joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438240
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00438450
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x45988c], 0
jne 0x43827d
cmp dword [0x459888], 0
je 0x43827d
mov eax, dword [0x459888]
mov dword [0x45988c], eax
cmp dword [0x45988c], 0
je 0x4382fa
mov ecx, dword [0x45988c]
cmp dword [ecx + 8], 0
je 0x4382fa
mov edx, dword [0x45988c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x4382fa
mov ecx, dword [0x45988c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x4382fa
mov eax, dword [0x45988c]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x4382c9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x4382d0
xor eax, eax
jmp 0x438440
mov ecx, dword [0x45988c]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0042d4e0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x438440
mov edx, dword [0x459888]
mov dword [0x45988c], edx
jmp 0x438316
mov eax, dword [0x45988c]
mov ecx, dword [eax + 4]
mov dword [0x45988c], ecx
cmp dword [0x45988c], 0
je 0x438356
cmp dword [0x45988c], 0
je 0x438354
mov edx, dword [0x45988c]
cmp dword [edx + 8], 0
je 0x438354
mov eax, dword [0x45988c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x438354
mov edx, dword [0x45988c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x438354
jmp 0x4382ae
jmp 0x438308
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x438387
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00438630
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4383a0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00438530
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43843e
mov ecx, dword [ebp - 4]
mov dword [0x45988c], ecx
mov edx, dword [0x45988c]
mov dword [edx], 0x52727464
mov eax, dword [0x45988c]
mov dword [eax + 8], 0
mov ecx, dword [0x45988c]
mov edx, dword [0x459888]
mov dword [ecx + 4], edx
mov eax, dword [0x45988c]
mov dword [0x459888], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x45988c]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x438409
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x43842d
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x438400
mov ecx, dword [0x45988c]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x4382ae
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x438530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00438600
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x4385f5
mov edx, dword [ebp - 4]
cmp edx, dword [0x456ce0]
jb 0x438575
mov eax, dword [ebp - 4]
cmp eax, dword [0x456ce4]
ja 0x438575
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x438545
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0042d4e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x43859b
jmp 0x4385f5
cmp dword [ebp - 0x10], 0x10000
jne 0x4385de
cmp dword [ebp - 0x14], 0x10000
jb 0x4385de
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4385d1
mov eax, dword [ebp - 0x24]
jmp 0x4385f7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4385f0
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00438600
add esp, 4
mov dword [ebp - 4], eax
jmp 0x438545
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x438630
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00438710
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x4386fd
mov edx, dword [ebp - 4]
cmp edx, dword [0x456ce0]
jb 0x43867a
mov eax, dword [ebp - 4]
cmp eax, dword [0x456ce4]
ja 0x43867a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x43864a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0042d4e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4386a0
jmp 0x4386fd
cmp dword [ebp - 0x10], 0x10000
jne 0x4386e3
cmp dword [ebp - 0x14], 0x10000
jb 0x4386e3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4386d6
mov eax, dword [ebp - 0x24]
jmp 0x4386ff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4386f8
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00438710
add esp, 4
mov dword [ebp - 4], eax
jmp 0x43864a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x438740
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4598d4], 0
je 0x438756
xor eax, eax
jmp 0x438972
cmp dword [0x4598d0], 0
je 0x438769
mov eax, dword [0x4598d0]
jmp 0x438972
push 0x24
push 0
push 0x4598ac
call fcn.0042d4e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x4598ac], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x4598b0], eax
cmp dword [0x4598b0], 0
jne 0x43880e
mov dword [0x4598d4], 1
cmp dword [0x4598b0], 0
je 0x4387c1
mov eax, dword [0x4598b0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4598b4], 0
mov dword [0x4598b8], 0
mov dword [0x4598bc], 0
mov dword [0x4598c0], 0
mov dword [0x4598c4], 0
mov dword [0x4598c8], 0
mov dword [0x4598cc], 0
xor eax, eax
jmp 0x438972
push str.ImagehlpApiVersionEx
mov ecx, dword [0x4598b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598b4], eax
push str.SymInitialize
mov edx, dword [0x4598b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598b8], eax
push str.SymSetOptions
mov eax, dword [0x4598b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598bc], eax
push str.SymGetOptions
mov ecx, dword [0x4598b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598c0], eax
push str.SymLoadModule64
mov edx, dword [0x4598b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598c4], eax
push str.SymGetModuleInfo64
mov eax, dword [0x4598b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598c8], eax
push str.SymFromName
mov ecx, dword [0x4598b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4598cc], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.0042d4e0
add esp, 0xc
mov eax, 0xb
mov word [ebp - 8], ax
cmp dword [0x4598b4], 0
je 0x4388f3
cmp dword [0x4598b8], 0
je 0x4388f3
cmp dword [0x4598c4], 0
je 0x4388f3
cmp dword [0x4598c8], 0
je 0x4388f3
cmp dword [0x4598cc], 0
jne 0x4388f8
jmp 0x4387a2
lea ecx, [ebp - 8]
push ecx
call dword [0x4598b4]
movzx edx, word [ebp - 8]
cmp edx, 0xb
jge 0x438910
jmp 0x4387a2
push 0
push 0
mov eax, dword [0x4598ac]
push eax
call dword [0x4598b8]
test eax, eax
jne 0x438929
jmp 0x4387a2
cmp dword [0x4598c0], 0
je 0x438963
cmp dword [0x4598bc], 0
je 0x438963
call dword [0x4598c0]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
or edx, 0x2704
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4598bc]
mov dword [0x4598d0], 0x4598ac
mov eax, dword [0x4598d0]
mov esp, ebp
pop ebp
ret
Function at 0x40973c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or eax, dword [ecx]
inc ebp
fsub st(3), st(0)
and bh, bh
dec ebp
hlt

Function at 0x409e60
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40a650
call fcn.0040a160
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409ec0
cmp eax, 0xffffffff
je 0x409ec0
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x409eb9
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x409eb9
cmp edx, 0x10000000
jae 0x409eb9
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x409eb6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x409f40
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x409f7e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x409f76
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x409f80
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x409f66
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a060
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40a091
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40a091
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40a091
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406770
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x40677e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x40685d
mov esi, edx
shr esi, 3
push edi
jmp 0x4067a0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4466f8]
add ecx, 8
sub edx, 8
dec esi
jne 0x4067a0
pop edi
test edx, edx
je 0x40687a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4466f8]
inc ecx
dec edx
jne 0x406861
not eax
pop esi
pop ebp
ret

Function at 0x406880
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4466f8]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4466f8]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x4068d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [ebp + 0xc]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x4466f8]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4466f8]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
pop ebp
ret

Function at 0x40b3f0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
push str.Mozilla_5.0__X11__Ubuntu__Linux_x86_64__rv:105.0__Gecko_20100101_Firefox_105.0
mov dword [ebp - 4], eax
mov byte [esi], al
call fcn.004299d0
add esp, 4
push eax
push str.Mozilla_5.0__X11__Ubuntu__Linux_x86_64__rv:105.0__Gecko_20100101_Firefox_105.0
mov ecx, esi
call fcn.004056f0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418150
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e2ab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4506f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004296b9
push 4
mov dword [ebp - 4], 0
call fcn.0042a511
mov edi, eax
add esp, 4
test edi, edi
je 0x4181d0
call fcn.00429377
mov dword [edi], eax
call fcn.00429136
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0042906b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4181c6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00429093
jmp 0x4181d2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e368
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4506f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x418e6e
cmp byte [edi + 0x49], bl
je 0x418e6e
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x418e62
push 8
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00429940
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x1c], 8
jae 0x418dc2
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x418dda
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
mov edx, dword [esi + 0x18]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
sub eax, 0
je 0x418e03
dec eax
je 0x418e07
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x418e5d
jmp 0x418e69
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x418e17
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x418e40
cmp ebx, 0x10
jae 0x418e26
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0042d227
add esp, 0x10
cmp esi, eax
jne 0x418e5a
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x418e66
test esi, esi
jne 0x418dce
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040b090
jmp 0x418dc8
lea ecx, [ebp - 0x2c]
call fcn.00405160
xor al, al
jmp 0x418e70
lea ecx, [ebp - 0x2c]
call fcn.00405160
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004299ba
mov esp, ebp
pop ebp
ret
Function at 0x41e7e0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e9c0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4506f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x50]
push eax
push 0x448b50
push 1
push ebx
push 0x448c20
mov dword [ebp - 0x50], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x44]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x44], ebx
mov ecx, dword [eax]
push str.ROOTCIMV2
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, ebx
jl 0x41e994
mov ecx, dword [ebp - 0x44]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push ecx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push 0x20
push str.Select__From_Win32_OperatingSystem
mov dword [ebp - 0x4c], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x447c2c
push eax
call edx
cmp eax, ebx
jl 0x41e994
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x41e994
mov ecx, dword [eax]
lea edx, [ebp - 0x54]
push edx
lea edx, [ebp - 0x48]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x54], ebx
je 0x41e982
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ecx
push ebx
push str.InstallDate
push eax
mov byte [ebp - 4], 2
call edx
mov ecx, dword [ebp - 0x5c]
push 1
lea eax, [ebp - 0x6c]
push eax
push ecx
call fcn.0041e600
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x6c]
push eax
call dword [0x4630cc]
call dword [0x463094]
push 0x104
push ebx
push eax
call dword [0x46301c]
movzx ecx, word [ebp - 0x18]
movzx edx, word [ebp - 0x1a]
push ecx
movzx ecx, word [ebp - 0x24]
push edx
movzx edx, word [ebp - 0x22]
mov esi, eax
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push ecx
push edx
push eax
push str._d__d__d__d:_d:_d
push esi
call dword [0x462e8c]
add esp, 0x20
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x40]
call fcn.00405160
mov eax, esi
jmp 0x41e999
cmp dword [ebp - 0x2c], 0x10
jb 0x41e994
mov edx, dword [ebp - 0x40]
push edx
call fcn.004298d9
add esp, 4
mov eax, str.Unknown
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004299ba
mov esp, ebp
pop ebp
ret
Function at 0x41ed30
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ea3b
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4506f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x7c]
push eax
push 0x448b50
push 1
push ebx
push 0x448c20
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x70]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x70], ebx
mov ecx, dword [eax]
push str.rootSecurityCenter2
push eax
mov eax, dword [ecx + 0xc]
call eax
cmp eax, ebx
jl 0x41eecd
mov ecx, dword [ebp - 0x70]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push ecx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x78]
push ecx
push ebx
push 0x20
push str.Select__From_AntiVirusProduct
mov dword [ebp - 0x78], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push 0x447c2c
push eax
call edx
cmp eax, ebx
jl 0x41eecd
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov eax, dword [ebp - 0x78]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x41eecd
mov ecx, dword [eax]
lea edx, [ebp - 0x74]
push edx
lea edx, [ebp - 0x80]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x74], ebx
je 0x41eebb
lea ecx, [ebp - 0x90]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ebx
push ebx
lea ecx, [ebp - 0x90]
push ecx
push ebx
push str.displayName
push eax
mov byte [ebp - 4], 2
call edx
mov eax, dword [ebp - 0x88]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041eab0
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0x69]
mov byte [ebp - 4], 3
call fcn.00422f10
cmp dword [eax + 0x14], 0x10
jb 0x41ee90
mov esi, dword [eax]
jmp 0x41ee92
mov esi, eax
lea ecx, [ebp - 0x68]
call fcn.00405160
lea ecx, [ebp - 0x4c]
call fcn.0040af40
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x30]
call fcn.00405160
mov eax, esi
jmp 0x41eed2
cmp dword [ebp - 0x1c], 0x10
jb 0x41eecd
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004298d9
add esp, 4
mov eax, str.Unknown
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004299ba
mov esp, ebp
pop ebp
ret