joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2f02
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 8], ecx
and dword [ebp - 4], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
cmp dword [ebp - 4], 0
jne 0x4a2f80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a2f5b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push 1
mov ecx, dword [ebp - 0xc]
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x4a2f5f
and dword [ebp - 0x20], 0
call fcn.0042a17a
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x48]
call fcn.0040e873
push str.thread.entry_event
lea eax, [ebp - 0x48]
push eax
call fcn.0042a826
pop ecx
pop ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x4a2ffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a2fd8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
push 1
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x4a2fdc
and dword [ebp - 0x2c], 0
call fcn.0042a17a
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x50]
call fcn.0040e873
push str.thread.exit_event
lea eax, [ebp - 0x50]
push eax
call fcn.0042a826
pop ecx
pop ecx
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0
push dword [ebp + 8]
push 0x4a5355
push dword [ebp + 0xc]
push 0
call fcn.0052d969
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x4a30a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a3057
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
push 1
mov ecx, dword [ebp - 0x14]
call dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
jmp 0x4a305b
and dword [ebp - 0x3c], 0
cmp dword [ebp - 4], 0
je 0x4a306a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x4a307f
mov eax, dword [ebp - 8]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042a17a
push eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.0040e873
push str.thread
lea eax, [ebp - 0x58]
push eax
call fcn.0042a826
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x4a30ba
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 8
Function at 0x4adf9f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004253c5
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.0041c138
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
jne 0x4adfdf
mov dword [ebp - 0x24], 1
jmp 0x4adfe3
and dword [ebp - 0x24], 0
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x1d], al
lea ecx, [ebp - 0x1c]
call fcn.00410a3c
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret

Function at 0x4ae000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004253c5
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.0041c138
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x4ae03e
mov dword [ebp - 0x24], 1
jmp 0x4ae042
and dword [ebp - 0x24], 0
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x1d], al
lea ecx, [ebp - 0x1c]
call fcn.00410a3c
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret

Function at 0x4ae58c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5545aa
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x24c], 0
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004b48bc
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00425487
pop ecx
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x230]
call fcn.00410a3c
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 8]
call fcn.00425362
pop ecx
pop ecx
mov eax, dword [ebp - 0x24c]
or eax, 1
mov dword [ebp - 0x24c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00410a23
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051dfa2
leave
ret
Function at 0x4aece6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea ecx, [ebp - 0x7c]
call fcn.004b49ad
push 0
push 0x2000080
push 3
push 0
push 3
push bind
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
call fcn.004253c5
pop ecx
pop ecx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
call fcn.0041c138
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
call fcn.00410a3c
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4aedb2
push 0x28
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x4aedb2
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], ecx
mov eax, dword [ebp - 0xc]
and eax, 0x10
jne 0x4aed7b
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0xc]
and eax, 0x10
je 0x4aed8a
mov dword [ebp - 0x6c], 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004b2f1c
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004b2f1c
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
jmp 0x4aedb9
mov dword [ebp - 0x7c], 0x10
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa
pop ecx
lea esi, [ebp - 0x7c]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret
Function at 0x4aedde
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5546f6
mov eax, dword fs:[0]
push eax
sub esp, 0x328
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x2c8], 0
lea ecx, [ebp - 0x2e4]
call fcn.004b496b
and dword [ebp - 4], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x334]
push eax
call fcn.004aece6
pop ecx
pop ecx
push 0xa
pop ecx
mov esi, eax
lea edi, [ebp - 0x30c]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x30c], 0
je 0x4aee89
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x2e4], eax
lea eax, [ebp - 0x2e4]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040f534
mov eax, dword [ebp - 0x2c8]
or eax, 1
mov dword [ebp - 0x2c8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e4]
call fcn.004b4baa
mov eax, dword [ebp + 8]
jmp 0x4aefcb
push str._.
push dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push eax
call fcn.004a84f7
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004253c5
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2d4]
call fcn.0041c138
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2d0], eax
lea ecx, [ebp - 0x74]
call fcn.00410a3c
cmp dword [ebp - 0x2d0], 0xffffffff
je 0x4aef8f
mov dword [ebp - 0x2cc], 2
mov eax, dword [ebp - 0x2c4]
and eax, 0x10
je 0x4aef0b
mov dword [ebp - 0x2cc], 1
jmp 0x4aef12
and dword [ebp - 0x2cc], 0
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x44]
call fcn.004b48bc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00425487
pop ecx
pop ecx
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.004b5c7c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004745a6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.00410a3c
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4aeeea
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x2e4]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040f534
mov eax, dword [ebp - 0x2c8]
or eax, 1
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00410a23
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e4]
call fcn.004b4baa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051dfa2
leave
ret
Function at 0x4b6777
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 5
push 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004253c5
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.0041c138
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.00410a3c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret

Function at 0x4bc8b2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556665
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
call fcn.00406b1d
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004bcaca
pop ecx
pop ecx
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x4bc6ca
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.004bbee6
push eax
push dword [ebp - 0x18]
push 0
push 0
call fcn.0052d969
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x4bc932
lea ecx, [ebp - 0x14]
call fcn.004bbef4
jmp 0x4bc940
mov eax, dword [ebp - 0x10]
and dword [eax + 4], 0
push 6
call fcn.0050a019
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004bbea7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x4c0b95
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call fcn.004c0b30
movzx eax, al
test eax, eax
jne 0x4c0ba6
jmp 0x4c0bb4
push 0
push dword [0x5c4858]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x4c2ce4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5c4928]
mov dword [ebp - 8], eax
mov eax, dword [0x5c492c]
mov dword [ebp - 4], eax
call fcn.004c0a8e
movzx eax, al
test eax, eax
jne 0x4c2d2a
movzx eax, byte [0x5c48c2]
test eax, eax
je 0x4c2d2a
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.004c2bec
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0
push dword [0x5c4858]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5c4838]
push dword [eax + 4]
push 0xffffffffffffffec
push dword [0x5c4858]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push dword [0x5c4858]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [0x5c4858]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x4d3ebf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
jne 0x4d3ece
xor al, al
jmp 0x4d3f0d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4d3ee4
xor al, al
jmp 0x4d3f0d
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4d3ef2
mov byte [ebp - 2], 1
jmp 0x4d3f0a
mov eax, dword [ebp - 8]
and eax, 0x10
jne 0x4d3f00
mov byte [ebp - 1], 0
jmp 0x4d3f04
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov byte [ebp - 2], al
mov al, byte [ebp - 2]
leave
ret

Function at 0x4d3f0f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5588b4
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.0041c807
movzx eax, al
test eax, eax
je 0x4d3f4d
xor al, al
jmp 0x4d401c
push 0
mov ecx, dword [ebp + 8]
call fcn.0041c127
push eax
call fcn.004d3ebf
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x4d3f6d
mov al, 1
jmp 0x4d401c
or dword [ebp - 0x38], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.0041c127
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x28]
call fcn.0040e585
and dword [ebp - 4], 0
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push dword [0x5b9054]
push dword [ebp - 0x30]
call fcn.0052df01
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4d3fee
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
call fcn.0041bdf7
push dword [0x5b9054]
lea ecx, [ebp - 0x28]
call fcn.0041bdf7
lea ecx, [ebp - 0x28]
call fcn.0041c127
push eax
call fcn.0052e4bd
pop ecx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
push dword [0x5b9054]
push 0
call fcn.0052df01
add esp, 0xc
mov dword [ebp - 0x30], eax
jmp 0x4d3fa4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x4d4009
mov byte [ebp - 0x29], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00410a23
mov al, byte [ebp - 0x29]
jmp 0x4d401c
mov byte [ebp - 0x2a], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00410a23
mov al, byte [ebp - 0x2a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051dfa2
leave
ret
Function at 0x4ed659
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b055
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b93d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x8000
push dword [ebp + 0xc]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.0040d021
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jge 0x4ed6ca
push dword [ebp + 0x10]
lea ecx, [ebp - 0x28]
call fcn.0040fef3
push 0x5a04f4
lea eax, [ebp - 0x28]
push eax
call fcn.00520b1d
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004ecda5
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004ed77d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret

Function at 0x4ee271
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x28]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ee2b0
cmp dword [ebp - 4], 5
je 0x4ee2a6
cmp dword [ebp - 4], 6
je 0x4ee2ab
cmp dword [ebp - 4], 9
je 0x4ee2a2
jmp 0x4ee2b5
xor eax, eax
jmp 0x4ee2b8
xor eax, eax
inc eax
jmp 0x4ee2b8
push 2
pop eax
jmp 0x4ee2b8
push 3
pop eax
jmp 0x4ee2b8
push 4
pop eax
leave
ret

Function at 0x4ee2ba
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x582d54
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4ee2fd
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0x3e8
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0051e060
jmp 0x4ee331
mov dword [ebp - 4], 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.MHz
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ee328
xor eax, eax
xor edx, edx
jmp 0x4ee331
imul eax, dword [ebp - 0xc], 0xf4240
xor edx, edx
leave
ret
Function at 0x4eec04
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push 0x582ebc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4eec4d
mov ecx, dword [ebp + 8]
call fcn.0040e585
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
jmp 0x4eecaa
mov dword [ebp - 0x1c], 0xd
xor eax, eax
inc eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4eec92
mov ecx, dword [ebp + 8]
call fcn.0040e585
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
jmp 0x4eecaa
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040e0e1
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret

Function at 0x4eecb6
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x58]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4eecff
mov ecx, dword [ebp + 8]
call fcn.0040e585
mov eax, dword [ebp - 0x4c]
or eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
jmp 0x4eed5c
mov dword [ebp - 0x50], 0x41
xor eax, eax
inc eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x48]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4eed44
mov ecx, dword [ebp + 8]
call fcn.0040e585
mov eax, dword [ebp - 0x4c]
or eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
jmp 0x4eed5c
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040e0e1
mov eax, dword [ebp - 0x4c]
or eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret
Function at 0x4f0f99
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b3ff
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.0040e585
and dword [ebp - 4], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
push eax
lea ecx, [ebp - 0x28]
call fcn.0041dcd0
lea ecx, [ebp - 0x28]
call fcn.00417983
inc eax
mov dword [ebp - 0x60], eax
push 0
lea ecx, [ebp - 0x28]
call fcn.0041198c
mov dword [ebp - 0x64], eax
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x582f1c
lea ecx, [ebp - 0x28]
call fcn.0043596d
push 0
lea ecx, [ebp - 0x28]
call fcn.0041c127
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
push eax
call fcn.004f1128
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
call fcn.00407d38
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x28]
call fcn.0041c127
mov dword [ebp - 0x6c], eax
push dword [ebp - 0x68]
push dword [ebp - 0x5c]
push 0
push dword [ebp - 0x6c]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x582f2a
lea ecx, [ebp - 0x58]
call fcn.00407d38
push eax
call sub.VERSION.dll_VerQueryValueA
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x10]
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x14]
shr eax, 0x10
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x14]
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 0x2c], eax
push 5
pop ecx
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x58]
call fcn.004f117f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00410a23
push 5
pop ecx
lea esi, [ebp - 0x50]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051dfa2
leave
ret
Function at 0x4f18ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5b93d4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4f1924
xor eax, eax
jmp 0x4f1a32
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], 4
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x582fdc
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f1955
mov eax, dword [ebp - 0x2c]
jmp 0x4f1a32
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push 0x582fe0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4f197c
xor eax, eax
jmp 0x4f1a32
push 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
call fcn.0040e05b
push 0
lea ecx, [ebp - 0x1c]
call fcn.0041198c
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x3c]
push 0
push 0
push str.BuildLabEx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4f19ca
and dword [ebp - 0x44], 0
lea ecx, [ebp - 0x1c]
call fcn.00410a23
mov eax, dword [ebp - 0x44]
jmp 0x4f1a32
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x582ff8
push 0
lea ecx, [ebp - 0x1c]
call fcn.0041198c
push eax
call fcn.0052df01
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0x582ffc
push 0
call fcn.0052df01
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4f1a1d
push 0xa
push 0
push dword [ebp - 0x28]
call fcn.0052c7ef
add esp, 0xc
mov dword [ebp - 0x34], eax
jmp 0x4f1a21
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1c]
call fcn.00410a23
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051dfa2
leave
ret