joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f6e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7463
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x672014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x43f71d
mov eax, dword [esi]
jmp 0x43f71f
mov eax, esi
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x43f865
push ebx
call fcn.005c1d53
mov edi, eax
add esp, 4
test edi, edi
je 0x43f865
cmp dword [esi + 0x14], 8
jb 0x43f74f
mov esi, dword [esi]
push edi
push ebx
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x43f85c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x638e20
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x43f85c
sub esp, 8
lea ecx, [ebp - 0xe8]
call fcn.00415530
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
lea ecx, [ebp - 0xd8]
push eax
call fcn.00434f40
mov edx, 0x636f74
mov ecx, eax
call fcn.00411a20
mov ecx, eax
call fcn.00434f40
mov edx, 0x636f74
mov ecx, eax
call fcn.00411a20
mov ecx, eax
call fcn.00434f40
mov edx, 0x636f74
mov ecx, eax
call fcn.00411a20
mov ecx, eax
call fcn.00434f40
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004153f0
mov ecx, dword [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.0040a8e5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00407420
push edi
call fcn.005bf75a
add esp, 4
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 2
call fcn.00415410
mov byte [ebp - 4], 3
mov dword [ebp - 0x80], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x80], vtable.std::ios_base.0
call fcn.005b72e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x43f867
push edi
call fcn.005bf75a
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret
Function at 0x43f890
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e74a6
mov eax, dword fs:[0]
push eax
mov eax, 0x179c
call fcn.005b5ca0
mov eax, dword [0x672014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor bl, bl
mov dword [ebp - 0x17a4], 0
mov dword [ebp - 0x17a0], 0
mov dword [ebp - 0x179c], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x1798]
mov dword [ebp - 4], 0
call fcn.00407456
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x1798]
mov byte [ebp - 4], 1
call fcn.0041e230
cmp dword [ebp - 0x1784], 8
lea eax, [ebp - 0x1798]
push 0x20019
cmovae eax, dword [ebp - 0x1798]
lea ecx, [ebp - 0x17a4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00435b20
test eax, eax
jne 0x43f9b0
lea eax, [ebp - 0x17a8]
mov dword [ebp - 0x17a8], 0x3e8
push eax
lea eax, [ebp - 0x7e0]
push eax
push 0x633b54
lea ecx, [ebp - 0x17a4]
call fcn.00435c20
test eax, eax
jne 0x43f9b0
push 0x7d0
lea eax, [ebp - 0x1780]
push eax
lea eax, [ebp - 0x7e0]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x1780]
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x43f990
sub edx, esi
lea eax, [ebp - 0x1780]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.004075f5
mov bl, 1
lea ecx, [ebp - 0x1798]
mov byte [ebp - 4], 0
call fcn.00407420
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x17a4]
test ecx, ecx
je 0x43f9e1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x17a4], 0
mov al, bl
mov dword [ebp - 0x17a0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret
Function at 0x441570
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x672014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push eax
push dword [ebx]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x4415ba
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret 8
push edi
push esi
call fcn.005c1d53
mov edi, eax
add esp, 4
test edi, edi
je 0x44168d
push edi
push esi
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x441684
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0
push eax
push 0x639d4c
push edi
call esi
mov ecx, dword [ebp - 0x208]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x204]
push str.StringFileInfo_04x_04xProductName
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call esi
test eax, eax
je 0x441684
cmp dword [ebp - 0x20c], 0
jbe 0x441684
push dword [ebp - 0x208]
mov ecx, dword [ebp - 0x214]
call fcn.0040d560
push edi
call fcn.005bf75a
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret 8
push edi
call fcn.005bf75a
add esp, 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b5208
mov esp, ebp
pop ebp
ret 8
Function at 0x4429b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edx
mov ebx, ecx
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x4429d4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.005c1d53
mov esi, eax
add esp, 4
test esi, esi
je 0x442a55
push esi
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x442a4c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x638e20
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x442a4c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push esi
mov ax, word [edx + 0xa]
mov word [ecx], ax
movzx ecx, word [edx + 8]
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0xc]
movzx ecx, word [edx + 0xe]
mov word [eax], cx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 0xc]
mov word [eax], cx
call fcn.005bf75a
add esp, 4
mov eax, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.005bf75a
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c110
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8478
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x672014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
mov esi, dword [ebp + 8]
jne 0x44c14e
xor al, al
jmp 0x44c2ee
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
xor bl, bl
push str.SELECT__FROM_Win32_CDROMDrive
mov byte [ebp - 0x2d], bl
call fcn.0044d690
test al, al
je 0x44c2ec
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push edx
push 1
mov dword [ebp - 0x4c], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x44c29a
lea ecx, [ebp - 0x64]
call fcn.00426d60
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
push str.Name
push dword [ebp - 0x34]
call fcn.0044d060
test al, al
je 0x44c208
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0044f180
mov byte [ebp - 4], 3
mov eax, dword [eax]
test eax, eax
je 0x44c1e0
mov eax, dword [eax]
jmp 0x44c1e2
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407456
push eax
lea ecx, [ebp - 0x64]
call fcn.00446430
lea ecx, [ebp - 0x2c]
call fcn.00407420
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.0044f010
lea eax, [ebp - 0x48]
push eax
push str.PNPDeviceID
push dword [ebp - 0x34]
call fcn.0044d060
test al, al
je 0x44c229
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x58]
call fcn.0044e3b0
lea eax, [ebp - 0x48]
push eax
push str.Drive
push dword [ebp - 0x34]
call fcn.0044d060
test al, al
je 0x44c24a
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x54]
call fcn.0044e3b0
lea eax, [ebp - 0x48]
push eax
push str.MediaType
push dword [ebp - 0x34]
call fcn.0044d060
test al, al
je 0x44c26b
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0044e3b0
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.0044e480
mov eax, dword [ebp - 0x34]
mov bl, 1
push eax
mov byte [ebp - 0x2d], bl
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.00427020
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x44c2ec
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret 4
Function at 0x44cd20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e85f0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x672014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
jne 0x44cd67
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
xor bl, bl
push str.SELECT__FROM_Win32_SoundDevice
mov byte [ebp - 0x15], bl
call fcn.0044d690
test al, al
je 0x44ce40
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push edx
push 1
mov dword [ebp - 0x24], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x44ce2c
lea ecx, [ebp - 0x50]
call fcn.0042f690
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
push str.Name
push dword [ebp - 0x1c]
mov bl, 1
mov byte [ebp - 0x15], bl
call fcn.0044d060
test al, al
je 0x44cdec
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
call fcn.0044e3b0
lea eax, [ebp - 0x34]
push eax
push str.DeviceID
push dword [ebp - 0x1c]
call fcn.0044d060
test al, al
je 0x44ce0d
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044e3b0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.0042f2c0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x44ce40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44ce60
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e861b
mov eax, dword fs:[0]
push eax
sub esp, 0x344
mov eax, dword [0x672014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
mov edi, dword [ebp + 8]
jne 0x44cea1
xor al, al
jmp 0x44d033
lea eax, [ebp - 0x33c]
mov dword [ebp - 4], 0
push eax
xor bl, bl
mov dword [ebp - 0x33c], 0
push str.SELECT__FROM_Win32_BaseBoard
mov byte [ebp - 0x335], bl
call fcn.0044d690
test al, al
je 0x44d031
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x340]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x340], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x44cfd9
xor esi, esi
nop dword [eax + eax]
cmp esi, dword [ebp - 0x340]
jae 0x44cfd9
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 1
push eax
push str.Manufacturer
push dword [ebp + esi*4 - 0x334]
call fcn.0044d060
test al, al
je 0x44cf5f
lea eax, [ebp - 0x350]
mov ecx, edi
push eax
call fcn.0044e3b0
mov bl, 1
mov byte [ebp - 0x335], bl
lea eax, [ebp - 0x350]
push eax
push str.Product
push dword [ebp + esi*4 - 0x334]
call fcn.0044d060
test al, al
je 0x44cf8a
lea eax, [ebp - 0x350]
push eax
lea ecx, [edi + 4]
call fcn.0044e3b0
lea eax, [ebp - 0x350]
push eax
push str.Version
push dword [ebp + esi*4 - 0x334]
call fcn.0044d060
test al, al
je 0x44cfb5
lea eax, [ebp - 0x350]
push eax
lea ecx, [edi + 8]
call fcn.0044e3b0
mov eax, dword [ebp + esi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
jmp 0x44cf10
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x44d031
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b5208
mov esp, ebp
pop ebp
ret 4
Function at 0x44e480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8860
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x672014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 1
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
je 0x44e50f
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 4]
mov dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
call fcn.0044eb10
add esp, 4
mov dword [ebp - 4], 0x15
mov dword [ebp - 4], 0xffffffff
add dword [esi + 4], 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0x18
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xffffffff
cmp ebx, 0xccccccc
jne 0x44e543
call fcn.004089d0
lea edi, [ebx + 1]
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0x25
mov ecx, dword [esi + 8]
sub ecx, dword [esi]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [ebp - 4], 0xffffffff
mov edx, ecx
shr edx, 1
mov eax, 0xccccccc
sub eax, edx
cmp ecx, eax
ja 0x44e587
lea edi, [edx + ecx]
lea eax, [ebx + 1]
cmp edi, eax
cmovb edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
push edi
call fcn.0044ea30
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0x35
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x34
push dword [ebp + 8]
lea eax, [ebx + ebx*4]
lea edx, [ecx + eax*4]
call fcn.0044eb10
add esp, 4
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3c
mov byte [ebp - 4], 0x34
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x34
mov byte [ebp + 8], 0
push ecx
mov dword [ebp - 0x28], esp
push dword [ebp + 8]
push ecx
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.0044ebb0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
push edi
push dword [ebp - 0x20]
push ebx
mov ecx, esi
call fcn.0044e870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44e670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e88a2
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x672014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 1
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
je 0x44e711
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0x10
test ecx, ecx
je 0x44e6eb
mov byte [ebp - 4], 0x10
push dword [ebp + 8]
call fcn.0044ed60
mov dword [ebp - 4], 0x18
mov dword [ebp - 4], 0xffffffff
add dword [edi + 4], 0x40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0x1b
mov esi, dword [edi + 4]
sub esi, dword [edi]
sar esi, 6
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0xffffffff
cmp esi, 0x3ffffff
jne 0x44e737
call fcn.004089d0
lea ebx, [esi + 1]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0x28
mov ecx, dword [edi + 8]
sub ecx, dword [edi]
sar ecx, 6
mov dword [ebp - 4], 0xffffffff
mov edx, ecx
shr edx, 1
mov eax, 0x3ffffff
sub eax, edx
cmp ecx, eax
ja 0x44e76c
lea ebx, [edx + ecx]
cmp ebx, dword [ebp - 0x1c]
cmovb ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
push ebx
call fcn.0044eaa0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0x38
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x37
shl esi, 6
add esi, eax
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3c
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 0x3d
je 0x44e7c8
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x3d
push dword [ebp + 8]
mov ecx, esi
call fcn.0044ed60
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0x37
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x43
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x37
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0x45
mov byte [ebp - 4], 0x37
mov byte [ebp + 8], 0
push ecx
mov dword [ebp - 0x2c], esp
push dword [ebp + 8]
push ecx
push eax
call fcn.0044eca0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
mov ecx, edi
call fcn.0044e960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44ed60
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e89ee
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x672014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.004460d0
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 8]
call fcn.004460d0
lea eax, [esi + 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x10]
call fcn.004460d0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x18]
call fcn.004460d0
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], vtable.srl::Exists.0
movzx eax, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov dword [edi + 0x30], vtable.srl::Exists.0
movzx eax, byte [esi + 0x34]
mov byte [edi + 0x34], al
mov dword [edi + 0x38], vtable.srl::Exists.0
movzx eax, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x452030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8f10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x672014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x452073
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x452170
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push esi
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x452167
mov eax, dword [ebp - 0x10]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046f3d6
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0
push esi
push dword [ebp - 0x14]
call edi
cmp dword [ebp - 0x1c], 3
jne 0x45213e
mov esi, dword [ebp - 0x10]
mov edi, ebx
nop dword [eax]
lea eax, [esi - 1]
xor edx, edx
mov bl, 1
test eax, eax
jle 0x45213c
lea eax, [edi + 2]
nop
cmp word [eax - 2], 0
jne 0x45212d
movzx ecx, word [eax]
test cx, cx
je 0x45212d
mov word [eax - 2], cx
xor ecx, ecx
mov word [eax], cx
xor bl, bl
mov esi, dword [ebp - 0x10]
inc edx
lea ecx, [esi - 1]
add eax, 2
cmp edx, ecx
jl 0x452110
test bl, bl
je 0x452100
mov ebx, edi
mov edx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x452143
mov ecx, dword [ebp + 0xc]
sub edx, esi
sar edx, 1
push edx
push ebx
call fcn.004075f5
push ebx
call fcn.0046f3d1
add esp, 4
mov bl, 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452190
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x10]
xor bl, bl
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov dword [esi], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x452226
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0
push str.Update_Signature
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45221d
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
inc eax
push eax
call fcn.0046f3d6
add esp, 4
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
push str.Update_Signature
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 3
jne 0x45221d
mov dword [esi], edi
mov bl, 1
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret