joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx]
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x48102c
push ebx
xor eax, eax
mov ebx, edx
mov al, byte [esi]
and ebx, 0xff
and eax, 0xff
inc esi
xor ebx, eax
shr edx, 8
mov eax, dword [ebx*4 + 0x5406b4]
xor edx, eax
dec edi
jne 0x481001
pop ebx
pop edi
mov dword [ecx], edx
pop esi
ret 8
pop edi
mov dword [ecx], edx
pop esi
ret 8

Function at 0x481070
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebp, dword [esp + 0x18]
mov bl, byte [esi]
inc esi
mov ecx, ebp
movzx di, byte [esi]
sub edi, 2
inc esi
and edi, 0xffff
lea eax, [edi + 1]
push eax
call fcn.004dc010
test edi, edi
jle 0x4810b1
mov cl, byte [esi]
add eax, 2
xor cl, bl
inc bl
movsx dx, cl
mov word [eax - 2], dx
inc esi
dec edi
jne 0x48109c
push 0xffffffffffffffff
mov ecx, ebp
mov word [eax], 0
call fcn.004dc060
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x481120
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10a8
call fcn.004c07d0
mov ecx, dword [esp + 0x10b8]
mov edx, dword [esp + 0x10b4]
lea eax, [esp + 0x18]
push edi
push eax
push ecx
push edx
call fcn.0047dbc0
add esp, 0xc
test eax, eax
jne 0x481218
mov eax, dword [esp + 0x10b4]
xor edi, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
test eax, eax
jle 0x481218
push ebx
mov ebx, dword [esp + 0x10c4]
push ebp
push esi
mov esi, dword [esp + 0x10bc]
mov ebp, eax
xor eax, eax
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 4]
test edi, edi
mov dword [esp + 0x14], eax
je 0x4811b4
test ebx, ebx
je 0x4811b4
xor eax, eax
mov cl, byte [esp + eax + 0x20]
mov dl, byte [esp + eax + 0x10]
xor dl, cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 8
jb 0x4811a0
lea edx, [esp + 0x28]
push ebx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0047d620
add esp, 0x10
test ebx, ebx
jne 0x481220
test edi, edi
je 0x4811ea
xor eax, eax
mov dl, byte [esp + eax + 0x20]
mov cl, byte [esp + eax + 0x18]
xor cl, dl
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 8
jb 0x4811d6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x18]
mov ecx, esi
mov edi, esi
add esi, 8
mov dword [ecx], edx
mov eax, dword [esp + 0x1c]
dec ebp
mov dword [ecx + 4], eax
jne 0x48117d
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10a8
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jmp 0x4811fa
Function at 0x481300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x53c7a8
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x48131b
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x48132a
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0xc]
test eax, eax
mov dword [ecx], eax
jne 0x48133d
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
pop esi
ret
Function at 0x486790
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5027c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
push ebx
push esi
push edi
mov edi, dword [esp + 0x290]
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 0x14]
call fcn.004dbc3f
mov eax, dword [0x5748d0]
mov dword [esp + 0x284], 0
mov dword [esp + 0xc], eax
push 0x208
lea ecx, [esp + 0x10]
mov byte [esp + 0x288], 1
call fcn.004dc010
test edi, edi
mov esi, eax
je 0x4867ff
push edi
push esi
call fcn.004bf69f
add esp, 8
jmp 0x486824
push 0x208
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push esi
call fcn.004c1742
add esp, 8
test eax, eax
je 0x486824
add eax, 2
mov word [eax], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
je 0x48696d
test al, 0x10
je 0x48696d
push esi
call fcn.004bf79a
lea ecx, [esi + eax*2]
push str..dic
push esi
mov dword [esp + 0x30], ecx
call fcn.004bf675
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, edi
je 0x48696d
mov eax, dword [0x5748d0]
push ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x290]
mov byte [esp + 0x288], 2
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x5c]
push eax
push ecx
call fcn.004bf69f
mov ecx, dword [esp + 0x34]
add esp, 8
lea edx, [esp + 0x18]
push 0
push edx
push esi
call fcn.004869c0
test eax, eax
je 0x486894
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
mov ecx, ebp
lea eax, [edi + 1]
push eax
call fcn.00486dd0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
shl ecx, 4
add ecx, eax
call fcn.00486c40
lea edx, [esp + 0x30]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x486894
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004dc060
lea ecx, [esp + 0x24]
mov byte [esp + 0x288], 5
call fcn.004dbbcb
lea ecx, [esp + 0x20]
mov byte [esp + 0x288], 4
call fcn.004dbbcb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x288], 3
call fcn.004dbbcb
lea ecx, [esp + 0x18]
mov byte [esp + 0x288], 1
call fcn.004dbbcb
lea ecx, [esp + 0x10]
mov byte [esp + 0x288], 0
call fcn.004dbbcb
lea ecx, [esp + 0x14]
mov dword [esp + 0x288], 0xffffffff
call fcn.004dbbcb
pop ebp
jmp 0x486998
push edi
lea ecx, [esp + 0x10]
call fcn.004dc060
lea ecx, [esp + 0xc]
mov byte [esp + 0x284], 0
call fcn.004dbbcb
lea ecx, [esp + 0x10]
mov dword [esp + 0x284], edi
call fcn.004dbbcb
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x27c
ret 8
Function at 0x4869c0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5027fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x27c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x298]
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.004dbc3f
xor ebx, ebx
push esi
mov dword [esp + 0x298], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
jne 0x486a37
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
push 0x208
mov dword [esp + 0x24], ebx
call fcn.004dc010
push eax
push 0x208
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebp
lea ecx, [esp + 0x18]
call fcn.004dc060
push 0xfffffffffffffffb
lea ecx, [esp + 0x24]
call fcn.00493590
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2a0], 1
call fcn.004dc696
test eax, eax
je 0x486b68
mov edx, dword [0x5748d0]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov byte [esp + 0x298], 2
call fcn.00493e70
test eax, eax
je 0x486b57
mov ecx, dword [0x5748d0]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x29c], 3
call fcn.004859c0
add esp, 8
lea ecx, [esp + 0x18]
push str.WinDict
call fcn.004d34b3
test eax, eax
jne 0x486b46
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.00493e70
test eax, eax
je 0x486b46
mov edi, dword [esp + 0x2a0]
cmp edi, ebx
je 0x486bd8
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x8c]
lea esi, [edi + 4]
push edx
push 0x104
mov ecx, esi
call fcn.004dc010
push eax
push ebx
push ebx
push ebp
call fcn.004bf9cf
add esp, 0x14
or ebp, 0xffffffff
mov ecx, esi
push ebp
call fcn.004dc060
lea eax, [esp + 0x8c]
mov ecx, esi
push eax
call fcn.004dbfbc
mov ecx, dword [esp + 0x10]
push edi
push ecx
call fcn.004859c0
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
call fcn.00493e70
test eax, eax
jne 0x486b8f
lea ecx, [esp + 0x18]
mov byte [esp + 0x294], 2
call fcn.004dbbcb
lea ecx, [esp + 0x10]
mov byte [esp + 0x294], 1
call fcn.004dbbcb
lea ecx, [esp + 0x20]
mov byte [esp + 0x294], bl
call fcn.00493610
lea ecx, [esp + 0x14]
mov dword [esp + 0x294], ebp
call fcn.004dbbcb
xor eax, eax
jmp 0x486c1f
mov ecx, dword [esp + 0x10]
lea eax, [edi + 8]
push eax
push ecx
call fcn.004859c0
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
call fcn.00493e70
test eax, eax
je 0x486bc3
mov eax, dword [esp + 0x10]
add edi, 0xc
push edi
push eax
call fcn.004859c0
add esp, 8
mov ecx, dword [esp + 0x2a4]
cmp ecx, ebx
je 0x486bd8
lea edx, [esp + 0x14]
push edx
call fcn.004dbd12
lea ecx, [esp + 0x18]
mov byte [esp + 0x294], 2
call fcn.004dbbcb
lea ecx, [esp + 0x10]
mov byte [esp + 0x294], 1
call fcn.004dbbcb
lea ecx, [esp + 0x20]
mov byte [esp + 0x294], bl
call fcn.00493610
lea ecx, [esp + 0x14]
mov dword [esp + 0x294], ebp
call fcn.004dbbcb
mov eax, 1
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x288
ret 0xc
Function at 0x48b7c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x502ec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x6c]
mov ax, word [esp + 0x78]
push ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x1c], 0x44
mov word [esp + 0x4c], ax
mov dword [esp + 0x48], 1
call fcn.004dbc3f
push 0x539d4c
lea ecx, [esp + 0x7c]
mov dword [esp + 0x68], 0
call fcn.004dbfbc
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x78]
push edx
call fcn.004dbfbc
mov edx, dword [esp + 0x74]
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x7c]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x48b870
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
lea ecx, [esp + 0x78]
mov dword [esp + 0x64], 0xffffffff
call fcn.004dbbcb
mov ecx, dword [esp + 0x5c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret

Function at 0x48b980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x502ee8
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x48ba81
mov eax, dword [edi]
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x1c]
test ecx, ecx
jne 0x48b9ba
test eax, eax
je 0x48ba81
jmp 0x48b9be
test eax, eax
je 0x48b9c6
push eax
mov ecx, edi
call fcn.004dbd62
push 0x412
call fcn.004db904
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov word [esi], 0
push 0x208
push esi
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push esi
call fcn.004c1742
add esp, 8
test eax, eax
je 0x48ba09
mov word [eax + 2], 0
mov eax, dword [edi]
push eax
push esi
call fcn.004bf675
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48ba50
push esi
mov ecx, edi
call fcn.004dbd62
push esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004db92d
add esp, 4
mov eax, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [edi]
push 0
push esi
push 0x104
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x48ba21
mov ecx, edi
call fcn.004dbb53
push esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004db92d
add esp, 4
mov ecx, dword [esp + 8]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x48bd90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x502f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
push ebx
mov ebp, 2
call fcn.004bf79a
add esp, 4
cmp eax, ebp
mov dword [esp + 0x10], eax
jl 0x48be39
lea esi, [ebx + 4]
mov di, word [esi + 2]
add esi, 2
inc ebp
cmp di, 0x5c
je 0x48bdda
test di, di
jne 0x48be35
push ebx
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48be2a
mov eax, dword [0x5748d0]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
push ecx
push ebx
call fcn.0048bca0
mov edx, dword [esp + 0x2c]
add esp, 8
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004dbbcb
jmp 0x48be2e
test al, 0x10
je 0x48be51
mov eax, dword [esp + 0x10]
mov word [esi], di
cmp ebp, eax
jle 0x48bdc7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48bf20
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push edi
push 0
push 0x2000000
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48bf49
xor eax, eax
pop edi
ret
push ebx
mov ebx, dword [esp + 0x10]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test ebx, ebx
mov esi, eax
jne 0x48bf64
cmp esi, 0xffffffff
jne 0x48bf64
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x48bf80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x48bfa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48bfba
test al, 0x10
je 0x48bfba
mov eax, 1
ret
xor eax, eax
ret
Function at 0x48bfc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x502f68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5748d0]
push esi
push edi
mov dword [esp + 8], eax
push 0x106
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.004dc010
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.004dc060
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 8]
push 0x208
mov ecx, edi
call fcn.004dc010
mov ecx, dword [esp + 0x1c]
push eax
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004dc060
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004dbbcb
mov ecx, dword [esp + 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48d4e0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5030e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5748d0]
push ebx
mov ebx, ecx
push esi
mov dword [esp + 8], ebx
lea esi, [ebx + 0x24]
mov dword [esi], eax
mov ecx, dword [0x5748d0]
mov dword [esp + 0x14], 0
mov dword [ebx + 0x28], ecx
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x14], 1
test eax, eax
mov dword [ebx], 0x517c64
jne 0x48d533
push 0x5792e8
jmp 0x48d534
push eax
mov ecx, esi
call fcn.004dbd62
push edi
mov ecx, esi
call fcn.004d3a07
mov eax, dword [esi]
mov edi, dword [eax - 8]
cmp edi, 3
jle 0x48d566
cmp word [eax + edi*2 - 2], 0x5c
jne 0x48d566
push edi
mov ecx, esi
call fcn.004dc010
dec edi
mov ecx, esi
push edi
call fcn.004dc060
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x48d5ab
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebp
test al, 0x10
je 0x48d582
cmp eax, 0xffffffff
jne 0x48d5aa
push 0x5c
mov ecx, esi
call fcn.004d3491
mov edi, eax
test edi, edi
jl 0x48d5aa
push edi
mov ecx, esi
call fcn.004dc010
push edi
mov ecx, esi
call fcn.004dc060
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x48d576
pop ebp
mov edx, dword [esp + 0x28]
lea esi, [ebx + 4]
xor eax, eax
mov ecx, 8
mov edi, esi
push eax
rep stosd dword es:[edi], eax
push edx
call fcn.004d9979
test eax, eax
pop edi
jne 0x48d5cd
mov dword [esi], eax
jmp 0x48d5d2
mov eax, dword [eax + 0x1c]
mov dword [esi], eax
mov edx, dword [esp + 0x20]
lea ecx, [ebx + 0x2c]
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 0xc]
or edx, 0x44
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], str.Current_Selection
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], 0x48d610
mov dword [ebx + 0x1c], ebx
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x48e210
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push esi
mov esi, dword [esp + 0x11c]
push edi
push str.unknown_Windows_version
mov ecx, esi
call fcn.004dbd62
mov edi, dword [esp + 0x124]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x48e258
pop edi
pop esi
add esp, 0x114
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
and eax, 0xffff
cmp ecx, 1
jne 0x48e3a2
cmp dword [esp + 0xc], 4
jne 0x48e4e2
mov ecx, dword [esp + 0x10]
cmp ecx, 0xa
jae 0x48e2fc
cmp eax, 0x3b6
jne 0x48e2a9
push str.Windows_95
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 1
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
jbe 0x48e2d2
cmp eax, 0x438
ja 0x48e2d9
push str.Windows_95_SP1
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 2
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 0x438
jbe 0x48e2f9
push str.Windows_95_OSR2
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 3
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp ecx, 0xa
jne 0x48e379
cmp eax, 0x7ce
jne 0x48e325
push str.Windows_98
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 4
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
jbe 0x48e34e
cmp eax, 0x887
jae 0x48e359
push str.Windows_98_SP1
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 5
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 0x887
jb 0x48e4e2
push str.Windows_98_SE
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 6
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp ecx, 0x5a
jne 0x48e4e2
push str.Windows_ME
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 7
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp ecx, 2
jne 0x48e4cb
mov eax, dword [esp + 0xc]
cmp eax, 3
jne 0x48e3df
cmp dword [esp + 0x10], 0x33
jne 0x48e4e2
push str.Windows_NT_3.51
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0x65
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 4
jne 0x48e404
push str.Windows_NT_4
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0x66
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 5
jne 0x48e479
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x48e431
push str.Windows_2000
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0x67
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 1
jne 0x48e456
push str.Windows_XP
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0x68
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
push str.Windows_2003
mov ecx, esi
cmp eax, 2
call fcn.004dbd62
mov dword [edi], 0x69
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 6
jne 0x48e4e2
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x48e4a6
push str.Windows_Vista
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0x6a
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp eax, 1
jne 0x48e4e2
push str.Windows_Vista
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0x6b
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
cmp ecx, 3
jne 0x48e4e2
push str.Windows_CE
mov ecx, esi
call fcn.004dbd62
mov dword [edi], 0xc9
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
Function at 0x48e800
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x48e834
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esp + 0xc]
push 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e834
mov eax, dword [esp + 4]
cmp eax, 4
je 0x48e836
cmp eax, 1
je 0x48e836
xor eax, eax
ret

Function at 0x48f860
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x503480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov ebp, ecx
push edi
push SysReAllocStringLen
lea ecx, [esp + 0x10]
call fcn.00441b90
mov dword [esp + 0x30], 0
call fcn.004f0680
mov ecx, dword [eax + 4]
call fcn.004f1d34
mov edi, dword [esp + 0x38]
mov esi, eax
test esi, esi
je 0x48f906
lea ecx, [esp + 0x14]
call fcn.004d5ea0
lea eax, [esp + 0x14]
push esi
push eax
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 1
call fcn.00441cf0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
xor esi, esi
test eax, eax
jle 0x48f8f8
mov ecx, dword [esp + 0x18]
push edi
mov edx, dword [ecx + esi*4]
push edx
call fcn.004bf7b7
add esp, 8
test eax, eax
je 0x48f935
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x48f8da
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.004d5ed3
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x48f956
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048de10
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push edi
mov ecx, ebp
call fcn.0048f710
mov esi, eax
mov ecx, esi
call fcn.0048f330
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.004d5ed3
jmp 0x48f960
push edi
mov ecx, ebp
call fcn.0048f710
mov esi, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048de10
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x491ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x503840
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5748d0]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x20], edi
je 0x491f03
push eax
lea ecx, [esp + 0x10]
call fcn.004dbd62
jmp 0x491f0c
lea ecx, [esp + 0xc]
call fcn.004dbb53
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x491f20
push eax
lea ecx, [esp + 0xc]
call fcn.004dbd62
jmp 0x491f29
lea ecx, [esp + 8]
call fcn.004dbb53
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x30]
lea edi, [esi + 0x7c]
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
mov esi, dword [edi + 8]
lea ecx, [esi + 1]
push ecx
mov ecx, edi
call fcn.00492b90
mov eax, dword [edi + 4]
lea edx, [esp + 8]
shl esi, 4
add esi, eax
push edx
mov ecx, esi
call fcn.004dbd12
lea eax, [esp + 0xc]
lea ecx, [esi + 4]
push eax
call fcn.004dbd12
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], ecx
mov edx, dword [esp + 0x14]
mov dword [esi + 0xc], edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 1
call fcn.004dbbcb
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.004dbbcb
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc