joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b2e90
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0xc]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x130]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100b2edc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.1008b9e0
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.100b2ab0
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x100b3030
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x134]
mov dword [esp + 8], eax
jne 0x100b317f
push esi
push edi
lea eax, [ebp + 0x1cb4]
lea edi, [ebp + 0x1eb4]
mov dword [edi], eax
cmp eax, edi
jae 0x100b307d
mov byte [eax], 0xff
inc eax
mov dword [edi], eax
cmp eax, edi
jae 0x100b307d
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100b307d
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x100b30e7
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100b30e7
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100b30e7
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100b30e7
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100b30e7
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100b30e7
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1eb8], eax
lea esi, [ebp + 0x1cb4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.100b2bb0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x130]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x100b313f
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1008b9e0
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb7]
push eax
push ebx
call fcn.100b2f00
add esp, 0xc
lea eax, [ebp + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x130]
call edi
test eax, eax
jns 0x100b317d
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1008b9e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100b45c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x1012604c]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x418]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x13c]
push 0
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x100b4646
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.100ccc90
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x100b4681
push str.Received_too_short_packet
push ebx
call fcn.1008b9e0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ca7cd
add esp, 0x88
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x100b46a0.1
jmp dword [ecx*4 + 0x100b47ac]
cmp esi, 4
jle case.0x100b46a0.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x100b46a0.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebx
call fcn.1008b930
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b46fb
push 5
push edi
call fcn.100b50e0
add esp, 8
mov eax, esi
jmp 0x100b4668
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.1009ab20
jmp 0x100b4781
movzx ecx, byte [edx + 2]
lea ebp, [edx + 4]
movzx eax, byte [edx + 3]
add esi, 0xfffffffc
shl ecx, 8
or ecx, eax
push esi
push ebp
mov dword [edi + 8], ecx
call fcn.100b5150
add esp, 8
cmp eax, esi
jae case.0x100b46a0.4
push ebp
push str.TFTP_error:__s
push ebx
call fcn.1008bab0
jmp 0x100b4781
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.100b4370
add esp, 0xc
test eax, eax
je case.0x100b46a0.4
jmp 0x100b4668
push str.Internal_error:_Unexpected_packet
push 0x100f9c24
push ebx
call fcn.1008b9e0
add esp, 0xc
push ebx
call fcn.1009af20
add esp, 4
test eax, eax
je 0x100b4666
push 5
push edi
call fcn.100b50e0
add esp, 8
mov eax, 0x2a
jmp 0x100b4668
Function at 0x100c04e0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x1012604c]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.100e1788
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x100c055f
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1009f490
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.1008b9e0
push esi
call dword [0x10126004]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x100c06bf
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x100c05b9
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1009f490
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.1008b9e0
push 0
mov esi, 0x4d
call dword [0x10126004]
add esp, 0x20
jmp 0x100c06b1
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x100c05f9
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1009f490
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.1008b9e0
add esp, 0x1c
mov esi, 0x4d
jmp 0x100c069d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x100c0627
jg 0x100c060d
cmp edi, 0x100000
jbe 0x100c0627
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.1008b9e0
add esp, 0xc
mov esi, 0x4d
jmp 0x100c069d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100c063f
lea esi, [eax + 0x1b]
jmp 0x100c069d
test edi, edi
je 0x100c0684
nop dword [eax]
nop word [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100c06dc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100c06d8
add esi, eax
cmp esi, edi
jb 0x100c0650
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.100c02e0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x10126004]
add esp, 4
push dword [esp + 0x20]
call fcn.100cfcb9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ca7cd
add esp, 0x120
ret
mov edi, esi
jmp 0x100c0684
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1009f490
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.1008b9e0
add esp, 0x1c
mov esi, 0x4d
jmp 0x100c069d
Function at 0x100c6df0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100c6e17
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x100c6e62
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x100c6e66
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100c6ec6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100c6e85
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x100c6ef7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x1010649c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x1010649d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x100c6ed0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x100c6f00
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.1008e3f0
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x100c7068
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x100c6f7c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100c6fe1
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100c6fa0
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x100c700d
mov eax, dword [esi + 4]
push 1
push 0x1010649c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x1010649d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x100c6fe6
push dword [esp + 0x28]
call fcn.1008e3f0
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x100c7038
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x10126004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x100e646d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e63ef

Function at 0x100e83e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e825a

Function at 0x100ed1a2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ece1f
Function at 0x4d5900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x4d5909
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d594c
mov eax, dword [ebp - 8]
jmp 0x4d59b2
cmp dword [ebp - 0xc], 1
je 0x4d595f
cmp dword [ebp - 0xc], 2
je 0x4d595f
mov eax, 0xd
jmp 0x4d59b2
cmp dword [ebp + 0xc], 0
je 0x4d59a6
cmp dword [ebp - 4], 0
je 0x4d5995
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4d598c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4d5993
mov eax, 0xd
jmp 0x4d59b2
jmp 0x4d59a6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d59c0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea ecx, [ebp - 0xc]
push ecx
push 0x6a63f4
push 1
push 0
push 0x6a6448
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4d5a1a
mov edx, dword [ebp - 4]
push edx
push 0x69a3a0
call fcn.004cbc00
add esp, 8
jmp 0x4d5a76
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4d5a4a
mov edx, dword [ebp - 4]
push edx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.004cbc00
add esp, 8
jmp 0x4d5a76
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4d5a76
mov edx, dword [ebp - 4]
push edx
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.004cbc00
add esp, 8
cmp dword [ebp - 8], 0
je 0x4d5a8a
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
cmp dword [ebp - 0xc], 0
je 0x4d5a9e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4d7a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6123eb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x23c], 0x104
mov dword [ebp - 0x240], 1
push 0x69b45c
lea ecx, [ebp - 0x230]
call fcn.0048b540
mov byte [ebp - 4], 2
lea edx, [ebp - 0x234]
push edx
push 0xf003f
push 0
lea ecx, [ebp + 0x10]
call fcn.0047ca20
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d7b88
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x240]
push eax
push 0
lea ecx, [ebp + 0x28]
call fcn.0047ca20
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d7b7b
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x230]
call fcn.0047ca60
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0049cd00
mov edx, dword [ebp - 0x238]
or edx, 1
mov dword [ebp - 0x238], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0047caf0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0047caf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.0047caf0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret

Function at 0x4d7bf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 0x218], 1
mov byte [ebp - 0x20d], 0
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp + 0xc]
call fcn.0047ca20
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4d7ca6
lea ecx, [ebp + 0x3c]
call fcn.0048b7c0
shl eax, 1
push eax
lea ecx, [ebp + 0x3c]
call fcn.0047ca20
push eax
mov ecx, dword [ebp - 0x218]
push ecx
push 0
lea ecx, [ebp + 0x24]
call fcn.0047ca20
push eax
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4d7c99
mov byte [ebp - 0x20d], 1
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x20d]
mov byte [ebp - 0x20e], cl
lea ecx, [ebp + 0xc]
call fcn.0047caf0
lea ecx, [ebp + 0x24]
call fcn.0047caf0
lea ecx, [ebp + 0x3c]
call fcn.0047caf0
mov al, byte [ebp - 0x20e]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret
Function at 0x4d8b00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61251b
mov eax, dword fs:[0]
push eax
mov eax, 0x4044
call fcn.005ca540
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4048], 0
push 0x6764f7
lea ecx, [ebp - 0x403c]
call fcn.0048bf00
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x4024], ax
push 0x3ffe
push 0
lea ecx, [ebp - 0x4022]
push ecx
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x4044], 0
mov dword [ebp - 0x404c], 0
lea edx, [ebp - 0x404c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x4044], eax
cmp dword [ebp - 0x4044], 0
je 0x4d8c8c
lea ecx, [ebp - 0x4024]
push ecx
mov edx, dword [ebp - 0x4044]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4d8c8c
mov dword [ebp - 0x4040], 0
mov dword [ebp - 0x4050], 0
lea ecx, [ebp - 0x4050]
push ecx
lea edx, [ebp - 0x4040]
push edx
push 0x69b5cc
lea eax, [ebp - 0x4024]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4d8c8c
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 8]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
push 0x69b5d0
lea edx, [ebp - 0x24]
push edx
call fcn.004da790
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x403c]
call fcn.004a8ec0
lea ecx, [ebp - 0x403c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0048be10
mov edx, dword [ebp - 0x4048]
or edx, 1
mov dword [ebp - 0x4048], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x403c]
call fcn.0048bcd0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret