joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4913ac
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00495180
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x491405
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x4914bb
mov eax, dword [ebp - 0x94]
dec eax
je 0x4914a7
dec eax
jne 0x4914bb
mov eax, dword [ebp - 0xa0]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x491454
cmp dword [ebp - 0x9c], edx
jne 0x49143e
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x4914a3
cmp dword [ebp - 0x9c], edi
jne 0x49148c
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x4914a3
cmp eax, 5
jne 0x49147e
cmp dword [ebp - 0x9c], 2
jne 0x491465
push eax
jmp 0x491485
cmp dword [ebp - 0x9c], 1
jne 0x491472
mov edi, ecx
jmp 0x4914bb
cmp dword [ebp - 0x9c], edi
jne 0x4914bb
push 3
jmp 0x491485
cmp eax, 4
ja 0x491488
push 4
pop edi
jmp 0x4914bb
cmp eax, ecx
jb 0x4914bb
cmp dword [ebp - 0x9c], 2
jae 0x491499
cmp eax, ecx
jbe 0x4914bb
cmp byte [ebp + 0x76], dl
jne 0x4914bb
call fcn.004912d4
mov edi, eax
jmp 0x4914bb
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x4917a3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x4917bc
mov eax, dword [ebp - 4]
jmp 0x491896
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x491871
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7228]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e7228]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7228]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e7228]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7228]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4e7228]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4e7228]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4e7228]
dec ebp
jne 0x4917db
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x49188d
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4e7228]
dec ecx
jne 0x49187b
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4918cb
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x491976
push edi
push 1
push esi
call fcn.004972d1
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x491973
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49196c
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x4eb260
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49196c
cmp dword [ebp - 4], 0
je 0x49196c
push 0x14
call fcn.0046222d
mov esi, eax
test esi, esi
pop ecx
je 0x491973
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi + 0xc], ecx
lea ecx, [ebp - 0x10]
push ecx
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
and dword [eax], 0
push eax
push 0x4e3bf8
push edi
mov dword [esi], vtable.cf::FileVersionInfo.0
mov dword [esi + 4], edi
call sub.VERSION.dll_VerQueryValueW
mov eax, esi
jmp 0x491975
push edi
call fcn.00495d38
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x491b69
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, ecx
mov ax, word [esi + 8]
mov word [ebp - 0x14], ax
mov ax, word [esi + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x12], ax
call edi
mov word [ebp - 0x10], ax
mov ax, word [esi + 0xc]
mov word [ebp - 0xe], ax
mov ax, word [esi + 8]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], 0x4e4
call edi
mov word [ebp - 8], ax
mov word [ebp - 6], 0x4e4
xor edi, edi
mov ebx, 0x104
movzx eax, word [ebp + edi*2 - 0x14]
movzx ecx, word [ebp + edi*2 - 0x12]
push dword [ebp + 8]
inc edi
movzx ecx, cx
push ecx
movzx eax, ax
push eax
push str.StringFileInfo_04x_04x_ls
push ebx
lea eax, [ebp - 0x220]
push ebx
push eax
inc edi
call fcn.004950bb
and dword [ebp - 4], 0
add esp, 0x1c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x491c0e
cmp dword [ebp - 4], 0
jne 0x491c1c
cmp edi, 8
jb 0x491bbc
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [ebp - 4]
push esi
call fcn.00495089
pop ecx
mov ecx, esi
mov esi, dword [ebp + 0xc]
call fcn.0041e4e5
mov al, 1
jmp 0x491c15
Function at 0x491fe0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x4d0f90
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebp
push esi
push edi
mov eax, dword [0x5061dc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov eax, dword [ebp]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4921bd
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
je 0x4921bd
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4921bd
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4921b0
test edi, edi
jbe 0x4921b0
push eax
lea edx, [esp + 0x4c]
push edx
call fcn.00492590
push esi
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [esp + 0x1c]
call fcn.004481c0
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x48]
push eax
lea esi, [esp + 0x20]
call fcn.004907e9
cmp dword [esp + 0x24], 0
je 0x492165
mov eax, dword [ebp]
push eax
mov eax, esi
call fcn.0048f75b
test eax, eax
je 0x4920dc
mov eax, dword [ebp]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00490a27
mov byte [esp + 0x40], 2
call fcn.0048f747
mov edx, dword [esp + 0x4c]
push eax
push edx
call fcn.00432921
mov byte [esp + 0x40], 1
mov eax, dword [ebx]
push eax
lea eax, [esp + 0x20]
call fcn.0048f75b
test eax, eax
je 0x49211a
mov eax, dword [ebx]
push eax
lea eax, [esp + 0x14]
push eax
lea esi, [esp + 0x24]
call fcn.00490a27
mov byte [esp + 0x40], 3
call fcn.0048f747
mov ecx, dword [esp + 0x50]
push eax
push ecx
call fcn.00432921
mov dword [esp + 0x10], vtable.cf::BkJson::Handle.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 0
call fcn.004907a6
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x492150
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x34
ret
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 0
call fcn.004907a6
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4921bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x34
