joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481b1a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4c0279
call fcn.004bd430
sub esp, 0x260
push ebx
push esi
push edi
push 0x4cc208
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 0x20], ebx
call fcn.00403217
mov dword [ebp - 4], ebx
call fcn.004450a7
movzx eax, byte [eax + 0x20]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
je 0x481b7f
cmp dword [esi + 0x14], ebx
jne 0x481b7f
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [ebp - 0x10]
push edx
push 0x20119
push ebx
push eax
push ecx
mov dword [ebp - 0x10], ebx
call edi
cmp eax, ebx
je 0x481b9e
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [ebp - 0x10]
push edx
push 0x20219
push ebx
push eax
push ecx
mov dword [ebp - 0x10], ebx
call edi
cmp eax, ebx
jne 0x481c38
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4f36c4]
mov ecx, 0x4f36c4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x208
lea eax, [ebp - 0x26a]
mov byte [ebp - 4], 2
push ebx
push eax
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x26c], bx
call fcn.0049cce0
mov esi, dword [esi + 0xc]
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x481cab
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x481c80
cmp eax, 2
je 0x481c80
cmp eax, 7
je 0x481c80
cmp eax, 4
jne 0x481c5d
push 0xa
push 0x20
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x26c]
call fcn.004a30c9
add esp, 0x10
lea eax, [ebp - 0x60]
jmp 0x481c86
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040317b
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004027f9
mov eax, esi
jmp 0x481cf3
cmp eax, 0xb
jne 0x481c90
push 0xa
push 0x20
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x268]
push dword [ebp - 0x26c]
call fcn.004a31f1
add esp, 0x14
jmp 0x481c33
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004033e6
lea ecx, [ebp - 0x10]
call fcn.00473d4a
lea ecx, [ebp - 0x10]
call fcn.00473e36
lea eax, [ebp - 0x10]
lea edi, [ebp - 0x18]
call fcn.0040308d
cmp dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x481cbe
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040317b
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004027f9
cmp dword [ebp - 0x14], ebx
je 0x481ce6
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004027f9
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4863d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [esi], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [edi], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x486461
push eax
call fcn.00487dae
pop ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 4], eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x486453
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4cf1a8
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x486453
cmp dword [ebp - 0xc], ebx
je 0x486453
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], ebx
je 0x486461
push dword [ebp - 4]
call fcn.0049bc75
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret

Function at 0x486531
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4bef1b
call fcn.004bd430
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x4f36c4
mov dword [ebp - 0x10], edi
call fcn.00402b17
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.0049cce0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.004033e6
push esi
call fcn.0048649d
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x48668c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.0049cce0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x4866e5
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x48679b
mov eax, dword [ebp - 0x94]
dec eax
je 0x486787
dec eax
jne 0x48679b
mov eax, dword [ebp - 0xa0]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x486734
cmp dword [ebp - 0x9c], edx
jne 0x48671e
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x486783
cmp dword [ebp - 0x9c], edi
jne 0x48676c
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x486783
cmp eax, 5
jne 0x48675e
cmp dword [ebp - 0x9c], 2
jne 0x486745
push eax
jmp 0x486765
cmp dword [ebp - 0x9c], 1
jne 0x486752
mov edi, ecx
jmp 0x48679b
cmp dword [ebp - 0x9c], edi
jne 0x48679b
push 3
jmp 0x486765
cmp eax, 4
ja 0x486768
push 4
pop edi
jmp 0x48679b
cmp eax, ecx
jb 0x48679b
cmp dword [ebp - 0x9c], 2
jae 0x486779
cmp eax, ecx
jbe 0x48679b
cmp byte [ebp + 0x76], dl
jne 0x48679b
call fcn.004865b4
mov edi, eax
jmp 0x48679b
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x486af3
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
push edi
mov dword [ebx], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call fcn.00486f56
xor edi, edi
inc edi
test eax, eax
je 0x486b1f
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
lea ecx, [ebp + 0xb]
call fcn.00486faf
test eax, eax
jne 0x486b43
lea ecx, [ebp + 0xb]
call fcn.00486fdd
test eax, eax
jne 0x486b43
lea ecx, [ebp + 0xb]
call fcn.0048700b
test eax, eax
je 0x486b47
or dword [ebp - 4], 2
call fcn.00487085
test eax, eax
je 0x486b57
or dword [ebp - 4], 4
mov dword [ebp - 8], edi
cmp dword [ebp - 8], 0
je 0x486b6e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [esi], edi
mov dword [ebx], edi
mov dword [eax], ecx
jmp 0x486c79
lea esi, [ebp - 4]
call fcn.00487156
test eax, eax
je 0x486b92
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x486c79
lea esi, [ebp - 4]
call fcn.00487198
test eax, eax
je 0x486bab
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 3
jmp 0x486b85
call fcn.004875fc
test al, al
jne 0x486bc6
call fcn.004875c1
test al, al
jne 0x486bc6
call fcn.00487529
test al, al
je 0x486bd3
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 4
jmp 0x486b85
lea esi, [ebp - 0xcc]
mov dword [ebp - 8], 3
call fcn.00487769
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.004877f3
test eax, eax
je 0x486c2d
mov eax, dword [ebp - 8]
test eax, eax
je 0x486c03
cmp eax, edi
je 0x486c03
cmp eax, 2
jne 0x486c2d
cmp eax, edi
mov ecx, dword [ebp + 8]
mov dword [ecx], edi
mov dword [ebx], 5
jne 0x486c1d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x3001
jmp 0x486c79
cmp eax, 2
jne 0x486c79
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x3002
jmp 0x486c79
push str.SbieDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x486c49
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 6
jmp 0x486c73
call fcn.00486c7f
test eax, eax
je 0x486c5f
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 7
jmp 0x486c73
call fcn.00486d22
test eax, eax
je 0x486c79
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebx], 8
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4871e1
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
xor bl, bl
call fcn.0049cce0
add esp, 0xc
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x487263
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x48725b
lea eax, [ebp - 0x20c]
push eax
push str.vmusrvc.exe
call fcn.0049f60e
test eax, eax
pop ecx
pop ecx
je 0x487261
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x487237
jmp 0x487263
mov bl, 1
test esi, esi
je 0x48726e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004a4038
leave
ret

Function at 0x48727e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
mov edi, 0x208
xor ebx, ebx
push edi
lea eax, [ebp + 0x192]
push ebx
push eax
mov word [ebp + 0x190], bx
call fcn.0049cce0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x190]
push eax
mov byte [ebp - 0x7d], bl
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x487337
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
and word [ebp - 0x7c], 0
push edi
lea eax, [ebp - 0x7a]
push 0
push eax
call fcn.0049cce0
push 0xffffffffffffffff
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0049fb34
push 0xffffffffffffffff
push dword [ebx + 0x4f32a4]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004bd1b6
add esp, 0x2c
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x487333
add ebx, 4
cmp ebx, 0x14
jb 0x4872e2
jmp 0x487337
mov byte [ebp - 0x7d], 1
mov ecx, dword [ebp + 0x39c]
mov al, byte [ebp - 0x7d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4038
add ebp, 0x3a0
leave
ret
Function at 0x487429
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x5e]
push ebx
push eax
mov byte [ebp - 0x61], bl
mov dword [ebp - 0x6c], ebx
mov word [ebp - 0x60], bx
call fcn.0049cce0
mov esi, str.DiskVirtual_HD
push esi
mov dword [ebp - 0x70], 0x104
call fcn.0049b764
add esp, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetEnumIDE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x48750f
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x6c]
test eax, eax
jne 0x487501
cmp word [ebp - 0x60], bx
je 0x4874e2
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x70], eax
jb 0x4874e2
push eax
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.004a0665
add esp, 0xc
test eax, eax
je 0x4874fd
push 0x208
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0049cce0
add esp, 0xc
mov dword [ebp - 0x70], 0x104
jmp 0x4874a0
mov byte [ebp - 0x61], 1
cmp dword [ebp - 0x68], ebx
je 0x48750f
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1a8]
mov al, byte [ebp - 0x61]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4038
add ebp, 0x1ac
leave
ret

Function at 0x4875fc
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
mov edi, 0x208
xor ebx, ebx
push edi
lea eax, [ebp + 0x192]
push ebx
push eax
mov word [ebp + 0x190], bx
call fcn.0049cce0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x190]
push eax
mov byte [ebp - 0x7d], bl
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x4876b5
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
and word [ebp - 0x7c], 0
push edi
lea eax, [ebp - 0x7a]
push 0
push eax
call fcn.0049cce0
push 0xffffffffffffffff
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0049fb34
push 0xffffffffffffffff
push dword [ebx + 0x4f32c8]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004bd1b6
add esp, 0x2c
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4876b1
add ebx, 4
cmp ebx, 4
jb 0x487660
jmp 0x4876b5
mov byte [ebp - 0x7d], 1
mov ecx, dword [ebp + 0x39c]
mov al, byte [ebp - 0x7d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4038
add ebp, 0x3a0
leave
ret
Function at 0x4876d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x487700
mov byte [ebp - 1], bl
jmp 0x487763
push esi
push 0x80
call fcn.0049cabc
pop ecx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 1
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x48773b
mov byte [ebp - 1], bl
jmp 0x48774e
push dword [ebp + 0x10]
push esi
call fcn.0049b77a
test eax, eax
pop ecx
pop ecx
je 0x48774e
mov byte [ebp - 1], 1
cmp esi, ebx
je 0x487759
push esi
call fcn.0049bd0b
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x4877f3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
mov eax, dword [ebp + 0x1b8]
push edi
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1bc]
xor edi, edi
push 0x206
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x5a]
push edi
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x68], edi
mov word [ebp - 0x5c], di
call fcn.0049cce0
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetEnumPCI
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x60], 0x104
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x487916
mov eax, dword [ebp - 0x70]
push ebx
mov dword [ebp - 0x64], eax
push esi
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x68]
test eax, eax
jne 0x487906
mov ebx, dword [ebp - 0x6c]
xor esi, esi
inc esi
add ebx, 0x48
cmp word [ebp - 0x5c], di
je 0x4878cc
cmp word [ebx], di
je 0x4878cc
push ebx
call fcn.0049b764
cmp eax, 1
pop ecx
jb 0x4878cc
cmp dword [ebp - 0x60], eax
jbe 0x4878cc
push eax
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.004a0665
add esp, 0xc
test eax, eax
je 0x4878f0
inc esi
add ebx, 0x40
cmp esi, 3
jb 0x48789e
push 0x208
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.0049cce0
add esp, 0xc
mov dword [ebp - 0x60], 0x104
jmp 0x487873
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x78]
shl esi, 6
mov eax, dword [esi + eax + 4]
mov dword [ecx], eax
mov dword [ebp - 0x74], 1
cmp dword [ebp - 0x64], edi
pop esi
pop ebx
je 0x487916
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
pop edi
call fcn.004a4038
add ebp, 0x1b0
leave
ret 8
Function at 0x487931
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
mov esi, ecx
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x487aa7
push ebx
push edi
push 0x208
push eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push eax
call fcn.0049cce0
add esp, 0xc
mov edi, str._ALLUSERSPROFILE_
push edi
xor ecx, ecx
call fcn.004031d3
or ebx, 0xffffffff
cmp eax, ebx
jne 0x487a72
mov edi, str._APPDATA_
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
jne 0x487a72
mov edi, str._TEMP_
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
jne 0x487a72
mov edi, str._SYSTEM_
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
je 0x4879fa
push 0x104
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x487a86
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call fcn.004708f1
mov eax, esi
call fcn.0042a862
mov edi, 0x4d5f20
jmp 0x487a96
mov edi, str._WINDOWS_
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
je 0x487a1c
push 0x104
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4879d6
mov edi, str._CUR_DIR_
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
je 0x487a5d
push 0x20a
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0049cce0
add esp, 0xc
push 0x105
lea eax, [ebp - 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x4879de
mov edi, 0x4d7e94
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
je 0x4879e9
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.00487abd
test eax, eax
pop ecx
pop ecx
jne 0x4879de
xor eax, eax
jmp 0x487aa5
push 0x4cf1a8
push edi
push esi
call fcn.004708f1
push edi
xor ecx, ecx
call fcn.004031d3
cmp eax, ebx
jne 0x487a8a
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.004a4038
add ebp, 0x190
leave
ret
Function at 0x487abd
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x4e01b0
call fcn.004a6d68
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x487b6e
cmp dword [ebp + 0xc], eax
je 0x487b6e
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x487b6e
mov ebx, 0x103
cmp esi, ebx
ja 0x487b6e
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00487dae
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x487b67
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.0049cce0
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x487b67
cmp eax, ebx
ja 0x487b67
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.0049fb34
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x487b67
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c], 0
je 0x487b7d
push dword [ebp - 0x1c]
call fcn.0049bc75
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.004a6dad
ret

Function at 0x487b86
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x487c2a
push edi
push 1
push esi
call fcn.0049c469
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x487c27
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x487c20
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x4d38f4
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x487c20
cmp dword [ebp - 4], 0
je 0x487c20
push 0x10
call fcn.00458807
mov esi, eax
test esi, esi
pop ecx
je 0x487c27
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x10]
push ecx
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
and dword [eax], 0
push eax
push 0x4cf1a8
push edi
mov dword [esi], edi
call sub.VERSION.dll_VerQueryValueW
mov eax, esi
jmp 0x487c29
push edi
call fcn.0049bd0b
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x487c44
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
mov ax, word [edi + 4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov ax, word [edi + 8]
push esi
mov word [ebp - 0x12], ax
call ebx
mov word [ebp - 0x10], ax
mov ax, word [edi + 8]
mov word [ebp - 0xe], ax
mov ax, word [edi + 4]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], 0x4e4
call ebx
mov word [ebp - 8], ax
mov word [ebp - 6], 0x4e4
xor ebx, ebx
mov esi, 0x104
movzx eax, word [ebp + ebx*2 - 0x14]
movzx ecx, word [ebp + ebx*2 - 0x12]
inc ebx
push str.ProductName
movzx ecx, cx
push ecx
movzx eax, ax
push eax
push str.StringFileInfo_04x_04x_ls
push esi
lea eax, [ebp - 0x21c]
push esi
push eax
inc ebx
call fcn.0049cc85
and dword [ebp - 0x220], 0
add esp, 0x1c
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [edi]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x487d06
cmp dword [ebp - 0x220], 0
jne 0x487d1d
cmp ebx, 8
jb 0x487ca7
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4038
leave
ret 4
mov esi, dword [ebp - 0x220]
push esi
call fcn.0049b764
pop ecx
mov ecx, esi
mov esi, dword [ebp - 0x224]
call fcn.004456ee
mov al, 1
jmp 0x487d0d

Function at 0x488a70
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4ed19c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004889af
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0049cce0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x488abf
cmp dword [ebp - 0x1c], 5
jb 0x488ad7
jmp 0x488ad3
cmp dword [ebp - 0x10], 1
jne 0x488ad7
cmp dword [ebp - 0x1c], 4
ja 0x488ad3
jne 0x488ad7
cmp dword [ebp - 0x18], 0
jbe 0x488ad7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4c4a74
call fcn.0043654f
test eax, eax
jge 0x488af8
mov byte [0x4f4474], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a4038
add ebp, 0x78
leave
ret