joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47aff4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x47b00b
add esp, 0xfffffff0
call fcn.004039a8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004238f0
mov eax, dword [0x5726d0]
cmp word [eax + 2], 0
jne 0x47b033
mov eax, dword [0x5726d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047c774
mov eax, dword [0x5728a4]
cmp word [eax + 2], 0
jne 0x47b04d
mov eax, dword [0x5728a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047c96c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4181c0]
call fcn.00403614
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4181c0]
call fcn.00403614
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x425e84]
call fcn.0042dc58
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x47b1d4
mov eax, dword [0x572494]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e028
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x47cf1c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x572494]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e34c
test eax, eax
je 0x47b142
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409dc8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e374
test eax, eax
je 0x47b156
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404714
mov eax, dword [0x5720dc]
cmp byte [eax], 0
jne 0x47b18a
mov eax, ebx
call fcn.0047b2fc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0047d0f8
mov eax, ebx
call fcn.0047dabc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47b1ca
call fcn.00403a00
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b57c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x573bf4]
cmp dword [eax + 0x30], 0
je 0x47b626
cmp dword [ebx + 0x94], 0
jne 0x47b620
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x47b50c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47b620
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47b5e6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47b620
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041aaf0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x47b5f5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x47c188
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x47c1bd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404584
jmp 0x47c1ca
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044e8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x47d2d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47d315
mov eax, esi
call fcn.00462f04
test al, al
je 0x47d315
mov eax, dword [ebx + 0x84]
call fcn.00462c00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47d315
push 0
mov eax, dword [ebx + 0x84]
call fcn.00462c00
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x483430
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48368a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00485688
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x5613f0], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5613f4], eax
mov eax, dword [ebp - 0x24]
mov dword [0x5613f8], eax
mov eax, dword [0x572c7c]
cmp dword [eax], 2
sete byte [0x560b88]
push 0x483698
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.00484b1c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x560b88], 0
jne 0x4834bf
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00484c60
test al, al
je 0x4834bf
mov eax, dword [ebp - 0x4c]
mov dword [0x573c70], eax
jmp 0x4834c6
xor eax, eax
mov dword [0x573c70], eax
call fcn.00482b1c
and eax, 0x7f
cmp eax, 0x1a
ja case.0x4834d7.0
jmp dword [eax*4 + 0x4834de]
mov byte [0x560b74], 1
jmp case.0x4834d7.0
mov byte [0x560b78], 1
jmp case.0x4834d7.0
mov byte [0x560b7c], 1
jmp case.0x4834d7.0
mov byte [0x560b80], 1
jmp case.0x4834d7.0
mov byte [0x560b84], 1
jmp case.0x4834d7.0
mov byte [0x560b8c], 1
mov byte [0x560b90], 1
jmp case.0x4834d7.0
mov byte [0x560b8c], 1
mov byte [0x560b94], 1
jmp case.0x4834d7.0
mov byte [0x560b8c], 1
mov byte [0x560b94], 1
mov byte [0x560b98], 1
jmp case.0x4834d7.0
mov byte [0x560b9c], 1
jmp case.0x4834d7.0
mov byte [0x560ba0], 1
jmp case.0x4834d7.0
mov byte [0x560ba4], 1
jmp case.0x4834d7.0
mov byte [0x560ba8], 1
jmp case.0x4834d7.0
mov byte [0x560bac], 1
jmp case.0x4834d7.0
mov byte [0x560bb0], 1
jmp case.0x4834d7.0
mov byte [0x560bb4], 1
jmp case.0x4834d7.0
mov byte [0x560bb8], 1
jmp case.0x4834d7.0
mov byte [0x560bbc], 1
jmp case.0x4834d7.0
mov byte [0x560bc0], 1
jmp case.0x4834d7.0
mov byte [0x560bc4], 1
jmp case.0x4834d7.0
mov byte [0x560bc8], 1
jmp case.0x4834d7.0
mov byte [0x560bcc], 1
jmp case.0x4834d7.0
mov byte [0x560bd0], 1
jmp case.0x4834d7.0
mov byte [0x560bd4], 1
jmp case.0x4834d7.0
mov byte [0x560bd8], 1
jmp case.0x4834d7.0
mov byte [0x560bdc], 1
jmp case.0x4834d7.0
mov byte [0x560be0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483691
lea eax, [ebp - 4]
call fcn.00404494
ret

Function at 0x483cd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.00485688
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x600
mov eax, ebx
call fcn.00404964
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.00485698
mov dword [ebp - 0x28], eax
mov eax, edi
call fcn.00485698
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x483d3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404964
push eax
mov eax, dword [ebp + 0x10]
call fcn.00404964
push eax
mov eax, edi
call fcn.00404964
push eax
mov eax, esi
call fcn.00404964
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x483e28
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x572c2c]
mov al, byte [eax]
xor al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x483fb2
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], 0
xor eax, eax
push ebp
push 0x483fab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x483eb1
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x483eb1
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x483f71
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [0x5729b8]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
call fcn.0040eec8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x483f01
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x483f06
call fcn.0040ee2c
mov eax, dword [ebp - 0x10]
call fcn.00408da0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
call fcn.0040eec8
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x483f71
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x483f6d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x10
cmp eax, 0x10
setne byte [ebp - 1]
jmp 0x483f71
inc ebx
dec esi
jne 0x483f3a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483fb2
cmp dword [ebp - 0x14], 0
je 0x483f8c
mov eax, dword [ebp - 0x14]
call fcn.00402774
cmp byte [ebp - 0x15], 0
je 0x483f9b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 8], 0
je 0x483faa
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4846e8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x4846fd
add esp, 0xfffffff0
call fcn.004039a8
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0x10]
xor edx, edx
mov eax, ebx
call fcn.00403614
test edi, edi
jne 0x48472b
mov ecx, dword [0x5722cc]
mov dl, 1
mov eax, dword [0x484680]
call fcn.004817a8
call fcn.00403e10
mov eax, edi
mov dword [ebx + 0x10], eax
cmp byte [eax + 0x10], 1
sete dl
lea eax, [ebp + 8]
call fcn.0048338c
push dword [ebp + 0xc]
push dword [ebp + 8]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0047f330
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
push esi
push eax
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x484792
mov ecx, dword [0x572a9c]
mov dl, 1
mov eax, dword [0x484680]
call fcn.004817a8
call fcn.00403e10
test esi, esi
jne 0x4847d9
mov eax, edi
mov edx, dword [0x55f0ac]
call fcn.004037d0
test al, al
je 0x4847d9
push 0
mov eax, dword [edi + 0x18]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x4847d9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov ecx, dword [0x5728dc]
mov dl, 1
mov eax, dword [0x484680]
call fcn.004817a8
call fcn.00403e10
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0041da4c
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
mov edx, ebx
call fcn.0041a944
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x484809
call fcn.00403a00
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x484ad4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404964
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x484aed
test al, 0x10
jne 0x484af1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x484af8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x484b16
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x484b0e
test al, 0x10
je 0x484b12
xor eax, eax
jmp 0x484b18
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x484c60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x484d16
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404964
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x484d00
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404af0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404964
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x484d00
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x484d28
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x484d00
cmp dword [ebp - 8], 0x34
jne 0x484d00
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484d1d
lea eax, [ebp - 0x10]
call fcn.00404494
ret

Function at 0x484d2c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x484d41
add esp, 0xfffffff0
call fcn.004039a8
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.00484af8
test al, al
jne 0x484d77
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x572454]
mov dl, 1
mov eax, dword [0x484390]
call fcn.0040d53c
call fcn.00403e10
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00404964
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x484daa
mov ecx, dword [0x5725ec]
mov dl, 1
mov eax, dword [0x484390]
call fcn.0040d500
call fcn.00403e10
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404af0
mov eax, dword [ebx + 4]
call fcn.00404964
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.00404964
push eax
call sub.version.dll_GetFileVersionInfoA
call fcn.0040eec8
mov eax, ebx
call fcn.004853c8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x484df2
call fcn.00403a00
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485a6c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x485b7e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x485aa2
mov eax, dword [ebp - 4]
test eax, eax
jne 0x485aae
push 0x57
call sub.kernel32.dll_SetLastError
jmp 0x485b68
test ebx, ebx
jne 0x485ab7
mov ebx, 0x1000
push 0x573c98
call sub.kernel32.dll_InterlockedIncrement_1
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, dword [0x573c98]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x24]
mov ecx, 2
mov eax, 0x485b9c
call fcn.0040a4bc
push edi
push 0x1d4c0
push ebx
push ebx
push 1
push 0
push 0x40000001
mov eax, dword [ebp - 0xc]
call fcn.00404964
push eax
call sub.kernel32.dll_CreateNamedPipeA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x485b68
push 0
push 0x80
push 3
push edi
push 0
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.00404964
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x485b5a
call sub.kernel32.dll_GetLastError
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_SetLastError
jmp 0x485b68
mov dword [esi], ebx
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485b85
lea eax, [ebp - 0xc]
call fcn.00404494
ret
Function at 0x487088
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x487119
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x572c7c]
cmp dword [eax], 2
jne 0x4870c8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x4870fb
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404ce8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040472c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.00404964
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487120
lea eax, [ebp - 8]
call fcn.00404bb0
lea eax, [ebp - 4]
call fcn.00404494
ret

Function at 0x4875b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00404964
mov edx, eax
mov eax, ebx
call fcn.00486ddc
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00487030
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x48762a
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404964
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x487efc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x487f14
add esp, 0xfffffff0
call fcn.004039a8
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x487ff8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 8], 0
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.004044e8
test esi, esi
jne 0x487f66
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x487af0]
call fcn.00487e34
mov dword [ebx + 4], eax
mov eax, 0x10
call fcn.00408da0
mov dword [ebx + 0x14], eax
jmp 0x487fd3
push 0
push 0
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x48802c
call fcn.004047b0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x487af0]
call fcn.00487e34
mov edi, eax
mov dword [ebx + 4], edi
mov al, byte [edi + 4]
mov byte [ebx + 8], al
lea eax, [ebp - 0xc]
mov ecx, esi
mov edx, 0x488044
call fcn.004047b0
mov eax, dword [ebp - 0xc]
call fcn.00404964
push eax
push 0x10
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
mov dword [ebx + 0xc], edi
push 0
push 0
push 0
push 2
push edi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx + 0x14], eax
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.00488144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487fff
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004044b8
ret

Function at 0x48d9bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x48da20
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404714
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409450
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48da27
lea eax, [ebp - 0xc]
call fcn.00404494
ret
Function at 0x48f728
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f7fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040452c
lea eax, [ebp - 8]
call fcn.004049b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404964
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x48f7e6
mov eax, ebx
call fcn.00402754
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48f7df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404964
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48f7c9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x48f80c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48f7c9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f7e6
mov eax, dword [ebp - 0x10]
call fcn.00402774
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f803
lea eax, [ebp - 8]
call fcn.00404494
ret

Function at 0x492f64
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x492f92
mov eax, ebx
call fcn.00493a18
cmp dword [ebx + 0x40], 0
je 0x492f8b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x493003
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x492ff5
cmp dword [ebx + 8], 0
je 0x492fb4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x492fc6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x492ff5
cmp dword [ebx + 8], 0
je 0x492fa7
cmp eax, 3
je 0x492fd9
dec eax
jne 0x492fa7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x492fa7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x492fa7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x493021
cmp dword [ebx + 0x14], 0xcc
je 0x493021
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049302c
pop ebx
ret