joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47627b
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004762f2
push 0x3c
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.00489500
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x64]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x68]
shrd eax, ecx, 0x14
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0xc]
shr ecx, 0x14
mov dword [esi + 4], eax
leave
ret
Function at 0x4762f2
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x512bd4]
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x512bd4
mov ecx, esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x512bd4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
push 0x104
lea esi, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.004010cd
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push eax
push edi
push edi
push 0x19
push edi
call ebx
push 0x104
lea esi, [ebp - 0xc]
call fcn.004010cd
push eax
push edi
push edi
push 0x10
push edi
call ebx
cmp dword [ebp - 8], edi
jne 0x476364
xor eax, eax
jmp 0x47636d
push dword [ebp - 8]
call fcn.00488c9a
pop ecx
lea edx, [ebp - 8]
call fcn.004010ac
mov ebx, dword [ebp - 0xc]
cmp ebx, edi
jne 0x476380
xor eax, eax
jmp 0x476387
push ebx
call fcn.00488c9a
pop ecx
lea edx, [ebp - 0xc]
call fcn.004010ac
push edi
push ecx
mov eax, esp
mov esi, 0x4f8be8
push esi
call fcn.0042241f
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
call fcn.00475e3f
add esp, 0x14
push edi
push ecx
mov eax, esp
push esi
call fcn.0042241f
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.00475e3f
add esp, 0x14
call fcn.004351fc
mov dword [ebp - 0x20], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 8], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], edi
call fcn.004760f8
mov esi, dword [ebp - 0x30]
cmp esi, dword [ebp - 0x2c]
jbe 0x4763fd
call fcn.0048a6bc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], esi
jbe 0x476416
call fcn.0048a6bc
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x10]
call fcn.00473de9
test al, al
je 0x47647a
call fcn.00414d80
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x476467
test al, 6
jne 0x476467
call fcn.00414d80
push dword [eax]
lea eax, [ebp - 0x24]
call fcn.0047603a
sub eax, 4
je 0x47645d
dec eax
je 0x476462
dec eax
je 0x476462
mov eax, dword [ebp + 0xc]
jmp 0x476460
mov eax, dword [ebp + 0x10]
inc dword [eax]
mov eax, dword [ebp + 8]
inc dword [eax]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x2c]
jb 0x476474
call fcn.0048a6bc
add dword [ebp - 0xc], 4
jmp 0x476409
lea eax, [ebp - 0x24]
call fcn.004764a4
lea eax, [ebx - 0x10]
call fcn.00401023
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
lea esi, [ebp - 0x34]
call fcn.0047949e
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x476bab
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and word [ebp - 0x18], 0
push esi
push edi
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x18]
push 0xb
push eax
push 0x4f11d4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jbe 0x476bf6
push 0xa
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0048e084
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x476bfe
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, eax
mov ecx, 0x512bd4
call fcn.0040de3b
xor ecx, ecx
push 2
pop edx
mov eax, 0x104
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00487ce0
mov ebx, eax
test ebx, ebx
pop ecx
je 0x476c6d
push 0x208
push 0
push ebx
call fcn.00489500
mov eax, dword [esp + 0x18]
add esp, 0xc
push dword [eax]
push 0x104
push ebx
push 0x4f11d4
push str.kp_lock
push 0x4f33b4
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push ebx
push esi
call fcn.00413ba8
push ebx
call fcn.0048ab32
pop ecx
jmp 0x476c78
push 0x4f11d4
push esi
call fcn.00413ba8
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x476c9c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [esi]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
lea ecx, [ebp - 8]
push ecx
mov ecx, esi
call dword [eax + 4]
xor ebx, ebx
inc ebx
test al, al
je 0x476ceb
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
mov dword [ebp - 0xc], ebx
call dword [eax + 8]
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov byte [ebp - 1], bl
je 0x476cef
mov byte [ebp - 1], 0
test byte [ebp - 0xc], bl
pop ebx
je 0x476d00
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [ebp - 8], 0
je 0x476d0f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
leave
ret
Function at 0x476ddc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallkbasesrv
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.0041352b
test eax, eax
je 0x476e14
cmp dword [ebp - 4], edi
je 0x476e10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x476e8d
mov eax, dword [0x512bd4]
push ebx
mov ecx, 0x512bd4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push str.UninstallString
push eax
lea ebx, [ebp - 8]
call fcn.00476e90
test al, al
pop ecx
pop ecx
pop ebx
jne 0x476e4d
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
jmp 0x476e02
push esi
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [esi - 0x10]
jne 0x476e77
call fcn.00401023
cmp dword [ebp - 4], edi
je 0x476e73
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x476e8c
call fcn.00401023
cmp dword [ebp - 4], edi
je 0x476e8a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop edi
leave
ret

Function at 0x476eec
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [0x512bd4]
push edi
mov ecx, 0x512bd4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
call fcn.004775eb
test eax, eax
je 0x476f1d
lea eax, [ebp - 4]
push eax
call fcn.004774ad
jmp 0x476f42
push str.idex
lea eax, [ebp - 8]
call fcn.0042241f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00477056
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [esi + 0x18], 8
jb 0x476f4d
mov eax, dword [esi + 4]
jmp 0x476f50
lea eax, [esi + 4]
push eax
lea eax, [ebp - 8]
call fcn.0042241f
mov edi, dword [ebp - 4]
cmp dword [edi - 0xc], 0
mov esi, dword [ebp - 8]
jg 0x476f6a
xor ebx, ebx
inc ebx
jmp 0x476f81
push esi
push 0xffffffffffffffff
push edi
push str.ulst
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
lea eax, [esi - 0x10]
call fcn.00401023
test ebx, ebx
je 0x476f99
lea eax, [ebp - 4]
push eax
call fcn.004774ad
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov eax, edi
call fcn.0042b759
lea eax, [edi - 0x10]
call fcn.00401023
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x477056
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0xc], esi
mov word [ebp - 0x218], si
call fcn.00489500
add esp, 0xc
xor edi, edi
inc edi
push edi
push str.CLSID8AB9CCC4_75EC_438b_B6C0_D8D78882A12DImplemented_Categories6BC04964_67B7_4d50_BB9B_3653A5C305B3
mov dword [ebp - 4], esi
push SysReAllocString
lea esi, [ebp - 4]
call fcn.00404d44
test eax, eax
je 0x4770a8
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
jmp 0x4770c4
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [edi]
push eax
lea ebx, [ebp - 4]
call fcn.0042394d
test eax, eax
je 0x4770c4
mov dword [ebp - 0xc], 1
mov eax, dword [0x512bd4]
mov ecx, 0x512bd4
xor ebx, ebx
call dword [eax + 0xc]
add eax, 0x10
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.004774e0
test eax, eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
je 0x477109
mov eax, dword [edi]
push esi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push ebx
push eax
push 0x4fa288
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x47713a
test ebx, ebx
ja 0x477121
push dword [ebp + 0xc]
push edi
call fcn.0047716a
mov dword [ebp - 8], eax
jmp 0x477149
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.00413ba8
mov dword [ebp - 8], 1
jmp 0x477141
test ebx, ebx
ja 0x477149
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.00477683
lea eax, [esi - 0x10]
call fcn.00401023
cmp dword [ebp - 4], 0
je 0x477160
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x477544
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x206]
push esi
push eax
mov word [ebp - 0x208], si
call fcn.00489500
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x4775e6
push 1
push 0x23
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
mov esi, 0x104
jne 0x4775b1
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
je 0x4775e6
lea eax, [ebp - 0x208]
push str.All_UsersApplication_Data
push eax
call fcn.0042e671
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push str.KingsoftKIS_
push eax
call fcn.0042e671
lea eax, [ebp - 0x208]
push eax
call fcn.00488c9a
add esp, 0xc
cmp eax, esi
jae 0x4775e6
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0048f4b5
pop ecx
pop ecx
pop esi
leave
ret 4

Function at 0x478f9f
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x512bd4]
push esi
push edi
xor edi, edi
mov ecx, 0x512bd4
mov dword [ebp - 8], edi
call dword [eax + 0xc]
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esi, 0x10
cmp dword [eax - 0xc], edi
mov dword [ebp - 4], esi
je 0x479079
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp dword [eax - 0xc], edi
je 0x479079
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x479079
push 0x4fa568
mov eax, ebx
lea ecx, [ebp - 0xc]
call fcn.00413c3b
pop ecx
lea edi, [ebp - 4]
call fcn.004234ea
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401023
mov esi, dword [ebp - 4]
push esi
call fcn.00425356
test eax, eax
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop ecx
je 0x479022
push esi
call edi
push dword [ebx]
call fcn.00425356
test eax, eax
pop ecx
je 0x479032
push dword [ebx]
call edi
push esi
call fcn.00425356
test eax, eax
pop ecx
jne 0x479079
push dword [ebx]
call fcn.00425356
test eax, eax
pop ecx
jne 0x479079
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push eax
call fcn.00474a8c
test eax, eax
pop ecx
pop ecx
jne 0x479079
push dword [ebp + 0xc]
lea eax, [ebp - 4]
call fcn.0047908a
test eax, eax
mov dword [ebp - 8], eax
je 0x479079
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov dword [ebp - 8], eax
lea eax, [esi - 0x10]
call fcn.00401023
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 8
Function at 0x47a978
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x512bd4]
push ebx
push esi
push edi
mov edi, 0x512bd4
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x512bd4]
mov ecx, edi
call dword [eax + 0xc]
mov ebx, eax
mov eax, dword [0x512bd4]
add ebx, 0x10
mov ecx, edi
mov dword [ebp - 8], ebx
call dword [eax + 0xc]
and word [ebp - 0x220], 0
add eax, 0x10
push 0x206
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21e]
push 0
push eax
call fcn.00489500
add esp, 0xc
lea edi, [ebp - 4]
call fcn.0047ab91
mov edi, eax
test edi, edi
je 0x47aaed
push dword [ebp - 4]
call fcn.00425356
mov edi, eax
test edi, edi
pop ecx
je 0x47aaed
push dword [ebp - 4]
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0x4f11d4
push str.cldcfg
mov esi, 0x4e9838
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x47aaed
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
call fcn.00413ba8
push dword [ebp - 4]
xor edi, edi
push edi
push str.item_count
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x47aaed
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x47aae5
inc eax
push eax
mov dword [ebp - 0x14], eax
push str.item__d
lea eax, [ebp - 0xc]
call fcn.00421c33
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00489500
add esp, 0x14
push dword [ebp - 4]
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0x4f11d4
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x47aaea
lea eax, [ebp - 0x220]
push eax
call fcn.00488c9a
pop ecx
lea ecx, [ebp - 0x220]
mov ebx, eax
push ecx
lea eax, [ebp - 8]
call fcn.00413bce
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.00407122
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x47aa64
mov ebx, dword [ebp - 8]
xor edi, edi
inc edi
jmp 0x47aaed
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [ebx - 0x10]
call fcn.00401023
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401023
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47ab12
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x512bd4]
push edi
mov ecx, 0x512bd4
call dword [eax + 0xc]
add eax, 0x10
lea edi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0047a7b1
mov edi, eax
test edi, edi
je 0x47ab81
push esi
push dword [ebp - 4]
call fcn.00425356
test eax, eax
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop ecx
je 0x47ab57
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
je 0x47ab80
lea edi, [ebp - 4]
call fcn.0047ab91
mov edi, eax
test edi, edi
je 0x47ab80
push dword [ebp - 4]
call fcn.00425356
test eax, eax
pop ecx
je 0x47ab7d
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
je 0x47ab80
xor edi, edi
inc edi
pop esi
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
mov eax, edi
pop edi
leave
ret
Function at 0x47ad46
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
mov ecx, 0x512bd4
call fcn.0040de3b
push dword [ebp + 8]
xor edi, edi
lea ebx, [esi + 0xc]
push esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [ebx], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.00413ba8
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, edi
mov dword [esi + 4], eax
je 0x47adf1
push eax
call fcn.00487ce0
cmp eax, edi
pop ecx
mov dword [esi + 8], eax
je 0x47adf1
push dword [esi + 4]
push edi
push eax
call fcn.00489500
add esp, 0xc
push dword [esi + 8]
push dword [esi + 4]
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x47adc7
push dword [esi + 8]
call fcn.004896b0
pop ecx
mov dword [esi + 8], edi
jmp 0x47adf1
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x14]
push eax
push 0x4e96bc
push dword [esi + 8]
mov dword [ebp + 8], edi
call sub.VERSION.dll_VerQueryValueW
lea eax, [esi + 0x10]
push eax
push ebx
push str.VarFileInfoTranslation
push dword [esi + 8]
call sub.VERSION.dll_VerQueryValueW
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x47e810
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x50c464]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x47e859
mov eax, dword [ebp - 0x414]
jmp 0x47e90c
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0xc], 0x200
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x47e8e5
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x418]
push eax
call fcn.0047e810
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x47e8dc
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x414]
jmp 0x47e90c
mov dword [ebp - 0xc], 0x200
jmp 0x47e86a
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491166
mov esp, ebp
pop ebp
ret
Function at 0x47fc60
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df24b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x50c464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00489500
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4ed7cc]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048d313
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004cefe0
push eax
call fcn.004ceff0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47fd05
jmp 0x47fdba
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042adad
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.0048d313
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042adb9
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491166
mov esp, ebp
pop ebp
ret 8
Function at 0x480200
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df24b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x50c464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00489500
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4ed78c]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048d313
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004cefe0
push eax
call fcn.004ceff0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4802a5
jmp 0x480338
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042adad
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.0048d313
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042adb9
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491166
mov esp, ebp
pop ebp
ret 8
Function at 0x4817b0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df24b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x50c464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00489500
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4ed9b4]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048d313
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004cefe0
push eax
call fcn.004ceff0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x481855
jmp 0x48192e
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042adad
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.0048d313
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.0048d313
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x65c]
mov dword [edx + 0x640], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x660]
mov dword [edx + 0x644], ecx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042adb9
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491166
mov esp, ebp
pop ebp
ret 8