joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d790
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x52de80]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x5549c4]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.004bbc06
add esp, 4
mov edi, 0x100
jmp 0x41d7f0
mov esi, dword [0x55b9e0]
xor dl, dl
test esi, esi
jle 0x41d828
lea esp, [esp]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x41d823
mov eax, dword [esi*4 + 0x55b040]
test eax, eax
je 0x41d823
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x41d800
dec edi
test edi, edi
jle 0x41d831
test dl, dl
jne 0x41d7f0
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret

Function at 0x41fbc8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [0x52de80]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esp + 4]
push edi
mov edi, dword [ebp + 8]
push 0x58
push 0
push eax
call fcn.004bf1a0
push dword [ebp + 0x10]
and dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
and dword [esp + 0x28], 0
mov edx, esi
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0041fc98
push 8
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x78]
call fcn.00420431
mov edx, dword [esp + 0x2c]
push 0x38
pop ecx
shr edx, 3
and edx, 0x3f
push 0x78
sub ecx, edx
pop eax
sub eax, edx
cmp edx, 0x38
mov edx, 0x5549d0
cmovb eax, ecx
lea ecx, [esp + 0x1c]
push eax
call fcn.0041fc98
push 8
lea edx, [esp + 0x80]
lea ecx, [esp + 0x24]
call fcn.0041fc98
push 0x10
lea edx, [esp + 0x28]
mov ecx, edi
call fcn.00420431
mov ecx, dword [esp + 0x8c]
add esp, 0x20
pop edi
pop esi
xor ecx, esp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret
Function at 0x420d54
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
test edx, edx
je 0x420e1c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x420e1b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x420e1b
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x420e1b
mov dword [edx], esi
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ecx], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x420e1b
push eax
call fcn.004badc8
mov edi, eax
pop ecx
test edi, edi
je 0x420e1b
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x420e14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x50c8cc
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x420e14
cmp dword [ebp - 8], esi
jbe 0x420e11
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ecx + 0x10]
mov dword [edx], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor esi, esi
inc esi
push edi
call fcn.004bbc06
pop ecx
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421341
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
mov edi, ecx
push 0x286
push eax
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x28a]
push eax
call fcn.004bf1a0
add esp, 0xc
lea eax, [ebp - 0x28c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.kdumpcfg.dat
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4214db
test al, 0x10
jne 0x4214db
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x28c]
push eax
xor ebx, ebx
inc ebx
push ebx
push str.autorecovery
push 0x50e7a8
call esi
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x28c]
push eax
push 0
push str.checkbrowsercrash
push 0x50e7a8
call esi
mov dword [edi + 8], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.checkbsod
push 0x50e7a8
call esi
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.checkdriverversion
push 0x50e7a8
call esi
mov dword [edi + 0x14], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.deletedump
push 0x50e7a8
call esi
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.enablereport
push 0x50e7a8
call esi
mov dword [edi], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.scanissuefile
push 0x50e7a8
call esi
mov dword [edi + 4], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.silentreport
push 0x50e7a8
call esi
mov dword [edi + 0x18], eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push str.checkonlinesolution
push 0x50e7a8
call esi
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x28c]
push eax
push 6
push str.bsoddelayhour
push 0x50e7a8
call esi
mov dword [edi + 0x24], eax
lea eax, [ebp - 0x28c]
push eax
push 0xffff
push 0x50e8c0
push 0x50e7a8
call esi
mov dword [edi + 0x28], eax
mov eax, ebx
pop esi
jmp 0x421509
and dword [edi + 8], 0
xor ebx, ebx
inc ebx
mov dword [edi + 0x24], 6
mov dword [edi + 0x10], ebx
xor eax, eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x28], 0xffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret
Function at 0x421ca3
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x294
mov eax, 0x4eef3d
call fcn.004bcf2f
mov ebx, ecx
push 0x50c8cc
call fcn.00404710
push 0x50c830
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0042449e
add esp, 0xc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x294]
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x421dc4
xor eax, eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 1
test byte [ebp - 0x294], 0x10
jne 0x421d47
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004045b0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004096f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00402120
lea eax, [ebp - 0x294]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x421d10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x29c]
mov edi, dword [ebp - 0x2a0]
sub eax, edi
push 0x18
cdq
pop ecx
idiv ecx
mov esi, eax
cmp esi, 0x1e
jbe 0x421db5
test esi, esi
je 0x421db5
push edi
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.004121d0
add esp, 0xc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00402120
add edi, 0x18
dec esi
jne 0x421d7f
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0
call fcn.00409770
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00402120
call fcn.004bcede
ret
Function at 0x424de5
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x80], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7c], eax
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x74], edi
test eax, eax
je 0x424f6c
test edi, edi
je 0x424f6c
lea ecx, [ebp - 0x68]
call fcn.00424b37
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x88]
push ecx
push 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], eax
push ecx
push 8
push eax
mov dword [ebp - 0x70], 1
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ebx, ebx
test eax, eax
je 0x424f60
cmp dword [ebp - 0x70], 1
je 0x424e82
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], ebx
push eax
push 1
push 2
push ebx
push 0xb
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x424f60
cmp dword [esi + 8], ebx
jne 0x424f00
push ecx
push ecx
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.00425d69
test al, al
jne 0x424eb0
cmp dword [ebp - 0x70], 1
je 0x424f60
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x424f60
push 8
xor eax, eax
lea edi, [ebp - 0xa8]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa8], 0x20
cmp dword [eax - 0xc], ebx
jne 0x424eda
lea ecx, [ebp - 0x68]
call fcn.00424c92
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
mov edi, dword [ebp - 0x74]
test eax, eax
je 0x424f00
mov eax, dword [ebp - 0x8c]
mov dword [esi + 8], eax
push ebx
push dword [ebp - 0x6c]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x424f60
push dword [ebp - 0x7c]
push edi
push ebx
push dword [ebp - 0x78]
push dword [ebp + 0x18]
push ebx
push ebx
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x70], 1
mov edi, eax
je 0x424f4b
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x78]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea ecx, [ebp - 0x68]
call fcn.00424ba6
mov al, bl
jmp 0x424f6e
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret 0x28
Function at 0x425419
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
push 0x1c
mov eax, 0x4ef335
call fcn.004bcefc
mov edi, ecx
xor esi, esi
mov dword [edi + 0x10], esi
call fcn.00425d3e
lea ecx, [ebp - 0x28]
call fcn.004962ee
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00496b58
push str.SeDebugPrivilege
lea ecx, [ebp - 0x28]
call fcn.0049658b
mov eax, 0xc8
push ecx
lea ebx, [eax + 0x14]
mov ecx, edi
push ebx
call fcn.00425cf2
movzx eax, al
test eax, eax
je 0x4254c4
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x10]
push ecx
shl eax, 2
push eax
push dword [edi]
mov dword [ebp - 0x10], esi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x425498
mov eax, dword [ebp - 0x10]
shr eax, 2
cmp ebx, eax
jb 0x425456
push ecx
push eax
mov ecx, edi
call fcn.00425cf2
jmp 0x4254d0
mov ecx, edi
call fcn.00425d3e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4254bd
call esi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4254d0
mov esi, 0x80004005
jmp 0x4254d0
mov ecx, edi
call fcn.00425d3e
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00496328
mov eax, esi
call fcn.004bceca
ret

Function at 0x425511
Capabilities:
Acquire debug privileges

Disassembly:
push 0x20
mov eax, 0x4ef360
call fcn.004bcefc
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.004962ee
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00496b58
push str.SeDebugPrivilege
lea ecx, [ebp - 0x2c]
call fcn.0049658b
and dword [ebp - 0x10], 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00425500
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x425577
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4255e9
mov edi, 0x80004005
jmp 0x4255f0
cmp dword [ebx + 0x18], 0
mov edi, 0x80004005
jne 0x4255df
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4255a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4255a5
call fcn.00424a24
jmp 0x4255ba
mov eax, edi
jmp 0x4255ba
mov eax, dword [ebx + 0x14]
lea ecx, [ebx + 0x14]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x18], eax
xor eax, eax
test eax, eax
jns 0x4255df
mov ecx, dword [ebp + 8]
mov ebx, 0x8000
push ebx
call fcn.00423ed3
push ebx
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov ecx, dword [ebp + 8]
push eax
call fcn.00425b83
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4255f0
call fcn.00424a24
mov edi, eax
mov byte [ebp - 4], 0
test esi, esi
je 0x4255ff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00496328
mov eax, edi
call fcn.004bceca
ret 4
Function at 0x425615
Capabilities:
Acquire debug privileges

Disassembly:
push 0x1c
mov eax, 0x4ef38b
call fcn.004bcefc
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004962ee
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00496b58
push str.SeDebugPrivilege
lea ecx, [ebp - 0x28]
call fcn.0049658b
mov dword [ebp - 0x10], ebx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00425500
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x42568f
mov ecx, dword [ebp + 8]
mov edi, 0x8000
push edi
call fcn.00423ed3
push edi
push eax
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov ecx, dword [ebp + 8]
mov edi, eax
push edi
call fcn.00425b83
test edi, edi
jne 0x4256a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4256a2
call fcn.00424a24
mov edi, eax
jmp 0x4256b4
mov edi, 0x80004005
jmp 0x4256b4
push dword [ebp + 8]
call fcn.00495e23
pop ecx
mov edi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x4256c2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00496328
mov eax, edi
call fcn.004bceca
ret 4

Function at 0x4256d8
Capabilities:
Acquire debug privileges

Disassembly:
push 0x20
mov eax, 0x4ef3b6
call fcn.004bcefc
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.004962ee
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00496b58
push str.SeDebugPrivilege
lea ecx, [ebp - 0x2c]
call fcn.0049658b
and dword [ebp - 0x10], 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00425500
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4257c9
cmp dword [ebx + 0x18], 0
jne 0x425778
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x425763
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42575c
call fcn.00424a24
mov edi, eax
jmp 0x425774
mov edi, 0x80004005
jmp 0x425774
mov eax, dword [ebx + 0x14]
lea ecx, [ebx + 0x14]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
xor edi, edi
mov dword [ebx + 0x18], eax
test edi, edi
js 0x4257e5
mov ecx, dword [ebp + 8]
push 0x8000
call fcn.00423ed3
cmp dword [ebx + 0x1c], 0
mov edi, eax
jne 0x4257b0
cmp dword [ebx + 0x18], 0
jne 0x425797
xor eax, eax
jmp 0x4257a5
push str.GetProcessImageFileNameW
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x1c], eax
test eax, eax
jne 0x4257b0
xor edi, edi
jmp 0x4257bc
push 0x8000
push edi
push esi
call dword [ebx + 0x1c]
mov edi, eax
mov ecx, dword [ebp + 8]
push edi
call fcn.00425b83
test edi, edi
jne 0x4257e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4257dc
call fcn.00424a24
mov edi, eax
jmp 0x4257e5
mov edi, 0x80004005
jmp 0x4257e5
xor edi, edi
mov byte [ebp - 4], 0
test esi, esi
je 0x4257f4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00496328
mov eax, edi
call fcn.004bceca
ret 4
Function at 0x42580a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ef3f2
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x52de80]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x52de80]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.004962ee
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x278], ebx
call fcn.00496b58
push str.SeDebugPrivilege
lea ecx, [esp + 0x18]
call fcn.0049658b
call fcn.00420e9a
push eax
lea ecx, [esp + 0x14]
call fcn.00423ea0
lea eax, [esp + 0x10]
mov byte [esp + 0x278], 1
push eax
mov ecx, esi
call fcn.00425511
test eax, eax
jns 0x42593e
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004256d8
test eax, eax
jns 0x42593e
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x25c], ebx
mov ecx, esi
mov byte [esp + 0x278], 2
call fcn.00425500
push eax
lea ecx, [esp + 0x30]
call fcn.004259dd
test eax, eax
jne 0x4258f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42599a
call fcn.00424a24
mov esi, eax
jmp 0x42599f
cmp dword [esp + 0x25c], 0
je 0x42599a
lea eax, [esp + 0x54]
push eax
call fcn.00424236
pop ecx
push eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
call fcn.004241bd
mov byte [esp + 0x278], 1
cmp dword [esp + 0x2c], 0
je 0x42593e
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x10]
call fcn.00496237
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00425bd3
mov esi, ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004209ab
or dword [esp + 0x278], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00496328
mov eax, esi
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.004bc11d
mov esp, ebp
pop ebp
ret 4
mov esi, 0x80004005
mov byte [esp + 0x278], 1
cmp dword [esp + 0x2c], 0
je 0x425955
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2c], ebx
jmp 0x425955
Function at 0x4259dd
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push 0x18
mov eax, 0x4ef428
call fcn.004bcefc
mov esi, ecx
lea ecx, [ebp - 0x24]
call fcn.004962ee
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.00496b58
push str.SeDebugPrivilege
lea ecx, [ebp - 0x24]
call fcn.0049658b
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x425a43
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x425a30
call fcn.00424a24
mov edi, eax
jmp 0x425a35
mov edi, 0x80004005
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00496328
jmp 0x425a5b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [esi + 0x230], 1
call fcn.00496328
mov edi, ebx
test edi, edi
js 0x425abc
push 0x22c
lea edi, [esi + 4]
push ebx
push edi
call fcn.004bf1a0
add esp, 0xc
mov dword [edi], 0x22c
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x425ab2
mov eax, ebx
cmp dword [esi + 0x230], ebx
je 0x425a8f
mov eax, dword [esi + 0xc]
cmp dword [ebp + 8], eax
je 0x425ac6
push 0x22c
push ebx
push edi
call fcn.004bf1a0
add esp, 0xc
mov dword [edi], 0x22c
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [esi + 0x230], eax
test eax, eax
jne 0x425a82
xor eax, eax
call fcn.004bceca
ret 4
xor eax, eax
inc eax
jmp 0x425abe

Function at 0x4260cc
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key

Disassembly:
push 0x42c
mov eax, 0x4ef4b9
call fcn.004bcf2f
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x428], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004bf1a0
add esp, 0xc
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x42c], edi
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x434]
mov dword [ebp - 4], edi
call fcn.00425fcb
test eax, eax
jne 0x4261f1
push 0x208
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push edi
push eax
call fcn.004bf1a0
add esp, 0xc
mov dword [ebp - 0x438], 0x105
lea eax, [ebp - 0x438]
lea ecx, [ebp - 0x434]
push eax
lea eax, [ebp - 0x424]
push eax
push str.Common_AppData
call fcn.00426059
lea ecx, [ebp - 0x434]
mov esi, eax
call fcn.00425fb1
test esi, esi
jne 0x4261b0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4261b0
test al, 0x10
je 0x4261b0
lea eax, [ebp - 0x424]
jmp 0x4261cf
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x8023
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4261f1
lea eax, [ebp - 0x218]
push ebx
push eax
push str._s_s
push 0x104
push dword [ebp - 0x428]
call fcn.004c033d
add esp, 0x14
cmp eax, 0xffffffff
je 0x4261f1
xor edi, edi
inc edi
lea ecx, [ebp - 0x434]
call fcn.00425fb1
mov eax, edi
call fcn.004bcede
ret
Function at 0x426a90
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x270], ax
mov edi, ecx
lea eax, [ebp - 0x26e]
push ebx
push eax
call fcn.004bf1a0
add esp, 0xc
lea eax, [ebp - 0x270]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x426aee
lea edx, [ebp - 0x270]
mov ecx, str.productidinfo.ini
call fcn.00420d2b
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426b56
test al, 0x10
jne 0x426b56
push esi
lea eax, [ebp - 0x270]
push eax
push ebx
push 0x50f62c
push str.productidinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
call fcn.004bf1a0
push esi
push 0x50f2f4
lea eax, [ebp - 0x68]
push 0x32
push eax
call fcn.004212ec
add esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.004046c0
xor eax, eax
inc eax
pop esi
jmp 0x426b58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret

Function at 0x426cff
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52de80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004bf1a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push esi
push 0x50f2f4
movzx edi, ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004212ec
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20c]
add esp, 0x10
push dword [ebx]
push eax
push str.SystemDefaultUILanguage
push str.SystemInfo
call esi
push edi
push 0x50f2f4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004212ec
add esp, 0x10
lea eax, [ebp - 0x20c]
push dword [ebx]
push eax
push str.UserDefaultUILanguage
push str.SystemInfo
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc11d
mov esp, ebp
pop ebp
ret