joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4728d1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5b5c7c
call fcn.00595e20
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0x14]
mov esi, 0x61b5f4
push esi
call fcn.004014d3
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x472917
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret
push esi
lea ecx, [ebp + 0xc]
call fcn.004047b4
test eax, eax
je 0x4728f8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4728f8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], ebx
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x472983
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00401752
mov eax, esi
jmp 0x472911
push 4
pop eax
cmp dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
jne 0x4729c0
or dword [ebp - 0x18], 0xffffffff
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x4729ee
push dword [ebp - 0x18]
push 0x61d510
push dword [ebp + 0x14]
call fcn.004048ab
add esp, 0xc
jmp 0x4729eb
push dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
call fcn.0040133e
lea ecx, [ebp + 8]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x4729ee
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
dec eax
push eax
call fcn.00411b03
mov dword [ebp - 0x14], edi
mov esi, dword [ebp - 0x14]
jmp 0x47295f

Function at 0x4729f6
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x5b313b
call fcn.00595e20
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
cmp dword [eax - 0xc], ebx
jne 0x472a2f
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
xor eax, eax
jmp 0x472a8b
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x472a14
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x472a69
xor edi, edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, edi
call fcn.00595ef8
ret
Function at 0x472b41
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x5b3110
call fcn.00595e20
mov dword [ebp - 4], 2
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x472b86
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401752
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
je 0x472b5b
push ebx
lea ecx, [ebp + 8]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x472b5b
mov eax, dword [ebp + 0x14]
mov eax, dword [eax - 0xc]
mov esi, dword [ebp + 0x10]
inc eax
push eax
lea ecx, [ebp + 0x14]
call fcn.004115ad
push eax
push 1
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor esi, esi
test eax, eax
je 0x472c04
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401752
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401752
mov eax, esi
jmp 0x472b80
inc esi
jmp 0x472bd1

Function at 0x472c07
Capabilities:
Delete registry value

Disassembly:
push 8
mov eax, 0x5b30dd
call fcn.00595e20
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
call fcn.004048be
mov byte [ebp - 4], 2
push 0x61b5f4
lea ecx, [ebp + 8]
call fcn.004047b4
test eax, eax
jne 0x472c64
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401752
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, esi
call fcn.00595ef8
ret
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x472c36
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
push dword [ebp - 0x10]
jne 0x472ca4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472c38
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472c36
Function at 0x472cac
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5b5c51
call fcn.00595e20
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x472cdc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x10]
push ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
push eax
mov dword [ebp - 0x10], ebx
call edi
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x472d0f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, ebx
jmp 0x472cd4
cmp dword [ebp - 0x14], 4
jne 0x472d50
lea eax, [ebp - 0x18]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x18], ebx
call fcn.004049a2
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
call fcn.00472d92
cmp eax, ebx
je 0x472d83
push dword [ebp - 0x18]
push 0x61d510
push dword [ebp + 0xc]
call fcn.004048ab
add esp, 0xc
jmp 0x472d83
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
call fcn.00472e83
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
push dword [esi + 0xc]
call edi
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x10]
dec eax
push eax
call fcn.00411b03
xor eax, eax
cmp dword [esi + 0x14], ebx
sete al
mov ebx, eax
jmp 0x472cff

Function at 0x472d92
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x5b32e8
call fcn.00595e20
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0xc]
cmp eax, edi
jne 0x472dc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, edi
call fcn.00595ef8
ret 8
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
push eax
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
cmp eax, edi
sete cl
mov dword [esi + 0x14], eax
mov edi, ecx
jmp 0x472daa

Function at 0x472dee
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x5b30aa
call fcn.00595e20
mov esi, ecx
mov dword [ebp - 4], 1
xor ebx, ebx
cmp dword [esi + 0xc], ebx
je 0x472e62
cmp dword [esi + 0x10], ebx
je 0x472e62
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
mov edi, dword [ebp + 8]
inc eax
push eax
lea ecx, [ebp + 0xc]
call fcn.004115ad
push eax
push 1
push ebx
push edi
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [esi + 0x14], eax
call fcn.00411b03
xor eax, eax
cmp dword [esi + 0x14], ebx
sete al
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, esi
jmp 0x472e7b
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
xor eax, eax
call fcn.00595ef8
ret 8
Function at 0x473e8b
Capabilities:
Get system information on windows

Disassembly:
push 0x24
push 0
push esi
call fcn.0058ee10
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push esi
je 0x473eb7
call eax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
ret
Function at 0x474356
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp + 0x88], eax
push str.unknown
mov ecx, esi
call fcn.004014d3
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftDirectX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4743d2
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4743c9
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.004014d3
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
call fcn.0058cc82
add ebp, 0x8c
leave
ret

Function at 0x4743e7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp + 0x90], eax
push edi
push str.unknown
mov ecx, ebx
call fcn.004014d3
lea eax, [ebp - 0x74]
push eax
push 1
xor edi, edi
push edi
push str.SoftwareMicrosoftActive_SetupInstalled_ComponentsD27CDB6E_AE6D_11cf_96B8_444553540000
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47448e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push edi
push str.IsInstalled
push dword [ebp - 0x74]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], 4
call esi
test eax, eax
jne 0x474484
cmp dword [ebp - 0x78], edi
je 0x474484
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push edi
push str.Version
push dword [ebp - 0x74]
mov dword [ebp - 0x80], 0x100
call esi
test eax, eax
jne 0x474484
lea eax, [ebp - 0x70]
push eax
mov ecx, ebx
call fcn.004014d3
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
pop edi
call fcn.0058cc82
add ebp, 0x94
leave
ret
Function at 0x474a09
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x5b9cd3
call fcn.00595e89
mov esi, str.unknown
push esi
mov edi, ecx
call fcn.004014d3
lea ecx, [edi + 4]
push esi
mov dword [ebp - 0x130], ecx
call fcn.004014d3
lea ecx, [edi + 8]
push esi
mov dword [ebp - 0x134], ecx
call fcn.004014d3
lea ecx, [edi + 0xc]
push esi
mov dword [ebp - 0x124], ecx
call fcn.004014d3
lea ecx, [edi + 0x10]
push esi
mov dword [ebp - 0x12c], ecx
call fcn.004014d3
lea ebx, [edi + 0x14]
push esi
mov ecx, ebx
call fcn.004014d3
lea esi, [ebp - 0x158]
call fcn.00473e8b
push dword [ebp - 0x144]
push 0x61d510
push edi
call fcn.004048ab
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call fcn.00474c11
xor esi, esi
mov dword [ebp - 4], esi
push eax
mov ecx, ebx
call fcn.004048fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401752
lea eax, [ebp - 0x11c]
push eax
xor ebx, ebx
inc ebx
push ebx
push esi
push str.HardwareDescriptionSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x474c0b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push esi
push str.MHz
push dword [ebp - 0x11c]
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x118], 4
call edi
test eax, eax
jne 0x474b4f
push esi
push dword [ebp - 0x120]
lea eax, [ebp - 0x128]
push eax
call fcn.00474930
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x124]
push eax
call fcn.004048fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.00401752
mov ecx, dword [ebp - 0x124]
push 0x634f6c
call fcn.00409033
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push str.ProcessorNameString
push dword [ebp - 0x11c]
mov ebx, 0x100
mov dword [ebp - 0x118], ebx
call edi
test eax, eax
jne 0x474b8d
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x114]
push eax
call fcn.004014d3
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push str.Identifier
push dword [ebp - 0x11c]
mov dword [ebp - 0x118], ebx
call edi
test eax, eax
jne 0x474bc6
mov ecx, dword [ebp - 0x134]
lea eax, [ebp - 0x114]
push eax
call fcn.004014d3
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push str.VendorIdentifier
push dword [ebp - 0x11c]
mov dword [ebp - 0x118], ebx
call edi
test eax, eax
jne 0x474bff
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x114]
push eax
call fcn.004014d3
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00595f0c
ret
Function at 0x474ce5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp + 0x88], eax
push str.unknown
mov ecx, esi
call fcn.004014d3
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x474d61
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x474d58
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.004014d3
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
call fcn.0058cc82
add ebp, 0x8c
leave
ret
Function at 0x475665
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x5b2feb
call fcn.00595e20
mov esi, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 3
mov ecx, esi
call fcn.004048be
mov eax, dword [ebp + 8]
push dword [ebp + 0x18]
mov edi, dword [eax]
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.0040133e
push edi
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00411b03
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x10]
call fcn.00401752
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x14]
call fcn.00401752
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x1c]
call fcn.00401752
mov eax, esi
call fcn.00595ef8
ret 0x18

Function at 0x4757c8
Capabilities:
Read .ini file

Disassembly:
push 0x10
mov eax, 0x5b58cc
call fcn.00595e20
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push ebx
call fcn.0056ecd9
mov esi, 0x2800
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
jne 0x475815
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, ebx
call fcn.00595ef8
ret 0xc
mov eax, dword [ebp + 8]
push dword [eax]
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp byte [edi], bl
mov esi, edi
je 0x4758f1
push esi
lea ecx, [ebp - 0x10]
call fcn.004015a6
mov byte [ebp - 4], 1
push 2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ddca
mov byte [ebp - 4], 2
push 0x6352e4
mov ecx, eax
call fcn.004047b4
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401752
cmp byte [ebp + 0xb], bl
je 0x4758d3
lea eax, [ebp + 8]
push eax
push 0x61b020
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
call fcn.0040dd0a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401752
lea eax, [ebp + 8]
push eax
push 0x61b5f4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040dd0a
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.004048fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401752
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
lea edx, [ebp - 0x10]
push edx
push eax
call fcn.0056efac
push esi
call fcn.0058cca0
pop ecx
lea esi, [esi + eax + 1]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401752
cmp byte [esi], bl
jne 0x47582f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
inc ebx
jmp 0x4757ff
Function at 0x475d70
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x5b9c3e
call fcn.00595e20
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
and dword [ebp - 0x14], 0
test eax, eax
jne 0x475dae
lea esi, [ebp - 0x10]
call fcn.0040d1ea
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
call fcn.004048fa
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401752
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x475e2e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x475e2e
push ebx
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x475e22
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x61cc54
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x475e22
push 0x34
pop eax
cmp dword [ebp - 0x10], eax
jb 0x475e0a
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call fcn.0058e7b0
add esp, 0xc
mov dword [ebp - 0x14], 1
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401752
mov eax, dword [ebp - 0x14]
call fcn.00595ef8
ret

Function at 0x475e43
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x5b9c13
call fcn.00595e20
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
push 0x61b5f4
call fcn.004015a6
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], edi
mov dword [ebp - 0x10], 1
jne 0x475e9a
lea esi, [ebp - 0x14]
call fcn.0040d1ea
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
call fcn.004048fa
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00401752
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, edi
jbe 0x475f4e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x475f4e
push edi
push ebx
push 0
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x475f42
lea eax, [ebp - 0x14]
push str.StringFileInfo040904E4_
push eax
lea ecx, [ebp + 0x10]
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 0x10]
call fcn.004048fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401752
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x475f42
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.00474e3a
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 8]
push eax
call fcn.004048fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401752
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401752
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00401752
mov eax, dword [ebp + 8]
call fcn.00595ef8
ret
Function at 0x4764fe
Capabilities:
Read .ini file

Disassembly:
push 0x18
mov eax, 0x5b9a6e
call fcn.00595e20
mov edi, dword [ebp + 8]
mov ebx, ecx
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
push ecx
lea esi, [ebx + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.004049a2
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00475626
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x61b5f4
call fcn.004015a6
mov byte [ebp - 4], 4
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Path
call fcn.004015a6
mov byte [ebp - 4], 5
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 6
push edi
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.00475665
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x18], 1
je 0x476674
push 0x5c
push 0x2f
push edi
call fcn.0041e86f
push dword [esi]
push 0
push str.IsRelative
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x476674
push edi
lea ecx, [ebp - 0x10]
call fcn.004049a2
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.MozillaFirefox
call fcn.004015a6
mov byte [ebp - 4], 8
push ecx
add ebx, 0xc
mov ecx, esp
mov dword [ebp - 0x24], esp
push ebx
call fcn.004049a2
mov byte [ebp - 4], 9
mov byte [ebp - 4], 7
lea esi, [ebp - 0x1c]
call fcn.0040d17c
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
push eax
mov ecx, edi
call fcn.004048fa
mov byte [ebp - 4], 7
mov ecx, esi
call fcn.00401752
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.004049a2
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
lea esi, [ebp - 0x1c]
call fcn.0040d17c
pop ecx
pop ecx
mov byte [ebp - 4], 0xd
push eax
mov ecx, edi
call fcn.004048fa
mov byte [ebp - 4], 7
mov ecx, esi
call fcn.00401752
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.00401752
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
call fcn.0044fd9b
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, edi
call fcn.00595ef8
ret 8