joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abe30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0xfe
push eax
lea ecx, [ebp - 0x106]
push ecx
mov word [ebp - 0x108], ax
call fcn.004e7d90
add esp, 0xc
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x206]
push eax
mov word [ebp - 0x208], dx
call fcn.004e7d90
add esp, 0xc
push 0x110
lea ecx, [ebp - 0x31c]
push 0
push ecx
call fcn.004e7d90
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea edx, [ebp - 0x320]
push edx
mov dword [ebp - 0x320], 0x114
call esi
push 0x11c
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x440]
push ecx
mov dword [ebp - 0x440], 0x11c
call esi
cmp dword [ebp - 0x43c], 6
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
jne 0x4abefb
lea edx, [ebp - 0x208]
lea ecx, [ebp - 0x108]
call fcn.004aa5f0
jmp 0x4abf6a
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4abf1f
cmp al, 5
jne 0x4abf1f
lea ebx, [ebp - 0x208]
lea ecx, [ebp - 0x108]
call fcn.004aa150
jmp 0x4abf6a
xor eax, eax
movzx ecx, word [eax + str.Windows]
mov word [ebp + eax - 0x108], cx
add eax, 2
test cx, cx
jne 0x4abf21
lea eax, [ebp - 0x30c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4abf41
sub eax, edx
sar eax, 1
je 0x4abf6a
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x208]
push str.___s_
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push str._s_t_t_t_t_t_t_t_t_t_tSystem_t
push edi
call esi
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4abf81
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub eax, edx
sar eax, 1
mov edx, 1
mov word [edi + eax*2], dx
lea eax, [ebp - 0x444]
push eax
push 0x208
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x444], 0
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4abfeb
mov ecx, dword [ebp - 0x444]
push edi
push 0x209
push ecx
call fcn.004ac0e0
mov edx, dword [ebp - 0x444]
add esp, 0xc
push edx
call ebx
call fcn.004bc7d0
test eax, eax
je 0x4ac030
lea eax, [ebp - 0x444]
push eax
push 0x108
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4ac030
mov ecx, dword [ebp - 0x444]
push edi
push 0x109
push ecx
call fcn.004ac0e0
mov edx, dword [ebp - 0x444]
add esp, 0xc
push edx
call ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4ac8f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.004f18a0
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push 0x3fe
lea ecx, [ebp - 0x402]
xor eax, eax
push ebx
xor edi, edi
push ecx
mov dword [ebp - 0x1020], esi
mov dword [ebp - 0x1010], edi
mov dword [ebp - 0x100c], ebx
mov dword [ebp - 0x1008], ebx
mov word [ebp - 0x404], ax
call fcn.004e7d90
add esp, 0xc
push 0x200
lea edx, [ebp - 0x404]
push edx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4acb3e
mov eax, dword [ebp + 8]
or eax, 1
mov dword [ebp - 0x1024], eax
mov edi, edi
push 0x7fe
lea ecx, [ebp - 0x1002]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x1004], ax
call fcn.004e7d90
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionUninstall_]
mov word [ebp + eax - 0x1004], cx
add eax, 2
cmp cx, bx
jne 0x4ac990
lea eax, [ebp - 0x404]
mov esi, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4ac9b0
lea edi, [ebp - 0x1004]
sub eax, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4ac9c6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x1024]
lea edx, [ebp - 0x100c]
push edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebx
lea ecx, [ebp - 0x1004]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4acad6
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, 4
lea edx, [ebp - 0x101c]
push edx
mov edx, dword [ebp - 0x100c]
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x101c], eax
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1018]
push ecx
push ebx
push str.SystemComponent
push edx
mov dword [ebp - 0x1014], ebx
call esi
mov edi, 1
test eax, eax
jne 0x4aca5f
cmp dword [ebp - 0x1014], edi
je 0x4acadb
push 0x3fe
lea ecx, [ebp - 0x802]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x804], ax
call fcn.004e7d90
mov ecx, dword [ebp - 0x100c]
add esp, 0xc
lea edx, [ebp - 0x1028]
push edx
lea eax, [ebp - 0x804]
push eax
push ebx
push ebx
push str.DisplayName
push ecx
mov dword [ebp - 0x1028], 0x200
call esi
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4acab0
sub eax, edx
sar eax, 1
je 0x4acac7
add dword [ebp - 0x1010], edi
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4acadb
mov edi, 1
add dword [ebp - 0x1008], edi
push 0x3fe
lea ecx, [ebp - 0x402]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x404], ax
call fcn.004e7d90
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x1020]
add esp, 0xc
push 0x200
lea edx, [ebp - 0x404]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4ac970
mov eax, dword [ebp - 0x1010]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4afc60
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53b5fe], 0
push esi
mov esi, ecx
jne 0x4afc93
push 0x400
push 0x53b2c0
mov byte [0x53b5fe], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0x53b2c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 3
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4afd20
xor eax, eax
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0x2d1080
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4afd20
mov eax, dword [ebp - 0x10]
cmp eax, 0x3e8
jae 0x4afd20
shl eax, 8
add eax, dword [ebp - 0xc]
push edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x53b2c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x53b2c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4b0d90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x10], eax
xor esi, esi
mov eax, 1
mov ecx, esi
shl eax, cl
test dword [ebp - 0x10], eax
je case.0x4b0de9.3
lea edx, [esi + 0x41]
mov word [ebp - 0xc], dx
lea eax, [ebp - 0xc]
xor edx, edx
push eax
mov dword [ebp - 0xa], 0x5c003a
mov word [ebp - 6], dx
call ebx
dec eax
cmp eax, 5
ja case.0x4b0de9.3
jmp dword [eax*4 + 0x4b0ec4]
mov ecx, 0x39
mov word [edi + esi*2], cx
jmp case.0x4b0de9.3
mov ecx, 0x5268b4
lea eax, [ebp - 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b0e2c
test dx, dx
je 0x4b0e28
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b0e2c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b0e06
xor eax, eax
jmp 0x4b0e31
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4b0e7a
mov ecx, 0x5268bc
lea eax, [ebp - 0xc]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b0e66
test dx, dx
je 0x4b0e62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b0e66
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b0e40
xor eax, eax
jmp 0x4b0e6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4b0e7a
mov edx, 0x37
mov word [edi + esi*2], dx
jmp case.0x4b0de9.3
mov eax, 0x31
jmp 0x4b0ea1
cmp esi, 1
jle 0x4b0e91
mov ecx, 0x37
mov word [edi + esi*2], cx
jmp case.0x4b0de9.3
mov edx, 0x31
mov word [edi + esi*2], dx
jmp case.0x4b0de9.3
mov eax, 0x32
mov word [edi + esi*2], ax
inc esi
cmp esi, 0x1a
jl 0x4b0db3
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4b5f50
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add edi, 0xfffff
adc edx, 0
shrd edi, edx, 0x14
shr edx, 0x14
add ebx, 0xfffff
adc eax, 0
shrd ebx, eax, 0x14
push 0x200
shr eax, 0x14
call fcn.004e4240
push 0x200
mov esi, eax
push 0
push esi
call fcn.004e7d90
push ebx
push edi
push str._d_t_d_t
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, esi
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b5fd5
sub eax, edx
sar eax, 1
mov ecx, 1
mov word [esi + eax*2], cx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b5ff2
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
cmp edx, 0x100
jae 0x4b6022
mov edx, dword [ebp - 0x50]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4b6013
push esi
call fcn.004e424b
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4bb880
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x4bb8e5
cmp dword [ebp - 0x118], 0
jne 0x4bb8e5
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bb900
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x4bb956
mov eax, 1
cmp dword [ebp - 0x118], eax
je 0x4bb958
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bb970
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, 2
cmp dword [ebp - 0x88], eax
jne 0x4bb9e2
cmp dword [ebp - 0x94], 5
jne 0x4bb9e2
cmp dword [ebp - 0x90], eax
jne 0x4bb9e2
lea ecx, [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0xbc], 9
jne 0x4bb9e2
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bba00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x4bba71
cmp dword [ebp - 0x118], 2
jne 0x4bba71
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4bba71
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4bba90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bbaec
cmp dword [ebp - 0x118], 0
jne 0x4bbaec
mov eax, 1
cmp byte [ebp - 6], al
je 0x4bbaee
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bbb00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bbb5b
mov eax, 1
cmp dword [ebp - 0x118], eax
jne 0x4bbb5b
cmp byte [ebp - 6], al
je 0x4bbb5d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bbb70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bbbcc
cmp dword [ebp - 0x118], 0
jne 0x4bbbcc
mov eax, 1
cmp byte [ebp - 6], al
jne 0x4bbbce
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bbbe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bbc3b
mov eax, 1
cmp dword [ebp - 0x118], eax
jne 0x4bbc3b
cmp byte [ebp - 6], al
jne 0x4bbc3d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bbc50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bbcac
cmp dword [ebp - 0x118], 2
jne 0x4bbcac
mov eax, 1
cmp byte [ebp - 6], al
je 0x4bbcae
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4bbf10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bbf6c
cmp dword [ebp - 0x118], 2
jne 0x4bbf6c
mov eax, 1
cmp byte [ebp - 6], al
jne 0x4bbf6e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4bc720
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x4bc778
cmp dword [ebp - 0x118], 1
jne 0x4bc778
cmp byte [ebp - 6], 1
jne 0x4bc7b3
call fcn.004bba00
test eax, eax
jne 0x4bc7b3
call fcn.004bbf10
test eax, eax
jne 0x4bc7b3
call fcn.004bbb70
test eax, eax
jne 0x4bc7b3
call fcn.004bba00
test eax, eax
jne 0x4bc7b3
call fcn.004bb880
test eax, eax
jne 0x4bc7b3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.004e3946
mov esp, ebp
pop ebp
ret

Function at 0x4bc850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e7d90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4bcc50
Capabilities:
Enumerate device drivers on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov ebx, ecx
mov byte [ebp - 0x110], 0
call fcn.004e7d90
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x103
lea edx, [ebp - 0x4ef]
push 0
push edx
mov byte [ebp - 0x4f0], 0
call fcn.004e7d90
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x4f0]
push str._sdriverquery.exe
push ecx
call fcn.004e5066
push 0xc7
lea edx, [ebp - 0x2df]
push 0
push edx
mov dword [ebp - 0x644], 0
call fcn.004e7d90
mov ecx, 9
mov esi, str.SYSTEMCurrentControlSet_servicesSmrf
lea edi, [ebp - 0x2e0]
rep movsd dword es:[edi], dword [esi]
add esp, 0x24
lea eax, [ebp - 0x644]
push eax
push 1
push 0
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x2e0]
push ecx
push reloc.WS2_32.dll_bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bce50
mov edx, dword [ebp - 0x644]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.004e7d90
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x218]
push str._sdriversSmrf.sys
push edx
call fcn.004e5066
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004e5d05
add esp, 0x20
test eax, eax
jne 0x4bce23
lea ecx, [ebp - 0x640]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x62c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x500]
push edx
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x103
lea ecx, [ebp - 0x3e7]
push 0
push ecx
mov byte [ebp - 0x3e8], 0
call fcn.004e7d90
movzx edx, word [ebp - 0x4fa]
movzx eax, word [ebp - 0x4fe]
movzx ecx, word [ebp - 0x500]
push edx
push eax
push ecx
lea edx, [ebp - 0x3e8]
push str._04u_02u_02u
push edx
call fcn.004e5066
push ebx
lea ebx, [ebp - 0x3e8]
call fcn.004bb6e0
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov eax, 0x5206c4
mov edx, ebx
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4bce30
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov eax, 0x5206c4
mov edx, ebx
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4bce60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
Function at 0x4c2430
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 0x424], eax
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x53b5fd], bl
je 0x4c262f
lea ecx, [ebp - 0x410]
push ecx
push 0x502118
push 1
push ebx
push 0x5021e8
mov dword [ebp - 0x410], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4c2629
mov eax, dword [ebp - 0x410]
lea ecx, [ebp - 0x414]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x414], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x52619c
push eax
call edx
test eax, eax
js 0x4c261b
mov eax, dword [ebp - 0x414]
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [ebp - 0x414]
js 0x4c2613
lea edx, [ebp - 0x418]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_DesktopMonitor
mov dword [ebp - 0x418], ebx
mov ecx, dword [eax]
push 0x526208
push eax
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
js 0x4c260d
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
cmp eax, ebx
je 0x4c2605
mov ecx, dword [eax]
lea edx, [ebp - 0x420]
push edx
lea edx, [ebp - 0x41c]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [ebp - 0x420], ebx
je 0x4c25e7
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [ebp - 0x434]
push edx
push ebx
push str.Name
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp word [ebp - 0x434], 1
je 0x4c25ca
push 0x3fe
lea edx, [ebp - 0x40a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x40c], cx
call fcn.004e7d90
mov eax, dword [ebp - 0x42c]
lea edx, [ebp - 0x40c]
add esp, 0xc
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4c25a0
mov ebx, dword [ebp - 0x424]
push 0xcc
lea edi, [ebp - 0x40c]
call fcn.004c0b90
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x418]
cmp eax, ebx
jne 0x4c2525
jmp 0x4c25ed
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x41c]
cmp ecx, ebx
je 0x4c2605
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret