joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465b90
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4d3bc0]
cmp dword [eax + 0x30], 0
je 0x465c3a
cmp dword [ebx + 0x94], 0
jne 0x465c34
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x465b20
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x465c34
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x465bfa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x465c34
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041877c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x465c09
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46679c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4667d1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049a4
jmp 0x4667de
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404908
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4678e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x467929
mov eax, esi
call fcn.0044df90
test al, al
je 0x467929
mov eax, dword [ebx + 0x84]
call fcn.0044dc8c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x467929
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044dc8c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46987c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469adc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4698df
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00469344
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d3d0
cmp al, 1
jne 0x4698df
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0046965c
test al, al
je 0x469a6b
cmp dword [ebp - 8], 0
jge 0x4698fd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00469344
mov eax, dword [ebp - 0x210]
call fcn.00404b74
cmp ebx, eax
jge 0x469947
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00469344
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4d209c]
and eax, 0xff
bt dword [edx], eax
jae 0x469947
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x46995b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00469858
cmp ebx, dword [ebp - 8]
je 0x469a5d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x469987
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403cc0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4cff58]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x469a4a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403cc0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4cff58]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044dc8c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403cc0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4cff58]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044dc8c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469a51
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x469abe
cmp dword [ebp - 8], 0
jge 0x469a76
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00469344
mov eax, dword [ebp - 0x218]
call fcn.00404b74
cmp eax, dword [ebp - 8]
jg 0x469ab0
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00469344
mov eax, dword [ebp - 0x21c]
call fcn.00404b74
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00469858
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469ae3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004048d8
ret
Function at 0x4743d0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d64
xor eax, eax
push ebp
push 0x47448a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4744a4
push dword [ebp - 4]
push 0x4744c0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404c34
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404d74
push eax
push 1
push 3
push 1
push 0xf01ff
mov eax, dword [0x4cff6c]
call fcn.00404d74
push eax
mov eax, dword [ebp - 4]
call fcn.00404d74
push eax
mov eax, dword [0x4d3c48]
push eax
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
test ebx, ebx
jne 0x474463
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x431
je 0x474463
xor eax, eax
jmp 0x474465
mov al, 1
neg al
sbb esi, esi
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474491
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048d8
ret

Function at 0x4744c8
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d64
xor eax, eax
push ebp
push 0x474555
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor eax, eax
mov dword [ebp - 8], eax
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404d74
push eax
mov eax, dword [0x4d3c48]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
je 0x47453f
lea eax, [ebp - 8]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
test esi, esi
jne 0x474531
cmp eax, 0x420
je 0x474531
xor eax, eax
jmp 0x474533
mov al, 1
neg al
sbb eax, eax
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47455c
lea eax, [ebp - 4]
call fcn.004048b4
ret
Function at 0x474738
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x474914
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
cmp byte [0x4d3c00], 0
je 0x4747d9
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push 0x474928
push dword [0x4cff64]
push 0x474938
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.00404c34
mov eax, dword [ebp - 0x10c]
call fcn.00404d74
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x4d3c40], eax
jmp 0x4748e8
cmp dword [0x4d3c04], 0
je 0x474878
mov eax, 0x4d3bfc
mov edx, dword [0x4cff68]
call fcn.00404908
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404b24
push dword [ebp - 0x114]
push 0x474948
push dword [0x4d3bfc]
push 0x47495c
push 0x474968
lea eax, [ebp - 0x110]
mov edx, 5
call fcn.00404c34
mov eax, dword [ebp - 0x110]
call fcn.00474268
test al, al
je 0x4748e8
lea eax, [ebp - 0x118]
mov ecx, 0x47495c
mov edx, dword [0x4d3bfc]
call fcn.00404bc0
mov eax, dword [ebp - 0x118]
mov edx, dword [0x4d3bfc]
call fcn.00474564
mov dword [0x4d3c40], eax
jmp 0x4748e8
mov eax, 0x4d3bfc
mov edx, dword [0x4cff64]
call fcn.00404908
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404b24
push dword [ebp - 0x120]
push 0x474948
push dword [0x4d3bfc]
push 0x474968
lea eax, [ebp - 0x11c]
mov edx, 4
call fcn.00404c34
mov eax, dword [ebp - 0x11c]
call fcn.004095f0
test al, al
je 0x4748e8
mov edx, dword [0x4d3bfc]
mov eax, dword [0x4d3bfc]
call fcn.00474564
mov dword [0x4d3c40], eax
cmp dword [0x4d3c40], 0xffffffff
setne byte [0x4d3c3d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47491b
lea eax, [ebp - 0x120]
mov edx, 6
call fcn.004048d8
ret

Function at 0x475660
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov esi, edx
mov ebx, eax
push esp
call sub.KERNEL32.DLL_QueryPerformanceCounter
test eax, eax
je 0x4756bb
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
push 1
call sub.KERNEL32.DLL_Sleep_1
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub eax, dword [esp]
sbb edx, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
fild qword [ebx + 0x10]
fdiv dword [0x4756c8]
fdivp st(1)
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
fcompp
fnstsw ax
sahf
ja 0x475673
jmp 0x4756c1
push esi
call sub.KERNEL32.DLL_Sleep_1
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x4756cc
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov esi, edx
mov ebx, eax
push esp
call sub.KERNEL32.DLL_QueryPerformanceCounter
test eax, eax
je 0x475720
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub eax, dword [esp]
sbb edx, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
fild qword [ebx + 0x10]
fdiv dword [0x475738]
fdivp st(1)
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
fcompp
fnstsw ax
sahf
ja 0x4756df
jmp 0x475730
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
push eax
call sub.KERNEL32.DLL_Sleep_1
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x476474
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00404908
mov eax, ebx
call fcn.00404dc4
mov eax, dword [ebx]
call fcn.00404b74
test eax, eax
jle 0x4764a5
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x47649a
pop esi
pop ebx
ret

Function at 0x47667c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x4766c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.00476ae8
test al, al
jne 0x4766be
cmp word [edi], 0x5a4d
jne 0x4766be
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x4766be
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4766d4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x476824
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x4d00a4], 0
jne 0x476905
call sub.KERNEL32.DLL_GetVersion
test eax, 0x80000000
jne 0x476877
push 0x10000
push 0x40
call sub.KERNEL32.DLL_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.KERNEL32.DLL_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x4768a8
push 0x105
push 0x40
call sub.KERNEL32.DLL_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
push ebx
call sub.KERNEL32.DLL_LocalFree
cmp esi, 0xffffffff
je 0x476905
call sub.KERNEL32.DLL_GetVersion
test eax, 0x80000000
jne 0x4768d3
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.DLL_CreateFileMappingW
mov ebx, eax
jmp 0x4768e5
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.DLL_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x4768ff
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov edi, eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x47c87c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov byte [ebp - 5], 0
and bl, 0xfe
mov eax, ebx
add al, 0x92
sub al, 2
jb 0x47c8a4
add al, 0xd0
sub al, 0xf
jae 0x47c8ac
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp - 4]
call fcn.0047c11c
xor eax, eax
push ebp
push 0x47c937
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047c2c0
test al, al
je 0x47c91b
mov byte [ebp - 5], 1
mov byte [ebp - 6], bl
mov eax, edi
test al, al
jb 0x47c90e
inc eax
mov byte [ebp - 7], al
mov bl, 0
mov edi, ebx
and edi, 0xff
mov dl, byte [esi + edi]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.0047c2c0
test al, al
jne 0x47c902
mov byte [ebp - 5], 0
mov al, byte [esi + edi]
xor byte [ebp - 6], al
inc ebx
dec byte [ebp - 7]
jne 0x47c8e5
mov cl, 1
mov dl, byte [ebp - 6]
mov eax, dword [ebp - 4]
call fcn.0047c2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c93e
cmp byte [ebp + 8], 0
je 0x47c936
mov eax, dword [ebp - 4]
call fcn.0047c1f8
ret
Function at 0x47cc6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004754a0
test al, al
je 0x47cdb9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x60], 0
jne 0x47cdb9
movzx eax, si
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x4a]
cmp eax, edx
ja 0x47cdb9
mov eax, dword [ebp - 4]
mov byte [eax + 0x60], 1
xor ecx, ecx
push ebp
push 0x47cdb2
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 4]
test al, al
je 0x47cd9d
mov eax, dword [ebp - 4]
call fcn.0047bff0
test al, al
je 0x47cd95
push ebx
push 1
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
dec ecx
mov dl, 0x6e
mov eax, dword [ebp - 4]
call fcn.0047c87c
test al, al
je 0x47cd95
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00475660
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 5], 0
mov eax, ebx
xor ecx, ecx
mov edx, 0x100c
call fcn.0040324c
mov ecx, ebx
mov dl, 0x6f
mov eax, dword [ebp - 4]
call fcn.0047c94c
and eax, 0xff
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jbe 0x47cd95
mov dl, 0x50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x47cd5c
inc eax
xor esi, esi
xor dl, byte [ebx + esi]
inc esi
dec eax
jne 0x47cd55
cmp byte [ebx], 0x6e
jne 0x47cd6b
test dl, dl
jne 0x47cd6b
mov byte [ebp - 5], 1
jmp 0x47cd72
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [eax], ecx
cmp byte [ebp - 5], 0
jne 0x47cd95
mov eax, dword [0x4d1fc4]
cmp byte [eax], 0
jne 0x47cd95
cmp byte [ebx], 0x6e
jne 0x47cd95
test dl, dl
je 0x47cd95
mov eax, 0x47cdcc
call fcn.0047b6a4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cdb9
mov eax, dword [ebp - 4]
mov byte [eax + 0x60], 0
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x47da38
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404d64
xor eax, eax
push ebp
push 0x47db02
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x47db14
lea edi, [ebp - 0x124]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, 0x47dc1c
call fcn.00404b7c
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
push ebx
push 0x20019
push 0
lea eax, [ebp - 4]
call fcn.00404dcc
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x47dae8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
jmp 0x47daec
xor eax, eax
mov dword [ebx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47db09
lea eax, [ebp - 4]
call fcn.004048b4
ret

Function at 0x47dc20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404d64
xor eax, eax
push ebp
push 0x47dcde
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test si, si
jbe 0x47dcc0
mov edi, esi
dec edi
test di, di
jb 0x47dcc0
inc edi
xor esi, esi
mov dword [ebp - 0x14], 0x200
mov dword [ebp - 0x10], 0x200
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x218]
push eax
movzx eax, si
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumValueA
test eax, eax
jne 0x47dcba
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x218]
call fcn.00409adc
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00404cc0
jne 0x47dcba
mov bl, 1
jmp 0x47dcc0
inc esi
dec di
jne 0x47dc61
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dce5
lea eax, [ebp - 0x18]
call fcn.004048b4
lea eax, [ebp - 8]
call fcn.004048b4
ret
Function at 0x488a58
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x10]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov ebp, dword [esp + 0x14]
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
xor edi, edi
mov ebx, dword [esp + 0xc]
and ebx, 0xffff0000
mov eax, edi
shl eax, 0x10
sub ebx, eax
mov eax, ebp
not eax
inc eax
and eax, ebx
mov ebx, eax
push 4
push 0x3000
push ebp
push ebx
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
test esi, esi
je 0x488ad1
cmp esi, ebx
je 0x488ad1
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_VirtualFree
inc edi
jmp 0x488b4a
test esi, esi
jne 0x488b53
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualQuery
cmp dword [esp + 0x40], 0x118
jb 0x488b47
mov eax, dword [esp + 0x48]
and eax, 4
cmp eax, 4
jne 0x488b47
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
cmp edx, dword [ebx + 4]
jne 0x488b47
cmp eax, dword [ebx]
jne 0x488b47
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
cmp edx, dword [ebx + 0x114]
jne 0x488b47
cmp eax, dword [ebx + 0x110]
jne 0x488b47
lea eax, [ebx + 8]
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403190
je 0x488b53
inc edi
xor ebx, ebx
cmp edi, 0x14
jle 0x488a8f
xor eax, eax
test esi, esi
je 0x488bb9
cmp esi, ebx
jne 0x488bd5
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebx + 8]
mov edx, dword [esp]
call fcn.004030e4
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov dword [edx], 1
jmp 0x488bd5
test ebx, ebx
je 0x488bd5
inc dword [ebx + 0x108]
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov ecx, dword [ebx + 0x108]
mov dword [edx], ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48c144
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c321
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.0040324c
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4d1230], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4d1234], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4d1238], eax
mov eax, dword [0x4d20a8]
cmp dword [eax], 2
sete byte [0x4d0bdc]
push 0x48c32c
call sub.KERNEL32.DLL_GetModuleHandleA_1
lea edx, [ebp - 4]
call fcn.0048cb4c
cmp byte [0x4d0bdc], 0
jne 0x48c1d0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0048cc90
test al, al
je 0x48c1d0
mov eax, dword [ebp - 0x4c]
mov dword [0x4d4948], eax
jmp 0x48c1d7
xor eax, eax
mov dword [0x4d4948], eax
call fcn.0048be84
and eax, 0x7f
cmp eax, 0x12
ja case.0x48c1e8.0
jmp dword [eax*4 + 0x48c1ef]
mov byte [0x4d0bc8], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bcc], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bd0], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bd4], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bd8], 1
jmp case.0x48c1e8.0
mov byte [0x4d0be0], 1
mov byte [0x4d0be4], 1
jmp case.0x48c1e8.0
mov byte [0x4d0be0], 1
mov byte [0x4d0be8], 1
jmp case.0x48c1e8.0
mov byte [0x4d0be0], 1
mov byte [0x4d0be8], 1
mov byte [0x4d0bec], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bf0], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bf4], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bf8], 1
jmp case.0x48c1e8.0
mov byte [0x4d0bfc], 1
jmp case.0x48c1e8.0
mov byte [0x4d0c00], 1
jmp case.0x48c1e8.0
mov byte [0x4d0c04], 1
jmp case.0x48c1e8.0
mov byte [0x4d0c08], 1
jmp case.0x48c1e8.0
mov byte [0x4d0c0c], 1
jmp case.0x48c1e8.0
mov byte [0x4d0c10], 1
jmp case.0x48c1e8.0
mov byte [0x4d0c14], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c328
lea eax, [ebp - 4]
call fcn.004048b4
ret

Function at 0x48cc90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48cd37
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d74
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x48cd21
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404f00
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d74
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48cd21
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x48cd48
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48cd21
cmp dword [ebp - 8], 0x34
jne 0x48cd21
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cd3e
lea eax, [ebp - 0x10]
call fcn.004048b4
ret