joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473b5d
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x50e594]
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x50e594
mov ecx, esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x50e594]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
push 0x104
lea esi, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.004010cd
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push eax
push edi
push edi
push 0x19
push edi
call ebx
push 0x104
lea esi, [ebp - 0xc]
call fcn.004010cd
push eax
push edi
push edi
push 0x10
push edi
call ebx
cmp dword [ebp - 8], edi
jne 0x473bcf
xor eax, eax
jmp 0x473bd8
push dword [ebp - 8]
call fcn.0048650a
pop ecx
lea edx, [ebp - 8]
call fcn.004010ac
mov ebx, dword [ebp - 0xc]
cmp ebx, edi
jne 0x473beb
xor eax, eax
jmp 0x473bf2
push ebx
call fcn.0048650a
pop ecx
lea edx, [ebp - 0xc]
call fcn.004010ac
push edi
push ecx
mov eax, esp
mov esi, 0x4f5b60
push esi
call fcn.00423978
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
call fcn.004736aa
add esp, 0x14
push edi
push ecx
mov eax, esp
push esi
call fcn.00423978
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.004736aa
add esp, 0x14
call fcn.004368cd
mov dword [ebp - 0x20], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 8], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], edi
call fcn.00473963
mov esi, dword [ebp - 0x30]
cmp esi, dword [ebp - 0x2c]
jbe 0x473c68
call fcn.00487f2c
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], esi
jbe 0x473c81
call fcn.00487f2c
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x10]
call fcn.004173ba
test al, al
je 0x473ce5
call fcn.00416489
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x473cd2
test al, 6
jne 0x473cd2
call fcn.00416489
push dword [eax]
lea eax, [ebp - 0x24]
call fcn.004738a5
sub eax, 4
je 0x473cc8
dec eax
je 0x473ccd
dec eax
je 0x473ccd
mov eax, dword [ebp + 0xc]
jmp 0x473ccb
mov eax, dword [ebp + 0x10]
inc dword [eax]
mov eax, dword [ebp + 8]
inc dword [eax]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x2c]
jb 0x473cdf
call fcn.00487f2c
add dword [ebp - 0xc], 4
jmp 0x473c74
lea eax, [ebp - 0x24]
call fcn.00473d0f
lea eax, [ebx - 0x10]
call fcn.00401023
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
lea esi, [ebp - 0x34]
call fcn.0040709c
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4743f7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and word [ebp - 0x18], 0
push esi
push edi
mov esi, eax
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x18]
push 0xb
push eax
push 0x4ee0dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jbe 0x474442
push 0xa
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0048b8f4
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x47444a
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, eax
mov ecx, 0x50e594
call fcn.0040f75c
xor ecx, ecx
push 2
pop edx
mov eax, 0x104
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00485550
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4744b9
push 0x208
push 0
push ebx
call fcn.00486d70
mov eax, dword [esp + 0x18]
add esp, 0xc
push dword [eax]
push 0x104
push ebx
push 0x4ee0dc
push str.kp_lock
push 0x4f02ac
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push ebx
push esi
call fcn.004152cd
push ebx
call fcn.004883a2
pop ecx
jmp 0x4744c4
push 0x4ee0dc
push esi
call fcn.004152cd
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x4744cb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [esi]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
lea ecx, [ebp - 8]
push ecx
mov ecx, esi
call dword [eax + 4]
xor ebx, ebx
inc ebx
test al, al
je 0x47451a
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
mov dword [ebp - 0xc], ebx
call dword [eax + 8]
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov byte [ebp - 1], bl
je 0x47451e
mov byte [ebp - 1], 0
test byte [ebp - 0xc], bl
pop ebx
je 0x47452f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [ebp - 8], 0
je 0x47453e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
leave
ret
Function at 0x47460b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallkbasesrv
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.00414c55
test eax, eax
je 0x474643
cmp dword [ebp - 4], edi
je 0x47463f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4746bc
mov eax, dword [0x50e594]
push ebx
mov ecx, 0x50e594
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push str.UninstallString
push eax
lea ebx, [ebp - 8]
call fcn.004746bf
test al, al
pop ecx
pop ecx
pop ebx
jne 0x47467c
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
jmp 0x474631
push esi
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [esi - 0x10]
jne 0x4746a6
call fcn.00401023
cmp dword [ebp - 4], edi
je 0x4746a2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4746bb
call fcn.00401023
cmp dword [ebp - 4], edi
je 0x4746b9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop edi
leave
ret

Function at 0x474823
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [0x50e594]
push edi
mov ecx, 0x50e594
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
call fcn.00474f22
test eax, eax
je 0x474854
lea eax, [ebp - 4]
push eax
call fcn.00474de4
jmp 0x474879
push str.idex
lea eax, [ebp - 8]
call fcn.00423978
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0047498d
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401023
cmp dword [esi + 0x18], 8
jb 0x474884
mov eax, dword [esi + 4]
jmp 0x474887
lea eax, [esi + 4]
push eax
lea eax, [ebp - 8]
call fcn.00423978
mov edi, dword [ebp - 4]
cmp dword [edi - 0xc], 0
mov esi, dword [ebp - 8]
jg 0x4748a1
xor ebx, ebx
