joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x4c], 0
je 0x41d52b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x41d49d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
cmp dword [esi + 0x38], 0
lea edi, [esi + 0x3d]
je 0x41d4e6
cmp byte [edi], 0
je 0x41d4e6
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41d4bd
xor al, al
jmp 0x41d4e8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41d503
sub eax, 1
je 0x41d506
sub eax, 2
jne 0x41d4b9
mov byte [edi], al
mov al, 1
push dword [esi + 0x4c]
xor ebx, ebx
test al, al
cmovne ebx, esi
call fcn.005bbd16
xor ecx, ecx
add esp, 4
test eax, eax
cmovne ebx, ecx
jmp 0x41d530
mov byte [edi], 0
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x41d523
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.005bbaf0
add esp, 0x10
cmp ebx, eax
jne 0x41d4b9
cmp byte [edi], 0
sete al
jmp 0x41d4e8
xor ebx, ebx
lea edi, [esi + 0x3d]
lea eax, [esi + 4]
mov byte [esi + 0x48], 0
mov dword [esi + 0xc], eax
lea edx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], edx
mov dword [esi + 0x1c], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [edi], 0
mov dword [edx], 0
mov dword [ecx], 0
mov edx, dword [0x66d950]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
pop edi
mov dword [eax], 0
mov eax, ebx
mov ecx, dword [esi + 0x1c]
mov dword [ecx], 0
mov ecx, dword [esi + 0x2c]
mov dword [ecx], 0
mov ecx, dword [0x66d94c]
mov dword [esi + 0x40], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x4c], 0
xor ecx, ebp
mov dword [esi + 0x44], edx
mov dword [esi + 0x38], 0
pop esi
pop ebx
call fcn.005af765
mov esp, ebp
pop ebp
ret
Function at 0x41edd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df0e3
mov eax, dword fs:[0]
push eax
sub esp, 0x18c
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ecx
lea ecx, [ebp - 0x198]
call fcn.00415de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x188]
push dword [ebp - 0x3c]
call fcn.00415f80
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x180]
call fcn.00416850
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov ecx, edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040d9f0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x41ee8e
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41ee84
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ef58
push ecx
push edx
call fcn.005af9e7
add esp, 8
cmp dword [ebp - 0x3c], 1
seta al
mov byte [edi + 4], al
call fcn.0041f3f0
call fcn.005da4c0
push ecx
lea ecx, [ebp - 0xe8]
mov esi, eax
call fcn.0041f4b0
push esi
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 2
call fcn.0041f580
mov edx, str._MHz
mov ecx, eax
call fcn.00413680
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe4]
call fcn.00416850
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [edi + 8]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00445460
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x41ef25
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41ef1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ef5d
push ecx
push edx
call fcn.005af9e7
add esp, 8
lea ecx, [ebp - 0xe8]
call fcn.0041ef70
lea ecx, [ebp - 0x198]
call fcn.00415cc0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af765
mov esp, ebp
pop ebp
ret
call fcn.005b681f
call fcn.005b681f
int3
Function at 0x41f3f0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
xorps xmm0, xmm0
lea eax, [esp + 0x14]
push edi
push eax
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x1c], xmm0
movlpd qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x41f42a
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
adc dword [esp + 0x14], eax
rdtsc
mov edi, eax
mov ebx, edx
nop dword [eax]
lea eax, [esp + 0x20]
push eax
call esi
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x14]
jb 0x41f450
ja 0x41f46d
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x10]
jb 0x41f450
rdtsc
mov ecx, eax
call fcn.005da640
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [esp + 0x10], xmm0
call fcn.005da640
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
pop edi
pop esi
pop ebx
movss xmm0, dword [esp + 4]
subss xmm0, xmm1
divss xmm0, dword [0x6376d8]
mov esp, ebp
pop ebp
ret
Function at 0x428150
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfdfb
mov eax, dword fs:[0]
push eax
mov eax, 0x146c
call fcn.005b0130
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1474], edx
mov eax, ecx
mov dword [ebp - 0x1470], eax
mov ecx, dword [ebp + 8]
mov dword [eax], 0
lea eax, [ebp - 0x1460]
push 0x1450
mov dword [edx], 0
push eax
mov dword [ebp - 0x1478], ecx
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4281c8
xor al, al
jmp 0x428361
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x42837d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1464], eax
lea eax, [ebp - 0x1460]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1464]
call fcn.0040d850
test al, al
jne 0x428214
lea eax, [ebp - 0x1460]
push eax
lea ecx, [ebp - 0x1464]
call fcn.0040d9f0
mov dword [ebp - 4], 1
xor edi, edi
mov esi, dword [ebp - 0x1464]
mov ebx, esi
movzx eax, word [esi]
test ax, ax
je 0x428271
mov ecx, eax
nop
push ecx
push 0x63203c
call fcn.005b30cc
add esp, 8
test eax, eax
je 0x42824d
test edi, edi
mov eax, ebx
cmovne eax, edi
mov edi, eax
jmp 0x42824f
xor edi, edi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x428230
test edi, edi
je 0x428271
sub edi, esi
lea ecx, [ebp - 0x1464]
sar edi, 1
push edi
call fcn.00416be0
lea eax, [ebp - 0x1464]
push eax
mov ecx, eax
call fcn.004106c0
push 0x632044
lea ecx, [ebp - 0x1464]
call fcn.0042c560
mov esi, dword [ebp - 0x1464]
lea eax, [ebp - 0x146c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
push edi
call fcn.00465842
add esp, 4
mov ebx, eax
push ebx
push edi
push dword [ebp - 0x146c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x428335
lea eax, [ebp - 0x1464]
mov dword [ebp - 0x1468], 0
push eax
lea eax, [ebp - 0x1468]
mov dword [ebp - 0x1464], 0
push eax
push 0x632b48
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x428328
cmp dword [ebp - 0x1464], 0
je 0x428328
mov ecx, dword [ebp - 0x1468]
mov edx, dword [ebp - 0x1470]
movzx eax, word [ecx + 0x12]
mov dword [edx], eax
movzx eax, word [ecx + 0x10]
mov edx, dword [ebp - 0x1474]
mov dword [edx], eax
movzx eax, word [ecx + 0x16]
mov ecx, dword [ebp - 0x1478]
mov dword [ecx], eax
push ebx
call fcn.0046583d
add esp, 4
mov bl, 1
jmp 0x428340
push ebx
call fcn.0046583d
add esp, 4
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42835f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af765
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040238e
int3
Function at 0x42b750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e07ad
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x663000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x18]
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push str.version
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b8ce
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x42b7b8
cmp eax, 2
jne 0x42b8ce
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x14], eax
je 0x42b8ce
lea ebx, [eax + 1]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
cmp ebx, 0x7fffffff
ja 0x42b93d
add ebx, ebx
cmp ebx, 0x1000
jb 0x42b81b
lea eax, [ebx + 0x23]
cmp eax, ebx
jbe 0x42b942
push eax
call fcn.00465805
add esp, 4
test eax, eax
je 0x42b938
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x42b82e
test ebx, ebx
je 0x42b82c
push ebx
call fcn.00465805
add esp, 4
mov esi, eax
jmp 0x42b82e
xor esi, esi
push ebx
push 0
lea edi, [ebx + esi]
mov dword [ebp - 0x28], esi
push esi
mov dword [ebp - 0x20], edi
call fcn.005b3720
add esp, 0xc
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push 0
push str.version
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b89a
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x42b881
cmp eax, 2
jne 0x42b89a
test esi, esi
je 0x42b8e7
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42b8e2
test al, 1
jne 0x42b89a
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x42b8e7
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42b8ce
sub edi, esi
and edi, 0xfffffffe
cmp edi, 0x1000
jb 0x42b8c4
mov ecx, dword [esi - 4]
add edi, 0x23
sub esi, ecx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x42b938
mov esi, ecx
push edi
push esi
call fcn.005af9e7
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [esi], ax
mov ecx, dword [ebp - 0x18]
push esi
call fcn.00415110
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42b924
sub edi, esi
and edi, 0xfffffffe
cmp edi, 0x1000
jb 0x42b91a
mov ecx, dword [esi - 4]
add edi, 0x23
sub esi, ecx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x42b938
mov esi, ecx
push edi
push esi
call fcn.005af9e7
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005b681f
call fcn.00409550
call fcn.00404e9f
int3
Function at 0x42b950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e07dd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x663000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 4
push eax
push 0
push str.install
push dword [edi]
call esi
test eax, eax
jne 0x42b9ad
cmp dword [ebp - 0x14], 4
je 0x42ba92
jmp 0x42b9b6
cmp eax, 0xd
jne 0x42badd
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push str.install
push dword [edi]
call esi
test eax, eax
jne 0x42badd
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x42b9eb
cmp eax, 2
jne 0x42badd
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x14], eax
je 0x42badd
push ecx
inc eax
lea ecx, [ebp - 0x20]
push eax
call fcn.0042c310
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
push esi
push str.install
mov ecx, edi
call fcn.0042ccd0
test eax, eax
jne 0x42baa6
mov ecx, 0x632a28
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42ba4d
test dx, dx
je 0x42ba49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42ba4d
add eax, 4
add ecx, 4
test dx, dx
jne 0x42ba27
xor ecx, ecx
jmp 0x42ba52
sbb ecx, ecx
or ecx, 1
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
sete al
mov dword [ebx], eax
test esi, esi
je 0x42ba92
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x42ba88
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42baf1
push ecx
push esi
call fcn.005af9e7
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42badd
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x42bad3
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42baf1
push ecx
push esi
call fcn.005af9e7
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005b681f
int3
Function at 0x42ccd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42cd41
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x42cd0f
cmp eax, 2
jne 0x42cd2b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x42cd3b
test ecx, ecx
je 0x42cd36
test cl, 1
jne 0x42cd2b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x42cd3b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4362c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1320
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4362fd
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x43643d
push ebx
call fcn.005bc026
mov edi, eax
add esp, 4
test edi, edi
je 0x43643d
cmp dword [esi + 0x14], 8
jb 0x43632d
mov esi, dword [esi]
push edi
push ebx
push dword [ebp - 0x30]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x436434
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x632b48
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x436434
push ecx
lea ecx, [ebp - 0xe8]
call fcn.00415de0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
lea ecx, [ebp - 0xd8]
push eax
call fcn.0042c3b0
mov edx, 0x631194
mov ecx, eax
call fcn.004121f0
mov ecx, eax
call fcn.0042c3b0
mov edx, 0x631194
mov ecx, eax
call fcn.004121f0
mov ecx, eax
call fcn.0042c3b0
mov edx, 0x631194
mov ecx, eax
call fcn.004121f0
mov ecx, eax
call fcn.0042c3b0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00416850
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push eax
call fcn.0040a4c1
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x43641c
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x436412
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43645b
push ecx
push edx
call fcn.005af9e7
add esp, 8
push edi
call fcn.005b98d1
add esp, 4
lea ecx, [ebp - 0xe8]
call fcn.00415cc0
mov al, 1
jmp 0x43643f
push edi
call fcn.005b98d1
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af765
mov esp, ebp
pop ebp
ret
call fcn.005b681f
int3
Function at 0x43e2e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e204d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x43e4b9
cmp dword [esi + 0xc], 0
je 0x43e4b9
cmp dword [esi + 0x18], 0
je 0x43e4b9
cmp dword [esi + 0x10], 0
je 0x43e4b9
push 1
lea ecx, [ebp - 0x40]
call fcn.00460c90
mov dword [ebp - 4], 0
mov ecx, 0x62ee88
cmp byte [ebp - 0x40], 0
mov eax, 0x6373d4
cmove eax, ecx
lea ecx, [ebp - 0x3c]
push eax
call fcn.0040d9f0
push dword [ebp - 0x3c]
mov ecx, dword [esi]
push 0
push 0x116fb
call fcn.0041a6c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 0x43e290
mov dword [ebp - 0x44], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x43e491
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x43e491
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x10028
push eax
push edi
mov dword [ebp - 0x34], 0x25
mov dword [ebp - 0x30], 0x1800
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x20000000
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.GDI32.dll_ChoosePixelFormat]
test eax, eax
je 0x43e491
lea ecx, [ebp - 0x38]
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_SetPixelFormat]
test eax, eax
je 0x43e491
mov eax, dword [esi + 0xc]
push edi
call eax
mov dword [esi + 8], eax
test eax, eax
je 0x43e491
push eax
mov eax, dword [esi + 0x10]
push edi
call eax
test eax, eax
je 0x43e491
mov eax, dword [esi + 0x18]
push str.glGetStringi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x43e451
push str.glGetStringi
push dword [esi + 4]
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x18]
push str.glGetString
call eax
mov dword [esi + 0x24], eax
test eax, eax
jne 0x43e46f
push str.glGetString
push dword [esi + 4]
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x18]
push str.glGetIntegerv
call eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x43e48d
push str.glGetIntegerv
push dword [esi + 4]
call edi
mov dword [esi + 0x1c], eax
mov bl, 1
jmp 0x43e493
xor bl, bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x3c]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43e4b5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
jmp 0x43e4bb
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af765
mov esp, ebp
pop ebp
ret
Function at 0x445990
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2976
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, eax
push 0x62e782
mov dword [ebp - 0x35c], eax
call fcn.004105e0
cmp byte [esi + 0x1c], 0
jne 0x4459e5
xor al, al
jmp 0x445b91
lea eax, [ebp - 0x358]
mov dword [ebp - 4], 0
push eax
push str.SELECT__FROM_Win32_BIOS
mov ecx, esi
call fcn.004484f0
test al, al
je 0x445b8f
mov eax, dword [ebp - 0x358]
lea edx, [ebp - 0x350]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x350], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x445b8f
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edi, edi
cmp edi, dword [ebp - 0x350]
jae 0x445b8f
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x370]
mov byte [ebp - 4], 1
push eax
push str.SerialNumber
push dword [ebp + edi*4 - 0x334]
call fcn.00447d00
test al, al
je 0x445b69
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x354]
call fcn.00449b60
mov byte [ebp - 4], 2
mov eax, dword [eax]
test eax, eax
je 0x445a9f
mov eax, dword [eax]
jmp 0x445aa1
xor eax, eax
push eax
lea ecx, [ebp - 0x34c]
call fcn.00407953
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x354]
test esi, esi
je 0x445b09
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x445aff
test esi, esi
je 0x445aff
mov eax, dword [esi]
test eax, eax
je 0x445add
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x445af4
push eax
call fcn.0046583d
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.005af9e7
add esp, 8
mov dword [ebp - 0x354], 0
cmp dword [ebp - 0x338], 8
lea eax, [ebp - 0x34c]
mov ecx, dword [ebp - 0x35c]
cmovae eax, dword [ebp - 0x34c]
push eax
call fcn.0040d9f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x338]
cmp ecx, 8
jb 0x445b69
mov edx, dword [ebp - 0x34c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x445b5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x445baf
push ecx
push edx
call fcn.005af9e7
add esp, 8
mov eax, dword [ebp + edi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x370]
mov byte [ebp - 4], 0
push eax
call ebx
inc edi
jmp 0x445a42
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005af765
mov esp, ebp
pop ebp
ret 4
call fcn.005b681f
int3
Function at 0x445bc0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e29b0
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x663000]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov byte [edi], 0
cmp byte [ecx + 0x1c], 0
jne 0x445c04
xor al, al
jmp 0x445cc7
lea eax, [ebp - 0x33c]
mov dword [ebp - 4], 0
push eax
push str.SELECT__FROM_Win32_ComputerSystem
call fcn.004484f0
test al, al
je 0x445cc5
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x338]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x338], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x445cc5
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor esi, esi
nop dword [eax + eax]
cmp esi, dword [ebp - 0x338]
jae 0x445cc5
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x34c]
mov byte [ebp - 4], 1
push eax
push str.PartOfDomain
push dword [ebp + esi*4 - 0x334]
call fcn.00447d00
test al, al
je 0x445ca2
cmp word [ebp - 0x344], 0xffff
jne 0x445ca2
mov byte [edi], 1
mov eax, dword [ebp + esi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x34c]
mov byte [ebp - 4], 0
push eax
call ebx
inc esi
jmp 0x445c60
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005af765
mov esp, ebp
pop ebp
ret 4