559
mov edi, 0x40
sub edi, dword [ebp - 0x54]
cmp ebx, edi
jb 0x478540
mov ecx, edi
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, esi
call fcn.0040d904
mov eax, 0x40
sub eax, dword [ebp - 0x54]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x54]
add esi, eax
push ebp
call fcn.00477bb8
pop ecx
jmp 0x478555
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, esi
mov ecx, ebx
call fcn.0040d904
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x478507
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x47856e
push ebp
call fcn.00477bb8
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.00477bb8
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.0040d904
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4796e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 0x5c], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x14
call fcn.0040d87c
mov esi, ebx
test esi, esi
jne 0x479709
xor ebx, ebx
jmp 0x47970b
mov ebx, edi
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.0040d87c
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x14
call fcn.0040d87c
mov dword [ebp - 0x58], 0x67452301
mov dword [ebp - 0x54], 0xefcdab89
mov dword [ebp - 0x50], 0x98badcfe
mov dword [ebp - 0x4c], 0x10325476
mov dword [ebp - 0x48], 0xc3d2e1f0
mov eax, edi
shr eax, 0x1d
add dword [ebp - 0x60], eax
mov eax, edi
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x64], eax
cmp eax, dword [ebp - 0x64]
jbe 0x479776
inc dword [ebp - 0x60]
test ebx, ebx
jbe 0x4797cc
mov edi, 0x40
sub edi, dword [ebp - 0x44]
cmp ebx, edi
jb 0x4797b3
mov ecx, edi
mov eax, dword [ebp - 0x44]
lea edx, [ebp + eax - 0x40]
mov eax, esi
call fcn.0040d904
mov eax, 0x40
sub eax, dword [ebp - 0x44]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x44]
add esi, eax
push ebp
call fcn.004785d0
pop ecx
jmp 0x4797c8
mov eax, dword [ebp - 0x44]
lea edx, [ebp + eax - 0x40]
mov eax, esi
mov ecx, ebx
call fcn.0040d904
add dword [ebp - 0x44], ebx
xor ebx, ebx
test ebx, ebx
ja 0x47977a
mov eax, dword [ebp - 0x44]
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x44], 0x38
jb 0x4797e1
push ebp
call fcn.004785d0
pop ecx
mov eax, dword [ebp - 0x60]
call fcn.0047859c
lea edx, [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x64]
call fcn.0047859c
lea edx, [ebp - 4]
mov dword [edx], eax
push ebp
call fcn.004785d0
pop ecx
mov eax, dword [ebp - 0x58]
call fcn.0047859c
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
call fcn.0047859c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
call fcn.0047859c
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
call fcn.0047859c
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
call fcn.0047859c
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
mov ecx, 0x14
call fcn.0040d904
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a294
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test edi, edi
jbe 0x47a39e
mov ebx, eax
mov eax, edi
mov esi, 3
xor edx, edx
div esi
mov esi, eax
test esi, esi
jle 0x47a314
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x661bb4]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x661bb4]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x661bb4]
mov byte [ecx + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x661bb4]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x47a2b4
mov eax, edi
mov esi, 3
xor edx, edx
div esi
dec edx
je 0x47a327
dec edx
je 0x47a358
jmp 0x47a39e
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x661bb4]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x661bb4]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x47a39e
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x661bb4]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x661bb4]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x661bb4]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebx
ret

Function at 0x47a3a4
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebx
push esi
push edi
push ecx
test edx, edx
jbe 0x47a472
mov ebx, edx
and ebx, 3
test ebx, ebx
jne 0x47a472
shr edx, 2
mov esi, eax
mov edi, ecx
dec edx
test edx, edx
jle 0x47a414
mov dword [esp], edx
xor ecx, ecx
or edx, 0xffffffff
inc edx
shl ecx, 6
movzx eax, byte [esi + edx]
cmp al, 0x80
jb 0x47a3df
mov al, 0x7f
movzx eax, al
movzx eax, byte [eax + 0x661bf4]
cmp al, 0xff
je 0x47a3f2
movzx eax, al
or ecx, eax
cmp edx, 3
jne 0x47a3d1
mov eax, ecx
shr eax, 0x10
mov byte [edi], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi + 2], cl
add esi, 4
add edi, 3
dec dword [esp]
jne 0x47a3cc
xor ecx, ecx
or edx, 0xffffffff
inc edx
shl ecx, 6
cmp byte [esi + edx], 0x3d
jne 0x47a43e
cmp edx, 3
jne 0x47a437
mov eax, ecx
shr eax, 0x10
mov byte [edi], al
shr ecx, 8
mov byte [edi + 1], cl
jmp 0x47a472
shr ecx, 0xa
mov byte [edi], cl
jmp 0x47a472
movzx eax, byte [esi + edx]
cmp al, 0x80
jb 0x47a448
mov al, 0x7f
movzx eax, al
movzx eax, byte [eax + 0x661bf4]
cmp al, 0xff
je 0x47a45b
movzx eax, al
or ecx, eax
cmp edx, 3
jne 0x47a419
mov eax, ecx
shr eax, 0x10
