joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e2cf
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x4620a4], 0
je 0x43e321
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0
call dword [0x4620a4]
test eax, eax
je 0x43e31a
jmp 0x43e321
mov dword [ebp - 8], 0
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x348], 0x128
mov byte [ebp - 0x324], 0
lea eax, [ebp - 0x348]
push eax
mov eax, dword [ebp - 0x218]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x43e49b
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x330], eax
jne 0x43e480
cmp dword [0x45e03c], 0
je 0x43e393
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x340]
push eax
push str._n_rPPID_VXW_DXT___d__ppid___d
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43e3a8
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x340]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x43e458
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x43e417
cmp dword [0x45e03c], 0
je 0x43e412
lea eax, [ebp - 0x324]
push eax
mov eax, dword [ebp - 0x340]
push eax
push str._n_rVXTchld_Process_Succesfully_terminated__d__s_
call fcn.00452380
add esp, 0xc
jmp 0x43e446
cmp dword [0x45e03c], 0
je 0x43e446
lea eax, [ebp - 0x324]
push eax
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rVXTchld_Error___d__d_terminating_process___s_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43e480
cmp dword [0x45e03c], 0
je 0x43e480
mov eax, dword [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nVXTchld_Error__d_on_Open__d
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x348]
push eax
mov eax, dword [ebp - 0x218]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x43e35f
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x43e4bc
mov eax, dword [ebp - 8]
push eax
call dword [0x4620a0]
mov dword [ebp - 8], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43f908
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 0xa
jle 0x43f933
xor eax, eax
jmp 0x43fb0e
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x144], 0x128
mov byte [ebp - 0x120], 0
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x43fafd
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x13c], eax
jne 0x43fae5
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x12c], 0
jne 0x43f9a6
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43fb0e
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0043dde0
add esp, 0x14
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0043e02d
add esp, 8
mov dword [ebp - 8], 0x63
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x12c]
push eax
call dword [0x462078]
cmp dword [ebp - 8], 0
jne 0x43fa11
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x85
jmp 0x43fb0e
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x43fa7d
mov eax, dword [ebp + 0x10]
push eax
call fcn.004447ff
add esp, 4
test eax, eax
je 0x43fa7d
cmp dword [0x45e03c], 0
je 0x43fa64
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x12c]
push eax
push str._r_nPPID__d._x_.sbx.Root__s__cd_d_
call fcn.00452380
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x56
jmp 0x43fb0e
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45e03c], 0
je 0x43fab3
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x12c]
push eax
push str._r_nPPID__d__x_.sbx.Empty_cd_d_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp + 0x14]
inc eax
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0043f908
add esp, 0x10
jmp 0x43fb0e
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x43f96b
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43fb0e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4445b8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea edi, [ebp - 0x78]
xor eax, eax
mov ecx, 0x19
rep stosd dword es:[edi], eax
push 0x63
lea eax, [ebp - 0x78]
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x78]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44464d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov esi, 0x5dfaa0
lea edi, [ebp - 0x10]
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x44464d
mov eax, dword [ebp - 0x10]
mov dword [0x5dfaa0], eax
xor eax, eax
mov al, byte [ebp - 0xd]
push eax
xor eax, eax
mov al, byte [ebp - 0xe]
push eax
xor eax, eax
mov al, byte [ebp - 0xf]
push eax
xor eax, eax
mov al, byte [ebp - 0x10]
push eax
push 0x47d094
push 0x14
push 0x5acc00
call fcn.00452660
add esp, 0x1c
call fcn.004287b7
movsx eax, byte [0x481ca0]
test eax, eax
je 0x444760
lea eax, [ebp - 0x110]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x110]
push eax
push 0x481ca0
call fcn.0042e926
add esp, 8
movsx eax, byte [ebp - 0x110]
test eax, eax
jne 0x4446b1
lea eax, [ebp - 0x110]
push eax
push 0x47d0a0
call fcn.0042ecd6
add esp, 8
movsx eax, byte [ebp - 0x110]
test eax, eax
je 0x444760
mov dword [ebp - 0x114], 0
cmp dword [0x45e03c], 0
je 0x4446eb
lea eax, [ebp - 0x110]
push eax
push str._r_n_AGAIN_Update_local_host___s_
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x110]
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x444715
mov eax, dword [ebp - 0x114]
mov dword [0x5dfaa0], eax
cmp dword [0x45e03c], 0
je 0x444736
mov eax, dword [ebp - 0x114]
push eax
push str._r_n_AGAIN_New_IP_INET___X_
call fcn.00452380
add esp, 8
lea edi, [ebp - 0x110]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5acc00
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x445c9a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0
mov eax, dword [0x4817e8]
push eax
push 0
push 0
push 0
push bind
push 0
push bind
push 0xcf0000
push str.no_title
push str.stlwa_nt_isw_8801
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x445cfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rFAIL_GOX_CRW__d_._.
call fcn.00452380
add esp, 8
xor eax, eax
jmp 0x445d1c
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
jmp 0x445d1c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4490ef
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push ebx
push esi
push edi
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x348], 0
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x204]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, str..
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov al, byte [edx + 4]
mov byte [edi + 4], al
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x44929f
test byte [ebp - 0x344], 0x10
je 0x44924c
lea esi, [ebp - 0x318]
mov edi, 0x47e638
mov ecx, 2
repe cmpsb byte [esi], byte es:[edi]
je 0x449247
lea esi, [ebp - 0x318]
mov edi, 0x47e63c
mov ecx, 3
repe cmpsb byte [esi], byte es:[edi]
je 0x449247
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x204]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x47e640]
mov word [edi - 1], ax
lea edi, [ebp - 0x318]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x204]
push eax
call fcn.004490ef
add esp, 4
add dword [ebp - 0x34c], eax
adc dword [ebp - 0x348], edx
jmp 0x44927c
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x350]
add dword [ebp - 0x34c], eax
adc dword [ebp - 0x348], ecx
lea eax, [ebp - 0x344]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x449177
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x34c]
mov edx, dword [ebp - 0x348]
jmp 0x4492b0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x449a60
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2154
call fcn.00452960
push ebx
push esi
push edi
mov dword [ebp - 0x2154], 0
mov dword [ebp - 0x214c], 0
cmp dword [ebp - 0x2154], 0
jne 0x449b56
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x204], 0
mov dword [ebp - 0x2148], 0x200
mov dword [ebp - 0x2150], 0x1f40
mov edx, dword [ebp - 0x2150]
lea edi, [ebp - 0x2144]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x2150]
push eax
lea eax, [ebp - 0x2144]
push eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x2148]
push eax
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x214c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x2154], eax
inc dword [ebp - 0x214c]
cmp dword [ebp - 0x2154], 0
jne 0x449b51
lea eax, [ebp - 0x2144]
push eax
call fcn.004492b5
add esp, 4
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x2154], eax
mov dword [ebp - 0x214c], 0
jmp 0x449b51
jmp 0x449a84
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44b485
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x44b4ad
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x44b4e3
cmp dword [0x464f7c], 0
jne 0x44b4d9
push 0x4dd1e0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x464f7c], eax
mov eax, dword [0x464f7c]
mov dword [ebp - 4], eax
jmp 0x44b4e3
mov eax, 1
jmp 0x44b663
cmp dword [ebp - 4], 0
jne 0x44b52f
cmp dword [ebp + 8], 0
jne 0x44b510
push 0x10
push 0x47e968
push str.MEMORY_FAILURE_5KA
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44b52a
cmp dword [0x45e03c], 0
je 0x44b52a
push str._r_nTKA_BXD_MEM_FAILURE_5KA
call fcn.00452380
add esp, 4
jmp 0x44b61f
mov byte [ebp - 0x208], 0
push 0x200
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x208]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 4
jle 0x44b61f
mov eax, dword [ebp - 0x20c]
mov ecx, dword [0x47e9ac]
mov dword [ebp + eax - 0x20b], ecx
push 0
push 0
push 3
push 0
push 0
push bind
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x44b61f
push 0
lea eax, [ebp - 0x210]
push eax
push 0x68
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x210]
push eax
push 0x4dd1e0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp + 0xc], 0
je 0x44b600
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x44b60b
mov eax, dword [ebp - 0x210]
mov dword [0x464f80], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x44b663
cmp dword [ebp + 8], 0
jne 0x44b642
push 0x10
push str.SofTrack_Timekeeper
push str.FAILURE_TO_READ_TKA_FILE
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44b65c
cmp dword [0x45e03c], 0
je 0x44b65c
push str._r_nFKA55_READ_TKA_FILE_NOT_FOUND
call fcn.00452380
add esp, 4
xor eax, eax
jmp 0x44b663
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ec0b
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x28
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44ec68
mov eax, dword [ebp + 8]
push eax
push str.SeDebugPrivilege
mov eax, dword [ebp - 0xc]
push eax
call fcn.0044eb45
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44ec68
mov eax, dword [ebp - 4]
jmp 0x44ec70
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ec75
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbe8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0xbe8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x44ecde
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0xbe8]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44ed7a
mov dword [ebp - 0x9e0], 1
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x9e0]
cmp dword [ebp - 0x9e8], eax
jle 0x44ed7a
mov eax, dword [ebp - 0x9e0]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x3a
jne 0x44ed6f
dec dword [ebp - 0x9e0]
mov eax, dword [ebp - 0x9e0]
add eax, dword [ebp + 8]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0xbe8]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x9e8]
inc eax
mov dword [ebp - 0x9e0], eax
jmp 0x44ed75
inc dword [ebp - 0x9e0]
jmp 0x44ecff
movsx eax, byte [ebp - 0xbe8]
test eax, eax
jne 0x44edae
cmp dword [0x45e03c], 0
je 0x44eda7
mov eax, dword [ebp + 8]
push eax
push str._r_nZPATH.18_unrecon__s_
call fcn.00452380
add esp, 8
xor eax, eax
jmp 0x44ee5c
lea edi, [ebp - 0x9d8]
xor eax, eax
mov ecx, 0x274
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9d8]
push eax
push 0x9d0
push 0
lea eax, [ebp - 0xbe8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 0
jne 0x44edf1
xor eax, eax
jmp 0x44ee5c
mov dword [ebp - 8], 0
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 8]
push eax
push 0x47f140
lea eax, [ebp - 0x9d8]
push eax
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 8], 0
je 0x44ee54
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
and eax, 0xffff0000
mov dword [ebp - 0x9dc], eax
shr dword [ebp - 0x9dc], 0x10
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
shr eax, 0x10
and eax, 0xffff
cmp eax, 0xa
jae 0x44ee54
mov dword [ebp - 4], 0x18
mov eax, dword [ebp - 4]
jmp 0x44ee5c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44fa2e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1344
call fcn.00452960
push ebx
push esi
push edi
lea eax, [ebp - 0x1344]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x44fa94
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x1344]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44fb30
mov dword [ebp - 0x9dc], 1
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x9dc]
cmp dword [ebp - 0x9e4], eax
jle 0x44fb30
mov eax, dword [ebp - 0x9dc]
mov ecx, dword [ebp + 8]
movsx eax, byte [eax + ecx]
cmp eax, 0x3a
jne 0x44fb25
dec dword [ebp - 0x9dc]
mov eax, dword [ebp - 0x9dc]
add eax, dword [ebp + 8]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x1344]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9dc], eax
jmp 0x44fb2b
inc dword [ebp - 0x9dc]
jmp 0x44fab5
movsx eax, byte [ebp - 0x1344]
test eax, eax
jne 0x44fb64
cmp dword [0x45e03c], 0
je 0x44fb5d
mov eax, dword [ebp + 8]
push eax
push str._r_nZPATH_unrecon__s_
call fcn.00452380
add esp, 8
xor eax, eax
jmp 0x44fc3d
lea edi, [ebp - 0x9d4]
xor eax, eax
mov ecx, 0x274
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9d4]
push eax
push 0x9d0
push 0
lea eax, [ebp - 0x1344]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 0
jne 0x44fba7
xor eax, eax
jmp 0x44fc3d
mov dword [ebp - 4], 0
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 4]
push eax
push 0x47f3e0
lea eax, [ebp - 0x9d4]
push eax
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 4], 0
je 0x44fc36
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
and eax, 0xffff0000
mov dword [ebp - 0x9d8], eax
shr dword [ebp - 0x9d8], 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
shr eax, 0x10
and eax, 0xffff
cmp eax, 0x10
jne 0x44fc36
mov eax, dword [ebp - 4]
test dword [eax + 0x10], 0xffff
jne 0x44fc36
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
shr eax, 0x10
and eax, 0xffff
cmp eax, 0x1366
jne 0x44fc36
mov eax, 1
jmp 0x44fc3d
xor eax, eax
jmp 0x44fc3d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44fc42
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x47f3e4
push 0x47f3f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
jne 0x44fc7f
xor eax, eax
jmp 0x44fd03
add dword [ebp - 0x10], 5
cmp dword [0x464fb4], 0
jne 0x44fcbe
xor eax, eax
mov al, byte [ebp - 4]
cmp eax, 6
jne 0x44fcad
mov dword [0x464fb4], 1
jmp 0x44fcbe
mov dword [0x462200], 0
xor eax, eax
jmp 0x44fd03
cmp dword [0x462200], 0
jne 0x44fcd2
xor eax, eax
jmp 0x44fd03
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xba
jne 0x44fcfc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 1]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x44fd03
xor eax, eax
jmp 0x44fd03
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450a0b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
cmp dword [0x464fb8], 0xffffffff
je 0x450a35
mov eax, dword [0x464fb8]
jmp 0x450b08
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x450af7
lea eax, [ebp - 0x8c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0xc], 0x80
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 0
push str.CurrentBuild
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x45e03c], 0
je 0x450ac9
lea eax, [ebp - 0x8c]
push eax
push str._r_nWindows_BUILD___d_
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x8c]
push eax
call fcn.004536a0
add esp, 4
cmp eax, 0x2774
jle 0x450af7
mov dword [0x464fb8], 1
mov eax, 1
jmp 0x450b08
mov dword [0x464fb8], 0
xor eax, eax
jmp 0x450b08
pop edi
pop esi
pop ebx
leave
ret

Function at 0x450bbc
Capabilities:
Get file version info
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbdc
push ebx
push esi
push edi
cmp dword [0x464fc4], 0xffffffff
je 0x450bdf
mov eax, dword [0x464fc4]
jmp 0x450d4f
lea eax, [ebp - 0xbdc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
push 0x1ff
lea eax, [ebp - 0xbdc]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, str._system32_ntdll.dll
lea edi, [ebp - 0xbdc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x9d4]
xor eax, eax
mov ecx, 0x274
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9d4]
push eax
push 0x9d0
push 0
lea eax, [ebp - 0xbdc]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 0
jne 0x450c6e
xor eax, eax
jmp 0x450d4f
mov dword [ebp - 4], 0
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 4]
push eax
push 0x47f5b4
lea eax, [ebp - 0x9d4]
push eax
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 4], 0
je 0x450d48
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
and eax, 0xffff0000
mov dword [ebp - 0x9d8], eax
shr dword [ebp - 0x9d8], 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
shr eax, 0x10
and eax, 0xffff
cmp eax, 0xa
jbe 0x450cd4
mov eax, 1
jmp 0x450d4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
shr eax, 0x10
and eax, 0xffff
cmp eax, 0xa
jne 0x450d48
mov eax, dword [ebp - 4]
test dword [eax + 0x10], 0xffff
jbe 0x450d05
mov eax, 1
jmp 0x450d4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
shr eax, 0x10
and eax, 0xffff
cmp eax, 0x4a61
jbe 0x450d28
mov eax, 1
jmp 0x450d4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
and eax, 0xffff
cmp eax, 0x691
jbe 0x450d48
mov eax, 1
jmp 0x450d4f
xor eax, eax
jmp 0x450d4f
pop edi
pop esi
pop ebx
leave
ret