joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b304
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44b4f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405a08
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x44b4c7
xor edx, edx
push ebp
push 0x44b4c0
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
je 0x44b3b4
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x44b38a
mov eax, dword [ebp - 8]
call fcn.00405a28
inc eax
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.0044b244
mov eax, dword [ebp - 4]
call fcn.00405308
inc eax
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 1
call fcn.0044b244
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, 0x10
call fcn.0044b244
test esi, esi
je 0x44b4ad
lea eax, [ebp - 0x18]
mov ecx, 0x44b508
mov edx, esi
call fcn.00405358
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00405a08
mov eax, dword [ebp - 0xc]
call fcn.00405a28
add eax, eax
add eax, 0x14
test eax, eax
jns 0x44b3ec
call fcn.00403edc
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b4ad
xor edx, edx
push ebp
push 0x44b4a6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
je 0x44b489
xor edx, edx
push ebp
push 0x44b482
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov dword [eax], 0x14
mov dword [eax + 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a28
mov ecx, eax
add ecx, ecx
mov edx, ebx
add edx, 0x14
mov eax, dword [ebp - 0xc]
call fcn.00403348
mov eax, dword [ebp - 0x14]
push eax
push 0xf
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x44b46b
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b489
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4ad
cmp dword [ebp - 0x14], 0
je 0x44b4a5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4c7
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4f9
lea eax, [ebp - 0x18]
call fcn.0040502c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040586c
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x44b7fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004038b8
mov dword [ebp - 0x3c], 0x3c
call fcn.0041bd94
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
test edi, edi
jns 0x44b83f
call fcn.00403edc
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
and eax, 0x7f
cmp eax, 1
jbe 0x44b85e
call fcn.00403edc
call fcn.00446e7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44bd1c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44bf12
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
mov ebx, eax
mov eax, dword [0x57b4a0]
cmp dword [eax], 0
jne 0x44bd6c
mov eax, dword [0x57b4a0]
mov dword [eax], ebx
lea eax, [ebp - 4]
mov edx, 0x44bf28
call fcn.004050c4
jmp 0x44bd8e
mov eax, dword [0x57b4a0]
cmp ebx, dword [eax]
jne 0x44bd84
lea eax, [ebp - 4]
mov edx, 0x44bf28
call fcn.004050c4
jmp 0x44bd8e
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0044bcb8
cmp dword [0x680454], 0
jne 0x44bde7
cmp dword [0x680450], 0
jne 0x44bde7
call fcn.004667c8
push edx
push eax
mov eax, 0x680450
call fcn.0044bca0
mov eax, dword [0x680450]
mov dword [0x680458], eax
mov eax, dword [0x680454]
mov dword [0x68045c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x44be50
call fcn.004667c8
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0044bca0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x680450]
sbb edx, dword [0x680454]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x680458]
sbb edx, dword [0x68045c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [0x680458], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x68045c], eax
push 0x44bf38
push dword [ebp - 4]
push 0x44bf44
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
call fcn.0044bce8
push dword [ebp - 0x34]
push 0x44bf50
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x38]
call fcn.0044bce8
push dword [ebp - 0x38]
push 0x44bf5c
lea eax, [ebp - 8]
mov edx, 7
call fcn.004053cc
mov eax, dword [ebp - 8]
call fcn.00405308
cmp eax, 0x19
jge 0x44bed2
push dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.00405308
mov edx, 0x19
sub edx, eax
lea ecx, [ebp - 0x3c]
mov al, 0x20
call fcn.004057f8
push dword [ebp - 0x3c]
push esi
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
jmp 0x44bedc
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405314
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf19
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x457848
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0040ea5c
test al, al
je 0x4578be
xor edx, edx
push ebp
push 0x4578b2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x45787f
cmp dword [eax + 0x3c], 0
jne 0x457889
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4578be
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0xf8
mov eax, ebx
call fcn.0040ea5c
test al, al
je 0x4578a6
cmp dword [ebx], 0x4550
je 0x4578a8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4578be
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4578c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0040ea5c
test al, al
je 0x45793e
xor edx, edx
push ebp
push 0x457932
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x4578ff
cmp dword [eax + 0x3c], 0
jne 0x457909
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45793e
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0x108
mov eax, ebx
call fcn.0040ea5c
test al, al
je 0x457926
cmp dword [ebx], 0x4550
je 0x457928
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45793e
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4579ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x457a8b
push 0
push 0
mov eax, ebx
call fcn.0043e460
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e66c
cmp word [ebp - 0x44], 0x5a4d
jne 0x457a8b
cmp dword [ebp - 8], 0
je 0x457a8b
mov eax, pe_nt_image_headers32
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e460
mov edx, dword [ebp - 4]
mov ecx, 0xf8
mov eax, ebx
call fcn.0043e66c
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x457a79
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446b74
jmp 0x457a8b
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0xf8
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457a94
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x457b33
push 0
push 0
mov eax, ebx
call fcn.0043e460
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e66c
cmp word [ebp - 0x44], 0x5a4d
jne 0x457b33
cmp dword [ebp - 8], 0
je 0x457b33
mov eax, 0x110
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e460
mov edx, dword [ebp - 4]
mov ecx, 0x108
mov eax, ebx
call fcn.0043e66c
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x457b21
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446b74
jmp 0x457b33
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0x108
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45bc60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45bcb8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x57b4b0]
mov dl, 1
mov eax, dword [0x45b784]
call fcn.0042c810
call fcn.00404984
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045b88c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45de0c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x45df6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, 0x45df84
call fcn.004463f8
mov ebx, eax
lea ecx, [ebx + 1]
mov edx, dword [ebp - 4]
mov eax, 0x45df84
call fcn.004463f8
mov ebx, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405308
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040556c
mov eax, dword [ebp - 4]
call fcn.00405308
mov ecx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004055ac
mov bl, 0x41
lea eax, [ebp - 8]
mov edx, 0x2800
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.00405308
test eax, eax
jns 0x45dea9
call fcn.00403edc
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405214
lea eax, [ebp - 0xc]
mov edx, 0x45df90
call fcn.00405314
mov eax, dword [ebp - 0xc]
call fcn.0040550c
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x45df40
mov eax, dword [ebp - 8]
call fcn.0040550c
call fcn.00429320
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405794
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00427f04
test al, al
je 0x45df40
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.0040379c
mov edx, 0x45df94
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.0040376c
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00405290
mov edx, dword [ebp - 0x10]
mov ecx, dword [esi]
mov eax, esi
call fcn.00405358
jmp 0x45df51
inc ebx
cmp bl, 0x5b
jne 0x45de8b
mov eax, esi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45df73
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405050
ret
Function at 0x45ead8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x45ebc2
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405990
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042809c
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004052d0
cmp dword [edi], 0
je 0x45eb9a
mov eax, 1
mov edx, dword [edi]
dec eax
test edx, edx
je 0x45eb2e
cmp eax, dword [edx - 4]
jb 0x45eb33
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x22
jne 0x45eb51
push edi
mov eax, dword [edi]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.0040556c
mov bl, 0x22
jmp 0x45eb53
mov bl, 0x20
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405214
mov eax, dword [ebp - 0xc]
mov edx, dword [edi]
call fcn.00405650
mov esi, eax
test esi, esi
jle 0x45eb7f
push edi
lea edx, [esi + 1]
mov eax, dword [edi]
mov ecx, 0x7fffffff
call fcn.0040556c
jmp 0x45eb86
mov eax, edi
call fcn.0040502c
lea edx, [ebp - 0x10]
mov eax, dword [edi]
call fcn.00428048
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ebc9
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040586c
ret

Function at 0x45f1e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f27c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.00405bfc
mov eax, dword [ebp - 4]
call fcn.00405a28
mov edx, eax
add edx, edx
mov eax, 1
mov ecx, dword [ebp - 4]
dec eax
test ecx, ecx
je 0x45f22b
cmp eax, dword [ecx - 4]
jb 0x45f230
call fcn.00403edc
inc eax
lea eax, [ecx + eax*2 - 2]
xor ecx, ecx
call fcn.004038b8
mov eax, dword [ebp - 4]
call fcn.00405a28
sar eax, 1
jns 0x45f24b
adc eax, 0
push eax
mov eax, dword [ebp - 4]
call fcn.00405a18
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f283
lea eax, [ebp - 4]
call fcn.00405854
ret
Function at 0x45f3b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f4ce
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6804fc], 0
jne 0x45f409
push 0x45f4dc
call fcn.0040dc34
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6804fc], eax
push 0x45f4dc
call fcn.0040dc34
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x680500], eax
mov eax, dword [0x45f4f4]
mov dword [ebp - 0xb], eax
mov ax, word [0x45f4f8]
mov word [ebp - 7], ax
mov al, byte [0x45f4fa]
mov byte [ebp - 5], al
push 6
lea eax, [ebp - 0xb]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 4]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040529c
call sub.kernel32.dll_GetACP_1
mov edx, eax
test edx, edx
jns 0x45f45b
call fcn.00403edc
mov eax, dword [ebp - 4]
call fcn.0042882c
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.0045f394
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00428770
push dword [ebp - 0x34]
push 0x45f504
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.00428770
push dword [ebp - 0x38]
mov eax, ebx
mov edx, 3
call fcn.004053cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f4d5
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x45f548
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 1], 0
push 0x45f604
call fcn.0040dc00
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x45f5c5
lea eax, [ebp - 0x41]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
mov dword [ebp - 0x41], 0x40
lea eax, [ebp - 0x41]
push eax
call ebx
test eax, eax
je 0x45f5c5
mov eax, dword [ebp - 0x39]
mov dword [edi], eax
mov eax, dword [ebp - 0x35]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x31]
mov dword [esi], eax
mov eax, dword [ebp - 0x2d]
mov dword [esi + 4], eax
mov byte [ebp - 1], 1
jmp 0x45f5f8
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x20
call fcn.004038b8
mov dword [ebp - 0x64], 0x20
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebp - 0x58]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460334
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46049a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040502c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040550c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x460477
mov eax, dword [ebp - 8]
call fcn.0040309c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x460470
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x460457
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4604a8
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x460457
push 0x4604cc
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x20]
push 0x4604e8
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x460457
cmp dword [ebp - 0x10], 1
jbe 0x460457
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00429320
mov ecx, eax
mov eax, esi
mov edx, ebx
call fcn.0040511c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460477
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4604a1
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x460530
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x460631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040502c
cmp dword [ebp - 4], 0
je 0x460597
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x460578
cmp eax, dword [edx - 4]
jb 0x46057d
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x460597
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46061b
mov eax, ebx
mov edx, 0x400
call fcn.00405794
mov eax, dword [ebx]
call fcn.00405308
test eax, eax
jns 0x4605d1
call fcn.00403edc
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
call fcn.0040550c
push eax
test edi, edi
jns 0x4605f1
call fcn.00403edc
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x46060b
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00405794
jmp 0x460612
mov eax, ebx
call fcn.0040502c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460638
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x460644
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004054fc
mov eax, dword [ebp - 8]
call fcn.004054fc
xor eax, eax
push ebp
push 0x460731
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4606ad
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x46068e
cmp eax, dword [edx - 4]
jb 0x460693
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x4606ad
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x460716
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040550c
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46070d
cmp dword [ebp - 0x14], 4
jne 0x46070d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460738
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret