joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x466274
cmp dword [esi + 4], 0
je 0x46626d
push eax
call fcn.005ab825
add esp, 4
mov dword [esi + 0x10], 0
push 0x633d84
push dword [ebp + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
call fcn.005b4897
mov edi, eax
add esp, 8
test edi, edi
jne 0x46629e
pop edi
pop esi
pop ebp
ret 4
push ebx
push 2
push 0
push edi
call fcn.005b4be1
push edi
call fcn.005b51da
push 0
push 0
push edi
mov ebx, eax
call fcn.005b4be1
add esp, 0x1c
test ebx, ebx
jle 0x4662de
push ebx
mov ecx, esi
call fcn.00466300
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4662de
push edi
push 1
push ebx
push eax
call fcn.005b53b1
add esp, 0x10
push edi
call fcn.005b54d7
add esp, 4
xor eax, eax
cmp dword [esi + 0x10], eax
setne al
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x466580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5096
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push dword [eax + 4]
call fcn.00466b30
mov eax, dword [ebx]
mov dword [eax + 4], eax
mov eax, dword [ebx]
mov dword [eax], eax
mov eax, dword [ebx]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], 0
test eax, eax
je 0x466640
push 0x633d84
push eax
call fcn.005b4897
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
test edi, edi
je 0x466640
push edi
call fcn.005b591f
add esp, 4
push eax
call fcn.005b5914
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
push edi
push 1
push 8
push eax
call fcn.005b53b1
add esp, 0x10
mov byte [ebp + 0xb], 0
cmp dword [ebp - 0x24], 0x78646972
jne 0x4666cf
cmp dword [ebp - 0x20], 0x8000
jb 0x466656
push edi
call fcn.005b54d7
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add esi, 0xfffffff8
push esi
call fcn.005b2e33
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4666cf
push edi
push 1
push esi
push ebx
call fcn.005b53b1
lea edx, [ebx + esi]
mov ecx, ebx
xor ebx, ebx
mov dword [ebp + 8], edx
add esp, 0x10
cmp dword [ebp - 0x20], ebx
jle 0x4666bd
mov edi, dword [ebp - 0x14]
nop word [eax + eax]
mov esi, dword [ecx + 0xc]
add esi, 0x12
add esi, ecx
cmp esi, edx
ja 0x4666ba
push dword [ecx + 8]
lea eax, [ecx + 0x10]
push dword [ecx + 4]
push dword [ecx]
mov ecx, edi
push eax
call fcn.004663c0
mov edx, dword [ebp + 8]
inc ebx
mov ecx, esi
cmp ebx, dword [ebp - 0x20]
jl 0x466690
mov edi, dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.005ab825
add esp, 4
cmp ebx, dword [ebp - 0x20]
sete byte [ebp + 0xb]
push edi
call fcn.005b54d7
mov al, byte [ebp + 0xb]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4680f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d51d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x67ace8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x67ace8
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x637326
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00468cb0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46c540
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5acb
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x6609c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], edx
mov ebx, ecx
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x46c647
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x46c647
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.005a3020
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x46c640
or edi, 0xffffffff
nop dword [eax]
mov edx, dword [ebp - 0x234]
lea ecx, [ebp - 0x240]
call fcn.0046c6a0
lea edx, [ebp - 0x240]
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.0046d210
test eax, eax
je 0x46c60a
mov edx, ebx
lea ecx, [ebp - 0x240]
call fcn.0046d210
test eax, eax
jne 0x46c665
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46c62e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x46c5d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589ffa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x244]
test ecx, ecx
je 0x46c677
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x46c699
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x46c649
Function at 0x46c6a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5b0b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x6609c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x21c], edi
mov ebx, ecx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x22c], 0
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x46c6fd
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x220], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005a3020
add esp, 0xc
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x46c788
push dword [ebp - 0x21c]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x46c788
add esi, 0xfffffff0
mov ecx, esi
call fcn.004072d0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46c883
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x46c883
lea eax, [ebp - 0x228]
mov dword [ebp - 0x21c], 0
push eax
push 4
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 0
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x46c7d3
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x46c819
mov eax, dword [0x67ad1c]
test eax, eax
jne 0x46c7f8
push str.QueryFullProcessImageNameW
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x67ad1c], eax
mov dword [ebp - 0x224], 0x104
test eax, eax
je 0x46c819
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46c830
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004073a0
mov esi, dword [ebp - 0x220]
add esi, 0xfffffff0
mov ecx, esi
call fcn.004072d0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46c883
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589ffa
mov esp, ebp
pop ebp
ret
Function at 0x46c8b0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6609c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x46c920
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00589ffa
mov esp, ebp
pop ebp
ret
Function at 0x46d310
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x46d33f
push 0x63c3f8
push eax
call fcn.005a1c1e
add esp, 8
test eax, eax
je 0x46d33f
sub eax, dword [esi]
sar eax, 1
cmp eax, 1
je 0x46d36a
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x46d3e3
push 0x63c3f0
push eax
call fcn.005a1c1e
add esp, 8
test eax, eax
je 0x46d3e3
sub eax, dword [esi]
sar eax, 1
cmp eax, 1
jne 0x46d3e3
xorps xmm0, xmm0
lea eax, [ebp - 4]
push 3
push eax
mov ecx, esi
movq qword [ebp - 0xc], xmm0
movq qword [ebp - 0x14], xmm0
call fcn.00446b20
push 0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 4]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x46d3b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x46d3e3
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x46d3c9
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
test edi, edi
je 0x46d3d8
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46e5c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax - 0xc], 0
jne 0x46e5d1
xor ebx, ebx
jmp 0x46e5ed
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
mov eax, dword [ebp + 8]
setg bl
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x46e605
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x46fe40
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
xor esi, esi
push esi
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46ffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x46ffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x470006
mov eax, dword [ebp - 4]
test eax, eax
je 0x470006
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push 1
push eax
mov dword [ebp - 0xc], esi
call edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46ffeb
push eax
call fcn.005b2e33
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46ffeb
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push 1
push dword [ebp - 4]
call edi
test eax, eax
je 0x46ffc7
mov edi, dword [ebx]
test edi, edi
je 0x46ffc7
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push esi
push 4
push 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x46ff90
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x46ff90
cmp word [ecx + 4], si
je 0x46ff90
nop dword [eax]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x46ff62
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x46ff62
cmp byte [eax], 1
jne 0x46ff62
add eax, 8
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x46ff70
mov ecx, dword [ebp - 8]
inc esi
movzx eax, word [ecx + 4]
cmp esi, eax
jb 0x46ff30
jmp 0x46ff90
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
push 0
push dword [ebp - 8]
push 0
push 0
push 4
push 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46ff9e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov esi, 1
call fcn.005ab825
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.005ab825
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4704b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6609c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], esi
mov eax, dword [0x67bcb4]
test al, 1
jne 0x470510
or eax, 1
mov dword [0x67bcb4], eax
call fcn.00402b70
mov ecx, eax
test ecx, ecx
je 0x47060b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x5daa70
mov dword [0x67bcb8], eax
call fcn.0058a62d
add esp, 4
mov eax, dword [0x67bcb8]
cmp dword [eax - 0xc], 0
jne 0x4705e7
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallMasterPDF
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4705e7
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.005a3020
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4705c6
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x67bcb8
call fcn.004073a0
mov ecx, dword [0x67bcb8]
add ecx, 0xfffffff0
call fcn.004072d0
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
pop esi
call fcn.00589ffa
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402440
int3
Function at 0x472630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
mov ebx, 0x20019
push edi
mov dword [ebp - 0xc], eax
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push ebx
push 0
push str.SoftwareClasses.pdf
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4726b3
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4726aa
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.005b6524
add esp, 8
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4726aa
push edi
call fcn.005ab825
add esp, 4
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x4726d4
mov eax, dword [ebp - 0xc]
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4726d4
cmp ebx, 0x20019
jne 0x4726d4
mov ebx, 0x20119
jmp 0x472645
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4726e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6197
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x6609c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x472722
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x128], eax
push 0x110
lea eax, [ebp - 0x120]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005a3020
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
or esi, 0xffffffff
cmp dword [ebp - 0x120], 5
jne 0x472777
xor ebx, ebx
jmp 0x4728d9
push str.SoftwareClasses_
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x12c], 0
call fcn.00406470
push str..pdf
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.00406200
add esp, 4
push eax
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 2
call fcn.00406bc0
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4727db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x134]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4727fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x12c]
push eax
push 0x2003f
push 0
push dword [ebp - 0x128]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4728cb
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
lea ecx, [ebp - 0x130]
call fcn.00406470
push str..pdf
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x134]
call fcn.00406200
add esp, 4
push eax
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 4
call fcn.00406bc0
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x134]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47287d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47289e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x12c]
push eax
push 0x2003f
push 0
lea eax, [ebp - 0x138]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
setne bl
test ebx, ebx
je 0x4728cd
jmp 0x4728d9
xor ebx, ebx
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x128]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4728fb
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589ffa
mov esp, ebp
pop ebp
ret
Function at 0x472920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d61c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x47295e
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str..pdf
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
push eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x14], 0
call fcn.004082f0
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.Progid
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4729c3
xor edi, edi
jmp 0x4729d7
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.005ab399
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4729f6
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret