joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4976be
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
mov word [ebp - 0x210], si
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x515950
push edi
mov ecx, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.0049706b
test eax, eax
jne 0x497714
push 0x515940
mov ecx, ebx
call fcn.0049706b
test eax, eax
jne 0x497714
mov dword [ebp - 4], 1
push 0x515928
mov ecx, ebx
call fcn.0049706b
test eax, eax
jne 0x49773b
push 0x515910
mov ecx, ebx
call fcn.0049706b
test eax, eax
jne 0x49773b
mov dword [ebp - 4], 1
cmp dword [ebp - 4], esi
je 0x4977ff
push edi
mov ecx, ebx
call fcn.004975ad
lea eax, [ebx + 4]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.geturl.htm
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 8], 0x22
call ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
mov edi, reloc.BugReportU.dll_Ordinal_1
push edi
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Contexts
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push edi
call esi
push str.getallurl.htm
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 8], 0xf3
call ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
mov ebx, 0x5157f0
push ebx
push edi
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Contexts
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x497804
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
call fcn.004971b6
mov ecx, esi
call fcn.0049727d
mov ecx, esi
call fcn.00497355
mov ecx, esi
call fcn.00497416
mov ecx, esi
pop esi
jmp fcn.004976be

Function at 0x4979ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
shl eax, 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x497a09
cmp dword [ebp + 0x10], 1
je 0x4979e7
cmp dword [ebp + 0x10], 2
jne 0x4979fe
test edi, edi
mov eax, dword [ebp - 4]
je 0x497a03
test al, 1
jne 0x4979fe
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x497a03
push 0xd
pop eax
jmp 0x497a09
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x498921
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
push edi
mov byte [ebp - 1], 1
jne 0x498975
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4989d1
shr eax, 2
test al, 1
je 0x49899e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
jmp 0x49896c
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x4989d0
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret

Function at 0x49d340
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
push edi
push esi
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x49d3b4
mov ecx, dword [esp + 8]
test ecx, ecx
jbe 0x49d3af
cmp ecx, 2
jbe 0x49d39e
cmp ecx, 7
jne 0x49d3af
mov ecx, dword [edi]
test cl, 1
jne 0x49d3af
shr ecx, 1
cmp ecx, 2
jb 0x49d3af
cmp word [esi + ecx*2 - 2], 0
jne 0x49d3af
cmp word [esi + ecx*2 - 4], 0
jmp 0x49d3ad
mov ecx, dword [edi]
test cl, 1
jne 0x49d3af
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x49d3b4
mov eax, 0xd
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x49d3c0
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0x5107b8
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CGopherFileFind::FindNextFileW]
cmp eax, 0xffffffff
jne 0x49d44c
push 0
push 0x3a
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CWnd::FilterToolTipMessage]
cmp eax, 1
jne 0x49d44c
push 0
push 0x5107b0
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Find]
cmp eax, 0xffffffff
jne 0x49d411
push 0
push 0x5107a8
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Find]
cmp eax, 0xffffffff
je 0x49d44c
add eax, 2
push eax
lea eax, [esp + 8]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_CToolBar::Layout]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x49d451
cmp eax, 2
je 0x49d451
cmp eax, 6
je 0x49d451
lea ecx, [esp + 4]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 4]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x49d470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f5c84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [esp + 8], 0
mov eax, dword [esp + 0x20]
cdq
mov ecx, 0xe10
idiv ecx
push ebx
push esi
mov ecx, 0x3c
push edi
push 0x4feb50
mov esi, eax
mov eax, edx
cdq
idiv ecx
lea ecx, [esp + 0x30]
mov ebx, edx
mov edi, eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
push 0x5161e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
push 0x5161d0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
push 0x5161c8
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
test esi, esi
push ebx
jle 0x49d538
push edi
push esi
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0x14
jmp 0x49d571
test edi, edi
jle 0x49d558
push edi
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0x10
jmp 0x49d571
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0xc
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_7]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x49d710
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f5c9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
cmp esi, ebx
mov word [esp + 0x20], bx
mov ecx, 0x81
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
mov dword [esp + 0x234], ebx
stosw word es:[edi], ax
jne 0x49d777
push 0x104
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea esi, [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x49d807
push eax
call sub.MFC71U.DLL_SerializeElements
mov edx, dword [esp + 0x14]
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x18]
push ebx
push edx
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49d7fe
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x503d24
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49d7fe
mov esi, dword [esp + 0x1c]
mov edi, dword [ebp + 0xc]
mov ecx, 0xd
push ebx
rep movsd dword es:[edi], dword [esi]
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, 1
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call sub.MFC71U.DLL_operator_new
add esp, 4
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49da40
Capabilities:
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f5ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x818
push ebx
push esi
push edi
xor eax, eax
mov word [esp + 0x20], 0
mov ecx, 0x1ff
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.http_shellopencommand
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
jne 0x49db83
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0x4feb50
push eax
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x14]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x49db83
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
push 0x22
lea ecx, [esp + 0x14]
mov dword [esp + 0x830], edi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Trim]
push edi
push 0x22
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_CWnd::FilterToolTipMessage]
cmp eax, 0xffffffff
je 0x49db40
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71U.DLL_CToolBar::Layout]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], 1
call dword [0x4fc954]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 1
push 0
push esi
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push str.open
push 0
call ebx
cmp eax, 0x20
lea ecx, [esp + 0x10]
jle 0x49db7d
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
xor eax, eax
push eax
mov ecx, 0x200
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
push 0x26
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x49dbd1
push 0x40
lea edx, [esp + 0x24]
push str.Internet_Exploreriexplore.exe
push edx
call dword [sym.imp.MSVCR71.dll_wcsncat]
add esp, 0xc
push 1
push 0
push esi
lea eax, [esp + 0x2c]
push eax
push str.open
push 0
call ebx
mov ecx, dword [esp + 0x824]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dc80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
push edi
xor eax, eax
mov word [esp + 0x40], 0
mov ecx, 0xa1
lea edi, [esp + 0x42]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x44]
push str._n__select___s_
push ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
add esp, 0xc
lea eax, [esp + 4]
lea edx, [esp + 0x40]
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x400
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], str.explorer
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x49dd10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x44]
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x400
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
add esp, 0x3c
ret

Function at 0x49df30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4f5d32
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 4]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
push 0x5c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call dword [sym.imp.MFC71U.DLL_COleMessageFilter::XMessageFilter::RetryRejectedCall]
push eax
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_CToolBar::Layout]
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call dword [0x4fc954]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49dfcb
test al, 0x10
je 0x49dfcb
lea ecx, [esp]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 8]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x49e070
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4f5d49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::TrimLeft_2]
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::TrimLeft_2]
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71U.DLL_CGopherFileFind::IsDots]
test al, al
lea ecx, [esp + 0x28]
jne 0x49e134
push 0
call dword [sym.imp.MFC71U.DLL_CRecordset::GetBoundParamIndex]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
test eax, eax
je 0x49e130
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x34]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49e130
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [esp + 0x30]
test eax, eax
je 0x49e112
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x49e4d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f5d89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [esp + 4], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0xc]
mov dword [esp + 4], eax
push edx
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 0x16]
movzx eax, word [esp + 0x14]
push ecx
movzx ecx, word [esp + 0x16]
push edx
movzx edx, word [esp + 0x16]
push eax
movzx eax, word [esp + 0x18]
push ecx
push edx
push eax
lea ecx, [esp + 0x48]
push str._02d__02d__02d__02d:_02d:_02d
push ecx
mov dword [esp + 0x44], esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
mov esi, dword [esp + 0x4c]
add esp, 0x20
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_7]
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x49e720
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x49e792
push esi
lea edx, [esp + 0xc]
push edx
push str.SeShutdownPrivilege
push 0
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 4]
push 0
push 0
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
jne 0x49e798
xor eax, eax
add esp, 0x14
ret
push 0
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x49ead0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f5de8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
lea ecx, [esp + 0xc]
mov dword [esp + 0x13c], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_9]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
mov ecx, 0x47
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x140], 1
mov dword [esp + 0x14], 0x11c
call esi
test eax, eax
jne 0x49eb70
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x114
call esi
test eax, eax
jne 0x49eb70
mov esi, dword [ebp + 8]
push 0x4feb50
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
jmp 0x49ec9d
mov eax, dword [esp + 0x20]
sub eax, 0
je 0x49ec7e
dec eax
je 0x49ec2a
dec eax
jne 0x49ec8d
cmp dword [esp + 0x14], 4
ja 0x49eba1
push str.Microsoft_Windows_NT
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
mov eax, dword [esp + 0x14]
mov esi, 5
cmp eax, esi
jne 0x49ebe1
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x49ebcb
push str.Microsoft_Windows_2000
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
cmp dword [esp + 0x14], esi
jne 0x49ebe1
cmp dword [esp + 0x18], 1
jne 0x49ebf7
push str.Microsoft_Windows_XP
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
cmp dword [esp + 0x14], 6
jne 0x49ebf7
push str.Microsoft_Windows_Vista
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push str.__d._d._d_
push edx
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format_1]
add esp, 0x14
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
call dword [0x4fc454]
jmp 0x49ec8d
mov eax, dword [esp + 0x14]
mov esi, 4
cmp eax, esi
jne 0x49ec8d
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x49ec54
push str.Microsoft_Windows_95
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
cmp dword [esp + 0x14], esi
jne 0x49ec8d
cmp dword [esp + 0x18], 0xa
jne 0x49ec70
push str.Microsoft_Windows_98
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
cmp dword [esp + 0x14], esi
jne 0x49ec8d
cmp dword [esp + 0x18], 0x5a
jne 0x49ec8d
push str.Microsoft_Windows_Me
jmp 0x49ec83
push str.Microsoft_Win32s
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator_1]
mov esi, dword [ebp + 8]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_7]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x134]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret