joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fbdc
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00488e51
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00464ea6
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0048dcd9
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x46fc56
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x46fc4d
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46fc43
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46fc54
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x46fc20
jmp 0x46fc56
xor edi, edi
push esi
call fcn.00464eaf
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46fc66
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push edi
push eax
xor edi, edi
mov ebx, 0xf003f
push ebx
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x46fc9b
xor eax, eax
jmp 0x46fcfc
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x56d1d4
push dword [ebp - 8]
call esi
test eax, eax
je 0x46fccb
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push 0x56d1dc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x46fc97
push dword [ebp + 0xc]
call fcn.00488e51
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fd03
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x55eb61
call fcn.004a9932
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.00485370
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.00485370
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x46fde1
cmp word [edi], dx
jne 0x46fd72
mov eax, edx
jmp 0x46fd79
push edi
call fcn.00488e51
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00419ff0
cmp dword [ebp - 0x30], 0
je 0x46fde1
mov edi, 0x56d070
push edi
call fcn.00488e51
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00419ff0
xor edi, edi
cmp word [esi], di
jne 0x46fdaa
mov eax, edi
jmp 0x46fdb1
push esi
call fcn.00488e51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00419e50
mov esi, 0x56d074
push esi
call fcn.00488e51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00419e50
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00419d60
jmp 0x46fdfd
xor edi, edi
cmp word [esi], di
jne 0x46fdec
mov eax, edi
jmp 0x46fdf3
push esi
call fcn.00488e51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00419ff0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x46fe29
mov esi, edi
jmp 0x46fe54
cmp byte [ebp + 0x10], 0
je 0x46fe41
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00419c20
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00419c20
mov eax, esi
call fcn.004a98dc
ret
Function at 0x46fe96
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1604
call fcn.00464ee0
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00485370
push esi
lea eax, [ebp - 0x20c]
push 0x56d048
push eax
call fcn.00473ed5
lea eax, [ebp - 0x20c]
push eax
call fcn.00488e51
add esp, 0x1c
lea ecx, [eax - 1]
test ecx, ecx
jle 0x46ff02
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x20e], cx
je 0x46ff02
mov word [ebp + eax*2 - 0x20c], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xbe4]
push str._s.
push eax
call fcn.00473ed5
add esp, 0xc
lea eax, [ebp - 0x1604]
push eax
lea eax, [ebp - 0xbe4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x46fffb
push ebx
push 0x2e
pop ebx
lea eax, [ebp - 0x1604]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x46fffa
cmp word [ebp - 0x15d8], bx
je 0x46ff40
cmp word [ebp - 0x15d6], 0
je 0x46ff40
cmp word [ebp - 0x15d6], bx
jne 0x46ff7c
cmp word [ebp - 0x15d4], 0
je 0x46ff40
test byte [ebp - 0x1604], 0x10
je 0x46ffc6
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00485370
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str._s_s_
push eax
call fcn.00473ed5
lea eax, [ebp - 0x414]
push eax
call fcn.0046fe96
add esp, 0x20
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x13b4]
push 0x56cc1c
push eax
call fcn.00473ed5
add esp, 0x10
lea eax, [ebp - 0x13b4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46ff40
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x470c05
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x54], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x470c43
xor al, al
jmp 0x470cee
push ebx
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
push edi
mov dword [ebp - 0x40], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x470cbd
push esi
push eax
call fcn.0048dd00
mov esi, eax
pop ecx
test esi, esi
je 0x470cb1
push esi
push dword [ebp - 0x3c]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x470cb1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ebx
push eax
push 0x56ca38
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x470cb1
push 0x34
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push eax
call fcn.00484430
add esp, 0xc
cmp dword [ebp - 0x38], 0xfeef04bd
sete al
mov bl, al
push esi
call fcn.0048dcfb
pop ecx
pop esi
test bl, bl
jne 0x470cc1
xor al, al
jmp 0x470ced
mov ecx, dword [ebp - 0x30]
mov eax, ecx
mov edx, dword [ebp - 0x48]
shr eax, 0x10
mov dword [edx], eax
mov edx, dword [ebp - 0x50]
movzx eax, cx
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
shr eax, 0x10
mov dword [edx], eax
movzx eax, cx
mov ecx, dword [ebp - 0x54]
mov dword [ecx], eax
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x470fea
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x55f005
call fcn.004a9932
mov eax, dword [ebp + 8]
test eax, eax
je 0x4710e6
push eax
lea ecx, [ebp - 0x40]
call fcn.00419540
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00473083
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.00485370
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4710d7
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4710cc
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x471076
mov eax, ebx
jmp 0x471083
lea eax, [ebp - 0x248]
push eax
call fcn.00488e51
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00419ff0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00473083
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00433da0
test eax, eax
je 0x4710ec
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00419c20
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x471059
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00419c20
mov eax, esi
call fcn.004a98dc
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00419c20
jmp 0x4710d9
Function at 0x471246
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x83c
mov eax, 0x55edc1
call fcn.004a9932
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
and dword [ebp - 0x848], 0
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00419540
xor ecx, ecx
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 4], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
call esi
test eax, eax
je 0x4712d7
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.004200d0
push 0
jmp 0x471414
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x471304
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4712c2
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x471337
push dword [ebp - 0x838]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x4712c2
lea eax, [ebp - 0x830]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x471389
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.004200d0
jmp 0x471413
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x844]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x82c]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.00488e51
pop ecx
mov ecx, edi
test eax, eax
je 0x471378
lea eax, [ebp - 0x810]
push eax
call fcn.00419540
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00419c20
mov eax, edi
call fcn.004a98dc
ret
Function at 0x471429
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x55e8e4
call fcn.004a9932
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x844], esi
call fcn.00419540
lea eax, [ebp - 0x834]
mov dword [ebp - 0x834], esi
push eax
push 0x20119
push esi
push str.SoftWare
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x4714b4
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.004200d0
push 0
jmp 0x4715a3
lea eax, [ebp - 0x830]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x4714dd
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47149f
lea eax, [ebp - 0x82c]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x838]
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x471524
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.004200d0
jmp 0x4715a2
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x83c], 0x400
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x840]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
push dword [ebp - 0x834]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.00488e51
pop ecx
mov ecx, edi
test eax, eax
je 0x471516
lea eax, [ebp - 0x810]
push eax
call fcn.00419540
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00419c20
mov eax, edi
call fcn.004a98dc
ret
Function at 0x4715b8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x55edf4
call fcn.004a9932
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
and dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00419540
xor ecx, ecx
lea eax, [ebp - 0x834]
push eax
push 0xf013f
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47163c
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.004200d0
push 0
jmp 0x47173a
xor ecx, ecx
lea eax, [ebp - 0x830]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push esi
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call esi
test eax, eax
je 0x471670
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x471627
xor ecx, ecx
lea eax, [ebp - 0x82c]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x4716ab
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x471627
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x838], 0x400
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
push dword [ebp - 0x834]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.00488e51
pop ecx
mov ecx, edi
test eax, eax
jne 0x47172d
lea eax, [ebp - 0x828]
push eax
call fcn.004200d0
jmp 0x471739
lea eax, [ebp - 0x810]
push eax
call fcn.00419540
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00419c20
mov eax, edi
call fcn.004a98dc
ret
Function at 0x4719a7
Capabilities:
Check os version

Disassembly:
push 0x34c
mov eax, 0x55ef00
call fcn.004a9932
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x358], esi
push 0x118
push ebx
mov dword [ebp - 0x350], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.00485370
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x563a30
mov ecx, esi
call fcn.00419540
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x34c], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x32c]
push str.ntdll.dll
mov dword [ebp - 4], ebx
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x471a9e
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x471a97
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34c]
cmp eax, 5
jne 0x471ad0
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x471b9c
cmp eax, 1
jne 0x471ac6
mov edi, str.WindowsXP
jmp 0x471b8c
mov edi, str.WindowsServer2003
jmp 0x471b8c
cmp eax, 6
jne 0x471b9c
mov eax, dword [ebp - 0x348]
sub eax, ebx
je 0x471b79
sub eax, 1
je 0x471b72
mov edi, dword [ebp - 0x338]
sub eax, 1
jne 0x471ba2
cmp edi, 0x1ebb
jne 0x471b0e
mov edi, str.Windows8
jmp 0x471b8c
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x471b07
cmp edi, 0x1f13
je 0x471b07
cmp dword [ebp - 0x340], 0xa
jne 0x471b46
cmp dword [ebp - 0x344], 0
jne 0x471ba2
push str.Windows10
call fcn.00488e51
pop ecx
push eax
push str.Windows10
jmp 0x471b69
cmp dword [ebp - 0x340], 6
jne 0x471ba2
cmp dword [ebp - 0x344], 3
jne 0x471ba2
push str.Windows8.1
call fcn.00488e51
pop ecx
push eax
push str.Windows8.1
mov ecx, esi
call fcn.00419ff0
jmp 0x471ba2
mov edi, str.Windows7
jmp 0x471b8c
cmp dword [ebp - 0x354], 1
mov edi, str.WindowsVista
je 0x471b8c
mov edi, str.WindowsServer2008
push edi
call fcn.00488e51
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00419ff0
mov edi, dword [ebp - 0x338]
push 0x563a30
mov ecx, esi
call fcn.00437c10
test eax, eax
jne 0x471c10
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00485370
mov eax, dword [ebp - 0x34c]
push edi
push dword [ebp - 0x348]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.00473ed5
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x471bf4
mov eax, ebx
jmp 0x471c01
lea eax, [ebp - 0x218]
push eax
call fcn.00488e51
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00419ff0
cmp dword [ebp + 0xc], 0
je 0x471c3e
cmp word [ebp - 0x320], 0
je 0x471c2f
lea eax, [ebp - 0x320]
push eax
call fcn.00488e51
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x320]
mov ecx, esi
push eax
call fcn.00419e50
mov eax, esi
call fcn.004a98dc
ret
Function at 0x472043
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x472173
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push connect
push esi
mov dword [ebp - 0x110], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4720a1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x110], eax
lea esi, [ebx + 1]
push esi
call fcn.00464ea6
and dword [ebp - 0x118], 0
mov ebx, eax
pop ecx
push 0
lea eax, [ebp - 0x118]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe
pop ecx
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
push 0xcb
lea eax, [ebp - 0xcf]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00485370
lea eax, [ebp - 0x108]
push eax
call fcn.00489270
mov esi, dword [ebp - 0x110]
add esp, 0x10
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 0x10c], eax
test esi, esi
jle 0x472164
mov cl, byte [ebp - 0x108]
mov edx, ebx
cmp byte [edx], cl
jne 0x472158
xor ecx, ecx
xor edi, edi
cmp dword [ebp - 0x114], ecx
jle 0x472152
mov al, byte [edx + ecx]
cmp al, byte [ebp + ecx - 0x108]
jne 0x47214c
mov eax, dword [ebp - 0x114]
inc edi
cmp edi, eax
je 0x472182
inc ecx
cmp ecx, eax
jl 0x472130
mov eax, dword [ebp - 0x10c]
mov cl, byte [ebp - 0x108]
inc eax
inc edx
mov dword [ebp - 0x10c], eax
cmp eax, esi
jl 0x472120
test ebx, ebx
je 0x47216f
push ebx
call fcn.00464eaf
pop ecx
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00464e95
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x47218d
push ebx
call fcn.00464eaf
pop ecx
xor eax, eax
inc eax
jmp 0x472171
Function at 0x472192
Capabilities:
Enumerate processes

Disassembly:
push 0x28c
mov eax, 0x55efcd
call fcn.004a9932
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
push 0x22c
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x284]
push eax
call fcn.00485370
add esp, 0xc
lea ecx, [ebp - 0x58]
push edi
call fcn.00419540
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00419540
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.00473083
lea eax, [ebp - 0x40]
push eax
call fcn.00473083
pop ecx
pop ecx
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x47234f
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4722ec
mov esi, dword [ebp + 8]
cmp dword [ebp - 0x27c], esi
je 0x4722d1
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
jne 0x472269
mov eax, ebx
jmp 0x472276
lea eax, [ebp - 0x260]
push eax
call fcn.00488e51
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00419ff0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.00473083
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00433da0
test eax, eax
jne 0x4722c2
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x298]
push eax
call fcn.00473d2c
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00419c20
lea eax, [ebp - 0x284]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x472240
mov esi, dword [ebp - 0x294]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x290]
jmp 0x472345
push dword [esi]
lea eax, [ebp - 0x28]
push eax
call fcn.00470e2c
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call fcn.00473083
add esp, 0xc
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x28]
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push ebx
push eax
call fcn.0041c140
lea ecx, [ebp - 0x28]
cmp eax, 0xffffffff
jg 0x47237a
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.00419c20
add esi, 4
cmp esi, edi
jne 0x4722fb
mov ebx, dword [ebp - 0x288]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00419c20
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00419c20
lea ecx, [ebp - 0x294]
call fcn.00473912
mov eax, ebx
call fcn.004a98dc
ret
xor ebx, ebx
inc ebx
push 0
push ebx
call fcn.00419c20
jmp 0x47234f