joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446268
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x49180a
call fcn.00474ec1
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x44635f
cmp byte [esi + 0x4a], bl
je 0x44635f
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x4462a4
xor al, al
jmp 0x446361
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040ec56
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x446302
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x446307
dec eax
je 0x44630b
dec eax
dec eax
je 0x44635b
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401524
mov al, bl
jmp 0x446361
mov edx, dword [ebp - 0x2c]
jmp 0x4462cd
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x446317
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x44633d
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x44632a
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.00471378
add esp, 0x10
cmp edi, eax
jne 0x4462f0
cmp byte [esi + 0x4a], 0
je 0x44635b
test edi, edi
jne 0x4462bf
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e1fe
jmp 0x4462bf
mov bl, 1
jmp 0x4462f2
mov al, 1
call fcn.00474f44
ret
Function at 0x44992d
Capabilities:
Hide graphical window

Disassembly:
push 0x138
mov eax, 0x4901d6
call fcn.00474ec1
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp byte [ebx + 0x460], 0
mov esi, edx
je 0x44995b
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449a92
lea eax, [ebp - 0x144]
push eax
call fcn.0044c69d
and dword [ebp - 4], 0
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
mov eax, ebx
call fcn.00449e51
test al, al
jne 0x44998f
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449a87
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0xa4]
jne 0x4499a1
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a49c
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x20], 0
je 0x4499d3
lea eax, [ebp - 0x30]
push eax
call fcn.0045772c
pop ecx
test al, al
je 0x4499d3
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449a7c
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0xdc]
jne 0x4499e5
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040a49c
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x4499fa
lea eax, [ebp - 0x4c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
push ebx
push dword [ebp - 0x134]
sub eax, dword [ebp - 0x13c]
push dword [ebp - 0x138]
sub eax, dword [ebp - 0x134]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi]
sub eax, dword [ebp - 0x140]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 8], 2
jne 0x449a61
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi]
mov edi, eax
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [esi]
push 0x28
push edi
jmp 0x449a6b
push ebx
push 0
push 0xf4
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.0040bba0
push 0
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040bba0
lea esi, [ebp - 0x144]
call fcn.0043ac32
call fcn.00474f44
ret 0xc
Function at 0x449a9a
Capabilities:
Hide graphical window

Disassembly:
push 0x120
mov eax, 0x49019b
call fcn.00474ec1
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp byte [ebx + 0x460], 0
mov esi, edx
je 0x449ac9
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449beb
lea eax, [ebp - 0x128]
push eax
call fcn.0044c69d
and dword [ebp - 4], 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
mov eax, ebx
call fcn.00449e51
test al, al
jne 0x449afe
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x449be0
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x88]
jne 0x449b10
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a49c
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x1c], 0
je 0x449bca
lea eax, [ebp - 0x2c]
push eax
call fcn.0045772c
pop ecx
test al, al
je 0x449bca
push dword [ebp - 0x118]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x11c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
push eax
call fcn.0040a49c
push esi
call fcn.0044dff4
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
push ebx
push dword [ebp - 0x118]
sub eax, dword [ebp - 0x120]
push dword [ebp - 0x11c]
sub eax, dword [ebp - 0x118]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi]
sub eax, dword [ebp - 0x124]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 8], 2
jne 0x449bd5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [esi + 4]
push 0x28
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x449bd5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040bba0
lea esi, [ebp - 0x128]
call fcn.0043ac32
call fcn.00474f44
ret 0xc
Function at 0x44bc86
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4938de
call fcn.00474e58
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
xor eax, eax
mov dword [esi + 0x48], 7
mov dword [esi + 0x44], edi
mov word [esi + 0x34], ax
mov byte [ebp - 4], 2
push 0xc8
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call fcn.0046e0a6
pop ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
cmp eax, edi
je 0x44bcea
push eax
call fcn.0041aaf2
jmp 0x44bcec
xor eax, eax
mov dword [esi], eax
cmp eax, edi
je 0x44bd09
lea eax, [esi + 0x24]
push eax
push 4
push esi
push 0x44bc68
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
mov eax, esi
call fcn.00474f30
ret 4

Function at 0x44bd13
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push 8
mov eax, 0x49152e
call fcn.00474e58
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 0x3e8
mov word [eax + 0x8f], 0x101
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, 0x103
test eax, eax
jne 0x44bd5f
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ecx
jne 0x44bd91
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xffffffffffffffff
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Download_thread_terminated
call fcn.0040a4c4
call fcn.004437b3
mov esi, dword [edi]
test esi, esi
je 0x44bda4
push esi
call fcn.0041ac13
push esi
call fcn.0046d5a8
pop ecx
and dword [edi], 0
push 0
push 1
lea ecx, [edi + 0x34]
call fcn.0040bba0
lea esi, [edi + 0x14]
call fcn.0040bc6e
lea esi, [edi + 4]
call fcn.0040bc6e
call fcn.00474f30
ret 4
Function at 0x44e5e7
Capabilities:
Create raw socket
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x4b9e20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x198]
push eax
push 0x1010
mov esi, ecx
mov dword [ebp - 0x1a0], 0x3e8
mov dword [ebp - 0x19c], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x44e64d
mov edi, str.WSA_Startup_error
push edi
call fcn.0046faa4
pop ecx
push eax
push edi
lea ecx, [esi + 0x2028]
call fcn.0040cee2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x44e7ad
push str.icmp
call dword [sym.imp.WS2_32.dll_getprotobyname]
test eax, eax
jne 0x44e663
mov edi, str.Cannot_get_icmp_protocol
jmp 0x44e62e
movsx eax, word [eax + 8]
push eax
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x2020], eax
test eax, eax
jns 0x44e683
mov edi, str.Socket_failed
jmp 0x44e62e
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 0x1a0]
push ecx
push 0x1006
mov ebx, 0xffff
push ebx
push eax
call edi
test eax, eax
jns 0x44e6c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.failed_to_set_recv_timeout:__d_n
call fcn.00470507
add eax, 0x40
push eax
call fcn.00472c59
add esp, 0xc
push 4
lea eax, [ebp - 0x1a0]
push eax
push 0x1005
push ebx
push dword [esi + 0x2020]
call edi
test eax, eax
jns 0x44e6f9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.failed_to_set_send_timeout:__d_n
call fcn.00470507
add eax, 0x40
push eax
call fcn.00472c59
add esp, 0xc
push 0x10
lea edi, [esi + 0x2000]
push 0
push edi
call fcn.0046fc60
add esp, 0xc
push 2
pop eax
mov ebx, 0x49c740
push ebx
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x44e74e
movsx eax, word [edi + 0xa]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
add esi, 0x2004
push esi
call fcn.0046d5d0
mov eax, dword [edi + 0xc]
add esp, 0xc
push 2
push 4
push dword [eax]
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
jmp 0x44e7ab
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x2004], eax
je 0x44e781
mov edi, str.Unknown_host
push edi
call fcn.0046faa4
pop ecx
push eax
push edi
lea ecx, [esi + 0x2028]
call fcn.0040cee2
or eax, 0xffffffff
jmp 0x44e7ad
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esi + 0x2024], eax
inc dword [ebp - 0x19c]
call fcn.0044e83b
call fcn.0044e8ab
mov eax, dword [ebp - 0x19c]
dec eax
cmp eax, dword [ebp - 0x19c]
jl 0x44e78c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d5b3
leave
ret
Function at 0x44e83b
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x4c05dc]
inc dword [0x4c05dc]
mov word [esi + 6], ax
mov ax, word [esi + 0x2024]
mov dword [esi], 8
mov word [esi + 4], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x14
pop edx
mov dword [esi + 8], eax
xor eax, eax
mov ecx, esi
push edi
movzx edi, word [ecx]
add eax, edi
add ecx, 2
dec edx
jne 0x44e86c
mov ecx, eax
and eax, 0xffff
sar ecx, 0x10
add ecx, eax
mov eax, ecx
sar eax, 0x10
add eax, ecx
not eax
push 0x10
mov word [esi + 2], ax
lea eax, [esi + 0x2000]
push eax
push edx
push 0x28
push esi
push dword [esi + 0x2020]
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
ret

Function at 0x44fc1b
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0x34
mov eax, 0x4912cb
call fcn.00474ec1
xor ebx, ebx
cmp byte [0x4bfff8], bl
je 0x44fc38
xor al, al
jmp 0x44fd36
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x3c]
push 0x4bffdc
push eax
mov dword [ebp - 4], ebx
call fcn.0044f3ea
pop ecx
pop ecx
test al, al
jne 0x44fc68
cmp dword [ebp - 0x3c], ebx
je 0x44fc31
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44fc31
mov esi, str.Uirt
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 4
lea eax, [ebp - 0x30]
push eax
push 4
push ebx
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44fc58
mov eax, dword [0x4c0028]
cmp eax, ebx
je 0x44fca1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4bfb94], ebx
je 0x44fd26
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push edi
push str.Default_ui_ready_time_out_from_server__d
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00418ebf
mov esi, dword [ebp - 0x30]
cmp dword [esi - 4], 1
pop ecx
pop ecx
jle 0x44fce8
push dword [esi - 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.00418cc4
mov esi, dword [ebp - 0x30]
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040a4c4
push 1
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x40], esp
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00456a76
pop ecx
mov ecx, 0x4bfcf0
call fcn.004437f6
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040bba0
lea eax, [esi - 0x10]
call fcn.00404bd4
cmp dword [ebp - 0x3c], ebx
je 0x44fd34
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
call fcn.00474f44
ret
Function at 0x450da7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0xffffffffffffffff
xor esi, esi
push esi
push 0x4bced0
mov ecx, 0x4c0000
call fcn.0040baae
mov eax, dword [ebp + 8]
mov dword [0x4c0038], eax
lea eax, [ebp - 4]
push eax
push esi
push 0x4bff38
push 0x450e1d
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4bfffc], eax
cmp eax, esi
jne 0x450df0
xor al, al
jmp 0x450e18
cmp dword [0x4bfb94], esi
je 0x450e16
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push str.Monitor_started
call fcn.00409f78
mov ecx, 0x4bfcf0
call fcn.004437f6
mov al, 1
pop esi
leave
ret 4
Function at 0x4532ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x45334c
cmp dword [ebp + 0x14], edi
je 0x45334c
cmp dword [ebp + 0x18], edi
je 0x45334c
cmp dword [ebp + 0x1c], edi
je 0x45334c
push ebx
push dword [ebp + 0xc]
or eax, 1
push dword [ebp + 8]
lea ebx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0040248f
mov ebx, eax
cmp ebx, edi
jne 0x453339
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call esi
mov ebx, eax
cmp ebx, edi
jne 0x453338
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x1c]
push ecx
push eax
push dword [ebp + 0x14]
mov dword [ecx], edx
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call esi
mov ebx, eax
pop esi
cmp dword [ebp - 0xc], edi
je 0x453347
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
jmp 0x453351
mov eax, 0x1e7
pop edi
leave
ret
Function at 0x4535ec
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x264
mov eax, 0x48dd2f
call fcn.00474ec1
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x26c]
push eax
call fcn.0041c359
and dword [ebp - 4], 0
mov ebx, 0x4a3b44
push ebx
call fcn.0046faa4
pop ecx
push eax
push ebx
lea eax, [ebp - 0x26c]
call fcn.00453c66
lea eax, [ebp - 0x268]
push eax
call fcn.0041c359
mov edi, 0x49c6b8
push edi
mov byte [ebp - 4], 1
call fcn.0046faa4
pop ecx
push eax
push edi
lea eax, [ebp - 0x268]
call fcn.00453c66
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x453698
mov eax, dword [ebp - 0x268]
mov edi, dword [esi]
mov esi, dword [esi + 4]
add eax, 0xfffffff0
call fcn.00404bd4
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.00404bd4
mov eax, edi
mov edx, esi
call fcn.00474f44
ret
lea eax, [ebp - 0x268]
lea edi, [ebp - 0x26c]
call fcn.0044ee10
mov dword [ebp - 0x270], 1
lea eax, [ebp - 0x264]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x45375c
lea eax, [ebp - 0x238]
push 0x4a3b4c
push eax
call fcn.00472e68
pop ecx
pop ecx
test eax, eax
je 0x45376e
lea eax, [ebp - 0x238]
push 0x4a3b50
push eax
call fcn.00472e68
pop ecx
pop ecx
test eax, eax
je 0x45376e
lea eax, [ebp - 0x238]
push eax
call fcn.0046faa4
pop ecx
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x268]
call fcn.00453c66
test byte [ebp - 0x264], 0x10
je 0x453738
push esi
push dword [ebp - 0x268]
call fcn.004535ec
or eax, edx
pop ecx
pop ecx
je 0x45377b
jmp 0x453749
mov ecx, dword [ebp - 0x244]
add dword [esi], ecx
mov eax, dword [ebp - 0x248]
adc dword [esi + 4], eax
lea eax, [ebp - 0x26c]
lea edi, [ebp - 0x268]
call fcn.0044ee10
jmp 0x45376e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x45377b
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0
jne 0x4536b3
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x45366d
Function at 0x453a46
Capabilities:
Get memory capacity
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x4b9e20]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
jne 0x453a84
push ebx
push 0x49b5c8
mov ecx, str.Invalid_Argument
mov ebx, 0x49bde8
call fcn.00411229
mov eax, 0x80070057
jmp 0x453b65
push 0x40
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0046fc60
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x453afb
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_memory_status._Win32_error_code__d
lea eax, [esp + 0x14]
call fcn.00418ebf
mov esi, dword [esp + 0x14]
pop ecx
pop ecx
push ebx
push 0x49b5c8
mov ecx, esi
mov ebx, 0x49bde8
call fcn.00411229
lea eax, [esi - 0x10]
call fcn.00404bd4
mov eax, 0x80004005
jmp 0x453b65
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov dword [esi], eax
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
push dword [esp + 0x1c]
add eax, 0x10
push dword [esp + 0x1c]
mov dword [esp + 0x14], eax
push str.Total_Memory_status__I64d
lea eax, [esp + 0x18]
call fcn.00418ebf
mov esi, dword [esp + 0x18]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x453b54
push dword [esi - 0xc]
lea eax, [esp + 0x10]
push eax
call fcn.00418cc4
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
call fcn.00404bd4
xor eax, eax
mov ecx, dword [esp + 0x54]
pop esi
pop ebx
xor ecx, esp
call fcn.0046d5b3
mov esp, ebp
pop ebp
ret 8
Function at 0x456e47
Capabilities:
Delete registry value

Disassembly:
push 0x6c
mov eax, 0x490ff1
call fcn.00474ec1
xor esi, esi
mov edi, edx
mov dword [ebp - 0x78], ecx
cmp dword [0x4bfb94], esi
je 0x456e9c
lea eax, [ebp - 0x64]
push 1
push eax
call fcn.00456a76
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 4], esi
mov dword [ebp - 0x68], esp
push eax
push str.DeleteRegister:
push ecx
call fcn.0040fae8
add esp, 0xc
mov ecx, 0x4bfcf0
call fcn.004437f6
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.00401524
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
lea ebx, [ebp - 0x68]
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00456f6b
test al, al
jne 0x456ec7
push esi
jmp 0x456f59
push dword [edi + 0x10]
xor eax, eax
push 0x49c6b8
call fcn.004173d8
inc eax
push eax
push edi
lea esi, [ebp - 0x48]
call fcn.0040a5d3
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0040ba5a
xor edi, edi
push edi
push 1
mov ecx, esi
call fcn.0040bba0
cmp dword [ebp - 0x1c], edi
je 0x456f58
mov esi, dword [ebp - 0x78]
cmp dword [esi + 0x10], edi
je 0x456f58
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
jae 0x456f1c
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x74]
call fcn.00402433
cmp dword [esi + 0x14], 8
jb 0x456f31
mov esi, dword [esi]
push esi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x74], edi
je 0x456f49
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040bba0
mov al, 1
jmp 0x456f65
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040bba0
xor al, al
call fcn.00474f44
ret
Function at 0x4577e4
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4b9e20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, str.unknown
push esi
mov dword [ebp - 0x120], 0x11c
call fcn.0046faa4
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040cee2
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x457983
cmp dword [ebp - 0x110], 3
jne 0x45784c
mov esi, 0x4a4264
jmp 0x457973
mov eax, dword [ebp - 0x11c]
sub eax, 4
je 0x45792c
dec eax
je 0x4578ce
dec eax
jne 0x457983
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x4578b4
dec eax
je 0x45789a
dec eax
jne 0x457983
cmp byte [ebp - 6], 2
jne 0x45788a
mov esi, str.server_2012
jmp 0x457973
cmp byte [ebp - 6], 3
je 0x457880
mov esi, 0x4a433c
jmp 0x457973
cmp byte [ebp - 6], 1
jne 0x4578aa
mov esi, 0x4a4304
jmp 0x457973
mov esi, 0x4a4308
jmp 0x457973
cmp byte [ebp - 6], 1
jne 0x4578c4
mov esi, str.vista
jmp 0x457973
mov esi, str.server_2k8
jmp 0x457973
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x457925
dec eax
je 0x45791e
dec eax
jne 0x457983
cmp byte [ebp - 6], 1
jne 0x4578fa
cmp word [ebp - 0x144], 9
jne 0x4578fa
mov esi, str.xp_64
jmp 0x457973
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x45790f
mov esi, str.server_2k3
jmp 0x457973
push 0x59
call esi
test eax, eax
je 0x457983
mov esi, str.server_2k3_R2
jmp 0x457973
mov esi, 0x4a4298
jmp 0x457973
mov esi, 0x4a4290
jmp 0x457973
cmp dword [ebp - 0x118], 0
je 0x457955
cmp dword [ebp - 0x118], 0xa
je 0x45794e
cmp dword [ebp - 0x118], 0x5a
jne 0x457983
mov esi, 0x4a4288
jmp 0x457973
mov esi, 0x4a4280
jmp 0x457973
cmp dword [ebp - 0x110], 2
jne 0x457965
mov esi, str.nt_4
jmp 0x457973
cmp dword [ebp - 0x110], 1
jne 0x457983
mov esi, 0x4a4278
push esi
call fcn.0046faa4
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040cee2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046d5b3
leave
ret