inc ebx
jmp 0x4748b8
push esi
push 0xffffffffffffffff
push edi
push str.ulst
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
lea eax, [esi - 0x10]
call fcn.00401023
test ebx, ebx
je 0x4748d0
lea eax, [ebp - 4]
push eax
call fcn.00474de4
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov eax, edi
call fcn.0042cdeb
lea eax, [edi - 0x10]
call fcn.00401023
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x47498d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0xc], esi
mov word [ebp - 0x218], si
call fcn.00486d70
add esp, 0xc
xor edi, edi
inc edi
push edi
push str.CLSID8AB9CCC4_75EC_438b_B6C0_D8D78882A12DImplemented_Categories6BC04964_67B7_4d50_BB9B_3653A5C305B3
mov dword [ebp - 4], esi
push SysReAllocString
lea esi, [ebp - 4]
call fcn.00440797
test eax, eax
je 0x4749df
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
jmp 0x4749fb
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [edi]
push eax
lea ebx, [ebp - 4]
call fcn.00424eca
test eax, eax
je 0x4749fb
mov dword [ebp - 0xc], 1
mov eax, dword [0x50e594]
mov ecx, 0x50e594
xor ebx, ebx
call dword [eax + 0xc]
add eax, 0x10
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.00474e17
test eax, eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
je 0x474a40
mov eax, dword [edi]
push esi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push ebx
push eax
push 0x4f71f0
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x474a71
test ebx, ebx
ja 0x474a58
push dword [ebp + 0xc]
push edi
call fcn.00474aa1
mov dword [ebp - 8], eax
jmp 0x474a80
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.004152cd
mov dword [ebp - 8], 1
jmp 0x474a78
test ebx, ebx
ja 0x474a80
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.00474fba
lea eax, [esi - 0x10]
call fcn.00401023
cmp dword [ebp - 4], 0
je 0x474a97
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x474e7b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x206]
push esi
push eax
mov word [ebp - 0x208], si
call fcn.00486d70
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x474f1d
push 1
push 0x23
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
mov esi, 0x104
jne 0x474ee8
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
je 0x474f1d
lea eax, [ebp - 0x208]
push str.All_UsersApplication_Data
push eax
call fcn.0042fce5
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push str.KingsoftKIS_
push eax
call fcn.0042fce5
lea eax, [ebp - 0x208]
push eax
call fcn.0048650a
add esp, 0xc
cmp eax, esi
jae 0x474f1d
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.0048cd25
pop ecx
pop ecx
pop esi
leave
ret 4

Function at 0x4768d6
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x50e594]
push esi
push edi
xor edi, edi
mov ecx, 0x50e594
mov dword [ebp - 8], edi
call dword [eax + 0xc]
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esi, 0x10
cmp dword [eax - 0xc], edi
mov dword [ebp - 4], esi
je 0x4769b0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp dword [eax - 0xc], edi
je 0x4769b0
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x4769b0
push 0x4f74d0
mov eax, ebx
lea ecx, [ebp - 0xc]
call fcn.00415360
pop ecx
lea edi, [ebp - 4]
call fcn.00424a4a
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401023
mov esi, dword [ebp - 4]
push esi
call fcn.004730af
test eax, eax
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop ecx
je 0x476959
push esi
call edi
push dword [ebx]
call fcn.004730af
test eax, eax
pop ecx
je 0x476969
push dword [ebx]
call edi
push esi
call fcn.004730af
test eax, eax
pop ecx
jne 0x4769b0
push dword [ebx]
call fcn.004730af
test eax, eax
pop ecx
jne 0x4769b0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push eax
call fcn.004725b7
test eax, eax
pop ecx
pop ecx
jne 0x4769b0
push dword [ebp + 0xc]
lea eax, [ebp - 4]
call fcn.004769c1
test eax, eax
mov dword [ebp - 8], eax
je 0x4769b0
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov dword [ebp - 8], eax
lea eax, [esi - 0x10]
call fcn.00401023
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 8
Function at 0x4781f3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x50e594]
push ebx
push esi
push edi
mov edi, 0x50e594
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x50e594]
mov ecx, edi
call dword [eax + 0xc]
mov ebx, eax
mov eax, dword [0x50e594]
add ebx, 0x10
mov ecx, edi
mov dword [ebp - 8], ebx
call dword [eax + 0xc]
and word [ebp - 0x220], 0
add eax, 0x10
push 0x206
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21e]
push 0
push eax
call fcn.00486d70
add esp, 0xc
lea edi, [ebp - 4]
call fcn.0047840c
mov edi, eax
test edi, edi
je 0x478368
push dword [ebp - 4]
call fcn.004730af
mov edi, eax
test edi, edi
pop ecx
je 0x478368
push dword [ebp - 4]
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0x4ee0dc
push str.cldcfg
mov esi, 0x4e6838
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x478368
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
call fcn.004152cd
push dword [ebp - 4]
xor edi, edi
push edi
push str.item_count
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x478368
xor eax, eax
cmp dword [ebp - 0x10], eax
jle 0x478360
inc eax
push eax
mov dword [ebp - 0x14], eax
push str.item__d
lea eax, [ebp - 0xc]
call fcn.0042318c
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00486d70
add esp, 0x14
push dword [ebp - 4]
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0x4ee0dc
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x478365
lea eax, [ebp - 0x220]
push eax
call fcn.0048650a
pop ecx
lea ecx, [ebp - 0x220]
mov ebx, eax
push ecx
lea eax, [ebp - 8]
call fcn.004152f3
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.004070d4
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x4782df
mov ebx, dword [ebp - 8]
xor edi, edi
inc edi
jmp 0x478368
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
lea eax, [ebx - 0x10]
call fcn.00401023
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401023
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47838d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x50e594]
push edi
mov ecx, 0x50e594
call dword [eax + 0xc]
add eax, 0x10
lea edi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0047802c
mov edi, eax
test edi, edi
je 0x4783fc
push esi
push dword [ebp - 4]
call fcn.004730af
test eax, eax
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop ecx
je 0x4783d2
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
je 0x4783fb
lea edi, [ebp - 4]
call fcn.0047840c
mov edi, eax
test edi, edi
je 0x4783fb
push dword [ebp - 4]
call fcn.004730af
test eax, eax
pop ecx
je 0x4783f8
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
je 0x4783fb
xor edi, edi
inc edi
pop esi
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
mov eax, edi
pop edi
leave
ret
Function at 0x4785c1
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
mov ecx, 0x50e594
call fcn.0040f75c
push dword [ebp + 8]
xor edi, edi
lea ebx, [esi + 0xc]
push esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [ebx], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.004152cd
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, edi
mov dword [esi + 4], eax
je 0x47866c
push eax
call fcn.00485550
cmp eax, edi
pop ecx
mov dword [esi + 8], eax
je 0x47866c
push dword [esi + 4]
push edi
push eax
call fcn.00486d70
add esp, 0xc
push dword [esi + 8]
push dword [esi + 4]
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x478642
push dword [esi + 8]
call fcn.00486f20
pop ecx
mov dword [esi + 8], edi
jmp 0x47866c
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x14]
push eax
push 0x4e66bc
push dword [esi + 8]
mov dword [ebp + 8], edi
call sub.VERSION.dll_VerQueryValueW
lea eax, [esi + 0x10]
push eax
push ebx
push str.VarFileInfoTranslation
push dword [esi + 8]
call sub.VERSION.dll_VerQueryValueW
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x47c0a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x508464]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x47c0e9
mov eax, dword [ebp - 0x414]
jmp 0x47c19c
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0xc], 0x200
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x47c175
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x418]
push eax
call fcn.0047c0a0
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x47c16c
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x414]
jmp 0x47c19c
mov dword [ebp - 0xc], 0x200
jmp 0x47c0fa
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e9d6
mov esp, ebp
pop ebp
ret
Function at 0x47d530
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcabb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x508464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00486d70
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4ea7cc]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048ab83
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004cc850
push eax
call fcn.004cc860
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47d5d5
jmp 0x47d68a
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042c410
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.0048ab83
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042c41c
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e9d6
mov esp, ebp
pop ebp
ret 8
Function at 0x47dad0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcabb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x508464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00486d70
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [str.SELECT__FROM_Win32_BIOS]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048ab83
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004cc850
push eax
call fcn.004cc860
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47db75
jmp 0x47dc08
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042c410
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.0048ab83
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042c41c
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e9d6
mov esp, ebp
pop ebp
ret 8
Function at 0x47f080
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcabb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x508464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00486d70
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x4ea9b4]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.0048ab83
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.004cc850
push eax
call fcn.004cc860
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x47f125
jmp 0x47f1fe
mov eax, dword [ebp + 8]
add eax, 4
lea esi, [ebp - 0x224]
call fcn.0042c410
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x1ac
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x190
push eax
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x33c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x320
push edx
call fcn.0048ab83
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x4cc
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x4b0
push ecx
call fcn.0048ab83
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x65c]
mov dword [edx + 0x640], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x660]
mov dword [edx + 0x644], ecx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
call fcn.0042c41c
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e9d6
mov esp, ebp
pop ebp
ret 8