joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4477e8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x534448]
cmp byte [eax + 0xc], 0
je 0x447955
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44794e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x535b78], 0
jne 0x44783c
push 0x44795c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x447964
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b78], eax
cmp dword [0x531d80], 0
jne 0x447937
push 0x447974
call sub.kernel32.dll_LoadLibraryA
mov dword [0x531d80], eax
cmp dword [0x531d80], 0
je 0x447937
push 0x447980
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b7c], eax
push 0x447990
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b80], eax
push 0x4479a4
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b84], eax
push 0x4479bc
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b88], eax
push 0x4479d4
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b8c], eax
push 0x4479e8
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b90], eax
push 0x447a00
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b94], eax
push 0x447a18
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b98], eax
push 0x447a34
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535b9c], eax
push 0x447a40
mov eax, dword [0x531d80]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x535ba0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447955
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44b7e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004042c0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44b82f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404540
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452f44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x452f94]
test si, 4
je 0x452f58
or bl, 1
test si, 8
je 0x452f62
or bl, 4
test si, 1
je 0x452f6c
or bl, 8
test si, 2
je 0x452f76
or bl, 0x10
test si, 0x10
je 0x452f80
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x452f8f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x452f98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x452fd0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x452fb1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x452fc0
or bl, 4
test esi, 0x20000000
je 0x452fcb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x459678
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45968a
add esp, 0xfffffff0
call fcn.004037f0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042625c
mov eax, dword [0x533c34]
mov dword [eax + 4], ebx
mov dword [eax], 0x459a1c
mov eax, dword [0x533c4c]
mov dword [eax + 4], ebx
mov dword [eax], 0x459a28
mov eax, ebx
call fcn.00459a34
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x455e50
push eax
push 0
push 0
mov eax, dword [0x533f5c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x427c9c]
call fcn.004290e0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x427c9c]
call fcn.004290e0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x427c9c]
call fcn.004290e0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00459e54
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459d30
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459d30
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459d30
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4597c7
call fcn.00403848
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459b14
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459cbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x459ca0
mov dl, 1
mov eax, dword [0x41b6c0]
call fcn.00403474
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004042c0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x459c8f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00447b48
test al, al
je 0x459c82
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x459cd0
lea eax, [ebp - 0x254]
call fcn.00409f08
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x459c82
xor eax, eax
push ebp
push 0x459c7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459d08
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x459c64
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404540
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x459c64
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459c82
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x459b85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041fd9c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459cc6
lea eax, [ebp - 0x260]
call fcn.004042c0
ret

Function at 0x45a5f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x535bc4]
cmp byte [eax + 0xa5], 0
jne 0x45a665
cmp dword [0x535bdc], 0
jne 0x45a626
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45a5b0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x535bdc], eax
cmp dword [0x535bd8], 0
jne 0x45a641
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x535bd8], eax
cmp dword [0x535be0], 0
jne 0x45a665
push esp
push 0
push 0
push 0x45a554
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x535be0], eax
