joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48619c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x486347
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x486328
mov dl, 1
mov eax, dword [0x418850]
call fcn.00403b64
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004049c8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x486317
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00473334
test al, al
je 0x48630a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x486358
lea eax, [ebp - 0x254]
call fcn.0040a9cc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x48630a
xor eax, eax
push ebp
push 0x486303
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x486390
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4862ec
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c38
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4862ec
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48630a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x48620d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041d644
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48634e
lea eax, [ebp - 0x260]
call fcn.004049c8
ret

Function at 0x486c7c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x504bf4]
cmp byte [eax + 0xa5], 0
jne 0x486ced
cmp dword [0x504c0c], 0
jne 0x486cae
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x486c38
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x504c0c], eax
cmp dword [0x504c08], 0
jne 0x486cc9
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x504c08], eax
cmp dword [0x504c10], 0
jne 0x486ced
push esp
push 0
push 0
push 0x486bdc
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread_1
mov dword [0x504c10], eax
pop edx
ret
Function at 0x486de4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x486dfb
add esp, 0xfffffff0
call fcn.00403ef8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423d1c
mov eax, dword [0x5039bc]
cmp word [eax + 2], 0
jne 0x486e23
mov eax, dword [0x5039bc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00488564
mov eax, dword [0x503abc]
cmp word [eax + 2], 0
jne 0x486e3d
mov eax, dword [0x503abc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0048875c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4181ec]
call fcn.00403b64
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4181ec]
call fcn.00403b64
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4262e8]
call fcn.0042e47c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x486fc4
mov eax, dword [0x50387c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e84c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x488d0c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x50387c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e548
test eax, eax
je 0x486f32
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a3ac
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e570
test eax, eax
je 0x486f46
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404c38
mov eax, dword [0x5036bc]
cmp byte [eax], 0
jne 0x486f7a
mov eax, ebx
call fcn.004870ec
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00488ee8
mov eax, ebx
call fcn.004898ac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x486fba
call fcn.00403f50
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48736c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x504bf4]
cmp dword [eax + 0x30], 0
je 0x487416
cmp dword [ebx + 0x94], 0
jne 0x487410
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4872fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x487410
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4873d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x487410
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041ab1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4873e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x487f78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x487fad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ab8
jmp 0x487fba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a1c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4890c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x489105
mov eax, esi
call fcn.0046e8b8
test al, al
je 0x489105
mov eax, dword [ebx + 0x84]
call fcn.0046e5b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x489105
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046e5b4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x48ef28
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f099
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48f074
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404bb0
lea eax, [ebp - 0x118]
mov edx, 0x48f0b0
call fcn.00404c90
mov eax, dword [ebp - 0x118]
call fcn.00404e88
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x48efe6
lea eax, [ebp - 0x111]
call fcn.0040a370
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404ab8
jmp 0x48efed
mov eax, esi
call fcn.004049c8
cmp bl, 0x61
jae 0x48f00e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e41c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404a1c
jmp 0x48f028
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e390
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404a1c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x48f0bc
call fcn.0040aa4c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f07b
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x49890c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4989c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004050fc
mov eax, dword [0x503764]
cmp byte [eax], 0
je 0x49897b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004054c0
mov eax, dword [ebx]
call fcn.00405288
push eax
mov eax, dword [ebx]
call fcn.00405278
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405288
mov edx, eax
dec edx
mov eax, ebx
call fcn.004054c0
jmp 0x4989ad
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a55c
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4989cd
lea eax, [ebp - 0x3f0]
call fcn.004049c8
ret
Function at 0x49bb98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x49bbf2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.0049bbfc
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bbf9
ret

Function at 0x4a3bc8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.0046e5b4
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.00467cb4
pop ebx
ret
Function at 0x4a9c6c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a9d26
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004050fc
mov eax, dword [0x503764]
cmp byte [eax], 0
je 0x4a9cdb
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004054c0
mov eax, dword [ebx]
call fcn.00405288
push eax
mov eax, dword [ebx]
call fcn.00405278
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405288
mov edx, eax
dec edx
mov eax, ebx
call fcn.004054c0
jmp 0x4a9d0d
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a55c
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9d2d
lea eax, [ebp - 0x3f0]
call fcn.004049c8
ret

Function at 0x4a9d34
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040a55c
add esp, 0x3ec
pop ebx
ret

Function at 0x4aff20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x503bf4]
mov eax, dword [eax]
cmp dword [eax + 0x64], 0
jne 0x4affc6
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4aff65
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4affa1
jmp 0x4aff69
pop edx
pop eax
jge 0x4affa1
mov eax, dword [0x503bf4]
mov eax, dword [eax]
mov dword [eax + 0x44], 2
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004aace0
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x4affc6
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4affc6
cmp dword [ebx + 0x11c], 0
je 0x4affc6
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00437df8
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4bab6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bacdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4bacc2
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040a55c
mov dl, 1
mov eax, dword [0x492550]
call fcn.004925a8
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x418b40]
call fcn.00403b64
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00492624
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4bacbf
mov dl, 1
mov eax, dword [0x494068]
call fcn.004940d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x4bacf4
call fcn.00492be8
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x4bacb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004943d0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004bacfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bacbf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00403b94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403b94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403b94
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bace4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004049ec
ret

Function at 0x4be71c
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, 1
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA_1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
cmp ecx, 2
jne 0x4be776
mov ebx, 2
cmp eax, 5
jne 0x4be759
test edx, edx
jne 0x4be759
mov ebx, 3
cmp eax, 5
jne 0x4be768
cmp edx, 1
jne 0x4be768
mov ebx, 4
cmp eax, 6
jne 0x4be776
test edx, edx
jne 0x4be776
mov ebx, 5
mov eax, ebx
add esp, 0x94
pop ebx
ret

Function at 0x4bf398
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
xor ebx, ebx
push 0
push 0x4bf3bc
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x4bf3b6
push esi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4bf3b6
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4bf4a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bf59e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x90
call fcn.0040273c
mov ebx, eax
push ebx
push 0x90
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404bc0
mov eax, ebx
call fcn.0040275c
lea eax, [ebp - 0x1d4]
mov ecx, 0x4bf5b4
mov edx, dword [ebp - 4]
call fcn.00404cd4
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00402f8c
xor eax, eax
push ebp
push 0x4bf541
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
call fcn.00402d1c
call fcn.004028a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf54b
xor eax, eax
push ebp
push 0x4bf573
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
call fcn.00403054
call fcn.004028a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf57d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf5a5
lea eax, [ebp - 0x1d4]
call fcn.004049c8
lea eax, [ebp - 4]
call fcn.004049c8
ret

Function at 0x4bfab8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4bfbdd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00404e88
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4bfbc7
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404e88
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA
push eax
call sub.KERNEL32.DLL_SetLastError
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
jne 0x4bfbbe
cmp dword [ebp - 0xc], 7
jne 0x4bfbbe
mov eax, dword [ebp - 0x10]
call fcn.0040273c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4bfbb5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404e88
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov ebx, dword [ebp - 0x14]
jmp 0x4bfb9a
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404bc0
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.KERNEL32.DLL_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x4bfb7d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfbbc
mov eax, dword [ebp - 0x14]
call fcn.0040275c
ret
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfbe4
lea eax, [ebp - 0x1c]
call fcn.004049c8
ret
Function at 0x4bfbf0
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, 1
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA_1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
cmp ecx, 2
jne 0x4bfc4a
mov ebx, 2
cmp eax, 5
jne 0x4bfc2d
test edx, edx
jne 0x4bfc2d
mov ebx, 3
cmp eax, 5
jne 0x4bfc3c
cmp edx, 1
jne 0x4bfc3c
mov ebx, 4
cmp eax, 6
jne 0x4bfc4a
test edx, edx
jne 0x4bfc4a
mov ebx, 5
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x4ee69c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ee79a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x320]
mov eax, dword [eax + 0x26c]
call fcn.00447ea8
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ee77f
inc ebx
xor esi, esi
mov eax, dword [edi + 0x320]
mov eax, dword [eax + 0x26c]
mov edx, esi
call fcn.00448274
mov eax, dword [eax + 8]
lea edx, [ebp - 0xc]
call fcn.00409234
mov edx, dword [ebp - 0xc]
mov eax, 0x4ee7b4
call fcn.00404fcc
test eax, eax
jle 0x4ee777
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4ee7b4
call fcn.00404fcc
mov edx, eax
dec edx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404ee8
lea eax, [ebp - 0x14]
mov ecx, 0x4ee7c0
mov edx, dword [ebp - 0x10]
call fcn.00404cd4
mov eax, dword [ebp - 0x14]
call fcn.00404e88
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, dword [ebp + 8]
jne 0x4ee777
mov eax, dword [ebp - 4]
inc dword [eax]
mov eax, dword [edi + 0x320]
mov eax, dword [eax + 0x26c]
mov edx, esi
call fcn.00448274
cmp dword [eax + 0x20], 2
jne 0x4ee777
mov eax, dword [ebp - 8]
inc dword [eax]
inc esi
dec ebx
jne 0x4ee6e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee7a1
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004049ec
ret

Function at 0x4ef2e4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ef3e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x320]
mov eax, dword [eax + 0x26c]
call fcn.00447ea8
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ef3cc
inc ebx
xor esi, esi
mov eax, dword [edi + 0x320]
mov eax, dword [eax + 0x26c]
mov edx, esi
call fcn.00448274
mov eax, dword [eax + 8]
lea edx, [ebp - 0xc]
call fcn.00409234
mov edx, dword [ebp - 0xc]
mov eax, 0x4ef400
call fcn.00404fcc
test eax, eax
jle 0x4ef3c4
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x4ef400
call fcn.00404fcc
mov edx, eax
dec edx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404ee8
lea eax, [ebp - 0x14]
mov ecx, 0x4ef40c
mov edx, dword [ebp - 0x10]
call fcn.00404cd4
mov eax, dword [ebp - 0x14]
call fcn.00404e88
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, dword [ebp + 0xc]
je 0x4ef3a1
cmp eax, dword [ebp + 8]
jne 0x4ef3c4
mov eax, dword [ebp - 4]
inc dword [eax]
mov eax, dword [edi + 0x320]
mov eax, dword [eax + 0x26c]
mov edx, esi
call fcn.00448274
cmp dword [eax + 0x20], 2
jne 0x4ef3c4
mov eax, dword [ebp - 8]
inc dword [eax]
inc esi
dec ebx
jne 0x4ef329
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef3ee
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004049ec
ret