joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4363df
Capabilities:
Write file on windows

Disassembly:
push 0x14
mov eax, 0x4bfd1c
call fcn.00492516
mov eax, dword [ebp + 0xc]
shr eax, 0x18
xor ebx, ebx
cmp al, 0xff
mov dword [ebp - 4], ebx
lea eax, [ebp + 8]
jne 0x436400
mov eax, dword [ebp + 8]
push 0x4d1e80
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00493016
add esp, 0xc
cmp eax, ebx
jne 0x43647b
push 2
push ebx
push dword [ebp - 0x10]
call fcn.00498a87
push dword [ebp - 0x10]
call fcn.00498998
push dword [ebp - 0x10]
mov esi, eax
call fcn.00499033
lea edi, [esi + 1]
push edi
call fcn.0048f372
push edi
push ebx
push eax
mov dword [ebp + 0x14], eax
call fcn.00491e90
push dword [ebp - 0x10]
push esi
push 1
push esi
push dword [ebp + 0x14]
call fcn.004986a0
mov ecx, dword [ebp + 0x10]
add esp, 0x38
push dword [ebp + 0x14]
call fcn.004707b0
push dword [ebp - 0x10]
call fcn.00492b68
push dword [ebp + 0x14]
call fcn.00491f8a
pop ecx
pop ecx
jmp 0x436594
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push str.Unable_to_open_file:
push eax
call fcn.00470fb0
push str.___try_creating_it_instead.
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00470f60
push eax
mov byte [ebp - 4], 2
call fcn.004126e0
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470660
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00470660
mov edi, dword [ebp + 0x10]
mov esi, 0x4cfa1a
cmp dword [ebp + 0x14], ebx
je 0x436508
push ebx
push ebx
push edi
push esi
push str.SOFTWARERealNetworksRealPlayer15.0PreferencesUID
push SysReAllocString
call fcn.0041085a
add esp, 0x18
mov ecx, edi
call fcn.0040d4fd
test al, al
je 0x436508
push ebx
push ebx
push edi
push esi
push str.SOFTWARERealNetworksRealPlayer16.0PreferencesUID
push SysReAllocString
call fcn.0041085a
add esp, 0x18
mov ecx, edi
call fcn.0040d4fd
test al, al
je 0x43654a
lea eax, [ebp - 0x20]
push eax
call fcn.0040ecb3
pop ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00470710
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00470660
mov ecx, edi
call fcn.004715d0
push 1
push esi
push 0x4e3e44
mov ecx, edi
call fcn.004715f0
cmp byte [ebp + 0xf], 0xff
lea eax, [ebp + 8]
jne 0x436556
mov eax, dword [ebp + 8]
push 0x4d6f74
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00493016
add esp, 0xc
cmp eax, ebx
jne 0x4365a4
cmp byte [edi + 7], 0xff
mov esi, edi
jne 0x436576
mov esi, dword [edi]
push dword [ebp - 0x10]
mov ecx, edi
call fcn.004703e0
push eax
push 1
push esi
call fcn.00498c5a
push dword [ebp - 0x10]
call fcn.00492b68
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00470660
xor eax, eax
jmp 0x4365dd
lea eax, [eax + str.Machine_GUID_error:]
push eax
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.004126e0
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00470660
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00470660
mov eax, 0x80004005
call fcn.004925ee
ret 0x10
Function at 0x43a124
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [ecx + 0x138]
jmp fcn.004384c9
Function at 0x43d102
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x4c0e9d
call fcn.00492516
mov esi, ecx
mov edi, 0x4cfa1a
push edi
lea ecx, [esi + 0x548]
call fcn.004707b0
lea ecx, [esi + 0x878]
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push eax
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0043ca2d
lea ecx, [esi + 0x888]
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push eax
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0043ca2d
push edi
mov ecx, 0x4ff4b0
call fcn.004707b0
push str._temp_detect.log
lea ecx, [ebp - 0x18]
call fcn.00470680
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004113a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00470710
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00470660
cmp byte [ebp - 0x11], 0xff
lea eax, [ebp - 0x18]
jne 0x43d1a0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00470660
xor eax, eax
call fcn.004925ee
ret
Function at 0x443989
Capabilities:
Hide graphical window

Disassembly:
push 0x28
mov eax, 0x4c2353
call fcn.00492516
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
call fcn.004362ed
mov ebx, eax
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004362ed
push eax
lea eax, [ebp - 0x24]
push str.USER_ShowWindow__iRow_
push eax
mov byte [ebp - 4], 1
call fcn.00470fb0
push str.__iCol_
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.00470f60
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.00470f10
push eax
mov byte [ebp - 4], 4
call fcn.004126e0
add esp, 0x38
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00470660
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00470660
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00470660
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00470660
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00470660
push 1
push edi
push edi
push dword [ebp + 8]
push dword [ebp + 0xc]
push edi
push dword [esi + 0x1f8]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esi + 0x1fc]
call ebx
push 5
push dword [esi + 0x1f8]
call ebx
push 1
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
push eax
push dword [esi + 0x1f8]
call edi
call fcn.004925ee
ret 8

Function at 0x443a84
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ecx
push 0
push dword [esi + 0x1fc]
call edi
push 0
push dword [esi + 0x1f8]
call edi
pop edi
pop esi
ret
Function at 0x443b19
Capabilities:
Delete registry value

Disassembly:
push 0x20
mov eax, 0x4c23ae
call fcn.00492516
mov esi, ecx
push str.in_USER_QuietCancel__
lea ecx, [ebp - 0x14]
call fcn.00470680
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004126e0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00470660
cmp dword [esi + 0x48], ebx
jne 0x443cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.ASKASK__bCancelT
lea ecx, [ebp - 0x14]
call fcn.00470680
xor edi, edi
lea eax, [ebp - 0x14]
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.004126e0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00470660
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x14], edi
call fcn.004703d0
push str.ask_pid
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.00470680
push 0x4d02f4
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00470680
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.__none__
mov byte [ebp - 4], 4
call fcn.00470680
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00417de0
add esp, 0x14
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00470660
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00470660
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push str.ASKASK_in_USER_Cancel____ask_pid_
push eax
call fcn.00470fb0
push eax
mov byte [ebp - 4], 5
call fcn.004126e0
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00470660
push 0x4cfa4c
lea ecx, [ebp - 0x2c]
call fcn.00470680
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push str.SOFTWAREAPN_PIP_
push eax
mov byte [ebp - 4], 6
call fcn.00470fb0
add esp, 0xc
cmp byte [eax + 7], 0xff
mov byte [ebp - 4], 7
jne 0x443c55
mov eax, dword [eax]
push edi
push ebx
lea ecx, [ebp - 0x2c]
push ecx
push str.Cancel_PIP
push eax
push SysReAllocString
call fcn.00412ffa
add esp, 0x18
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.00470660
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00470660
mov ecx, dword [esi + 0xba0]
cmp ecx, ebx
je 0x443c95
call fcn.00422b88
lea ecx, [esi + 0x1f0]
call fcn.0041fbb7
cmp dword [esi + 0x4c], 0
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x443cbe
push 0x4d58f8
push str.SOFTWAREGoogleNo_Chrome_Offer_Until
push ebx
call edi
cmp dword [esi + 0x50], 0
je 0x443cd1
push 0x4d58f8
push str.SOFTWAREGoogleNo_Toolbar_Offer_Until
push ebx
call edi
cmp dword [esi + 0x54], 0
je 0x443ce4
push 0x4d58f8
push str.SOFTWAREGoogleNo_Drive_Offer_Until
push ebx
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00470660
call fcn.004925ee
ret
Function at 0x443e99
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x300
lea ebp, [esp - 4]
mov eax, dword [0x4fc5b0]
xor eax, ebp
mov dword [ebp + 0x300], eax
push 0x20
mov eax, 0x4c23d9
call fcn.00492516
mov eax, dword [ebp + 0x310]
mov esi, dword [ebp + 0x30c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x314]
xor ebx, ebx
push 0xff
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x201]
push ebx
push eax
mov byte [ebp + 0x200], bl
call fcn.00491e90
add esp, 0xc
push ebx
push ebx
mov edi, 0x100
push edi
lea eax, [ebp + 0x200]
push eax
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
push 0xff
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.00491e90
add esp, 0xc
push ebx
push ebx
push edi
lea eax, [ebp]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10]
push ebx
push ebx
call esi
push 5
lea eax, [ebp + 0x200]
push str.HKCR_
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
call fcn.004b4aee
add esp, 0xc
test eax, eax
jne 0x443f61
mov dword [ebp - 0x10], SysStringLen
push str.HKCR_
jmp 0x443faf
push 5
lea eax, [ebp + 0x200]
push str.HKCU_
push eax
call fcn.004b4aee
add esp, 0xc
test eax, eax
jne 0x443f89
mov dword [ebp - 0x10], SysStringLen
push str.HKCU_
jmp 0x443faf
push 5
lea eax, [ebp + 0x200]
push str.HKLM_
push eax
call fcn.004b4aee
add esp, 0xc
test eax, eax
jne 0x443fbf
mov dword [ebp - 0x10], reloc.OLEAUT32.dll_SysReAllocString
push str.HKLM_
call fcn.00492a70
lea eax, [ebp + eax + 0x200]
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x443ff6
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x14], ebx
je 0x4440aa
push 0xff
lea eax, [ebp + 0x101]
push ebx
push eax
mov byte [ebp + 0x100], bl
call fcn.00491e90
add esp, 0xc
push ebx
push ebx
push edi
lea eax, [ebp + 0x100]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x24]
push ebx
push ebx
call esi
lea eax, [ebp + 0x100]
push eax
lea ecx, [ebp - 0x20]
call fcn.00470680
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.004113a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00470710
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00470660
lea ecx, [ebp - 0x20]
call fcn.004703e0
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.004710f0
push eax
push 1
push ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.00471180
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00470660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x300]
xor ecx, ebp
call fcn.00492093
add ebp, 0x304
leave
ret 0xc
Function at 0x4440cf
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4c247a
call fcn.00492516
mov esi, ecx
push str.in_USER_BeginInstall__
lea ecx, [ebp - 0x18]
call fcn.00470680
lea eax, [ebp - 0x18]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004126e0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00470660
cmp dword [esi + 0xbb4], edi
jne 0x444129
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x4362b6
push edi
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xbb4], eax
call fcn.004925ee
ret
Function at 0x444502
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0xc
mov eax, 0x4c247a
call fcn.00492516
push str.in_USER_IsConnect__
lea ecx, [ebp - 0x18]
call fcn.00470680
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
call fcn.004126e0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00470660
mov esi, dword [ebp + 8]
test esi, esi
je 0x444561
and dword [esi + 8], 0
and dword [ebp - 0x10], 0
push 3
pop eax
mov word [esi], ax
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x444561
mov dword [esi + 8], 1
call fcn.004925ee
ret 4

Function at 0x444569
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x4fc5b0]
xor eax, ebp
mov dword [ebp + 0xbc], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc8]
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0x43]
push ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.00491e90
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 7
lea eax, [ebp - 0x44]
push str.http:__
push eax
call fcn.004b4aee
add esp, 0xc
test eax, eax
je 0x4445e5
push 8
lea eax, [ebp - 0x44]
push str.https:__
push eax
call fcn.004b4aee
add esp, 0xc
test eax, eax
jne 0x444636
push 0x38
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00491e90
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], str.open
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x444636
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00492093
add ebp, 0xc0
leave
ret 8
Function at 0x4667bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x466803
cmp edx, 0x10
jl 0x4667ef
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x4667dc
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x466803
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x4667fb
and edx, 3
cmp edx, 3
jne 0x466817
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x46681c
cmp edx, 2
jne 0x466828
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x46682d
cmp edx, 1
jne 0x466833
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x46b690
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0xe8], 0
jne 0x46b708
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
push esi
lea esi, [edi + 0x24]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x46b6f6
cmp dword [ebp - 4], 0
je 0x46b6f6
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
pop esi
mov dword [edi + 0xe8], 1
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [edi + 0xe8], 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x46b710
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x46b7a5
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 8]
push ecx
lea edx, [esi + 0x10c]
push edx
push eax
push eax
mov eax, dword [ebp - 4]
push str.MHz
push eax
call edi
mov ecx, dword [esi + 0xf4]
push ecx
call fcn.0049168b
push 0x100
mov dword [esi + 0xf4], ebx
call fcn.00491f0a
add esp, 8
mov dword [esi + 0xf4], eax
mov byte [eax], bl
mov eax, dword [esi + 0xf4]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push eax
push ebx
push ebx
push str.ProcessorNameString
push ecx
mov dword [ebp - 0xc], 0x100
call edi
pop edi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
sbb eax, eax
pop esi
and eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b9d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4fc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0xf8]
push edi
push eax
call fcn.0049168b
mov edi, 0x100
push edi
mov dword [ebx + 0xf8], 0
call fcn.00491f0a
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
mov dword [ebx + 0xf8], eax
mov byte [eax], 0
push 1
mov dword [ebp - 0x108], edi
call esi
mov edx, dword [ebx + 0xf8]
lea ecx, [ebp - 0x104]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x46ba40
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 2
mov dword [ebp - 0x10c], edi
call esi
cmp dword [ebp - 0x10c], 0
je 0x46babd
mov edi, dword [ebx + 0xf8]
add edi, dword [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46ba78
mov dx, word [0x4cfa18]
lea eax, [ebp - 0x104]
mov word [edi], dx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46ba92
mov edi, dword [ebp - 0x108]
sub eax, esi
add edi, dword [ebx + 0xf8]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46baa7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00492093
mov esp, ebp
pop ebp
ret
Function at 0x46e5b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4fc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00491e90
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
push 0xc
jb 0x46e628
call fcn.00491f0a
add esp, 4
test eax, eax
je 0x46e61c
mov ecx, eax
call fcn.0046e8e0
push eax
mov ecx, esi
call fcn.0046e4b0
jmp 0x46e647
xor eax, eax
push eax
mov ecx, esi
call fcn.0046e4b0
jmp 0x46e647
call fcn.00491f0a
add esp, 4
test eax, eax
je 0x46e63d
mov ecx, eax
call fcn.0046f540
jmp 0x46e63f
xor eax, eax
push eax
mov ecx, esi
call fcn.0046e530
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
xor ecx, ebp
add eax, 0x8007000e
pop esi
call fcn.00492093
mov esp, ebp
pop ebp
ret
Function at 0x472cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x18
mov dword [ebp - 4], 0
call fcn.00491f0a
add esp, 4
test eax, eax
je 0x472ce7
mov ecx, eax
call fcn.004b93b0
mov esi, eax
test esi, esi
jne 0x472cf3
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ebx
push edi
push esi
call ecx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x472d29
mov edi, dword [ebp + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push edi
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push ebx
push edi
push 1
push esi
call edx
push eax
call fcn.0049872e
add esp, 0x10
test eax, eax
jns 0x472d32
xor eax, eax
mov edi, 0x80004005
jmp 0x472d35
mov edi, dword [ebp - 4]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
push eax
push esi
call edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push esi
push edi
push eax
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x472d60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4fc5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4d1f20
push eax
call fcn.00492fff
mov esi, eax
add esp, 8
test esi, esi
je 0x472de4
push esi
call fcn.00498494
add esp, 4
test eax, eax
jne 0x472ddb
lea esp, [esp]
push esi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.0049872e
add esp, 0x10
test eax, eax
jle 0x472dce
push edi
push eax
lea ecx, [ebp - 0x204]
push 1
push ecx
call fcn.00498c5a
add esp, 0x10
push esi
call fcn.00498494
add esp, 4
test eax, eax
je 0x472da0
push esi
call fcn.00492b68
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00492093
mov esp, ebp
pop ebp
ret