pop edx
ret
Function at 0x45a75c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45a773
add esp, 0xfffffff0
call fcn.004037f0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042625c
mov eax, dword [0x533f38]
cmp word [eax + 2], 0
jne 0x45a79b
mov eax, dword [0x533f38]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045be34
mov eax, dword [0x5340d8]
cmp word [eax + 2], 0
jne 0x45a7b5
mov eax, dword [0x5340d8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c02c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41b05c]
call fcn.00403474
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x42844c]
call fcn.0042e0d0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45a93c
mov eax, dword [0x533d14]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e4a0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45c5cc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x533d14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dcf4
test eax, eax
je 0x45a8aa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004098e8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dd1c
test eax, eax
je 0x45a8be
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404540
mov eax, dword [0x533a34]
cmp byte [eax], 0
jne 0x45a8f2
mov eax, ebx
call fcn.0045aa64
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045c7a8
mov eax, ebx
call fcn.0045d16c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45a932
call fcn.00403848
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ace4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x535bc4]
cmp dword [eax + 0x30], 0
je 0x45ad8e
cmp dword [ebx + 0x94], 0
jne 0x45ad88
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45ac74
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45ad88
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45ad4e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45ad88
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d8ec
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45ad5d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b8f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b925
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043b0
jmp 0x45b932
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404314
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c984
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c9c5
mov eax, esi
call fcn.0044330c
test al, al
je 0x45c9c5
mov eax, dword [ebx + 0x84]
call fcn.00443008
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c9c5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00443008
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x473e5c
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x473e75
add esp, 0xfffffff0
call fcn.004037f0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x473eea
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0041e2e4
xor edx, edx
mov eax, esi
call fcn.00474014
xor edx, edx
mov eax, esi
call fcn.00474038
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.00418c30
lea edx, [ebp - 0x10]
lea eax, [esi + 0x18]
call fcn.00410cc0
mov byte [esi + 0x39], 0
mov byte [esi + 0x30], 1
lea eax, [esi + 0x10]
call fcn.004042c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473ef1
lea eax, [ebp - 0x10]
call fcn.004109ac
ret
Function at 0x4a1008
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x49fd38]
call fcn.004a0068
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1116
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x1c]
push eax
call sub.kernel32.dll_InterlockedIncrement_1
mov dword [ebx], eax
call fcn.004a0cbc
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0x28]
call fcn.00404a18
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebx + 0xc]
call fcn.00404a18
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x14]
call fcn.00404a18
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [ebx + 0x1c]
call fcn.00404a18
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 4]
add eax, 0x4c
mov edx, dword [ebx + 0x24]
call fcn.00404a18
mov eax, dword [ebp - 4]
add eax, 0x50
mov edx, dword [ebx + 0x2c]
call fcn.00404a18
mov eax, dword [ebp - 4]
add eax, 0x54
mov edx, dword [ebx + 0x30]
mov ecx, dword [0x49fd00]
call fcn.00405b94
mov eax, dword [ebp - 4]
add eax, 0x58
mov edx, dword [ebx + 0x40]
mov ecx, dword [0x49fa68]
call fcn.00405b94
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004a1208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a112d
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4ba5e8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x4ad9d0]
call fcn.00403630
test al, al
je 0x4ba6ee
mov edi, esi
mov al, byte [ebx + 4]
mov byte [edi + 4], al
mov dl, byte [ebx + 5]
mov eax, edi
call fcn.004ba6fc
mov al, byte [ebx + 6]
mov byte [edi + 6], al
mov dl, byte [ebx + 7]
mov eax, edi
call fcn.004ba734
mov al, byte [ebx + 8]
mov byte [edi + 8], al
mov dl, byte [ebx + 9]
mov eax, edi
call fcn.004ba7fc
mov al, byte [ebx + 0xa]
mov byte [edi + 0xa], al
mov dl, byte [ebx + 0xb]
mov eax, edi
call fcn.004ba744
mov dl, byte [ebx + 0xd]
mov eax, edi
call fcn.004ba774
mov dl, byte [ebx + 0xf]
mov eax, edi
call fcn.004ba818
mov al, byte [ebx + 0xe]
mov byte [edi + 0xe], al
mov dl, byte [ebx + 0x10]
mov eax, edi
call fcn.004ba940
mov edx, dword [ebx + 0x14]
mov eax, edi
call fcn.004ba894
mov dl, byte [ebx + 0x18]
mov eax, edi
call fcn.004ba9ac
mov dl, byte [ebx + 0x1a]
mov eax, edi
call fcn.004ba8b8
mov eax, ebx
call fcn.004ba90c
mov edx, eax
mov eax, edi
call fcn.004ba918
mov dl, byte [ebx + 0x1b]
mov eax, edi
call fcn.004baa38
mov dl, byte [ebx + 0x1c]
mov eax, edi
call fcn.004baab8
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov al, byte [ebx + 0x24]
mov byte [edi + 0x24], al
mov al, byte [ebx + 0x19]
mov byte [edi + 0x19], al
mov dl, byte [ebx + 0xc]
mov eax, edi
call fcn.004ba75c
mov al, byte [ebx + 0xc]
mov byte [edi + 0x25], al
mov dl, byte [ebx + 0x1d]
mov eax, edi
call fcn.004bab38
mov dl, byte [ebx + 0x26]
mov eax, edi
call fcn.004babb8
mov dl, byte [ebx + 0x27]
mov eax, edi
call fcn.004bac34
jmp 0x4ba6f7
mov edx, esi
mov eax, ebx
call fcn.0041e070
pop edi
pop esi
pop ebx
ret

Function at 0x4c96c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042c0
push 0
push 0
push 0x4c9714
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4c970d
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.0040491c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404790
push eax
push 0x4c9714
call sub.kernel32.dll_GetEnvironmentVariableA
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c971c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404780
xor eax, eax
push ebp
push 0x4c98c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004042c0
mov word [0x537b20], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404790
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x478e8c]
call fcn.00405a38
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404790
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4c9893
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c98d0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4c9830
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, 4
call fcn.004029ec
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.004090e4
lea eax, [ebp - 0x24]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.004047f0
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 4
mov edx, 5
mov eax, dword [ebp - 0x20]
call fcn.004047f0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
pop ecx
call fcn.004045dc
jmp 0x4c983d
lea eax, [ebp - 0x20]
mov edx, 0x4c98f4
call fcn.00404358
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c9908
push dword [ebp - 0x20]
push 0x4c9924
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404650
mov eax, dword [ebp - 0x2c]
call fcn.00404790
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4c9893
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x478f10]
call fcn.004794c8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00404314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c98cb
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.004042e4
lea eax, [ebp - 0xc]
mov edx, dword [0x478e8c]
call fcn.00405b58
lea eax, [ebp - 4]
call fcn.004042c0
ret
Function at 0x4c9ac8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404780
xor eax, eax
push ebp
push 0x4c9c92
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x537b44], 0xa
jge 0x4c9c74
cmp byte [ebp - 5], 0
je 0x4c9b17
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4c9ca8
call fcn.004045dc
jmp 0x4c9b27
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4c9cd0
call fcn.004045dc
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404790
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c9c74
cmp byte [ebp - 5], 0
je 0x4c9b6e
mov eax, dword [ebp - 4]
call fcn.00404790
mov edx, eax
lea eax, [ebp - 0x85]
call fcn.004098e8
mov byte [ebp - 0x19], 1
jmp 0x4c9b98
mov dword [ebp - 0x14], 0x64
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4c9ce4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0x19]
cmp byte [ebp - 0x19], 0
je 0x4c9c6b
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x185]
push eax
push 0
push 0
push 0x4c9cf8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c9c6b
mov byte [ebp - 0x1a], 0
mov eax, dword [0x537b44]
dec eax
test eax, eax
jl 0x4c9c13
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax*4 + 0x537b9c]
call fcn.00404790
lea edx, [ebp - 0x85]
call fcn.00408b40
test eax, eax
jne 0x4c9c0b
mov byte [ebp - 0x1a], 1
jmp 0x4c9c13
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jne 0x4c9be7
cmp byte [ebp - 0x1a], 0
jne 0x4c9c6b
inc dword [0x537b44]
mov eax, dword [0x537b44]
lea eax, [eax*4 + 0x537b48]
lea edx, [ebp - 0x185]
mov ecx, pe_nt_image_headers32
call fcn.00404540
mov eax, dword [0x537b44]
lea eax, [eax*4 + 0x537b70]
mov edx, dword [ebp - 4]
call fcn.00404314
mov eax, dword [0x537b44]
lea eax, [eax*4 + 0x537b98]
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.00404540
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9c99
lea eax, [ebp - 0xc]
call fcn.004042c0
lea eax, [ebp - 4]
call fcn.004042c0
ret