joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436850
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed4a4
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x84], vtable.srl::Size.0
movlpd qword [ebp - 0x7c], xmm0
mov dword [ebp - 0x94], vtable.srl::Size.0
movlpd qword [ebp - 0x8c], xmm0
mov dword [ebp - 0xa4], vtable.srl::Size.0
movlpd qword [ebp - 0x9c], xmm0
mov byte [ebp - 4], 3
push str.kernel32.dll
mov dword [ebp - 0x74], 0x40
mov dword [ebp - 0x34], 0x20
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4369cc
sub esp, 8
lea ecx, [ebp - 0x2b8]
call fcn.00415be0
sub esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x208]
call fcn.00415be0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x158]
call fcn.00415be0
push str.GlobalMemoryStatusEx
push esi
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x436963
lea ecx, [ebp - 0x74]
push ecx
call eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x98], eax
jmp 0x4369a0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x158]
call fcn.00415840
lea ecx, [ebp - 0x208]
call fcn.00415840
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 3
call fcn.00415840
mov eax, dword [0x683374]
test eax, eax
jne 0x436a01
push 0x70
call fcn.00476eaa
add esp, 4
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x4369f6
mov ecx, eax
call fcn.0040d600
jmp 0x4369f8
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x683374], eax
lea esi, [eax + 0x60]
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
push 0x11597
call fcn.0041acf0
lea eax, [ebp - 0x94]
mov ecx, esi
push eax
push 0x116d5
call fcn.0041acf0
lea eax, [ebp - 0xa4]
mov ecx, esi
push eax
push 0x116d6
call fcn.0041acf0
push 0x63abd4
push 0x11606
mov ecx, esi
call fcn.0041afd0
push 0x63abd4
push 0x11607
mov ecx, esi
call fcn.0041afd0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret
Function at 0x4409d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edf03
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x440a0d
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x440b30
push ebx
call fcn.005c9188
mov edi, eax
add esp, 4
test edi, edi
je 0x440b30
cmp dword [esi + 0x14], 8
jb 0x440a3d
mov esi, dword [esi]
push edi
push ebx
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x440b27
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x63fe60
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x440b27
sub esp, 8
lea ecx, [ebp - 0xec]
call fcn.00415be0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
lea ecx, [ebp - 0xdc]
push eax
call fcn.00435eb0
mov edx, 0x63dfe4
mov ecx, eax
call fcn.00411d70
mov ecx, eax
call fcn.00435eb0
mov edx, 0x63dfe4
mov ecx, eax
call fcn.00411d70
mov ecx, eax
call fcn.00435eb0
mov edx, 0x63dfe4
mov ecx, eax
call fcn.00411d70
mov ecx, eax
call fcn.00435eb0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00416830
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.0040a73c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004075ab
push edi
call fcn.005c6b78
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.00415840
mov al, 1
jmp 0x440b32
push edi
call fcn.005c6b78
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret
Function at 0x440b50
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edf46
mov eax, dword fs:[0]
push eax
mov eax, 0x17a0
call fcn.005bd1d0
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x179c], edi
mov esi, ecx
xor bl, bl
mov dword [ebp - 0x17ac], 0
mov dword [ebp - 0x17a8], 0
mov dword [ebp - 0x17a4], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x1798]
mov dword [ebp - 4], 0
call fcn.004075e1
mov byte [ebp - 4], 1
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x440bd1
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
mov esi, dword [ebp - 0x1788]
mov eax, dword [ebp - 0x1784]
sub eax, esi
mov dword [ebp - 0x17a0], esi
cmp ecx, eax
ja 0x440c2e
cmp dword [ebp - 0x1784], 8
lea edi, [esi + ecx]
lea eax, [ecx + ecx]
mov dword [ebp - 0x1788], edi
push eax
mov eax, dword [ebp - 0x17a0]
lea esi, [ebp - 0x1798]
cmovae esi, dword [ebp - 0x1798]
push edx
lea eax, [esi + eax*2]
push eax
call fcn.005bfc60
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [ebp - 0x179c]
jmp 0x440c49
push ecx
push edx
mov byte [ebp - 0x179c], 0
push dword [ebp - 0x179c]
push ecx
lea ecx, [ebp - 0x1798]
call fcn.0041ea00
cmp dword [ebp - 0x1784], 8
lea eax, [ebp - 0x1798]
push 0x20019
cmovae eax, dword [ebp - 0x1798]
lea ecx, [ebp - 0x17ac]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00436690
mov esi, dword [ebp - 0x17ac]
test eax, eax
jne 0x440d11
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0x17a0], 0x7d0
push eax
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x179c]
push eax
push 0
push 0x63abd4
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440d11
mov eax, dword [ebp - 0x179c]
cmp eax, 1
je 0x440cc2
cmp eax, 2
jne 0x440d11
mov eax, dword [ebp - 0x17a0]
test eax, eax
je 0x440cdf
test al, 1
jne 0x440d11
shr eax, 1
cmp word [ebp + eax*2 - 0x7e2], 0
je 0x440ce8
jmp 0x440d11
xor eax, eax
mov word [ebp - 0x7e0], ax
push 0x7d0
lea eax, [ebp - 0x1780]
push eax
lea eax, [ebp - 0x7e0]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x1780]
mov ecx, edi
push eax
call fcn.00414ef0
mov bl, 1
lea ecx, [ebp - 0x1798]
mov byte [ebp - 4], 0
call fcn.004075ab
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x440d3c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x17ac], 0
mov al, bl
mov dword [ebp - 0x17a8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret
Function at 0x44cd30
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eeed6
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov byte [edi], 0
cmp byte [ecx + 0x1c], 0
jne 0x44cd74
xor al, al
jmp 0x44cef5
lea eax, [ebp - 0x354]
mov dword [ebp - 4], 0
push eax
push 0x641530
call fcn.0044ed00
test al, al
je 0x44cef3
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x350], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x44cef3
xor esi, esi
nop dword [eax]
cmp esi, dword [ebp - 0x350]
jae 0x44cef3
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 1
push eax
push str.PhysicalAdapter
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44cec9
lea ecx, [ebp - 0x368]
call fcn.00450ba0
test al, al
je 0x44cec9
lea eax, [ebp - 0x368]
push eax
push str.NetConnectionStatus
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44cec9
lea ecx, [ebp - 0x368]
call fcn.00450b00
cmp eax, 2
jne 0x44cec9
lea eax, [ebp - 0x368]
push eax
push str.NetConnectionID
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44cec9
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x358]
call fcn.00450a50
mov byte [ebp - 4], 2
mov eax, dword [eax]
test eax, eax
je 0x44ce8c
mov eax, dword [eax]
jmp 0x44ce8e
xor eax, eax
push eax
lea ecx, [ebp - 0x34c]
call fcn.004075e1
mov edx, str.Wi_Fi
mov ecx, eax
call fcn.004504a0
lea ecx, [ebp - 0x34c]
mov bl, al
call fcn.004075ab
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 1
call fcn.00450930
test bl, bl
je 0x44cec9
mov byte [edi], 1
mov eax, dword [ebp + esi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
jmp 0x44cdd0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret 4
Function at 0x44cf20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eef16
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov byte [edi], 0
cmp byte [ecx + 0x1c], 0
jne 0x44cf64
xor al, al
jmp 0x44d0e5
lea eax, [ebp - 0x354]
mov dword [ebp - 4], 0
push eax
push 0x641530
call fcn.0044ed00
test al, al
je 0x44d0e3
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x350], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x44d0e3
xor esi, esi
nop dword [eax]
cmp esi, dword [ebp - 0x350]
jae 0x44d0e3
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 1
push eax
push str.PhysicalAdapter
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44d0b9
lea ecx, [ebp - 0x368]
call fcn.00450ba0
test al, al
je 0x44d0b9
lea eax, [ebp - 0x368]
push eax
push str.NetConnectionStatus
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44d0b9
lea ecx, [ebp - 0x368]
call fcn.00450b00
cmp eax, 2
jne 0x44d0b9
lea eax, [ebp - 0x368]
push eax
push str.NetConnectionID
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44d0b9
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x358]
call fcn.00450a50
mov byte [ebp - 4], 2
mov eax, dword [eax]
test eax, eax
je 0x44d07c
mov eax, dword [eax]
jmp 0x44d07e
xor eax, eax
push eax
lea ecx, [ebp - 0x34c]
call fcn.004075e1
mov edx, str.Ethernet
mov ecx, eax
call fcn.004504a0
lea ecx, [ebp - 0x34c]
mov bl, al
call fcn.004075ab
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 1
call fcn.00450930
test bl, bl
je 0x44d0b9
mov byte [edi], 1
mov eax, dword [ebp + esi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
jmp 0x44cfc0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret 4
Function at 0x44d5e0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eefd8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
mov esi, dword [ebp + 8]
jne 0x44d61e
xor al, al
jmp 0x44d7be
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
xor bl, bl
push str.SELECT__FROM_Win32_CDROMDrive
mov byte [ebp - 0x2d], bl
call fcn.0044ed00
test al, al
je 0x44d7bc
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push edx
push 1
mov dword [ebp - 0x4c], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x44d76a
lea ecx, [ebp - 0x64]
call fcn.004274a0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
push str.Name
push dword [ebp - 0x34]
call fcn.0044e5f0
test al, al
je 0x44d6d8
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.00450a50
mov byte [ebp - 4], 3
mov eax, dword [eax]
test eax, eax
je 0x44d6b0
mov eax, dword [eax]
jmp 0x44d6b2
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.004075e1
push eax
lea ecx, [ebp - 0x64]
call fcn.004474b0
lea ecx, [ebp - 0x2c]
call fcn.004075ab
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00450930
lea eax, [ebp - 0x48]
push eax
push str.PNPDeviceID
push dword [ebp - 0x34]
call fcn.0044e5f0
test al, al
je 0x44d6f9
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x58]
call fcn.004503d0
lea eax, [ebp - 0x48]
push eax
push str.Drive
push dword [ebp - 0x34]
call fcn.0044e5f0
test al, al
je 0x44d71a
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x54]
call fcn.004503d0
lea eax, [ebp - 0x48]
push eax
push str.MediaType
push dword [ebp - 0x34]
call fcn.0044e5f0
test al, al
je 0x44d73b
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004503d0
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.0044fbb0
mov eax, dword [ebp - 0x34]
mov bl, 1
push eax
mov byte [ebp - 0x2d], bl
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.00427780
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x44d7bc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret 4
Function at 0x44e2b0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef130
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x677010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
jne 0x44e2f7
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
xor bl, bl
push str.SELECT__FROM_Win32_SoundDevice
mov byte [ebp - 0x15], bl
call fcn.0044ed00
test al, al
je 0x44e3d0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push edx
push 1
mov dword [ebp - 0x24], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x44e3bc
lea ecx, [ebp - 0x50]
call fcn.0042f900
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
push str.Name
push dword [ebp - 0x1c]
mov bl, 1
mov byte [ebp - 0x15], bl
call fcn.0044e5f0
test al, al
je 0x44e37c
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
call fcn.004503d0
lea eax, [ebp - 0x34]
push eax
push str.DeviceID
push dword [ebp - 0x1c]
call fcn.0044e5f0
test al, al
je 0x44e39d
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004503d0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.0042f660
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x44e3d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44e3f0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef15b
mov eax, dword fs:[0]
push eax
sub esp, 0x344
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
mov edi, dword [ebp + 8]
jne 0x44e431
xor al, al
jmp 0x44e5c3
lea eax, [ebp - 0x33c]
mov dword [ebp - 4], 0
push eax
xor bl, bl
mov dword [ebp - 0x33c], 0
push str.SELECT__FROM_Win32_BaseBoard
mov byte [ebp - 0x335], bl
call fcn.0044ed00
test al, al
je 0x44e5c1
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x340]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x340], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x44e569
xor esi, esi
nop dword [eax + eax]
cmp esi, dword [ebp - 0x340]
jae 0x44e569
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 1
push eax
push str.Manufacturer
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44e4ef
lea eax, [ebp - 0x350]
mov ecx, edi
push eax
call fcn.004503d0
mov bl, 1
mov byte [ebp - 0x335], bl
lea eax, [ebp - 0x350]
push eax
push str.Product
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44e51a
lea eax, [ebp - 0x350]
push eax
lea ecx, [edi + 4]
call fcn.004503d0
lea eax, [ebp - 0x350]
push eax
push str.Version
push dword [ebp + esi*4 - 0x334]
call fcn.0044e5f0
test al, al
je 0x44e545
lea eax, [ebp - 0x350]
push eax
lea ecx, [edi + 8]
call fcn.004503d0
mov eax, dword [ebp + esi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
jmp 0x44e4a0
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x44e5c1
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret 4
Function at 0x44fe40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef3e2
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x677010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 1
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
je 0x44fed9
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xe
push dword [ebp + 8]
call fcn.004505c0
mov dword [ebp - 4], 0x16
mov dword [ebp - 4], 0xffffffff
add dword [edi + 4], 0x40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0x19
mov esi, dword [edi + 4]
sub esi, dword [edi]
sar esi, 6
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0xffffffff
cmp esi, 0x3ffffff
jne 0x44feff
call fcn.00408880
lea ebx, [esi + 1]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0x24
mov ecx, dword [edi + 8]
sub ecx, dword [edi]
sar ecx, 6
mov dword [ebp - 4], 0xffffffff
mov edx, ecx
shr edx, 1
mov eax, 0x3ffffff
sub eax, edx
cmp ecx, eax
jbe 0x44ff31
mov eax, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x44ff3c
lea eax, [edx + ecx]
cmp eax, ebx
cmovb eax, ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x44ff52
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x44ffab
cmp eax, 0x3ffffff
jbe 0x44ff5e
call fcn.005bdc77
shl eax, 6
cmp eax, 0x1000
jb 0x44ff94
lea ecx, [eax + 0x23]
cmp ecx, eax
ja 0x44ff74
call fcn.005bdc77
push ecx
call fcn.00476eaa
add esp, 4
test eax, eax
jne 0x44ff86
call fcn.005c3f14
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
mov dword [ebp - 0x18], ebx
jmp 0x44ffab
push eax
call fcn.00476eaa
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x44ffa8
call fcn.005c3f14
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x34
mov byte [ebp - 4], 0x33
shl esi, 6
add esi, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x35
push dword [ebp + 8]
mov ecx, esi
call fcn.004505c0
mov byte [ebp - 4], 0x33
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x3c
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x33
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x33
mov byte [ebp + 8], 0
push ecx
mov dword [ebp - 0x2c], esp
push dword [ebp + 8]
push ecx
push ebx
call fcn.004507b0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
mov ecx, edi
call fcn.004501c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4505c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef51e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x677010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00447150
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 8]
call fcn.00447150
lea eax, [esi + 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x10]
call fcn.00447150
lea eax, [esi + 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x18]
call fcn.00447150
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], vtable.srl::Exists.0
movzx eax, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov dword [edi + 0x30], vtable.srl::Exists.0
movzx eax, byte [esi + 0x34]
mov byte [edi + 0x34], al
mov dword [edi + 0x38], vtable.srl::Exists.0
movzx eax, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4