mov byte [edi], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi + 2], cl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4a92a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
shr eax, 2
mov ebx, eax
add ebx, ebx
add ebx, ebx
mov edx, 0x40
mov eax, ebx
call fcn.0041f77c
test al, al
je 0x4a931d
xor edx, edx
push ebp
push 0x4a9311
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4a92de
cmp dword [eax + 0x3c], 0
jne 0x4a92e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a931d
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.0041f77c
test al, al
je 0x4a9305
cmp dword [esi], 0x4550
je 0x4a9307
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a931d
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a9324
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
shr eax, 2
mov ebx, eax
add ebx, ebx
add ebx, ebx
mov edx, 0x40
mov eax, ebx
call fcn.0041f77c
test al, al
je 0x4a93a1
xor edx, edx
push ebp
push 0x4a9395
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4a9362
cmp dword [eax + 0x3c], 0
jne 0x4a936c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a93a1
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0x108
mov eax, esi
call fcn.0041f77c
test al, al
je 0x4a9389
cmp dword [esi], 0x4550
je 0x4a938b
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a93a1
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a95a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4a9643
push 0
push 0
mov eax, ebx
call fcn.00464b24
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.0040d87c
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.00464d30
cmp word [ebp - 0x44], 0x5a4d
jne 0x4a9643
cmp dword [ebp - 8], 0
je 0x4a9643
mov eax, pe_nt_image_headers32
call fcn.00403448
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.00464b24
mov edx, dword [ebp - 4]
mov ecx, 0xf8
mov eax, ebx
call fcn.00464d30
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x4a9631
lea eax, [ebp - 4]
xor edx, edx
call fcn.00474204
jmp 0x4a9643
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0xf8
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a964c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4a96eb
push 0
push 0
mov eax, ebx
call fcn.00464b24
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.0040d87c
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.00464d30
cmp word [ebp - 0x44], 0x5a4d
jne 0x4a96eb
cmp dword [ebp - 8], 0
je 0x4a96eb
mov eax, 0x110
call fcn.00403448
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.00464b24
mov edx, dword [ebp - 4]
mov ecx, 0x108
mov eax, ebx
call fcn.00464d30
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x4a96d9
lea eax, [ebp - 4]
xor edx, edx
call fcn.00474204
jmp 0x4a96eb
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0x108
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aceac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4aceb5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad0dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405dd0
mov eax, edi
call fcn.00405dd0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, ebx
call fcn.0047393c
test al, al
je 0x4ad0b9
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040627c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x4ad0b9
mov eax, esi
call fcn.00403498
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4ad0b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
push esi
push 0
mov eax, ebx
call fcn.0040627c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ad09c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4ad0ec
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4acfec
push 0x4ad110
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00449e90
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00449e90
push dword [ebp - 0x24]
push 0x4ad12c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00406180
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4acfec
cmp dword [ebp - 0x10], 1
jbe 0x4acfec
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.0044b064
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.00405ec0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4ad140
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ad09c
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov eax, dword [ebp - 0x1c]
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.00449d7c
push dword [ebp - 0x28]
push 0x4ad14c
lea edx, [ebp - 0x2c]
movzx eax, si
call fcn.00449d7c
push dword [ebp - 0x2c]
push 0x4ad14c
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x12]
call fcn.00449d7c
push dword [ebp - 0x30]
push 0x4ad14c
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x14]
call fcn.00449d7c
push dword [ebp - 0x34]
mov eax, edi
mov edx, 7
call fcn.00406180
mov eax, dword [edi]
mov edx, 0x4ad158
call fcn.00406214
jne 0x4ad09c
mov eax, edi
call fcn.00405dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad0b9
mov eax, dword [ebp - 0x18]
call fcn.004034b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad0e3
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00405df4
lea eax, [ebp - 4]
call fcn.00405dd0
ret