joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb01d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb01d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb01d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb01d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb01d94
push eax
push esi
call fcn.00b0420b
add esp, 8
pop esi
ret 0x10

Function at 0xb01da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb01e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb01e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xb1a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b03dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb01dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb01e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb01ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb01eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xb1a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b03dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb01eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb01e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb02000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb02131
push esi
call fcn.00b05145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00af4080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb02131
push 0
push ebp
call fcn.00af43a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00af4260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb0208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00af42f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb02121
push 0xb1a918
push edi
call fcn.00b033f0
push eax
push ebx
push esi
call fcn.00b01f60
push 0xb1a8f8
push edi
call fcn.00b033f0
push eax
push ebx
push esi
call fcn.00b01f60
push 0xb1a8d8
push edi
call fcn.00b033f0
push eax
push ebx
push esi
call fcn.00b01f60
push 0xb1a8c0
push edi
call fcn.00b033f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b01f60
push 0xb1a8a0
push edi
call fcn.00b033f0
push eax
push ebx
push esi
call fcn.00b01f60
push 0xb1a888
push edi
call fcn.00b033f0
push eax
push ebx
push esi
call fcn.00b01f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb031b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b03140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b03140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b03140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b03140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb03bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb03c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb1587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb03c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb03c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4024d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
add edx, 0xc
mov dword [esp + 4], edx
jmp sym.WarZ.exe_ZSTD_CCtxParams_getParameter
Function at 0x445f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7fc
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x7f4], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x40
lea eax, [esp + 0x80]
push esi
push eax
mov edi, ecx
mov dword [esp + 0x84], esi
call fcn.005e4b70
add esp, 0xc
push 0x44
lea ecx, [esp + 0x38]
push esi
push ecx
mov dword [esp + 0x3c], esi
call fcn.005e4b70
mov ebx, dword [edi]
add edi, 4
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
cmp ebx, 0x10
jbe 0x445f86
mov eax, 0xffffffd4
jmp 0x44610e
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x81c]
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x81c]
lea edx, [esp + 0x50c]
push edx
call fcn.004454e0
add esp, 0x10
mov dword [esp + 0x2c], eax
cmp eax, 0xffffff88
ja 0x44610e
mov edi, dword [esp + 0x1c]
cmp edi, ebx
ja 0x445f7c
mov dword [esp + 0x14], edi
cmp dword [esp + edi*4 + 0x78], esi
jne 0x445fe0
dec edi
cmp dword [esp + edi*4 + 0x78], esi
je 0x445fd5
mov dword [esp + 0x14], edi
xor ebp, ebp
lea eax, [ebp + 1]
lea ebx, [edi + 1]
mov dword [esp + 0x20], ebp
cmp ebx, eax
jbe 0x446003
mov ecx, ebp
add ebp, dword [esp + eax*4 + 0x78]
mov dword [esp + eax*4 + 0x34], ecx
inc eax
cmp eax, ebx
jb 0x445ff0
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x34], ebp
test esi, esi
jbe 0x44603b
movzx edx, byte [esp + eax + 0x500]
mov ecx, dword [esp + edx*4 + 0x34]
mov byte [esp + ecx*2 + 0x600], al
inc eax
lea edi, [ecx + 1]
mov dword [esp + edx*4 + 0x34], edi
mov byte [esp + ecx*2 + 0x601], dl
cmp eax, esi
jb 0x446011
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x1c]
xor esi, esi
lea eax, [esi + 1]
dec edx
mov dword [esp + 0x34], esi
cmp ebx, eax
jbe 0x446072
mov ebp, dword [esp + eax*4 + 0x78]
lea ecx, [eax + edx]
shl ebp, cl
mov edi, esi
mov dword [esp + eax*4 + 0xc0], edi
inc eax
add esi, ebp
cmp eax, ebx
jb 0x446051
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov edi, dword [esp + 0x24]
inc ecx
sub edi, ecx
inc edi
cmp ecx, edi
jae 0x4460d7
mov edx, ecx
neg edx
mov eax, ecx
shl eax, 4
shl edx, 4
add eax, ecx
sub edx, ecx
lea eax, [esp + eax*4 + 0xc4]
add edx, edx
mov dword [esp + 0x18], eax
add edx, edx
cmp ebx, 1
jbe 0x4460c4
lea esi, [ebx - 1]
jmp 0x4460b0
mov ebp, dword [edx + eax]
shr ebp, cl
add eax, 4
sub esi, 1
mov dword [eax - 4], ebp
jne 0x4460b0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
inc ecx
add eax, 0x44
sub edx, 0x44
mov dword [esp + 0x18], eax
cmp ecx, edi
jb 0x4460a3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
inc ecx
push ecx
push edx
lea eax, [esp + 0xc8]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push ebp
lea edx, [esp + 0x614]
push edx
push eax
push ecx
call fcn.00445df0
mov eax, dword [esp + 0x4c]
add esp, 0x20
mov ecx, dword [esp + 0x804]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e425b
add esp, 0x7fc
ret
Function at 0x44de60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
mov esi, ecx
lea ecx, [esi + eax]
mov dword [esp + 0x24], ecx
lea ecx, [edx + ebp]
xor edx, edx
push edi
mov edi, dword [esp + 0x80]
mov ebx, dword [edi + 0x6860]
mov dword [esp + 0x18], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x14], edx
lea edx, [edi + 0x1004]
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 0x6814]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x6818]
mov dword [esp + 0x34], edx
mov edx, dword [edi + 0x681c]
mov dword [esp + 0x30], edx
mov edx, dword [edi + 0x6858]
push edx
push eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edi + 0x685c]
mov dword [esp + 0x28], ecx
add ebx, ecx
push esi
lea ecx, [edi + 0x1808]
push eax
push ecx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x30]
lea edx, [esp + 0x98]
call fcn.0044d6b0
add esp, 0x18
cmp eax, 0xffffff88
ja 0x44e085
cmp dword [esp + 0x80], 0
lea edx, [eax + esi]
je 0x44e045
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x74], eax
add eax, ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x28]
mov esi, 1
sub eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], esi
mov dword [esp + 0x70], esi
call fcn.0044b7a0
cmp eax, 0xffffff88
jbe 0x44df66
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
lea edx, [esp + 0x58]
push edx
mov eax, edi
lea edx, [esp + 0x4c]
call fcn.0044b930
lea eax, [esp + 0x64]
add esp, 4
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x4c]
call fcn.0044b930
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x6c]
add esp, 4
push ecx
lea edx, [esp + 0x4c]
call fcn.0044b930
add esp, 4
lea ecx, [esp + 0x48]
call fcn.0044b8a0
cmp eax, 2
jg 0x44e037
jmp 0x44dfc5
mov esi, 1
cmp dword [esp + 0x80], 0
je 0x44e045
sub dword [esp + 0x80], esi
lea edx, [esp + 0x3c]
push edx
lea esi, [esp + 0x4c]
call fcn.0044da90
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 4
push eax
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x4c]
push ebx
lea eax, [esp + 0x30]
push eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x44]
mov dword [eax + 8], ecx
push edx
mov eax, ebp
call fcn.0044dca0
add esp, 0x24
cmp eax, 0xffffff88
ja 0x44e085
mov ecx, esi
add ebp, eax
call fcn.0044b8a0
cmp eax, 2
jle 0x44dfc0
cmp dword [esp + 0x80], 0
jne 0x44df59
mov ecx, dword [esp + 0x20]
mov eax, ebx
sub eax, ecx
cmp ecx, ebx
ja 0x44df59
lea esi, [eax + ebp]
cmp esi, dword [esp + 0x24]
jbe 0x44e06b
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
test eax, eax
jbe 0x44e07c
push eax
push ecx
push ebp
call fcn.005e3b10
add esp, 0xc
mov ebp, esi
mov eax, ebp
sub eax, dword [esp + 0x84]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x451790
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
xor ebp, ebp
cmp ebx, ebp
jne 0x4517a1
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x10]
push esi
push 0x54
cmp eax, ebp
je 0x4517c3
mov ecx, dword [esp + 0x20]
push ecx
call eax
push 0x54
mov esi, eax
push ebp
push esi
call fcn.005e4b70
add esp, 0x14
jmp 0x4517cf
push 1
call fcn.005f75d0
add esp, 8
mov esi, eax
cmp esi, ebp
jne 0x4517d9
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
mov edi, 1
mov dword [esi + 0x24], edi
mov eax, dword [esp + 0x18]
push 8
cmp eax, ebp
je 0x4517f8
mov edx, dword [esp + 0x24]
push edx
call eax
add esp, 8
jmp 0x451800
call fcn.005e60a8
add esp, 4
mov dword [esi + 0x18], eax
lea eax, [esi + 0x30]
push eax
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea ecx, [esi + 0x48]
push ecx
call edi
lea edx, [esi + 0x4c]
push edx
call edi
lea eax, [ebx + ebx*2]
add eax, eax
mov dword [esi + 0x50], ebp
mov ecx, dword [esp + 0x18]
add eax, eax
push eax
cmp ecx, ebp
je 0x45184a
mov eax, dword [esp + 0x24]
push eax
call ecx
add esp, 8
jmp 0x451852
call fcn.005e60a8
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x20]
mov dword [esi + 8], ecx
cmp eax, ebp
je 0x4518d3
cmp dword [esi + 0x18], ebp
je 0x4518d3
cmp ebx, ebp
jbe 0x4518c3
xor ebx, ebx
jmp 0x451880
mov edi, dword [esi + 0xc]
push 0
push 0
add edi, ebx
push edi
push 0x4527c0
push 0
push 0
mov dword [edi + 8], esi
mov dword [edi + 4], 0x451690
call fcn.005e4d3c
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x4518b5
call fcn.005eae8f
cmp dword [eax], 0
jne 0x4518d0
inc ebp
add ebx, 0xc
cmp ebp, dword [esp + 0x14]
jb 0x451880
mov ebx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], ebp
mov eax, esi
call fcn.00451980
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x451a30
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
cmp ebp, dword [esi + 0x10]
ja 0x451a53
test ebp, ebp
jne 0x451a49
lea eax, [ebp + 1]
pop ebp
add esp, 0xc
ret
mov dword [esi + 0x14], ebp
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [esp + 8], eax
lea eax, [ebp + ebp*2]
add eax, eax
add eax, eax
push edi
push eax
test ecx, ecx
je 0x451a75
push edx
call ecx
add esp, 8
jmp 0x451a7d
call fcn.005e60a8
add esp, 4
mov edi, eax
test edi, edi
jne 0x451a8c
lea eax, [edi + 1]
pop edi
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
add ecx, ecx
add ecx, ecx
push ecx
push edx
push edi
call fcn.005e3b10
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
add esp, 0xc
test eax, eax
je 0x451acc
push eax
test ecx, ecx
je 0x451ac4
push edx
call ecx
add esp, 8
jmp 0x451acc
call fcn.005e5f06
add esp, 4
push ebx
mov ebx, dword [esi + 0x10]
mov dword [esi + 0xc], edi
cmp ebx, ebp
jae 0x451b18
lea ecx, [ebx + ebx*2]
lea edi, [edi + ecx*4]
lea ecx, [ecx]
push 0
push 0
push edi
push 0x4527c0
push 0
push 0
mov dword [edi + 8], esi
mov dword [edi + 4], 0x451690
call fcn.005e4d3c
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x451b10
call fcn.005eae8f
cmp dword [eax], 0
jne 0x451b27
inc ebx
add edi, 0xc
cmp ebx, ebp
jb 0x451ae0
pop ebx
pop edi
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
xor eax, eax
pop ebp
add esp, 0xc
ret
mov dword [esi + 0x10], ebx
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0xc
ret

Function at 0x4528a0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4528b8
cmp eax, 0x80010106
jne 0x452936
push edi
push esi
push 0x6176c0
push 1
push 0
push 0x6176b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4528e7
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.005bacf0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x452910
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.005bacf0
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x452934
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.005bacf0
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret
Function at 0x452c00
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x452c18
cmp eax, 0x80010106
jne 0x452c6c
push edi
push esi
push 0x617888
push 1
push 0
push 0x617878
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x452c47
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.005bacf0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x452c6b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.005bacf0
mov eax, esi
add esp, 8
pop edi
pop esi
ret

Function at 0x452d00
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
cmp dword [ecx + 4], 0
mov dword [esp], ecx
jne 0x452d13
mov eax, 0x80004001
pop ecx
ret 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call fcn.00452830
mov edi, eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.00452830
mov ecx, dword [esp + 0x28]
push ecx
mov ebx, eax
call fcn.00452830
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push esi
mov ebp, eax
mov dword [esp + 0x24], 0
call fcn.00452c70
mov esi, eax
test esi, esi
jge 0x452d73
push esi
push 0x61780c
call fcn.005bacf0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
cmp dword [esp + 0x18], 0
je 0x452d84
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
lea eax, [esp + 0x1c]
push eax
push 0x617904
push 1
push 0
push 0x6178f4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x452dae
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x452e39
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push ebp
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebx
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x452e41
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.005bacf0
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebx
call edi
push ebp
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x452e60
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x453130
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x6f1330]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.005e4550
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x45318b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.005bb000
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.005bca70
add esp, 0xc
test al, al
jne 0x4531be
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.005baec0
add esp, 8
push str.1.0.1
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.004530f0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4531fb
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.005baec0
add esp, 0xc
push 0x2f
push str.http:__147.50.253.186_NHZ_UPDATER_woupd.xml
call fcn.005e4550
mov esi, eax
add esp, 8
test esi, esi
jne 0x453225
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.005bb000
add esp, 0x10
lea edi, [esi + 1]
push 0x617a1c
push edi
call fcn.005bbb30
mov esi, eax
push 0x617a14
push esi
call fcn.005e47e1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.1.0.1
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__147.50.253.186_NHZ_UPDATER_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.005e47e1
push str.__p__n
push esi
call fcn.005e47e1
push esi
call fcn.005e4765
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00453110
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.005e425b
add esp, 0x614
ret

Function at 0x453ba0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x453bec
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
add esi, 0x88
push esi
push eax
push eax
push str.MHz
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop esi
add esp, 8
ret