joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473944
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and word [ebp - 0x18], 0
push esi
push edi
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x18]
push 0xb
push eax
push 0x4e9bdc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jbe 0x47398f
push 0xa
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00487c0f
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x473997
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, eax
mov ecx, 0x509500
call fcn.0040f32d
xor ecx, ecx
push 2
pop edx
mov eax, 0x104
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004827bc
mov ebx, eax
test ebx, ebx
pop ecx
je 0x473a06
push 0x208
push 0
push ebx
call fcn.004857c0
mov eax, dword [esp + 0x18]
add esp, 0xc
push dword [eax]
push 0x104
push ebx
push 0x4e9bdc
push str.kp_lock
push 0x4ebdac
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push ebx
push esi
call fcn.00414fa4
push ebx
call fcn.00483868
pop ecx
jmp 0x473a11
push 0x4e9bdc
push esi
call fcn.00414fa4
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x473a35
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [esi]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
lea ecx, [ebp - 8]
push ecx
mov ecx, esi
call dword [eax + 4]
xor ebx, ebx
inc ebx
test al, al
je 0x473a84
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
mov dword [ebp - 0xc], ebx
call dword [eax + 8]
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov byte [ebp - 1], bl
je 0x473a88
mov byte [ebp - 1], 0
test byte [ebp - 0xc], bl
pop ebx
je 0x473a99
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [ebp - 8], 0
je 0x473aa8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
leave
ret
Function at 0x473b75
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallkbasesrv
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.0041491e
test eax, eax
je 0x473bad
cmp dword [ebp - 4], edi
je 0x473ba9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x473c26
mov eax, dword [0x509500]
push ebx
mov ecx, 0x509500
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push str.UninstallString
push eax
lea ebx, [ebp - 8]
call fcn.00473c29
test al, al
pop ecx
pop ecx
pop ebx
jne 0x473be6
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
jmp 0x473b9b
push esi
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [esi - 0x10]
jne 0x473c10
call fcn.00401023
cmp dword [ebp - 4], edi
je 0x473c0c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x473c25
call fcn.00401023
cmp dword [ebp - 4], edi
je 0x473c23
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop edi
leave
ret

Function at 0x476331
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
mov ecx, 0x509500
call fcn.0040f32d
push dword [ebp + 8]
xor edi, edi
lea ebx, [esi + 0xc]
push esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [ebx], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.00414fa4
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, edi
mov dword [esi + 4], eax
je 0x4763dc
push eax
call fcn.004827bc
cmp eax, edi
pop ecx
mov dword [esi + 8], eax
je 0x4763dc
push dword [esi + 4]
push edi
push eax
call fcn.004857c0
add esp, 0xc
push dword [esi + 8]
push dword [esi + 4]
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4763b2
push dword [esi + 8]
call fcn.00485474
pop ecx
mov dword [esi + 8], edi
jmp 0x4763dc
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x14]
push eax
push 0x4e26ac
push dword [esi + 8]
mov dword [ebp + 8], edi
call sub.VERSION.dll_VerQueryValueW
lea eax, [esi + 0x10]
push eax
push ebx
push str.VarFileInfoTranslation
push dword [esi + 8]
call sub.VERSION.dll_VerQueryValueW
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x479030
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x479079
mov eax, dword [ebp - 0x414]
jmp 0x47912c
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0xc], 0x200
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x479105
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x418]
push eax
call fcn.00479030
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x4790fc
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x414]
jmp 0x47912c
mov dword [ebp - 0xc], 0x200
jmp 0x47908a
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret
Function at 0x47afc0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87ab
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e636c]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47b065
jmp 0x47b11a
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.00487869
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8
Function at 0x47b560
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87ab
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e632c]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47b605
jmp 0x47b698
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.00487869
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8
Function at 0x47bf50
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8d7b
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [str.SELECT__FROM_Win32_DiskDrive_WHERE_MediaType_LIKE_Fixed_hard_disk_]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047feb0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47bffd
jmp 0x47c1cb
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00479d60
lea eax, [ebp - 0x878]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00480060
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], edx
jmp 0x47c059
push 0
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00480020
lea ecx, [ebp - 0x888]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00479be0
push eax
lea ecx, [ebp - 0x22c]
call fcn.00479c30
movzx edx, al
test edx, edx
je 0x47c1a7
lea ecx, [ebp - 0x22c]
call fcn.00480120
mov eax, dword [eax]
mov dword [ebp - 0x870], eax
mov word [ebp - 0x86c], 0
push 0x18e
push 0
lea ecx, [ebp - 0x86a]
push ecx
call fcn.004857c0
add esp, 0xc
push 0x4b0
push 0
lea edx, [ebp - 0x6dc]
push edx
call fcn.004857c0
add esp, 0xc
cmp dword [ebp - 0x870], 0
jne 0x47c0d8
jmp 0x47c045
push 0xffffffffffffffff
mov eax, dword [ebp - 0x870]
push eax
push 0xc8
lea ecx, [ebp - 0x86c]
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp - 0x870]
add edx, 0x190
push edx
push 0xc8
lea eax, [ebp - 0x6dc]
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x870]
add ecx, 0x320
push ecx
push 0xc8
lea edx, [ebp - 0x54c]
push edx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x870]
add eax, 0x4b0
push eax
push 0xc8
lea ecx, [ebp - 0x3bc]
push ecx
call fcn.00487869
add esp, 0x10
mov word [ebp - 0x88a], 0x20
lea edx, [ebp - 0x88a]
push edx
lea eax, [ebp - 0x86c]
push eax
call fcn.00483779
add esp, 4
lea ecx, [ebp + eax*2 - 0x86a]
push ecx
lea edx, [ebp - 0x86c]
push edx
call fcn.00481480
add esp, 0xc
lea eax, [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0047ff50
jmp 0x47c045
mov ecx, dword [ebp + 8]
call fcn.0047c1f0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8
Function at 0x47c7a0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87ab
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e6558]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47c845
jmp 0x47c91e
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.00487869
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x65c]
mov dword [edx + 0x640], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x660]
mov dword [edx + 0x644], ecx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8
Function at 0x47ce60
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8d46
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e666c]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47cf05
jmp 0x47d074
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x20
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1b0
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x340
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.00487869
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4d0]
mov dword [eax + 0x4b0], edx
mov ecx, dword [ecx + 0x4d4]
mov dword [eax + 0x4b4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x4d8]
mov dword [edx + 0x4b8], ecx
mov eax, dword [eax + 0x4dc]
mov dword [edx + 0x4bc], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x4e0
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x4c0
push edx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x670
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x650
push ecx
call fcn.00487869
add esp, 0x10
lea eax, [ebp - 0x228]
call fcn.004234d5
mov byte [ebp - 4], 1
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp + 8]
call fcn.0047d0a0
lea eax, [ebp - 0x228]
call fcn.00414d43
push eax
lea eax, [ebp - 0x228]
call fcn.00423e27
push eax
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x7e0
push eax
call fcn.00487869
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.004011f0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8
Function at 0x47d480
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x3cc
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [str.SELECT__FROM_Win32_OnBoardDevice]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047feb0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47d52d
jmp 0x47d640
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00479d60
lea eax, [ebp - 0x3c8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00480060
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], edx
jmp 0x47d589
push 0
lea eax, [ebp - 0x3d0]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00480020
lea ecx, [ebp - 0x3d8]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00479be0
push eax
lea ecx, [ebp - 0x22c]
call fcn.00479c30
movzx edx, al
test edx, edx
je 0x47d61c
lea ecx, [ebp - 0x22c]
call fcn.00480120
mov eax, dword [eax]
mov dword [ebp - 0x3c0], eax
mov word [ebp - 0x3bc], 0
push 0x18e
push 0
lea ecx, [ebp - 0x3ba]
push ecx
call fcn.004857c0
add esp, 0xc
cmp dword [ebp - 0x3c0], 0
jne 0x47d5eb
jmp 0x47d575
push 0xffffffffffffffff
mov edx, dword [ebp - 0x3c0]
push edx
push 0xc8
lea eax, [ebp - 0x3bc]
push eax
call fcn.00487869
add esp, 0x10
lea ecx, [ebp - 0x3bc]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0047ffc0
jmp 0x47d575
mov ecx, dword [ebp + 8]
call fcn.0047c1f0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8
Function at 0x47dc10
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d87ab
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x503454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004857c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4e650c]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x21c]
push eax
call fcn.00487869
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004c7da0
push eax
call fcn.004c7db0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47dcb5
jmp 0x47ddf3
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042bee7
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x65c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x640
push eax
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x7ec
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x7d0
push edx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x97c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x960
push ecx
call fcn.00487869
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0xb0c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0xaf0
push eax
call fcn.00487869
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042bef3
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048bcc6
mov esp, ebp
pop ebp
ret 8