joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447078
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4470ad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c4c
jmp 0x4470b7
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403bb8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x448010
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x448048
mov eax, esi
call fcn.0042f648
test al, al
je 0x448048
mov eax, dword [ebx + 0x74]
call fcn.0042f34c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x448048
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042f34c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x44ab14
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0044a778
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403fa8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x44ab72
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45ba18]
mov dl, 1
mov eax, dword [0x44a670]
call fcn.0040a1a0
call fcn.004035b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44ab7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403fa8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x44abd4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45bbec]
mov dl, 1
mov eax, dword [0x44a670]
call fcn.0040a1a0
call fcn.004035b0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044a7a8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44bf70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403f98
xor eax, eax
push ebp
push 0x44bfee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403fa8
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x44bfb9
mov eax, dword [ebx + 4]
call fcn.00403fa8
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bff5
lea eax, [ebp - 4]
call fcn.00403b64
ret
Function at 0x44cf90
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44d127
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040295c
cmp word [ebx + 0x9a], 0
je 0x44cfd9
mov edx, ebx
mov eax, dword [ebx + 0x9c]
call dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44cfed
lea esi, [ebp - 8]
jmp 0x44cfef
xor esi, esi
cmp dword [ebx + 0x78], 0
jne 0x44cff9
xor edi, edi
jmp 0x44d003
mov eax, dword [ebx + 0x78]
call fcn.00403fa8
mov edi, eax
mov eax, dword [ebx + 0x74]
call fcn.00403fa8
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044c724
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
push esi
mov eax, dword [ebx + 0x6c]
call fcn.00403fa8
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
mov eax, ebx
call fcn.0044c858
push eax
mov eax, ebx
call fcn.0044c82c
push eax
mov eax, ebx
call fcn.0044c7e0
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044c5f8
mov eax, dword [ebp - 0x18]
call fcn.00403fa8
push eax
mov eax, dword [ebx + 8]
call fcn.00403fa8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x88], eax
cmp dword [ebp - 0xc], 0
jne 0x44d08c
call fcn.0040b114
xor edx, edx
push ebp
push 0x44d105
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x44d0ca
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xa2], 0
je 0x44d0c0
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d0ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d10c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x44d138
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44d164
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d189
call fcn.0040b114
xor eax, eax
push ebp
push 0x44d1c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x44d1a9
call fcn.0040b114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d1c7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x44ff44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450080
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x450098
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.004511c4
mov eax, dword [ebp - 4]
call fcn.00450a54
xor edx, edx
push ebp
push 0x450063
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x450002
test si, si
jne 0x44ffb4
mov eax, dword [ebp - 8]
call fcn.0040906c
mov esi, eax
cmp esi, 0xffff
jbe 0x44ffb4
call fcn.00402d98
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x450002
cmp eax, 0xffffffff
jle 0x44ffe3
sub ebx, eax
jmp 0x44fff2
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.004510f8
test ebx, ebx
je 0x450002
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x44ffb7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45004d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4500b0
mov dl, 1
mov eax, dword [0x44f464]
call fcn.0040a0a8
call fcn.004035b0
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x45004d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45006a
mov eax, dword [ebp - 4]
call fcn.00450aac
ret
Function at 0x451000
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4510cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4510e0
mov dl, 4
mov eax, ebx
call fcn.004511c4
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x4510b6
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x4510a8
test byte [ebx + 0x20], 8
jne 0x451065
cmp word [ebx + 0x1004a], 0
je 0x451065
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x4510b6
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x451088
call fcn.00402d98
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4510b6
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.004510f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4510d3
lea eax, [ebp - 4]
call fcn.00403b64
ret

Function at 0x45126c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x4512a8
mov dl, 8
mov eax, ebx
call fcn.004511c4
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x45129a
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x4512b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4512bf
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x45130c
mov dl, 8
mov eax, ebx
call fcn.004511c4
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret
Function at 0x40800a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x4080a2
push 0x432ccc
push 4
push eax
call fcn.004141fe
push eax
call fcn.004022a0
add esp, 0x10
push ebx
push edi
call fcn.004163b3
mov edi, dword [eax]
call fcn.004163b3
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00414d13
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004163b3
cmp dword [eax], ebx
je 0x4080b9
call fcn.004163b3
push dword [eax]
call fcn.004064f8
pop ecx
jmp 0x4080c0
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40804d
jmp 0x408147
call fcn.004163b3
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x408143
cmp dword [ebp - 0x234], esi
jae 0x408143
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00413bd0
add esp, 0xc
push 0x432a2c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x408132
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x408132
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x408132
push ebx
push ebx
push esi
jmp 0x40813b
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x408145
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413af2
leave
ret

Function at 0x413af2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441cc0]
jne 0x413afc
repz ret
jmp fcn.00419784
Function at 0x421980
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419193
and dword [ebp - 4], 0
cmp dword [0x445cb0], 0
mov ebx, eax
jne 0x421a31
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421ae2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421ae2
push eax
call fcn.00419121
mov dword [esp], 0x435128
push edi
mov dword [0x445cb0], eax
call esi
push eax
call fcn.00419121
mov dword [esp], 0x435114
push edi
mov dword [0x445cb4], eax
call esi
push eax
call fcn.00419121
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x445cb8], eax
call esi
push eax
call fcn.00419121
pop ecx
mov dword [0x445cc0], eax
test eax, eax
je 0x421a31
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419121
pop ecx
mov dword [0x445cbc], eax
mov eax, dword [0x445cbc]
cmp eax, ebx
je 0x421a89
cmp dword [0x445cc0], ebx
je 0x421a89
push eax
call fcn.0041919c
push dword [0x445cc0]
mov esi, eax
call fcn.0041919c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421a89
test edi, edi
je 0x421a89
call esi
test eax, eax
je 0x421a80
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421a80
test byte [ebp - 0xc], 1
jne 0x421a89
or dword [ebp + 0x10], 0x200000
jmp 0x421ac2
mov eax, dword [0x445cb4]
cmp eax, ebx
je 0x421ac2
push eax
call fcn.0041919c
pop ecx
test eax, eax
je 0x421ac2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421ac2
mov eax, dword [0x445cb8]
cmp eax, ebx
je 0x421ac2
push eax
call fcn.0041919c
pop ecx
test eax, eax
je 0x421ac2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445cb0]
call fcn.0041919c
pop ecx
test eax, eax
je 0x421ae2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421ae4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a680
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x42a6ba
mov eax, 1
jmp 0x42a6bc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413af2
mov esp, ebp
pop ebp
ret

Function at 0x42a720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.004055d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret
Function at 0x42aa90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b79
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], 0
mov ax, word [0x437c54]
mov word [ebp - 0x224], ax
push 0x208
push 0
lea ecx, [ebp - 0x222]
push ecx
call fcn.00413bd0
add esp, 0xc
push 0x437c58
lea ecx, [ebp - 0x228]
call fcn.004024e0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42ab7d
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402960
call fcn.00404ac0
test eax, eax
je 0x42ab6b
mov dword [ebp - 0x22c], 0xffffffff
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [ebp - 0x22c]
push edx
push str.unpack_d.log
lea eax, [ebp - 0x228]
push eax
call fcn.004032a0
add esp, 0xc
jmp 0x42ab7b
push str.unpack.log
lea ecx, [ebp - 0x228]
call fcn.004034f0
jmp 0x42abf5
push 0x104
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x228]
call fcn.00402960
call fcn.00404ac0
test eax, eax
je 0x42abe5
mov dword [ebp - 0x230], 0xffffffff
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [ebp - 0x230]
push ecx
push str.Tempunpack_d.log
lea edx, [ebp - 0x228]
push edx
call fcn.004032a0
add esp, 0xc
jmp 0x42abf5
push str.Tempunpack.log
lea ecx, [ebp - 0x228]
call fcn.004034f0
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402d10
mov ecx, dword [ebp - 0x234]
or ecx, 1
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00402ac0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413af2
mov esp, ebp
pop ebp
ret
Function at 0x42ac50
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00413bd0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42ad69
push 0x436c1c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ad08
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42ad08
cmp dword [0x445d74], 0
je 0x42ad04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x436c30
push 0x436c38
push 3
call dword [0x445d74]
add esp, 0x10
xor eax, eax
jne 0x42acdf
push 0x436c60
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ad67
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42ad67
cmp dword [0x445d74], 0
je 0x42ad63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x436c6c
push str.__s__ESA_Folder:_CreateFile_failed:__d
push 3
call dword [0x445d74]
add esp, 0x10
xor ecx, ecx
jne 0x42ad3e
jmp 0x42ad8d
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004024e0
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413af2
mov esp, ebp
pop ebp
ret
Function at 0x42adc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430bac
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
call fcn.00403d40
cmp dword [ebp - 0x14], 0xffffffff
je 0x42aeea
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42aed9
lea ecx, [ebp - 0x250]
call fcn.00402aa0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x250]
call fcn.00402960
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x250]
call fcn.00401090
test eax, eax
jne 0x42aeb3
cmp dword [ebp + 0x10], 0xffffffff
je 0x42aea4
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x42aea2
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x42aea2
lea ecx, [ebp - 0x244]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00404ad0
jmp 0x42aeb3
lea edx, [ebp - 0x244]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00404ad0
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ae4b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00402ac0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413af2
mov esp, ebp
pop ebp
ret
Function at 0x42b040
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430c7b
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, word [0x437c00]
mov word [ebp - 0x81c], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x81a]
push ecx
call fcn.00413bd0
add esp, 0xc
lea edx, [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3ff
lea edx, [ebp - 0x81c]
push edx
call fcn.00413e44
add esp, 0x10
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00405750
lea ecx, [ebp - 0x820]
call fcn.00402aa0
mov dword [ebp - 4], 0
push str._Y__m__d__H:_M:_S
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00405660
mov dword [ebp - 0x828], eax
mov edx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], edx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x81c]
push eax
mov ecx, dword [ebp - 0x82c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.__d__s___s__Last_d_
lea eax, [ebp - 0x820]
push eax
call fcn.00402140
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x824]
call fcn.00402ac0
lea ecx, [ebp - 0x820]
call fcn.004055d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x820]
call fcn.004055d0
push eax
call fcn.0042afe0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x820]
call fcn.00402ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413af2
mov esp, ebp
pop ebp
ret