joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10004577
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x10007040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x414], edi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 0
push ecx
push 0xf003f
push 0
push eax
push 0x80000001
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x414], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001370
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.10002ed0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100036f2
mov esp, ebp
pop ebp
ret
Function at 0x10001c30
Capabilities:
Delete registry value
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4268
call fcn.10004510
mov eax, dword [0x10007040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
test eax, eax
je 0x10001dd8
movaps xmm0, xmmword [0x100052b0]
xor ecx, ecx
mov dword [ebp - 0x4248], 0
movups xmmword [ebp - 0x4264], xmm0
mov dword [ebp - 0x4254], 0x60775559
mov dword [ebp - 0x4250], 0x61646a69
mov byte [ebp - 0x424c], 0
mov al, byte [ebp - 0x4264]
xor byte [ebp + ecx - 0x4263], al
inc ecx
cmp ecx, 0x17
jb 0x10001c91
lea eax, [ebp - 0x4248]
mov byte [ebp - 0x424c], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x4263]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001dd8
push 0x103
push eax
mov byte [ebp - 0x114], al
lea eax, [ebp - 0x113]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x4220], 0x104
lea eax, [ebp - 0x4244]
mov dword [ebp - 0x421c], 0
push eax
lea eax, [ebp - 0x422c]
push eax
lea eax, [ebp - 0x4230]
push eax
lea eax, [ebp - 0x4234]
push eax
lea eax, [ebp - 0x4218]
push eax
lea eax, [ebp - 0x4238]
push eax
lea eax, [ebp - 0x423c]
push eax
lea eax, [ebp - 0x421c]
push eax
push 0
lea eax, [ebp - 0x4220]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x4248]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x4218]
test eax, eax
je 0x10001dd8
xor esi, esi
test eax, eax
je 0x10001dd8
mov ebx, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
lea eax, [ebp - 0x4224]
mov dword [ebp - 0x4228], 0x3fff
push eax
lea eax, [ebp - 0x214]
mov byte [ebp - 0x4214], 0
push eax
push 0
push 0
lea eax, [ebp - 0x4228]
mov dword [ebp - 0x4224], 0xff
push eax
lea eax, [ebp - 0x4214]
push eax
push esi
push dword [ebp - 0x4248]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10001dcf
push 0x10
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
add esp, 0xc
cmp eax, edi
je 0x10001ded
inc esi
cmp esi, dword [ebp - 0x4218]
jb 0x10001d70
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100036f2
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x4214]
push eax
push dword [ebp - 0x4248]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100036f2
mov esp, ebp
pop ebp
ret 4
Function at 0x10001e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, edx
mov byte [ebp - 0x10], 0x2b
mov al, 0x5e
xor al, byte [ebp - 0x10]
mov cl, 0x58
xor cl, byte [ebp - 0x10]
mov ah, 0x59
mov byte [ebp - 0xf], al
mov ch, 0x18
mov byte [ebp - 0xe], cl
mov bl, 0x4e
mov cl, byte [ebp - 0x10]
mov bh, 0x19
mov byte [ebp - 1], 0x47
xor ah, cl
mov al, byte [ebp - 1]
xor bl, cl
xor al, cl
mov byte [ebp - 2], 0x47
mov byte [ebp - 7], al
xor ch, cl
mov al, byte [ebp - 2]
xor bh, cl
mov byte [ebp - 0xc], ah
xor al, cl
mov byte [ebp - 5], 0
mov dl, 5
mov byte [ebp - 6], al
mov dh, 0x4f
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0xf]
mov byte [ebp - 0xb], ch
xor dl, cl
mov byte [ebp - 0xa], bh
xor dh, cl
mov byte [ebp - 9], dl
push eax
mov byte [ebp - 8], dh
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x10001f4d
movaps xmm0, xmmword [0x10005290]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x3d080913
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x13
jb 0x10001eb8
lea eax, [ebp - 0x27]
mov byte [ebp - 0x14], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword fs:[0x2c]
mov esi, eax
mov edx, dword [0x10007440]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x10007498]
cmp ecx, dword [edx + 4]
jle 0x10001f1d
push 0x10007498
call fcn.10003751
add esp, 4
cmp dword [0x10007498], 0xffffffff
jne 0x10001f1d
push 0x10007498
mov dword [0x1000749c], esi
call fcn.10003700
add esp, 4
call fcn.100011e0
push 0
push 0xc8
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [0x1000749c]
test eax, eax
je 0x10001f4d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001f60
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10007040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov cl, 0x39
mov dword [ebp - 0x40], eax
mov ch, 0x7a
push ebx
mov byte [ebp - 0x38], 0x54
mov al, 0x3d
xor al, byte [ebp - 0x38]
mov bl, cl
mov dword [ebp - 0x44], edx
mov bh, 0x38
mov byte [ebp - 0x37], al
mov dl, 0x67
mov al, byte [ebp - 0x38]
mov ah, 0x66
xor cl, al
mov byte [ebp - 0x29], bh
xor bl, al
mov byte [ebp - 0x2e], 0
xor dl, al
mov byte [ebp - 0x36], cl
xor ah, al
mov byte [ebp - 0x35], bl
xor ch, al
mov byte [ebp - 0x33], ah
xor bh, al
mov byte [ebp - 0x34], dl
mov dh, 0x30
mov byte [ebp - 0x32], ch
xor dh, al
mov byte [ebp - 0x30], bh
mov al, byte [ebp - 0x29]
xor al, byte [ebp - 0x38]
push esi
mov byte [ebp - 0x2f], al
lea eax, [ebp - 0x37]
push edi
push eax
mov byte [ebp - 0x31], dh
mov byte [ebp - 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x100020cc
movaps xmm0, xmmword [0x10005270]
xor ecx, ecx
movups xmmword [ebp - 0x54], xmm0
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0xe
jb 0x10001ff1
lea eax, [ebp - 0x53]
mov byte [ebp - 0x45], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword fs:[0x2c]
mov ebx, eax
mov edx, dword [0x10007440]
mov dword [ebp - 0x3c], ebx
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x100074ac]
cmp ecx, dword [edx + 4]
jle 0x10002059
push 0x100074ac
call fcn.10003751
add esp, 4
cmp dword [0x100074ac], 0xffffffff
jne 0x10002059
push 0x100074ac
mov dword [0x100074a8], ebx
call fcn.10003700
add esp, 4
call fcn.100011e0
test al, al
je 0x100020ad
mov esi, dword [0x100074a8]
lea eax, [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x24], 0x8b55ff8b
call ebx
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
mov dword [esi], edi
push 4
push esi
call ebx
mov esi, dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 4
push esi
call ebx
lea eax, [ebp - 0x28]
mov dword [esi], edi
push eax
push dword [ebp - 0x28]
push 4
push esi
call ebx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [0x100074a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100036f2
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100036f2
mov esp, ebp
pop ebp
ret 4
Function at 0x100026e0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100046cd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x10007040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.100038d7
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
add esp, 4
mov dword [eax], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.10001720
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10002782
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x100027b8
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100027ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100027ae
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10003907
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100036f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5be1188d
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x50613a7a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401c66
pop dword [ebp - 0xc]
mov eax, 0x401c66
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xbb16afe5
sub dword [ebp - 0x1c], 0x6cc46a9a
mov dword [ebp - 0x18], 0xa81618d2
add dword [ebp - 0x18], 0x8a1d3373
mov dword [ebp - 0x14], 0x28970c1f
add dword [ebp - 0x14], 0x23b5380f
mov dword [ebp - 0x10], 0xd487be3e
add dword [ebp - 0x10], 0x2b7841c2
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x77e61098
sub eax, 0x77a5e044
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x66f4d629
sub dword [ebp - 0x1c], 0xf2826cd3
mov dword [ebp - 0x18], 0x32a438a1
add dword [ebp - 0x18], 0xec828d4
mov dword [ebp - 0x14], 0x527f6d30
add dword [ebp - 0x14], 0x10efff3c
mov dword [ebp - 0x10], 0x3a6ef462
sub dword [ebp - 0x10], 0x3a6ef462
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xb3cdbf18
sub eax, 0xb38d8eec
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6e2
push 0
call eax
mov ecx, 0x41348e46
sub ecx, 0x4134367a
mov esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0xc]
mov ebx, 0x697b66b6
add ebx, 0xcbdcf9f6
add dword [ebp - 8], ecx
mov edi, dword [edx]
xor dword [ebp - 4], 0xfc282217
add edi, ebx
add dword [ebp - 4], edx
mov dword [esi], edi
add dword [ebp - 4], 0xcb3145c2
add esi, 0x39c08481
add esi, 0xc63f7b83
add edx, 4
loop 0x401d7d
add eax, 0xc227a4b
add eax, 0xf3ded7b8
mov ebx, eax
add eax, 0x4cddb49a
add eax, 0xb3224b6b
mov ecx, 0x8e9b5bab
add ecx, 0x71a4a455
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4238e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x58
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x64]
push edi
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x423a36
push esi
push edi
call fcn.004b3e82
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x423a2c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x4e2f88
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x423a2c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x423a0d
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 2]
movzx eax, word [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push edx
push eax
lea ecx, [esp + 0x2c]
push 0x4e2f44
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4239bf
mov edx, dword [esp + 0x14]
push edx
lea eax, [ebx + 0x10]
push pe_nt_image_headers32
push eax
call fcn.00422580
add esp, 0xc
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x2c]
push 0x4e2f1c
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x423a0d
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [ebx + 0x110]
push pe_nt_image_headers32
push edx
call fcn.00422580
add esp, 0xc
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + 0xa]
mov dword [ebx], ecx
movzx edx, word [eax + 8]
mov dword [ebx + 4], edx
movzx ecx, word [eax + 0xe]
mov dword [ebx + 8], ecx
movzx edx, word [eax + 0xc]
mov dword [ebx + 0xc], edx
push esi
call fcn.004b3e87
add esp, 4
pop esi
mov ecx, dword [esp + 0x60]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c2fd1
add esp, 0x58
ret 8
Function at 0x4a4040
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4a40f9
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4a40f9
push esi
lea eax, [esp + 0x10]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x18], eax
jbe 0x4a40ed
push eax
call fcn.004b3e82
mov esi, eax
add esp, 4
test esi, esi
jne 0x4a408c
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x18]
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4a40e4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
push 0x4e2f88
push esi
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4a40e4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a40e4
mov ecx, dword [eax + 8]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 0xc]
push esi
mov dword [ebx], edx
call fcn.004b3e87
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.004b3e87
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
add esp, 8
ret
pop edi
mov eax, 0x80070057
pop ebx
add esp, 8
ret
Function at 0x4a5950
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
push reloc.OLEAUT32.dll_SysReAllocString
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a597e
or eax, esi
pop esi
add esp, 0x10
ret
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.EnableFirewall
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a59b6
cmp dword [esp + 0xc], 4
jne 0x4a59b6
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 4]
test eax, eax
je 0x4a59c5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4a5a70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push 0x20019
xor edi, edi
push edi
push str.HTTP_shellopencommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a5a9c
xor eax, eax
pop edi
add esp, 0xc
ret
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x4f90e3
push eax
call esi
test eax, eax
jne 0x4a5aea
cmp dword [esp + 0xc], 1
jne 0x4a5aea
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x4f90e3
push ecx
call esi
mov edi, 1
mov eax, dword [esp + 8]
test eax, eax
pop esi
je 0x4a5afa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
add esp, 0xc
ret
Function at 0x4aeb20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4df384
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x5265f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x8000
call fcn.00437cf0
xor ebx, ebx
push 0xc
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.CWMIInterface.0
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
call fcn.004b3e57
add esp, 4
cmp eax, ebx
je 0x4aeb8a
mov ecx, eax
call fcn.004ae8e0
jmp 0x4aeb8c
xor eax, eax
push 0x14
mov dword [esi + 0x30], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x4aebaf
mov ecx, eax
call fcn.004ae440
jmp 0x4aebb1
xor eax, eax
push 0xc
mov byte [esp + 0x20], bl
mov dword [esi + 8], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
je 0x4aebd8
mov ecx, eax
call fcn.004ae5d0
jmp 0x4aebda
xor eax, eax
push 0x14
mov byte [esp + 0x20], bl
mov dword [esi + 0xc], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 3
je 0x4aec01
mov ecx, eax
call fcn.004ae4f0
jmp 0x4aec03
xor eax, eax
push 0x18
mov byte [esp + 0x20], bl
mov dword [esi + 0x10], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1c], 4
je 0x4aec2a
mov ecx, eax
call fcn.004ae640
jmp 0x4aec2c
xor eax, eax
push 0xc
mov byte [esp + 0x20], bl
mov dword [esi + 0x14], eax
call fcn.004b3e57
add esp, 4
cmp eax, ebx
je 0x4aec5f
mov ecx, eax
call fcn.004ae900
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x18], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4aec80
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ecx
push esi
push 2
push 0
mov esi, ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x4aecc4
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jge 0x4aeccb
cmp eax, 0x80010119
je 0x4aeccb
mov ecx, esi
call fcn.004ae7f0
xor eax, eax
pop esi
pop ecx
ret 4
push ebx
push ebp
mov ebp, dword [sym.imp.ole32.dll_CoCreateInstance]
lea ebx, [esi + 0x20]
push ebx
push 0x4f6f5c
push 1
push 0
push 0x4f701c
call ebp
test eax, eax
jge 0x4aecfb
mov ecx, esi
call fcn.004ae7f0
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0x14]
push edi
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebx]
lea edi, [esi + 0x1c]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esi + 0x2c], eax
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xc]
push ecx
call eax
test eax, eax
jl 0x4aed6d
mov eax, dword [edi]
test eax, eax
je 0x4aed6d
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x4f6e8c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x4aed6d
mov ecx, dword [edi]
mov edi, dword [sym.imp.ole32.dll_CoSetProxyBlanket]
push 0
push 0
push 3
push 0
push 0
push 0
push 0xa
push ecx
call edi
test eax, eax
jge 0x4aed7e
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, esi
call fcn.004ae7f0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 0x10]
push 0
push 0
push 3
push 0
push 0
push 0
push 0xa
push ecx
call edi
mov edi, eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
test edi, edi
jl 0x4aed6d
lea edi, [esi + 0x24]
push edi
push 0x4f6fec
push 1
push 0
push 0x4f708c
call ebp
test eax, eax
jl 0x4aed6d
mov edi, dword [edi]
mov ecx, dword [edi]
mov eax, dword [ecx]
lea edx, [esi + 0x28]
push edx
push 0x4f700c
push edi
call eax
test eax, eax
jl 0x4aed6d
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret 4