joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402404
Capabilities:
Get local ipv4 addresses

Disassembly:
push 0xc
mov eax, 0x48fdf1
call fcn.004869c2
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
mov eax, dword [0x4c4f6c]
and dword [ebp - 0x10], 0
mov esi, 0x4c4f6c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, esi
mov esi, dword [ebp + 8]
call fcn.00401dec
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], edi
push eax
xor edi, edi
push edi
call fcn.00486d9c
cmp eax, 0x6f
jne 0x402461
push dword [ebp - 0x10]
call dword [0x496680]
pop ecx
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00486d9c
test eax, eax
jne 0x4024ab
test edi, edi
mov esi, edi
je 0x4024b7
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402d77
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [0x4964f4]
test eax, eax
pop ecx
pop ecx
je 0x40249c
mov esi, dword [esi]
test esi, esi
jne 0x402475
jmp 0x4024ab
add esi, 0x1b0
push esi
push dword [ebp + 8]
call fcn.00402d77
test edi, edi
je 0x4024b7
push edi
call dword [0x49668c]
pop ecx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, dword [ebp + 8]
call fcn.00486a9a
ret

Function at 0x4027fe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x4c002c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
lea esi, [ebp + 0xc]
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
lea esi, [ebp + 0x1c]
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [eax + 0xc]
movsd dword es:[edi], dword [esi]
call fcn.00402780
push eax
sub esp, 0x14
mov edi, esp
lea esi, [esp + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00402780
pop ecx
push eax
mov ecx, ebx
call fcn.00484277
mov edi, eax
push edi
push str.nat_InitializeAdapters_return:_x
mov esi, 0x4f73fc
call fcn.0043eb4e
xor esi, esi
cmp edi, esi
pop ecx
pop ecx
jne 0x4028a7
push esi
push esi
push 1
push esi
call dword [0x496204]
mov dword [ebx + 0x51e4], eax
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push 0x4847d1
push esi
push esi
call dword [0x4964e8]
add esp, 0x18
mov dword [ebx + 0x51e0], eax
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004862e5
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4028bd
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4924ee
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4c002c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x4c4f6c]
mov ecx, 0x4c4f6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
and dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x4c020c
mov ebx, 0x4f73fc
mov eax, dword [esp + 0x10]
push dword [eax]
mov esi, dword [ebp + 0x10]
sub esp, 0x14
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00402780
pop ecx
push eax
call fcn.0043e907
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
push dword [eax]
push dword [ebp + 0xc]
call fcn.00401e07
and dword [esp + 0x14], 0
cmp dword [esp + 0x14], 5
jne 0x402987
push ecx
mov edi, esp
mov dword [esp + 0x28], esp
push str.255.255.255.0
call fcn.004022b2
mov eax, dword [esp + 0x14]
push ecx
mov byte [esp + 0x40], 1
mov edi, esp
mov dword [esp + 0x30], esp
push dword [eax]
call fcn.0040230a
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
add ecx, 0x5238
mov byte [esp + 0x44], 0
call fcn.0040ddbe
push 0x64
call dword [0x4961f0]
mov edi, dword [ebp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.00414b5c
pop ecx
mov byte [esp + 0x38], 2
push dword [eax]
lea eax, [esp + 0x20]
push eax
call fcn.00402404
pop ecx
pop ecx
lea edi, [esp + 0x18]
mov byte [esp + 0x38], 3
call fcn.00401ce5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.00401a1d
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.00401a1d
mov edi, dword [esp + 0x18]
push edi
push str.KDhcpServer::GetIpAddressByGuid__Result:_s
mov esi, ebx
call fcn.0043eb4e
pop ecx
pop ecx
push edi
push dword [ebp + 0xc]
call fcn.00402d50
test eax, eax
je 0x402a2d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jl 0x402942
add dword [esp + 0x10], 4
cmp dword [esp + 0x10], 0x4c0218
jl 0x40290f
push 0
push str.KDhcpServer::ReSettIpAddress__Result:_d
call fcn.0043eb4e
xor esi, esi
jmp 0x402a3d
push edi
push str.KDhcpServer::ReSettIpAddress_Success_:_s
mov esi, ebx
call fcn.0043eb4e
xor esi, esi
inc esi
pop ecx
pop ecx
lea eax, [edi - 0x10]
call fcn.00401a1d
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405d18
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
call dword [0x496520]
and dword [eax], 0
mov eax, dword [esi]
and dword [eax], 0x7fffffff
mov eax, dword [esi + 4]
sub eax, esi
sub eax, 8
mov dword [esi + 0x133c], eax
movzx eax, ax
sub ax, 2
lea edi, [esi + 8]
push eax
push edi
call fcn.00403876
pop ecx
pop ecx
push 0
push dword [esi + 0x133c]
push edi
push dword [esi + 0x1310]
call dword [0x496970]
cmp dword [esi + 0x133c], eax
pop edi
jne 0x405d7b
call dword [0x4969c0]
test eax, eax
jne 0x405d7b
mov ax, word [esi + 0x133c]
ret
xor ax, ax
ret
Function at 0x4060a7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
mov edi, dword [0x496520]
call edi
and dword [eax], 0
mov eax, dword [esi + 4]
push 0x10
sub eax, esi
add eax, 0xfffffff8
lea ecx, [esi + 0x1324]
push ecx
push 0
push eax
mov dword [esi + 0x133c], eax
lea eax, [esi + 8]
push eax
movzx eax, byte [esi + 0x1347]
imul eax, eax, 0x2c
push dword [eax + 0x4c939c]
call dword [0x496968]
mov dword [esi + 0x133c], eax
call edi
mov ebx, eax
call dword [0x4969c0]
mov dword [ebx], eax
call edi
cmp dword [eax], 0
pop edi
pop ebx
jne 0x406114
cmp dword [esi + 0x133c], 0
jle 0x406114
mov ax, word [esi + 0x133c]
ret
xor ax, ax
ret
Function at 0x4086e5
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0x56c], ebx
je 0x40884a
cmp byte [edi + 0xc8c], bl
je 0x40870d
cmp byte [edi + 0xc8d], 5
jne 0x40884a
mov eax, dword [edi]
mov ecx, dword [edi + 0xa84]
cmp ecx, eax
jbe 0x40871b
mov eax, ecx
mov ecx, dword [edi + 0x56c]
or dword [ecx + 0x10], 4
mov ecx, dword [edi + 0x56c]
or dword [ecx + 0x10], 2
mov esi, dword [edi + 0x56c]
call fcn.00408fbb
push dword [edi + 0x56c]
push ebx
push 0x40b651
call dword [0x496528]
add esp, 0xc
cmp byte [0x4f5e85], 2
je 0x40875f
mov eax, edi
call fcn.00408ee0
cmp byte [0x4f5e82], 1
jb 0x408814
mov eax, dword [edi]
cmp eax, ebx
je 0x40879f
cmp dword [edi + 0x548], ebx
je 0x40879f
push eax
mov eax, dword [edi + 0x14]
push 0x4c5b20
call fcn.0040a18e
pop ecx
push eax
lea eax, [edi + 0x404]
push eax
lea eax, [edi + 0x504]
push eax
push str.Host__s___s__allotted__s_for__u_seconds
jmp 0x4087ca
cmp byte [edi + 0xc8c], bl
je 0x4087da
push eax
mov eax, dword [edi + 0x14]
push 0x4c5b20
call fcn.0040a18e
pop ecx
push eax
lea eax, [edi + 0x404]
push eax
lea eax, [edi + 0x504]
push eax
push str.Host__s___s__renewed__s_for__u_seconds
mov esi, 0x4c5820
push esi
call fcn.0040d69e
add esp, 0x18
jmp 0x40880a
mov eax, dword [edi + 0x14]
push 0x4c5b20
call fcn.0040a18e
pop ecx
push eax
lea eax, [edi + 0x404]
push eax
lea eax, [edi + 0x504]
push eax
push str.BOOTP_Host__s___s__allotted__s
mov esi, 0x4c5820
push esi
call fcn.0040d69e
add esp, 0x14
push 1
push esi
call fcn.0040bdf3
pop ecx
pop ecx
cmp byte [0x4f5e85], bl
je 0x40883f
mov eax, dword [0x4f5e74]
cmp eax, dword [0x4f7384]
jl 0x40883f
jg 0x408838
mov eax, dword [0x4f5e70]
cmp eax, dword [0x4f7380]
jbe 0x40883f
mov ecx, edi
call fcn.004090a8
mov eax, dword [edi + 0x56c]
mov eax, dword [eax + 0x18]
jmp 0x408898
cmp byte [0x4f5e82], 2
jb 0x408896
cmp byte [edi + 0xc8d], 2
jne 0x408896
mov eax, dword [edi + 0x14]
push 0x4c5b20
call fcn.0040a18e
pop ecx
push eax
lea eax, [edi + 0x404]
push eax
add edi, 0x504
push edi
push str.Host__s___s__offered__s
mov esi, 0x4c5820
push esi
call fcn.0040d69e
add esp, 0x14
push 2
push esi
call fcn.0040bdf3
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4090a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c002c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0xf4]
cmp byte [eax], 0xff
push edi
je 0x4090ed
mov ecx, dword [esi + 0x568]
cmp eax, ecx
jae 0x4090ed
cmp byte [eax], 0x35
je 0x4090e9
movzx edx, byte [eax + 1]
lea eax, [eax + edx + 2]
cmp byte [eax], 0xff
jne 0x4090d1
jmp 0x4090ed
mov byte [eax + 2], 8
cmp byte [esi + 0xbc1], 0
jne 0x409116
lea edi, [ebp - 0x110]
mov byte [ebp - 0x110], 0x35
mov byte [ebp - 0x10f], 1
mov byte [ebp - 0x10e], 8
call fcn.00408dad
lea edi, [esi + 0x404]
cmp byte [edi], 0
je 0x40915d
cmp byte [esi + 0xb98], 0
jne 0x40915d
push edi
mov byte [ebp - 0x110], 0xc
call fcn.004863d4
mov byte [ebp - 0x10f], al
movzx eax, al
pop ecx
push eax
lea eax, [ebp - 0x10e]
push edi
push eax
call fcn.00486306
add esp, 0xc
lea edi, [ebp - 0x110]
call fcn.00408dad
mov edi, dword [0x496520]
lea eax, [esi + 0x568]
mov ecx, dword [eax]
mov byte [ecx], 0xff
inc dword [eax]
mov eax, dword [eax]
sub eax, esi
sub eax, 4
lea ebx, [esi + 4]
mov dword [esi + 0x54c], eax
mov byte [ebx], 1
call edi
and dword [eax], 0
push 0x10
push 0x4c6f00
push 0
push dword [esi + 0x54c]
push ebx
push dword [0x4cded8]
call dword [0x496968]
mov dword [esi + 0x54c], eax
call edi
mov ebx, eax
call dword [0x4969c0]
mov dword [ebx], eax
call edi
xor ecx, ecx
cmp dword [eax], ecx
jne 0x409227
cmp dword [esi + 0x54c], ecx
jle 0x409227
cmp byte [0x4f5e82], 2
jb 0x409222
cmp byte [0x4f5e85], 1
lea edi, [esi + 0x56c]
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
push 0x4c5b20
jne 0x4091fa
call fcn.0040a18e
pop ecx
push eax
mov eax, dword [edi]
push dword [eax]
push str.DHCP_Update_for_host__s___s__sent_to_Secondary_Server
jmp 0x40920a
call fcn.0040a18e
pop ecx
push eax
mov eax, dword [edi]
push dword [eax]
push str.DHCP_Update_for_host__s___s__sent_to_Primary_Server
mov edi, 0x4c5820
push edi
call fcn.0040d69e
add esp, 0x10
push 2
push edi
call fcn.0040bdf3
pop ecx
pop ecx
mov eax, dword [esi + 0x14]
jmp 0x409273
cmp byte [0x4f5e82], 1
mov dword [0x4f5e70], ecx
mov dword [0x4f5e74], ecx
jb 0x409271
cmp byte [0x4f5e85], 1
jne 0x409250
call edi
push dword [eax]
push str.WSAError__u_Sending_DHCP_Update_to_Secondary_Server
jmp 0x409259
call edi
push dword [eax]
push str.WSAError__u_Sending_DHCP_Update_to_Primary_Server
mov edi, 0x4c5820
push edi
call fcn.0040d69e
add esp, 0xc
push 1
push edi
call fcn.0040bdf3
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004862e5
leave
ret
Function at 0x40a9ce
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x14]
push ecx
xor edi, edi
push edi
push edi
lea ecx, [ebp - 0x120]
lea eax, [ebx + 1]
push ecx
push eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], edi
call dword [0x4969a4]
test eax, eax
je 0x40ab18
mov esi, dword [0x496520]
call esi
push edi
push 2
push dword [ebp + 8]
mov dword [eax], edi
push ebx
mov ebx, dword [0x496988]
call ebx
movzx eax, ax
mov dword [ebp - 8], eax
call esi
mov dword [ebp - 4], eax
call dword [0x4969c0]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call esi
cmp dword [eax], edi
jne 0x40ab18
push 2
pop eax
cmp word [ebp - 8], ax
jne 0x40ab18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
movzx eax, word [eax]
push eax
call dword [0x4969cc]
add ax, 2
movzx eax, ax
cmp ax, 0x800
mov dword [ebp - 4], eax
ja 0x40ab18
cmp ax, 2
jbe 0x40ab12
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push edi
push edi
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x11c], eax
push ecx
inc eax
push eax
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], edi
call dword [0x4969a4]
test eax, eax
je 0x40ab18
call esi
movzx ecx, word [ebp - 4]
mov dword [eax], edi
movzx eax, word [ebp - 0xc]
push edi
sub ecx, eax
push ecx
mov ecx, dword [ebp + 8]
add eax, ecx
push eax
push dword [ebp + 0xc]
call ebx
movzx eax, ax
mov dword [ebp - 8], eax
call esi
mov dword [ebp - 0x18], eax
call dword [0x4969c0]
cmp word [ebp - 8], di
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
jle 0x40ab18
call esi
cmp dword [eax], edi
jne 0x40ab18
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
cmp ax, word [ebp - 4]
mov dword [ebp - 0xc], eax
jb 0x40aa8c
mov ax, word [ebp - 0xc]
jmp 0x40ab1b
xor ax, ax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bdb4
Capabilities:
Create thread

Disassembly:
push esi
mov esi, 0x4c5820
push esi
push 0x49c4bc
call dword [0x496550]
cmp byte [0x4f5e83], 1
pop ecx
pop ecx
jae 0x40bdda
cmp byte [0x4f5e82], 1
jb 0x40bdf1
push esi
call fcn.0040a9a1
push eax
push 0
push 0x40bc2e
call dword [0x496528]
add esp, 0x10
pop esi
ret

Function at 0x40da6b
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 8
mov eax, 0x490ece
call fcn.004869c2
xor esi, esi
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [0x496b28]
cmp eax, esi
jge 0x40daac
cmp eax, 0x80010119
je 0x40daac
push eax
push str.KWMIResetIP::Init_CoInitializeSecurity:_d
mov esi, 0x4f73fc
call fcn.0043eb4e
pop ecx
pop ecx
jmp 0x40db53
mov ebx, dword [ebp + 8]
lea edi, [ebx + 4]
push edi
push 0x496f20
push 1
push esi
push 0x496ff0
call dword [0x496b2c]
cmp eax, esi
jge 0x40dad2
push eax
push str.KWMIResetIP::Init_CoCreateInstance:_d
jmp 0x40da9b
mov eax, dword [edi]
push str.ROOTCIMV2
lea edi, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.0040230a
mov dword [ebp - 4], esi
mov eax, dword [eax]
cmp eax, esi
je 0x40daf1
mov eax, dword [eax]
jmp 0x40daf3
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
add ebx, 8
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push ecx
call dword [edx + 0xc]
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.0040235a
cmp dword [ebp - 0x10], esi
jge 0x40db28
push dword [ebp - 0x10]
push str.KWMIResetIP::Init_ConnectServer:_d
jmp 0x40da9b
mov ebx, dword [ebx]
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push ebx
call dword [0x496b24]
cmp eax, esi
jge 0x40db4a
push eax
push str.KWMIResetIP::Init_CoSetProxyBlanket:_d
jmp 0x40da9b
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00486a9a
ret 4
Function at 0x40de7b
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push 0x2c
mov eax, 0x490e40
call fcn.004869c2
mov esi, ecx
mov eax, dword [0x4c4f6c]
mov edi, 0x4c4f6c
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 0x24], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
movzx eax, byte [esi + 0xf]
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, word [esi + 6]
push eax
movzx eax, word [esi + 4]
push eax
push dword [esi]
lea eax, [ebp - 0x1c]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00401cd2
mov eax, dword [0x4c4f6c]
add esp, 0x34
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push str.SELECT__FROM_Win32_NetworkAdapterConfiguration_WHERE_SettingID____s_
push eax
call fcn.00401cd2
add esp, 0xc
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
push dword [ebp - 0x18]
mov esi, dword [eax + 8]
lea edi, [ebp + 8]
call fcn.0040230a
mov byte [ebp - 4], 4
mov eax, dword [eax]
cmp eax, ebx
je 0x40df3c
mov eax, dword [eax]
jmp 0x40df3e
xor eax, eax
mov ecx, dword [esi]
lea edx, [ebp - 0x14]
push edx
push ebx
push 0x30
push eax
push 0x49cbb0
push esi
call dword [ecx + 0x50]
lea edi, [ebp + 8]
mov esi, eax
mov byte [ebp - 4], 3
call fcn.0040235a
cmp esi, ebx
jge 0x40df6b
push esi
push str.KWMIResetIP::GetObjectPath:_ExecQuery_Error:_d
jmp 0x40dfc5
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
xor esi, esi
inc esi
push esi
push 0xffffffffffffffff
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jl 0x40dfbf
cmp dword [ebp - 0x20], esi
jne 0x40dfbf
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp - 0x38]
push edx
push ebx
push str.__RELPATH
push eax
call dword [ecx + 0x10]
cmp eax, ebx
jge 0x40dfaf
push eax
push str.KWMIResetIP::GetObjectPath:_Get___RELPATH_Error:_d
jmp 0x40dfc5
push dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
call fcn.0040d944
mov dword [ebp - 0x24], esi
jmp 0x40dfd1
push eax
push str.KWMIResetIP::GetObjectPath:_Next_Error:_d
mov esi, 0x4f73fc
call fcn.0043eb4e
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x40dfe2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x40dff3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401a1d
mov eax, dword [ebp - 0x24]
call fcn.00486a9a
ret 8
Function at 0x40e143
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [0x496204]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov ebp, 0x80004005
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x40e191
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x40e191
cmp dword [esi], ebx
jne 0x40e191
lea eax, [esi + 4]
push eax
push ebx
push esi
push 0x40e217
push ebx
push ebx
call dword [0x4964e8]
add esp, 0x18
cmp eax, ebx
mov dword [esi], eax
je 0x40e191
xor ebp, ebp
pop edi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x40f2cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 8], edi
je 0x40f389
cmp dword [ebp + 0xc], edi
je 0x40f389
push esi
mov esi, dword [0x496030]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x200
push eax
call esi
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xc], ecx
jne 0x40f388
cmp eax, edi
jne 0x40f324
mov word [ebx + 0x1fe], di
mov dword [ebp - 8], ecx
jmp 0x40f388
mov eax, dword [ebp - 4]
add eax, 2
push eax
call dword [0x496680]
mov edi, eax
test edi, edi
pop ecx
je 0x40f388
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax + 4]
call esi
test eax, eax
jne 0x40f380
mov eax, dword [ebp - 4]
push 0xff
push edi
shr eax, 1
and word [edi + eax*2], 0
push 0x100
push ebx
call dword [0x4964d8]
add esp, 0x10
and word [ebx + 0x1fe], 0
mov dword [ebp - 8], 1
push edi
call dword [0x49668c]
pop ecx
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret 8

Function at 0x410e62
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [0x496030]
test eax, eax
jne 0x410ec5
cmp dword [ebp + 0xc], 1
je 0x410e9e
cmp dword [ebp + 0xc], 2
je 0x410e9e
push 0xd
pop eax
jmp 0x410ec5
test edi, edi
mov eax, dword [ebp - 4]
je 0x410ebf
test eax, eax
je 0x410ebb
test al, 1
jne 0x410e99
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x410ebf
jmp 0x410e99
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x411506
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x411595
push edi
mov edi, dword [0x496030]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x41153d
cmp dword [ebp - 8], 2
jne 0x411594
push esi
mov esi, dword [ebp + 0xc]
call fcn.00401e31
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00401a56
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x41157b
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x41158c
push eax
call dword [0x496688]
pop ecx
mov edx, esi
call fcn.00401a35
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x41191a
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x48ee79
call fcn.00486a2b
or eax, 0xffffffff
test edi, edi
mov esi, eax
je 0x4119f7
lea ecx, [ebp - 0x64]
call dword [0x496390]
and dword [ebp - 4], 0
lea eax, [ebp - 0x64]
push eax
call fcn.00411790
test eax, eax
pop ecx
je 0x4119e8
mov esi, 0x49d18c
push esi
lea ecx, [ebp - 0x2c]
call dword [0x496374]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call dword [0x496394]
push esi
lea ecx, [ebp - 0x2c]
call dword [0x49639c]
push 0x49d190
lea ecx, [ebp - 0x48]
call dword [0x496374]
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call dword [0x49639c]
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x4119a4
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4119b0
lea eax, [ebp - 0x28]
push 1
push 0
push ecx
push eax
push 0x49d1a4
push 0
call dword [0x496728]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov byte [ebp - 4], 1
dec ecx
mov esi, ecx
lea ecx, [ebp - 0x48]
call dword [0x496378]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x496378]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call dword [0x496378]
mov eax, esi
call fcn.00486aae
ret