joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494190
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x830], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x810]
push 0x800
push 0
push eax
call fcn.004b493e
add esp, 0xc
mov dword [ebp - 0x82c], 0x800
xor edi, edi
lea eax, [ebp - 0x82c]
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x830]
push edi
push dword [eax + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x494218
xor eax, eax
jmp 0x494332
test eax, eax
jne 0x49432d
xor eax, eax
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x494246
sub eax, edx
lea ecx, [ebp - 0x828]
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00410410
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0
cmp dword [esi + 8], eax
je 0x4942a2
movups xmm0, xmmword [ebp - 0x828]
xor ecx, ecx
mov word [ebp - 0x828], cx
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x818]
movq qword [eax + 0x10], xmm0
mov eax, 7
add dword [esi + 4], 0x18
jmp 0x4942b7
lea ecx, [ebp - 0x828]
push ecx
push eax
mov ecx, esi
call fcn.00417620
mov eax, dword [ebp - 0x814]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x4942f4
mov ecx, dword [ebp - 0x828]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4942ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49434f
push edx
push ecx
call fcn.004aebf7
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0x800
push eax
lea eax, [ebp - 0x810]
inc edi
push eax
mov eax, dword [ebp - 0x830]
push edi
push dword [eax + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x494220
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret 4
call dword [0x4c59b0]
int3
Function at 0x4a01e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
call fcn.004b493e
push 0x104
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0049fc50
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.004b493e
lea eax, [ebp - 0x210]
push 0x4dc61c
push eax
call dword [0x4c5ae4]
add esp, 0x2c
pop esi
test eax, eax
jne 0x4a0269
push str.FC_A389516E_D197_406a_AA5A_53311DDD900C
push 0x4d86e4
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00434600
add esp, 0x10
jmp 0x4a028e
lea eax, [ebp - 0x210]
push eax
push str.FC_A389516E_D197_406a_AA5A_53311DDD900C
push 0x4dc62c
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00434600
add esp, 0x14
lea eax, [ebp - 0x41c]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4a02c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 5
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
Function at 0x4a0520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x634], esi
test ebx, ebx
jne 0x4a0559
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret 4
lea eax, [esi + 0x10]
push edi
push eax
mov dword [ebp - 0x630], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0
push eax
push ebx
mov ecx, esi
call fcn.004a02e0
mov esi, dword [ebp - 0x62c]
mov edi, eax
test edi, edi
js 0x4a0597
test esi, esi
jne 0x4a06df
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004b493e
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.004b493e
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0049f970
lea eax, [ebp - 0x210]
push eax
call fcn.004a0cf0
add esp, 0x24
test eax, eax
je 0x4a05eb
mov edi, 0xfffffffe
jmp 0x4a070f
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.0049f9c0
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004b493e
lea eax, [ebp - 0x41c]
push eax
push str..pipeFC_4F5765F1_F320_4f2f_A7BE_EFED8CA81770
push 0x4dc62c
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.00434600
add esp, 0x2c
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x44
push 1
call dword [0x4c5964]
mov esi, eax
mov eax, dword [ebp - 0x634]
push 0
mov dword [ebp - 0x638], esi
mov dword [esi], eax
lea eax, [ebp - 0x628]
mov ecx, dword [ebx + 0x18]
mov dword [esi + 4], ecx
lea ecx, [esi + 8]
push eax
push ecx
call fcn.004a7f90
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4a06c3
push eax
push eax
push esi
push 0x4a08f0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x634]
add ecx, 4
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4a06ae
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x4a06d3
lea edx, [ebp - 0x638]
push edx
push eax
call fcn.0049fd20
mov esi, dword [ebp - 0x638]
jmp 0x4a06d3
push esi
call dword [0x4c5958]
mov esi, dword [ebp - 0x62c]
add esp, 4
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x4a070f
test esi, esi
je 0x4a070f
push dword [ebx + 0x14]
lea eax, [esi + 8]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
call fcn.004a82ce
mov edi, eax
add esp, 0x18
test edi, edi
jns 0x4a070f
mov dword [esi + 4], 0
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret 4
Function at 0x4a09a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4a09d2
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
cmp esi, 0xfffffffe
jne 0x4a0a03
push edi
push 0x4a03f0
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopsW]
neg eax
pop edi
sbb eax, eax
and eax, 2
add eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
push esi
call fcn.004a0cf0
add esp, 4
test eax, eax
je 0x4a0a25
pop edi
mov eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
push esi
call fcn.004a01e0
add esp, 4
test eax, eax
jne 0x4a0a47
pop edi
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004b493e
push esi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0049f9c0
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.004b493e
lea eax, [ebp - 0x210]
push eax
push str..pipeFC_4F5765F1_F320_4f2f_A7BE_EFED8CA81770
push 0x4dc62c
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00434600
push dword [edi + 0x10]
lea eax, [ebp - 0x41c]
push dword [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.004a8142
mov ecx, dword [ebp - 4]
add esp, 0x50
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
and eax, 0xfffffffc
pop esi
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret

Function at 0x4a0c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x4dc61c
push 0x5435e0
call dword [0x4c5ae4]
add esp, 8
test eax, eax
je 0x4a0c21
mov eax, 0xfffffff6
pop ebp
ret
call fcn.004a7f78
push eax
push str._sFortiTray.exe
push 0x104
push 0x543820
call fcn.00434600
add esp, 0x10
mov dword [0x543a30], 0
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x543a2c], eax
test eax, eax
jne 0x4a0c66
mov eax, 0xfffffffe
pop ebp
ret
push 0
push 0
push dword [ebp + 8]
push 0x4a0740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x543a34], eax
test eax, eax
jne 0x4a0ca2
push dword [0x543a2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x543a2c], 0
mov eax, 0xfffffffd
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4a13d0
Capabilities:
Create process on windows
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be49b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x294]
push 0x44
push 0
push eax
call fcn.004b493e
lea eax, [ebp - 0x23c]
xorps xmm0, xmm0
xor esi, esi
push eax
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x23c], esi
call fcn.004a7f00
xor eax, eax
mov dword [ebp - 0x238], esi
add esp, 0x10
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push 0x4f28a8
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x4a15b8
mov edx, dword [ebp - 0x238]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x240], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a1486
sub ecx, dword [ebp - 0x240]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x234]
call fcn.00410410
push dword [ebp - 0x238]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004b493e
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push edi
cmovae eax, dword [ebp - 0x234]
push eax
push str._scmd.exe__c___s_
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.0042da70
add esp, 0x24
mov dword [ebp - 0x294], 0x44
xor eax, eax
mov dword [ebp - 0x268], 1
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x294]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a15aa
cmp dword [ebp - 0x250], 0
je 0x4a15a5
push 0x210
call fcn.004aebc7
mov esi, eax
add esp, 4
test esi, esi
je 0x4a15a5
push 0x210
push 0
push esi
call fcn.004b493e
mov eax, dword [ebp - 0x250]
push 0xffffffffffffffff
push edi
mov dword [esi], eax
lea eax, [esi + 4]
push 0x104
push eax
call dword [0x4c5af0]
add esp, 0x1c
push 0
push 0
push esi
push 0x4a0e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4a15a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
push dword [ebp - 0x23c]
call fcn.004a7f06
add esp, 4
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x4a15fa
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a15f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a15f0
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
Function at 0x4a3550
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be8ab
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push 0
push esi
mov dword [ebp - 0x278], eax
call dword [0x4c593c]
add esp, 8
test eax, eax
jne 0x4a35f7
call fcn.004a7ec4
test eax, eax
je 0x4a35b2
lea eax, [ebp - 0x274]
push eax
call fcn.004a7f00
add esp, 4
lea eax, [ebp - 0x27c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
call fcn.004af950
mov edi, esp
test edi, edi
je 0x4a35f7
push edi
push ebx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4a35fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004a7ec4
test eax, eax
je 0x4a35f7
push dword [ebp - 0x274]
call fcn.004a7f06
add esp, 4
xor eax, eax
jmp 0x4a3790
xor eax, eax
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a36a6
mov edx, dword [ebp - 0x270]
xor eax, eax
mov esi, dword [ebp - 0x26c]
mov ecx, esi
shr edx, 2
test edx, edx
je 0x4a3664
mov ebx, 0x409
cmp word [ecx], bx
je 0x4a3664
inc eax
add ecx, 4
cmp eax, edx
jb 0x4a3657
cmp eax, edx
cmovae ecx, esi
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str._04x_04x
lea eax, [ebp - 0x50]
push 0x20
push eax
call fcn.00434600
lea ecx, [ebp - 0x50]
add esp, 0x14
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a3690
sub ecx, edx
lea eax, [ebp - 0x50]
sar ecx, 1
push ecx
push eax
jmp 0x4a36ad
push 8
push str.040904B0
lea ecx, [ebp - 0x268]
call fcn.00410410
cmp dword [ebp - 0x254], 8
lea eax, [ebp - 0x268]
cmovae eax, dword [ebp - 0x268]
push eax
push str.StringFileInfo_sProductName
lea eax, [ebp - 0x250]
push 0x100
push eax
call fcn.00434600
add esp, 0x10
xor eax, eax
mov word [ebp - 0x52], ax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a3732
mov esi, dword [ebp - 0x26c]
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a3716
mov ecx, dword [ebp - 0x278]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.00410410
call fcn.004a7ec4
test eax, eax
je 0x4a3749
push dword [ebp - 0x274]
call fcn.004a7f06
add esp, 4
mov edx, dword [ebp - 0x254]
cmp edx, 8
jb 0x4a378b
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a3781
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4a3781
call dword [0x4c59b0]
push edx
push ecx
call fcn.004aebf7
add esp, 8
mov eax, 1
lea esp, [ebp - 0x28c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
Function at 0x4a9990
Capabilities:
Create process on windows
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
call fcn.004a80ac
test eax, eax
jne 0x4a99be
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.00491e40
mov ebx, eax
call fcn.00491f60
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
cmp eax, 3
setne cl
test ebx, ebx
je 0x4a99e6
test ecx, ecx
jne 0x4a9aa1
push 0x3c
lea eax, [ebp - 0x498]
push 0
push eax
call fcn.004b493e
add esp, 0xc
lea eax, [ebp - 0x458]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x458]
mov dword [ebp - 0x498], 0x3c
push 0x42
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x48]
push 0
push eax
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x48c], str.runas
call fcn.004b493e
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._a__ul
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push 0x21
push eax
call fcn.0042da70
add esp, 0x14
mov dword [ebp - 0x480], edi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4a9a91
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x30
push 0x4d96d4
push str.You_need_administrative_privileges_to_start_FortiClient._n
push 0
call esi
push 0x31
push 0x4d96d4
push str.FIPS_error_mode_detected._nDo_you_want_to_restore_FortiClient_default_settings_and_continue_
push 0
call esi
cmp eax, 1
je 0x4a9ace
pop esi
mov edi, 0xffffff9c
pop ebx
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x4a9af5
push 0x30
push 0x4d96d4
push str.You_need_administrative_privileges_to_restore_FortiClient_default_settings._n
push ebx
call esi
pop esi
lea eax, [ebx - 0x65]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
call fcn.004a80ee
mov ebx, eax
call fcn.004b4cae
test eax, eax
je 0x4a9b7f
call fcn.004a80ac
test eax, eax
jne 0x4a9b7f
lea eax, [ebp - 0x45c]
push eax
push 2
push 0
push str.softwareFortinetFortiClientFA_CONFIGD
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a9b4a
push 0x4edcec
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.FCT_shutdown:_FIPS_error_mode_recovery._n
call fcn.004ae050
push str.FA_Scheduler
call fcn.004b4cba
add esp, 8
test ebx, ebx
je 0x4a9b94
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
push 0
push 0x4d96d4
push str.Restore_FortiClient_default_settings_failed._n
push 0
call esi
mov edi, 0xffffff9a
mov ecx, dword [ebp - 4]
mov eax, edi
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret
Function at 0x10029462
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 4], eax
jle 0x10029489
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x10095ea8]
mov esi, eax
ret

Function at 0x1002df30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x3c]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [edx], edi
jne 0x1002df6b
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx]
or eax, 0x1e
push edi
and eax, 0x87f3f
push eax
push edx
push edi
push ecx
call dword [ecx + 0x18]
add esp, 0x14
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x1002e04f
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x1002dfa5
mov eax, dword [ebx + 0x80]
push edi
cdq
push ecx
push edx
push eax
call fcn.10078c80
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], eax
jmp 0x1002dfa5
xor edi, edi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x1002e04f
mov edi, dword [esi + 0xc]
mov dword [ebp - 0xc], edi
cmp edi, dword [ebx + 0x18]
ja 0x1002e03f
test byte [esi + 0x14], 0x20
jne 0x1002e03f
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.10078c80
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp edi, 1
jne 0x1002dfe9
call fcn.1002d67e
push dword [ebp - 0x14]
mov eax, dword [esi]
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebx + 0x80]
push eax
mov eax, dword [ebx + 0x3c]
call fcn.10026275
add esp, 0x10
mov dword [ebp - 4], eax
cmp edi, 1
jne 0x1002e021
mov esi, dword [ebp - 8]
add esi, 0x18
lea edi, [ebx + 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
cmp edi, dword [ebx + 0x20]
jbe 0x1002e029
mov dword [ebx + 0x20], edi
mov eax, dword [ebp + 8]
push dword [esi]
mov eax, dword [eax + 0x58]
mov ebx, edi
call fcn.10037ff5
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
pop ecx
cmp dword [ebp - 4], 0
mov eax, dword [esi + 8]
mov dword [ebp + 0xc], eax
je 0x1002dfa3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10044a9a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x10044aac
xor eax, eax
jmp 0x10044b9b
push esi
mov esi, dword [ebp + 8]
push 0x50
call fcn.10027256
mov esi, eax
pop ecx
test esi, esi
je 0x10044b9a
push ebx
push dword [ebp + 0x10]
mov ebx, dword [edi]
push dword [ebp + 8]
call fcn.10044824
push dword [ebp + 0x10]
mov dword [esi], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.100448e7
push 0
push dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push eax
push dword [ebp + 8]
call fcn.100445d4
push dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x10]
call fcn.10044824
push 0
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push eax
push dword [ebp + 8]
call fcn.100445d4
push dword [ebp + 0x10]
mov dword [esi + 0x14], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x18]
call fcn.10044824
add esp, 0x44
push dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.10044a9a
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x28]
push eax
push dword [ebp + 8]
call fcn.100445d4
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
push eax
push dword [ebp + 8]
call fcn.100445d4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov ax, word [edi + 6]
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x3c], 0xffffffff
mov ecx, 0xfff7
and ax, cx
add esp, 0x2c
or dword [esi + 0x40], 0xffffffff
mov word [esi + 6], ax
mov dword [esi + 0x24], ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10046bad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10046cc5
test esi, esi
je 0x10046cc5
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
mov ebx, eax
cmp cx, bx
je 0x10046c69
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x10046c69
xor cl, dl
test cl, 0x10
jne 0x10046c69
mov al, byte [edi]
cmp al, byte [esi]
jne 0x10046c69
push dword [esi + 8]
push dword [edi + 8]
call fcn.10046bad
pop ecx
pop ecx
test eax, eax
jne 0x10046c69
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.10046bad
pop ecx
pop ecx
test eax, eax
jne 0x10046c69
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.10046cd4
test eax, eax
jne 0x10046c69
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x10046c69
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x10046c69
movzx eax, word [edi + 2]
mov ecx, eax
mov eax, 0x400
and ecx, eax
mov edx, eax
cmp cx, dx
jne 0x10046c6e
mov cx, word [esi + 2]
and cx, dx
cmp cx, ax
jne 0x10046c69
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x10046c98
push 2
pop eax
jmp 0x10046cd0
cmp byte [edi], 0x98
je 0x10046c98
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x10046c98
mov dx, word [esi + 2]
mov ebx, eax
and dx, bx
cmp dx, ax
je 0x10046c69
mov edx, dword [esi + 4]
test edx, edx
je 0x10046c69
call fcn.10028c1a
test eax, eax
jne 0x10046c69
movzx ecx, word [edi + 2]
mov dx, word [esi + 2]
mov eax, 0x100
and ecx, eax
and dx, ax
cmp cx, dx
je 0x10046cb4
xor eax, eax
inc eax
jmp 0x10046cd0
test cx, cx
je 0x10046cc1
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x10046c69
xor eax, eax
jmp 0x10046cd0
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
ret