joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455a70
Capabilities:
Get storage device properties

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x810
test edx, edx
push esi
push edi
je 0x455afa
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x455afa
push eax
push eax
push 3
push eax
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x455afa
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x800
push ecx
lea edx, [esp + 0x18]
push 0xc
push edx
push 0x2d1400
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
mov eax, edi
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop esi
add esp, 0x810
ret
pop edi
xor eax, eax
pop esi
add esp, 0x810
ret

Function at 0x455b70
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x455bf6
lea ecx, [esp + 8]
mov dword [esp + 4], 1
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x455bb8
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
ret
mov ecx, dword [esp]
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x455beb
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
ret
Function at 0x456c40
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x344
mov eax, dword [str.IsUserLogOff]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [0x4e8a98]
mov al, byte [0x4e8aa0]
mov edx, dword [0x4e8a9c]
push edi
mov dword [esp + 0x18], ecx
mov byte [esp + 0x20], al
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x28]
push eax
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esp + 0x154]
rep stosd dword es:[edi], eax
push 2
mov bl, 1
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x456ced
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7a40
lea ecx, [esi + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d2de4]
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0x14]
push 0xe0d
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
pop edi
pop esi
pop ebp
mov eax, 0x23
pop ebx
add esp, 0x344
ret 4
lea edx, [esp + 0x28]
push edx
push ebp
call sub.KERNEL32.dll_Process32First
lea eax, [esp + 0x4c]
push 0x5c
push eax
call fcn.00466c80
add esp, 8
test eax, eax
push 0x201
jne 0x456d1f
lea ecx, [esp + 0x50]
lea edx, [esp + 0x154]
push ecx
push edx
jmp 0x456d29
inc eax
push eax
lea eax, [esp + 0x158]
push eax
call fcn.00466df0
mov ecx, dword [str.explorer.exe]
add esp, 0xc
lea edx, [esp + 0x150]
push ecx
push edx
call fcn.00473dd0
add esp, 8
test eax, eax
je 0x456d66
mov eax, dword [str.AgentAdmin.exe]
lea ecx, [esp + 0x150]
push eax
push ecx
call fcn.00473dd0
add esp, 8
test eax, eax
jne 0x456d68
xor bl, bl
lea edx, [esp + 0x28]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x456cf8
test bl, bl
je 0x456e1a
mov eax, dword [esp + 0x358]
add esi, 0x10a8
mov byte [eax], 0
mov edi, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov eax, dword [edi]
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x456df6
mov ecx, eax
cmp eax, ecx
jne 0x456df6
mov ebx, dword [edi + 4]
mov eax, dword [0x4fa4d8]
cmp ebx, eax
mov edi, ebx
je 0x456ddc
mov ecx, dword [edi + 8]
push ecx
mov ecx, esi
call fcn.00457920
mov edi, dword [edi]
lea ecx, [ebx + 0xc]
call fcn.00450c10
push ebx
call fcn.00463c78
mov eax, dword [0x4fa4d8]
add esp, 4
cmp edi, eax
mov ebx, edi
jne 0x456db3
mov edx, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
jmp 0x456e1a
cmp eax, edi
je 0x456e1a
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00457ec0
lea eax, [esp + 0x24]
push ebx
push eax
mov ecx, esi
call fcn.00457480
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x456dfa
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x344
ret 4

Function at 0x4590c0
Capabilities:
Create tcp socket

Disassembly:
push esi
mov esi, ecx
call fcn.004590f0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
dec ecx
mov dword [esi], eax
mov eax, ecx
pop esi
ret
Function at 0x459120
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c]
mov word [esp + 6], ax
mov dword [esp + 8], ecx
mov dword [esp + 0x18], 1
call fcn.004753b0
test eax, 0x10000
je 0x459186
mov eax, dword [esi]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push 0xffff
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x459186
or eax, eax
pop esi
add esp, 0x10
ret 8
mov edx, dword [esi]
lea ecx, [esp + 4]
push 0x10
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
pop esi
add esp, 0x10
ret 8

Function at 0x459290
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x11c
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
je 0x4593fc
mov esi, dword [esp + 0x134]
test esi, esi
jle 0x4593fc
lea eax, [esi + 7]
mov dword [esp + 0x18], 0
cdq
and edx, 7
add eax, edx
mov ebx, eax
sar ebx, 3
shl ebx, 3
push ebx
call fcn.00467824
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x10], edi
je 0x4593fc
lea eax, [ebx + 0x18]
push eax
call fcn.00467824
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x459314
push edi
call fcn.00463c78
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 8
mov ecx, ebx
xor eax, eax
mov edx, ecx
push 0x18
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [esp + 0x134]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp + 4]
push ecx
mov ecx, dword [esp + 0x1c]
push 2
push edx
push ecx
push ebx
push eax
call fcn.004a8630
mov eax, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
jbe 0x459413
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
sub eax, esi
push 0
push eax
mov eax, dword [ebp]
lea edx, [edi + esi]
push edx
push eax
call ebx
test eax, eax
jg 0x4593d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4593e9
mov ecx, dword [ebp]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push 0
push eax
push 0
push 0
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x45940c
test eax, eax
je 0x45940c
jmp 0x4593df
add esi, eax
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x1c]
cmp esi, eax
jb 0x459371
jmp 0x459417
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00463c78
push edi
call fcn.00463c78
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x11c
ret 8
mov edx, dword [esp + 0x10]
push edx
jmp 0x4593ee
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
call fcn.00463c78
push edi
call fcn.00463c78
mov eax, dword [esp + 0x13c]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 8
Function at 0x459440
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x118
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
je 0x459667
mov eax, dword [esp + 0x130]
test eax, eax
jle 0x459667
add eax, 7
cdq
and edx, 7
add eax, edx
mov esi, eax
sar esi, 3
shl esi, 3
push esi
call fcn.00467824
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x10], edi
jne 0x459492
push 8
jmp 0x459669
mov ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esi + 0x18]
push eax
call fcn.00467824
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4594ca
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00463c78
add esp, 4
push 8
jmp 0x459669
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x14], esi
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
test esi, esi
jle 0x459578
mov edx, dword [ebp]
mov eax, esi
sub eax, edi
push 0
lea ecx, [edi + ebx]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x45955a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45959e
mov eax, dword [ebp]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x2c], eax
push 0
lea edx, [esp + 0x2c]
push 0
inc eax
push edx
push eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4595c1
test eax, eax
je 0x4595e4
jmp 0x45956c
je 0x4595eb
mov edx, dword [esp + 0x14]
sub edx, eax
add edi, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
test eax, eax
jg 0x4594ec
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45960d
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00463c78
push ebx
call fcn.00463c78
add esp, 8
push 0xd
jmp 0x459669
mov eax, dword [esp + 0x10]
push eax
call fcn.00463c78
push ebx
call fcn.00463c78
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00463c78
push ebx
call fcn.00463c78
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 8
mov edx, dword [esp + 0x10]
push edx
jmp 0x4595f0
mov eax, dword [esp + 0x10]
push eax
call fcn.00463c78
push ebx
call fcn.00463c78
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 8
add ebp, 4
push 0x18
push ebp
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0x28]
push 2
push edx
push ebp
push esi
push ebx
call fcn.004a871d
mov ecx, dword [esp + 0x14c]
mov edi, dword [esp + 0x148]
mov eax, ecx
mov esi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00463c78
push ebx
call fcn.00463c78
mov eax, dword [esp + 0x154]
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 8
push 0x57
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x118
ret 8
Function at 0x459c60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
mov eax, dword [0x4fa538]
sub esp, 0x14
test eax, eax
push esi
mov esi, ecx
jne 0x459c76
xor al, al
pop esi
add esp, 0x14
ret
cmp dword [esi + 0xc], 0xffffffff
je 0x459c83
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x459c9e
xor al, al
pop esi
add esp, 0x14
ret
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push 0x10
mov dword [esp + 0x10], ecx
push edx
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov word [esp + 0x14], 2
mov word [esp + 0x16], cx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x459ce1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
xor al, al
pop esi
add esp, 0x14
ret
mov ecx, dword [esi + 4]
mov dx, word [esi + 8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 0xc]
lea eax, [esp + 8]
push 0x10
push eax
push ecx
mov word [esp + 0x16], dx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x459d15
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
xor al, al
pop esi
add esp, 0x14
ret
mov ecx, dword [esi + 0xc]
lea eax, [esp + 4]
push 4
push eax
push 1
push 6
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov byte [esi + 0xa], 1
mov al, 1
pop esi
add esp, 0x14
ret

Function at 0x459df0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x4fa538]
sub esp, 0x190
test eax, eax
jne 0x459e21
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x459e21
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0x190
ret
inc dword [0x4fa538]
add esp, 0x190
ret
Function at 0x45a590
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4cea93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 3]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x13]
xor ebx, ebx
push 0x18
mov dword [esp + 0x1c], esi
mov byte [esi], al
mov byte [esi + 1], cl
mov byte [esi + 8], bl
call fcn.00467824
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.00465cc3
cmp dword [0x4fa5dc], ebx
jne 0x45a600
mov dword [0x4fa5dc], edi
mov dword [edi], ebx
mov edx, dword [0x4fa5dc]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x4fa5e0]
inc ecx
mov dword [0x4fa5e0], ecx
lea ecx, [esp + 0x14]
call fcn.00465d5f
cmp ebp, ebx
je 0x45a623
push ebp
call fcn.00463c78
add esp, 4
mov edi, dword [0x4fa5dc]
push 0x18
call fcn.00467824
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
lea edi, [esi + 0x10]
mov dword [esp + 0x24], ebx
mov ecx, edi
call fcn.00428920
push 0xfa0
push ebx
push ebx
mov ecx, edi
mov byte [esp + 0x30], 1
call fcn.00428950
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x45b450
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
call fcn.0045b440
test eax, eax
je 0x45b463
mov eax, 0x1a
pop esi
ret
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
xor eax, eax
pop esi
ret

Function at 0x45b480
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov word [esp + 4], 2
mov cx, word [esi + 0xc]
mov dword [esp + 0xc], eax
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0x1c]
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esi + 4]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x45b50f
push 0x4e8fbc
lea ecx, [esi + 0x10]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d309c]
add esp, 0xc
mov ecx, esi
push 0x76
push str.Write_const_char_szBuffer__int_nLen_
push edx
call fcn.0045b520
mov eax, 0x1a
pop esi
add esp, 0x10
ret 8
xor eax, eax
pop esi
add esp, 0x10
ret 8
Function at 0x45d7f0
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x224
mov edx, dword [0x4e99bc]
mov eax, dword [str.CheckVersion__]
push esi
mov esi, ecx
mov ecx, dword [0x4e99b8]
mov dword [esp + 0x10], edx
push edi
mov dword [esp + 0xc], eax
mov ax, word [0x4e99c0]
mov dword [esp + 0x10], ecx
mov cl, byte [0x4e99c2]
lea edx, [esp + 0x128]
push 0x104
push edx
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [str.WUAUENG.DLL]
lea ecx, [esp + 0x128]
push eax
push ecx
push 0x4df9ac
lea edx, [esp + 0x30]
push 0x103
push edx
call fcn.00466ca7
add esp, 0x14
lea eax, [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 8], eax
jne 0x45d8bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetFileVersionInfoSize__
lea edx, [esi + 0x55]
push 0xfff
push edx
call fcn.00466ca7
mov edx, dword [0x4d30ac]
mov eax, dword [esi]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x4d4
push ecx
push edx
mov ecx, esi
call dword [eax + 0x10]
pop edi
xor eax, eax
pop esi
add esp, 0x224
ret
push eax
call fcn.00467824
mov edi, eax
add esp, 4
test edi, edi
jne 0x45d908
mov eax, dword [esp + 8]
lea ecx, [esi + 0x55]
push eax
push 0x4e9970
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d30ac]
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0xc]
push 0x4db
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
pop edi
xor eax, eax
pop esi
add esp, 0x224
ret
mov edx, dword [esp + 8]
push edi
push edx
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x45d967
push edi
call fcn.00463c78
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetFileVersionInfo__
lea ecx, [esi + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d30ac]
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0xc]
push 0x4e4
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
pop edi
xor eax, eax
pop esi
add esp, 0x224
ret
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x4e2314
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x45d9c9
push edi
call fcn.00463c78
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VerQueryValue__
lea ecx, [esi + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d30ac]
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 0xc]
push 0x4ed
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
pop edi
xor eax, eax
pop esi
add esp, 0x224
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 8]
cmp eax, 0x50004
jb 0x45d9f9
jne 0x45d9e2
cmp dword [ecx + 0xc], 0xece03e8
jb 0x45d9f9
push edi
call fcn.00463c78
add esp, 4
mov eax, 2
pop edi
pop esi
add esp, 0x224
ret
push edi
call fcn.00463c78
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x224
ret
Function at 0x45e850
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 5
mov esi, str.ResetAuthorization__
lea edi, [esp + 0x10]
push eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate]
push 0xf003f
push 0
push ecx
push 0x80000002
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x45e8cd
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate]
push eax
push edx
push 0x4e9558
lea eax, [ebx + 0x55]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d30ac]
mov edx, dword [ebx]
add esp, 0x14
lea eax, [esp + 0x10]
push 0x6a9
push eax
push ecx
mov ecx, ebx
call dword [edx + 0x10]
pop edi
pop esi
mov eax, 0x10
pop ebx
add esp, 0x1c
ret
mov edx, dword [0x4d311c]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edx
push eax
call esi
mov ecx, dword [str.PingID]
mov edx, dword [esp + 0xc]
push ecx
push edx
call esi
mov eax, dword [str.AccountDomainSid]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call esi
mov edx, dword [str.wuauserv]
push 0
push edx
mov ecx, ebx
call fcn.0045da10
cmp eax, 0x10
jb 0x45e951
mov eax, dword [str.wuauserv]
lea ecx, [ebx + 0x55]
push eax
push 0x4e9bd4
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d30ac]
mov edx, dword [ebx]
add esp, 0x10
lea eax, [esp + 0x10]
push 0x6b6
push eax
push ecx
mov ecx, ebx
call dword [edx + 0x10]
pop edi
pop esi
mov eax, 0x10
pop ebx
add esp, 0x1c
ret
mov edx, dword [str.wuauserv]
push 1
push edx
mov ecx, ebx
call fcn.0045da10
cmp eax, 0x10
jb 0x45e9a6
mov eax, dword [str.wuauserv]
lea ecx, [ebx + 0x55]
push eax
push 0x4e9bc0
push 0xfff
push ecx
call fcn.00466ca7
mov ecx, dword [0x4d30ac]
mov edx, dword [ebx]
add esp, 0x10
lea eax, [esp + 0x10]
push 0x6bd
push eax
push ecx
mov ecx, ebx
call dword [edx + 0x10]
pop edi
pop esi
mov eax, 0x10
pop ebx
add esp, 0x1c
ret
push str._resetauthorization__detectnow
call fcn.0045f310
add esp, 4
test eax, eax
je 0x45e9f2
push eax
push 0x4e9464
lea edx, [ebx + 0x55]
push 0xfff
push edx
call fcn.00466ca7
mov edx, dword [0x4d30ac]
mov eax, dword [ebx]
add esp, 0x10
lea ecx, [esp + 0x10]
push 0x6c5
push ecx
push edx
mov ecx, ebx
call dword [eax + 0x10]
pop edi
pop esi
mov eax, 0x10
pop ebx
add esp, 0x1c
ret
pop edi
mov dword [ebx + 0x12b4], 1
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret
Function at 0x45ef40
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
mov esi, dword [esp + 0x9c]
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x45f0d2
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x45efb4
cmp dword [esp + 8], 4
jne 0x45f019
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x45ef9a
mov dword [esi], 1
jmp 0x45f019
cmp eax, 0xa
jne 0x45efa7
mov dword [esi], 2
jmp 0x45f019
cmp eax, 0x5a
jne 0x45f019
mov dword [esi], 3
jmp 0x45f019
cmp eax, 2
jne 0x45f019
mov eax, dword [esp + 8]
cmp eax, 3
jne 0x45efca
mov dword [esi], 4
jmp 0x45f019
cmp eax, 4
jne 0x45efd7
mov dword [esi], 5
jmp 0x45f019
cmp eax, 5
jne 0x45f006
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x45efec
mov dword [esi], 6
jmp 0x45f019
cmp eax, 1
jne 0x45eff9
mov dword [esi], 7
jmp 0x45f019
cmp eax, 2
jne 0x45f019
mov dword [esi], 8
jmp 0x45f019
cmp eax, 6
jne 0x45f019
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x45f019
mov dword [esi], 9
mov ecx, dword [str.Service_Pack_1]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00468480
add esp, 8
test eax, eax
je 0x45f040
mov dword [esi + 4], 1
pop esi
add esp, 0x94
ret
mov eax, dword [str.Service_Pack_2]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00468480
add esp, 8
test eax, eax
je 0x45f066
mov dword [esi + 4], 2
pop esi
add esp, 0x94
ret
mov edx, dword [str.Service_Pack_3]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00468480
add esp, 8
test eax, eax
je 0x45f08d
mov dword [esi + 4], 3
pop esi
add esp, 0x94
ret
mov ecx, dword [str.Service_Pack_4]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00468480
add esp, 8
test eax, eax
je 0x45f0b4
mov dword [esi + 4], 4
pop esi
add esp, 0x94
ret
mov eax, dword [str.Service_Pack_5]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00468480
add esp, 8
test eax, eax
je 0x45f0d2
mov dword [esi + 4], 5
pop esi
add esp, 0x94
ret

Function at 0x45f310
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x158
lea eax, [esp + 0x54]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45f3da
cmp eax, 0x104
jg 0x45f3da
mov ecx, dword [esp + 0x15c]
mov edx, dword [0x4d31cc]
push edi
push ecx
lea eax, [esp + 0x5c]
push edx
push eax
push str._s_s__s
lea ecx, [esp + 0x68]
push 0x103
push ecx
call fcn.00466ca7
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2c]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], edx
add esp, 0x18
mov word [esp + 0x44], ax
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], edx
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x2c], edx
push edx
lea edx, [esp + 0x78]
mov dword [esp + 0x34], 0x44
push edx
push 0
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x45f3da
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
xor eax, eax
pop esi
add esp, 0x158
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x158
ret