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x34
ret
Function at 0x492661
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
push edi
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call fcn.00492ac4
xor edi, edi
inc edi
test eax, eax
je 0x49268d
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
lea ecx, [ebp + 0xb]
call fcn.00492b1d
test eax, eax
jne 0x4926b1
lea ecx, [ebp + 0xb]
call fcn.00492b4b
test eax, eax
jne 0x4926b1
lea ecx, [ebp + 0xb]
call fcn.00492b79
test eax, eax
je 0x4926b5
or dword [ebp - 4], 2
call fcn.00492bf3
test eax, eax
je 0x4926c5
or dword [ebp - 4], 4
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x4926dc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [esi], edi
mov dword [ebx], edi
mov dword [eax], ecx
jmp 0x4927e7
lea esi, [ebp - 4]
call fcn.00492cc4
test eax, eax
je 0x492700
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x4927e7
lea esi, [ebp - 4]
call fcn.00492d06
test eax, eax
je 0x492719
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 3
jmp 0x4926f3
call fcn.0049316a
test al, al
jne 0x492734
call fcn.0049312f
test al, al
jne 0x492734
call fcn.00493097
test al, al
je 0x492741
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 4
jmp 0x4926f3
lea esi, [ebp - 0xcc]
mov dword [ebp - 8], 3
call fcn.004932d7
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.00493361
test eax, eax
je 0x49279b
mov eax, dword [ebp - 8]
test eax, eax
je 0x492771
cmp eax, edi
je 0x492771
cmp eax, 2
jne 0x49279b
cmp eax, edi
mov ecx, dword [ebp + 8]
mov dword [ecx], edi
mov dword [ebx], 5
jne 0x49278b
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x3001
jmp 0x4927e7
cmp eax, 2
jne 0x4927e7
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x3002
jmp 0x4927e7
push str.SbieDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4927b7
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 6
jmp 0x4927e1
call fcn.004927ed
test eax, eax
je 0x4927cd
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 7
jmp 0x4927e1
call fcn.00492890
test eax, eax
je 0x4927e7
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 8
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x492d4f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5061dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
xor bl, bl
call fcn.00495180
add esp, 0xc
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x492dd1
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x492dc9
lea eax, [ebp - 0x20c]
push eax
push str.vmusrvc.exe
call fcn.004978f4
test eax, eax
pop ecx
pop ecx
je 0x492dcf
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x492da5
jmp 0x492dd1
mov bl, 1
test esi, esi
je 0x492ddc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0049de7e
leave
ret

Function at 0x492dec
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x5061dc]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
mov edi, 0x208
xor ebx, ebx
push edi
lea eax, [ebp + 0x192]
push ebx
push eax
mov word [ebp + 0x190], bx
call fcn.00495180
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x190]
push eax
mov byte [ebp - 0x7d], bl
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x492ea5
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
and word [ebp - 0x7c], 0
push edi
lea eax, [ebp - 0x7a]
push 0
push eax
call fcn.00495180
push 0xffffffffffffffff
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00499a26
push 0xffffffffffffffff
push dword [ebx + 0x50d800]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004cbd1d
add esp, 0x2c
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x492ea1
add ebx, 4
cmp ebx, 0x14
jb 0x492e50
jmp 0x492ea5
mov byte [ebp - 0x7d], 1
mov ecx, dword [ebp + 0x39c]
mov al, byte [ebp - 0x7d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049de7e
add ebp, 0x3a0
leave
ret
Function at 0x492f97
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x5061dc]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x5e]
push ebx
push eax
mov byte [ebp - 0x61], bl
mov dword [ebp - 0x6c], ebx
mov word [ebp - 0x60], bx
call fcn.00495180
mov esi, str.DiskVirtual_HD
push esi
mov dword [ebp - 0x70], 0x104
call fcn.00495089
add esp, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetEnumIDE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x49307d
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x6c]
test eax, eax
jne 0x49306f
cmp word [ebp - 0x60], bx
je 0x493050
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x70], eax
jb 0x493050
push eax
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0049a7bc
add esp, 0xc
test eax, eax
je 0x49306b
push 0x208
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00495180
add esp, 0xc
mov dword [ebp - 0x70], 0x104
jmp 0x49300e
mov byte [ebp - 0x61], 1
cmp dword [ebp - 0x68], ebx
je 0x49307d
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1a8]
mov al, byte [ebp - 0x61]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049de7e
add ebp, 0x1ac
leave
ret

Function at 0x49316a
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x5061dc]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
mov edi, 0x208
xor ebx, ebx
push edi
lea eax, [ebp + 0x192]
push ebx
push eax
mov word [ebp + 0x190], bx
call fcn.00495180
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x190]
push eax
mov byte [ebp - 0x7d], bl
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x493223
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
and word [ebp - 0x7c], 0
push edi
lea eax, [ebp - 0x7a]
push 0
push eax
call fcn.00495180
push 0xffffffffffffffff
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00499a26
push 0xffffffffffffffff
push dword [ebx + 0x50d824]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004cbd1d
add esp, 0x2c
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49321f
add ebx, 4
cmp ebx, 4
jb 0x4931ce
jmp 0x493223
mov byte [ebp - 0x7d], 1
mov ecx, dword [ebp + 0x39c]
mov al, byte [ebp - 0x7d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049de7e
add ebp, 0x3a0
leave
ret
Function at 0x49323e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49326e
mov byte [ebp - 1], bl
jmp 0x4932d1
push esi
push 0x80
call fcn.00497722
pop ecx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 1
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4932a9
mov byte [ebp - 1], bl
jmp 0x4932bc
push dword [ebp + 0x10]
push esi
call fcn.00494ca6
test eax, eax
pop ecx
pop ecx
je 0x4932bc
mov byte [ebp - 1], 1
cmp esi, ebx
je 0x4932c7
push esi
call fcn.00495d38
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x493361
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x5061dc]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
mov eax, dword [ebp + 0x1b8]
push edi
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1bc]
xor edi, edi
push 0x206
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x5a]
push edi
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x68], edi
mov word [ebp - 0x5c], di
call fcn.00495180
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetEnumPCI
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x60], 0x104
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x493484
mov eax, dword [ebp - 0x70]
push ebx
mov dword [ebp - 0x64], eax
push esi
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x68]
test eax, eax
jne 0x493474
mov ebx, dword [ebp - 0x6c]
xor esi, esi
inc esi
add ebx, 0x48
cmp word [ebp - 0x5c], di
je 0x49343a
cmp word [ebx], di
je 0x49343a
push ebx
call fcn.00495089
cmp eax, 1
pop ecx
jb 0x49343a
cmp dword [ebp - 0x60], eax
jbe 0x49343a
push eax
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.0049a7bc
add esp, 0xc
test eax, eax
je 0x49345e
inc esi
add ebx, 0x40
cmp esi, 3
jb 0x49340c
push 0x208
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.00495180
add esp, 0xc
mov dword [ebp - 0x60], 0x104
jmp 0x4933e1
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x78]
shl esi, 6
mov eax, dword [esi + eax + 4]
mov dword [ecx], eax
mov dword [ebp - 0x74], 1
cmp dword [ebp - 0x64], edi
pop esi
pop ebx
je 0x493484
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
pop edi
call fcn.0049de7e
add ebp, 0x1b0
leave
ret 8
Function at 0x49349f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x5061dc]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
mov esi, ecx
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x493615
push ebx
push edi
push 0x208
push eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push eax
call fcn.00495180
add esp, 0xc
mov edi, str._ALLUSERSPROFILE_
push edi
xor ecx, ecx
call fcn.00401336
or ebx, 0xffffffff
cmp eax, ebx
jne 0x4935e0
mov edi, str._APPDATA_
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
jne 0x4935e0
mov edi, str._TEMP_
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
jne 0x4935e0
mov edi, str._SYSTEM_
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
je 0x493568
push 0x104
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x4935f4
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call fcn.00479fd5
mov eax, esi
call fcn.0043285f
mov edi, 0x4ed6b0
jmp 0x493604
mov edi, str._WINDOWS_
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
je 0x49358a
push 0x104
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x493544
mov edi, str._CUR_DIR_
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
je 0x4935cb
push 0x20a
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00495180
add esp, 0xc
push 0x105
lea eax, [ebp - 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x49354c
mov edi, 0x4ef65c
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
je 0x493557
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.0049362b
test eax, eax
pop ecx
pop ecx
jne 0x49354c
xor eax, eax
jmp 0x493613
push 0x4e3bf8
push edi
push esi
call fcn.00479fd5
push edi
xor ecx, ecx
call fcn.00401336
cmp eax, ebx
jne 0x4935f8
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.0049de7e
add ebp, 0x190
leave
ret
Function at 0x49362b
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x4f9130
call fcn.004a0bac
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x4936dc
cmp dword [ebp + 0xc], eax
je 0x4936dc
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x4936dc
mov ebx, 0x103
cmp esi, ebx
ja 0x4936dc
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049391c
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4936d5
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.00495180
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4936d5
cmp eax, ebx
ja 0x4936d5
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.00499a26
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x4936d5
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c], 0
je 0x4936eb
push dword [ebp - 0x1c]
call fcn.004951fa
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.004a0bf1
ret

Function at 0x4936f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x493798
push edi
push 1
push esi
call fcn.004972d1
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x493795
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49378e
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x4eb260
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49378e
cmp dword [ebp - 4], 0
je 0x49378e
push 0x10
call fcn.0046222d
mov esi, eax
test esi, esi
pop ecx
je 0x493795
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x10]
push ecx
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
and dword [eax], 0
push eax
push 0x4e3bf8
push edi
mov dword [esi], edi
call sub.VERSION.dll_VerQueryValueW
mov eax, esi
jmp 0x493797
push edi
call fcn.00495d38
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret