joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3b3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.004bf1c0
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x7d4]
push 0x572ea0
push eax
call fcn.004b7428
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4b3bf1
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b3c01
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1604
call fcn.00437c60
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x20c]
push 0x572ea0
push eax
call fcn.004b7428
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
add esp, 0x1c
lea ecx, [eax - 1]
test ecx, ecx
jle 0x4b3c6d
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x20e], cx
je 0x4b3c6d
mov word [ebp + eax*2 - 0x20c], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xbe4]
push str._s.
push eax
call fcn.004b7428
add esp, 0xc
lea eax, [ebp - 0x1604]
push eax
lea eax, [ebp - 0xbe4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b3d66
push ebx
push 0x2e
pop ebx
lea eax, [ebp - 0x1604]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4b3d65
cmp word [ebp - 0x15d8], bx
je 0x4b3cab
cmp word [ebp - 0x15d6], 0
je 0x4b3cab
cmp word [ebp - 0x15d6], bx
jne 0x4b3ce7
cmp word [ebp - 0x15d4], 0
je 0x4b3cab
test byte [ebp - 0x1604], 0x10
je 0x4b3d31
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004bf1c0
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str._s_s_
push eax
call fcn.004b7428
lea eax, [ebp - 0x414]
push eax
call fcn.004b3c01
add esp, 0x20
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x13b4]
push 0x573dcc
push eax
call fcn.004b7428
add esp, 0x10
lea eax, [ebp - 0x13b4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4b3cab
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b4919
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4b4961
xor eax, eax
jmp 0x4b4a4b
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x571908
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b4a2d
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push str.Internet_Exploreriexplore.exe
push eax
call fcn.004d2a28
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b495a
lea ecx, [ebp - 0x20c]
push ecx
push esi
call fcn.004d2a59
pop ecx
pop ecx
jmp 0x4b4a48
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004d2a59
pop ecx
pop ecx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b4dcc
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x56f1ce
call fcn.004e718f
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b4ec8
push eax
lea ecx, [ebp - 0x40]
call fcn.0041ff90
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004b6ac2
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.004bf1c0
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4b4eb9
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4b4eae
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x4b4e58
mov eax, ebx
jmp 0x4b4e65
lea eax, [ebp - 0x248]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00419cc0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004b6ac2
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00443d2d
test eax, eax
je 0x4b4ece
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00430390
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b4e3b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00430390
mov eax, esi
call fcn.004e7139
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00430390
jmp 0x4b4ebb
Function at 0x4b4ff4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x83c
mov eax, 0x56f22e
call fcn.004e718f
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
and dword [ebp - 0x848], 0
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.0041ff90
xor ecx, ecx
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 4], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
call esi
test eax, eax
je 0x4b5085
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.0043cf36
push 0
jmp 0x4b51c2
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x4b50b2
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b5070
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x4b50e5
push dword [ebp - 0x838]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x4b5070
lea eax, [ebp - 0x830]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x4b5137
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.0043cf36
jmp 0x4b51c1
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x844]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x82c]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004d2a7b
pop ecx
mov ecx, edi
test eax, eax
je 0x4b5126
lea eax, [ebp - 0x810]
push eax
call fcn.0041ff90
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00430390
mov eax, edi
call fcn.004e7139
ret
Function at 0x4b51d7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x56f261
call fcn.004e718f
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x844], esi
call fcn.0041ff90
lea eax, [ebp - 0x834]
mov dword [ebp - 0x834], esi
push eax
push 0x20119
push esi
push str.SoftWare
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4b5262
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.0043cf36
push 0
jmp 0x4b5351
lea eax, [ebp - 0x830]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x4b528b
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b524d
lea eax, [ebp - 0x82c]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x838]
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x4b52d2
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.0043cf36
jmp 0x4b5350
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x83c], 0x400
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x840]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
push dword [ebp - 0x834]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004d2a7b
pop ecx
mov ecx, edi
test eax, eax
je 0x4b52c4
lea eax, [ebp - 0x810]
push eax
call fcn.0041ff90
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00430390
mov eax, edi
call fcn.004e7139
ret
Function at 0x4b5366
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x56f294
call fcn.004e718f
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
and dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.0041ff90
xor ecx, ecx
lea eax, [ebp - 0x834]
push eax
push 0xf013f
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4b53ea
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.0043cf36
push 0
jmp 0x4b54e8
xor ecx, ecx
lea eax, [ebp - 0x830]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push esi
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call esi
test eax, eax
je 0x4b541e
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b53d5
xor ecx, ecx
lea eax, [ebp - 0x82c]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x4b5459
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x4b53d5
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x838], 0x400
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
push dword [ebp - 0x834]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004d2a7b
pop ecx
mov ecx, edi
test eax, eax
jne 0x4b54db
lea eax, [ebp - 0x828]
push eax
call fcn.0043cf36
jmp 0x4b54e7
lea eax, [ebp - 0x810]
push eax
call fcn.0041ff90
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00430390
mov eax, edi
call fcn.004e7139
ret
Function at 0x4b56ef
Capabilities:
Check os version

Disassembly:
push 0x34c
mov eax, 0x56f368
call fcn.004e718f
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x358], esi
push 0x118
push ebx
mov dword [ebp - 0x350], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x571908
mov ecx, esi
call fcn.0041ff90
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x34c], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x32c]
push 0x577f9c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4b57e6
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b57df
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34c]
cmp eax, 5
jne 0x4b5818
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x4b58e4
cmp eax, 1
jne 0x4b580e
mov edi, 0x58a1ac
jmp 0x4b58d4
mov edi, str.WindowsServer2003
jmp 0x4b58d4
cmp eax, 6
jne 0x4b58e4
mov eax, dword [ebp - 0x348]
sub eax, ebx
je 0x4b58c1
sub eax, 1
je 0x4b58ba
mov edi, dword [ebp - 0x338]
sub eax, 1
jne 0x4b58ea
cmp edi, 0x1ebb
jne 0x4b5856
mov edi, str.Windows8
jmp 0x4b58d4
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x4b584f
cmp edi, 0x1f13
je 0x4b584f
cmp dword [ebp - 0x340], 0xa
jne 0x4b588e
cmp dword [ebp - 0x344], 0
jne 0x4b58ea
push str.Windows10
call fcn.004d2a7b
pop ecx
push eax
push str.Windows10
jmp 0x4b58b1
cmp dword [ebp - 0x340], 6
jne 0x4b58ea
cmp dword [ebp - 0x344], 3
jne 0x4b58ea
push str.Windows8.1
call fcn.004d2a7b
pop ecx
push eax
push str.Windows8.1
mov ecx, esi
call fcn.00419cc0
jmp 0x4b58ea
mov edi, str.Windows7
jmp 0x4b58d4
cmp dword [ebp - 0x354], 1
mov edi, str.WindowsVista
je 0x4b58d4
mov edi, str.WindowsServer2008
push edi
call fcn.004d2a7b
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00419cc0
mov edi, dword [ebp - 0x338]
push 0x571908
mov ecx, esi
call fcn.004b331f
test eax, eax
jne 0x4b5958
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004bf1c0
mov eax, dword [ebp - 0x34c]
push edi
push dword [ebp - 0x348]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.004b7428
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x4b593c
mov eax, ebx
jmp 0x4b5949
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00419cc0
cmp dword [ebp + 0xc], 0
je 0x4b5986
cmp word [ebp - 0x320], 0
je 0x4b5977
lea eax, [ebp - 0x320]
push eax
call fcn.004d2a7b
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x320]
mov ecx, esi
push eax
call fcn.0041e910
mov eax, esi
call fcn.004e7139
ret
Function at 0x4b5ba3
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0x20c]
push ebx
push eax
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc18], ebx
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
jmp 0x4b5c9d
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4b5c8f
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc1c], 0x104
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0xc20], 1
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.DisplayName
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b5c83
push dword [ebp - 0xc24]
lea eax, [ebp - 0x414]
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
jne 0x4b5ccb
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4b5bfd
push 0x571908
mov ecx, esi
call fcn.0041ff90
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
push 0x800
lea eax, [ebp - 0xc14]
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0xc1c], 0x400
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.UninstallString
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc14]
push eax
jmp 0x4b5cb1
Function at 0x4b5e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor ebx, ebx
push 0x208
push ebx
push eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x21c], ebx
call fcn.004bf1c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push 0x20019
push ebx
push str.htmlfile
push SysReAllocString
call esi
test eax, eax
je 0x4b5e82
xor eax, eax
jmp 0x4b5f2b
lea eax, [ebp - 0x210]
push eax
push 0x20019
push ebx
push str.shell
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x4b5e7b
lea eax, [ebp - 0x214]
push eax
push 0x20019
push ebx
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x4b5e7b
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x571908
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004c8113
push edi
push eax
call fcn.004bf4ae
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret

Function at 0x4b6269
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 0xa
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret

Function at 0x4b62c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
pop esi
jb 0x4b6316
cmp dword [ebp - 0x118], 2
jb 0x4b6316
xor eax, eax
inc eax
jmp 0x4b6320
cmp dword [ebp - 0x11c], 0xa
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b632e
Capabilities:
Enumerate processes

Disassembly:
push 0x678
mov eax, 0x56f40e
call fcn.004e718f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x67c]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004bf1c0
add esp, 0x18
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b637c
xor eax, eax
jmp 0x4b63e2
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x67c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4b63d4
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x218]
push eax
call fcn.004d5355
lea eax, [ebp - 0x218]
push eax
call fcn.004b5f3c
add esp, 0x10
test al, al
jne 0x4b63e8
lea eax, [ebp - 0x67c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b6395
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
call fcn.004e7139
ret
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
push dword [ebp - 0x674]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
sub esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.0041ff90
sub esp, 0x18
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.0041ff90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.004b348a
xor esi, esi
mov ecx, edi
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.004b708a
lea ecx, [ebp - 0x450]
call fcn.004b34e2
mov eax, esi
jmp 0x4b63e2