joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d11
Capabilities:
Terminate process

Disassembly:
push ebx
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x2000
call fcn.004046cc
cmp dword [0x42ca0c], ebx
jne 0x405d3f
call fcn.00405c10
cmp al, bl
jne 0x405d3f
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, esi
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x2004
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x405d36
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x405d65
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
add eax, 0x2000
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push ebx
xor ebx, ebx
inc eax
shl eax, 4
push edi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], eax
mov edi, eax
call fcn.004046cc
cmp edi, 0x6400000
ja 0x405dd0
cmp edi, ebx
jne 0x405d9b
xor edi, edi
inc edi
add edi, 4
cmp dword [0x42ca0c], ebx
jne 0x405daf
call fcn.00405c10
cmp al, bl
je 0x405dd0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x405dd2
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov dword [esi], eax
cmp byte [esp + 0x10], bl
je 0x405de7
cmp eax, ebx
je 0x405de7
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
jmp 0x405dea
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop ebx
ret 8

Function at 0x405df1
Capabilities:
Terminate process

Disassembly:
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 8]
push ebx
test eax, eax
jle 0x405e04
mov dword [esi + 8], eax
jmp 0x405e0b
mov dword [esi + 8], 0x2000
mov ebx, dword [esi + 8]
call fcn.004046cc
cmp ebx, 0x6400000
ja 0x405e57
test ebx, ebx
jne 0x405e20
inc ebx
add ebx, 4
cmp dword [0x42ca0c], 0
jne 0x405e35
call fcn.00405c10
test al, al
je 0x405e57
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x405e59
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov dword [esi], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x405e78
test eax, eax
je 0x405e78
cmp dword [edi + 8], 0
jle 0x405e78
push dword [esi + 8]
push ecx
push eax
call fcn.00412d60
add esp, 0xc
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, esi
pop ebx
ret
Function at 0x405e82
Capabilities:
Terminate process

Disassembly:
push ebx
cmp esi, edi
je 0x405f28
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 8]
test eax, eax
jle 0x405e9d
mov dword [esi + 8], eax
jmp 0x405ea4
mov dword [esi + 8], 0x2000
cmp dword [esi], 0
je 0x405eb5
call fcn.004046cc
push dword [esi]
call fcn.00405c44
mov ebx, dword [esi + 8]
call fcn.004046cc
cmp ebx, 0x6400000
ja 0x405f01
test ebx, ebx
jne 0x405eca
inc ebx
add ebx, 4
cmp dword [0x42ca0c], 0
jne 0x405edf
call fcn.00405c10
test al, al
je 0x405f01
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x405f03
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov dword [esi], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x405f22
test eax, eax
je 0x405f22
cmp dword [edi + 8], 0
jle 0x405f22
push dword [esi + 8]
push ecx
push eax
call fcn.00412d60
add esp, 0xc
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, esi
pop ebx
ret

Function at 0x405f9d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
add eax, dword [ebp + 8]
push ebx
push edi
cmp dword [esi + 8], eax
jg 0x4060aa
add eax, 0x2000
cdq
and edx, 0xf
add eax, edx
mov edi, eax
sar edi, 4
inc edi
shl edi, 4
xor ebx, ebx
mov dword [ebp - 4], edi
cmp dword [esi], ebx
jne 0x406038
call fcn.004046cc
cmp edi, ebx
jl 0x406023
cmp edi, 0x6400000
jg 0x406023
cmp edi, ebx
jne 0x405feb
mov dword [ebp - 4], 1
add dword [ebp - 4], 4
cmp dword [0x42ca0c], ebx
jne 0x406000
call fcn.00405c10
test al, al
je 0x406023
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 4]
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x406025
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], ebx
cmp eax, ebx
jne 0x4060a7
mov dword [esi + 8], ebx
xor al, al
jmp 0x4060b8
call fcn.004046cc
cmp edi, ebx
jl 0x406087
cmp edi, 0x6400000
jg 0x406087
cmp edi, ebx
jne 0x406054
mov dword [ebp - 4], 1
add dword [ebp - 4], 4
cmp dword [0x42ca0c], ebx
jne 0x406069
call fcn.00405c10
test al, al
je 0x406031
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 4]
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
je 0x40601c
mov ebx, eax
test ebx, ebx
je 0x406031
push dword [esi + 4]
push dword [esi]
push ebx
call fcn.00412d60
add esp, 0xc
call fcn.004046cc
push dword [esi]
call fcn.00405c44
mov dword [esi], ebx
mov dword [esi + 8], edi
cmp byte [ebp + 0xc], 0
je 0x4060b6
mov eax, dword [ebp + 8]
add dword [esi + 4], eax
mov al, 1
pop edi
pop ebx
leave
ret 8
Function at 0x40669b
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x5968], ecx
test eax, eax
je 0x4066d2
test cl, 0x20
jne 0x4066d2
mov edx, ecx
shr edx, 2
mov al, 1
and dl, al
mov byte [esi + 0x5964], dl
leave
ret
xor al, al
leave
ret

Function at 0x4066e2
Capabilities:
Check os version

Disassembly:
mov eax, 0x41d83b
call fcn.004198ec
sub esp, 0x11c
cmp dword [esi + 0x595c], 0xffffffff
push ebx
push edi
jne 0x40683c
xor ebx, ebx
inc ebx
mov edi, 0x42b310
test byte [0x42d600], bl
jne 0x406726
or dword [0x42d600], ebx
and dword [ebp - 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], ebx
and dword [esi + 0x595c], 0
mov ecx, 0x11c
mov edx, ecx
lea eax, [ebp - 0x128]
mov byte [eax], 0
inc eax
dec edx
jne 0x406744
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x406795
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x406795
and dword [esi + 0x595c], eax
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x406842
cmp dword [ebp - 0x118], ebx
jbe 0x40682a
push 2
pop eax
cmp dword [ebp - 0x118], eax
jne 0x406831
cmp dword [ebp - 0x124], 6
jbe 0x4067c5
mov dword [esi + 0x595c], 5
jmp 0x406831
jne 0x4067f8
cmp dword [ebp - 0x120], eax
jb 0x4067db
mov dword [esi + 0x595c], 7
jmp 0x406831
cmp dword [ebp - 0x120], ebx
je 0x4067b9
cmp dword [ebp - 0x120], 0
jne 0x40682a
mov dword [esi + 0x595c], 3
jmp 0x406831
cmp dword [ebp - 0x124], 5
jne 0x40682a
cmp dword [ebp - 0x120], eax
jne 0x406811
mov dword [esi + 0x595c], eax
jmp 0x406831
cmp dword [ebp - 0x120], ebx
je 0x406809
cmp dword [ebp - 0x120], 0
jne 0x40682a
mov dword [esi + 0x595c], ebx
jmp 0x406831
and dword [esi + 0x595c], 0
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x595c]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4068cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406900
xor al, al
jmp 0x406976
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call ebx
test eax, eax
je 0x406922
push dword [ebp - 4]
jmp 0x406949
mov eax, dword [ebp - 8]
cmp dword [edi], eax
jb 0x406964
cmp dword [ebp + 0x14], esi
je 0x406964
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
test eax, eax
je 0x406955
mov dword [edi], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x406975
mov eax, dword [ebp - 8]
mov dword [edi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x406975
push dword [ebp - 4]
mov dword [edi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], esi
sete al
pop ebx
pop esi
leave
ret 0x10

Function at 0x40697b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4069aa
xor al, al
jmp 0x4069e4
cmp dword [ebp + 0x18], esi
je 0x4069d9
cmp dword [ebp + 0x1c], esi
je 0x4069d9
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4069dc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4069a6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
leave
ret 0x18
Function at 0x4069e9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], edx
push edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x406b46
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x104
cmp byte [ebp + 0x10], bl
je 0x406a73
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
mov dword [ebp - 8], ebx
push ebx
jmp 0x406a67
push dword [ebp - 4]
lea eax, [ebp - 0x424]
push dword [ebp + 0x18]
push eax
push dword [ebp + 8]
call dword [ebp + 0x14]
add esp, 0x10
test al, al
je 0x406a73
inc dword [ebp - 8]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call edi
test eax, eax
je 0x406a38
cmp byte [ebp + 0xc], bl
je 0x406b36
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push esi
lea eax, [ebp - 0x424]
push eax
mov dword [ebp - 8], ebx
push ebx
jmp 0x406b26
push 0x208
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x102
jae 0x406ae2
push 0x4215cc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 4]
lea eax, [ebp - 0x21c]
push dword [ebp + 0x18]
push ebx
push eax
call dword [ebp + 0x14]
add esp, 0x10
test al, al
je 0x406b36
push dword [ebp + 0x18]
mov edx, dword [ebp - 0x10]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x21c]
push dword [ebp + 0xc]
push eax
call fcn.004069e9
inc dword [ebp - 8]
push esi
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call edi
test eax, eax
je 0x406a93
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
jmp 0x406b48
xor al, al
leave
ret 0x14
Function at 0x406b4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, eax
mov dword [esi], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
call fcn.00407000
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
xor eax, eax
xor ecx, ecx
add eax, dword [ebp + 0xc]
mov byte [esi + 0x258], bl
mov dword [esi + 0x40], eax
lea eax, [esi + 0x4c]
push eax
push 1
push ebx
adc edi, ecx
push 0x2e
mov dword [esi + 0x44], edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ebx
mov dword [esi + 0x48], ebx
call edi
test eax, eax
je 0x406bcf
lea eax, [esi + 0x4c]
push eax
push 1
push ebx
push 0x23
push ebx
call edi
test eax, eax
je 0x406bcf
lea eax, [esi + 0x4c]
push eax
push 1
push ebx
push 0x2d
push ebx
call edi
test eax, eax
je 0x406bcf
lea eax, [esi + 0x4c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x406c3d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
inc dword [esi + 0x48]
push 0x4215cc
lea eax, [esi + 0x4c]
push eax
call edi
push str.ntuser4CB43D7F_7DCA_4906_8698_
lea ebx, [esi + 0x4c]
push ebx
call edi
push dword [esi + 0x44]
lea eax, [ebp - 0x20]
push dword [esi + 0x40]
push 0x4218e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
mov cl, 0x20
call fcn.00419400
push edx
push eax
lea eax, [ebp - 0x20]
push 0x4218e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
push str..pol
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x406c79
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [esi + 0x258], 0
push ebx
push edi
jne 0x406dae
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
push eax
push 2
lea edi, [esi + 0x4c]
push 4
cmp dword [esi], eax
jne 0x406ca8
push eax
jmp 0x406cac
lea ecx, [esi + 4]
push ecx
push eax
push 0x10000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x254], eax
cmp eax, 0xffffffff
je 0x406cd0
mov byte [esi + 0x258], 1
jmp 0x406da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x406ced
mov eax, dword [esi + 0x48]
xor ecx, ecx
sub eax, ecx
je 0x406cf4
dec eax
je 0x406d07
dec eax
je 0x406d1a
dec eax
je 0x406d2b
xor al, al
jmp 0x406db0
push edi
push 1
push ecx
push 0x2e
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x406d3b
xor ecx, ecx
push edi
push 1
push ecx
push 0x23
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x406d3b
xor ecx, ecx
push edi
push 1
push ecx
push 0x2d
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x406d3b
push edi
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x406ced
inc dword [esi + 0x48]
push 0x4215cc
push edi
call ebx
push str.ntuser4CB43D7F_7DCA_4906_8698_
push edi
call ebx
push dword [esi + 0x44]
lea eax, [esp + 0xc]
push dword [esi + 0x40]
push 0x4218e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 8]
push eax
push edi
call ebx
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
mov cl, 0x20
call fcn.00419400
push edx
push eax
lea eax, [esp + 0x10]
push 0x4218e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 8]
push eax
push edi
call ebx
push str..pol
push edi
call ebx
cmp byte [esi + 0x258], 0
je 0x406c97
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406f26
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, eax
mov al, byte [ebx + 0x258]
mov esi, ebx
mov byte [ebp - 1], al
call fcn.00406c79
test al, al
je 0x406ffa
mov eax, ebx
call fcn.00406de4
mov esi, edi
mov dword [ebp - 8], eax
call fcn.00405f3e
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x406fe9
jle 0x406f78
push 1
push dword [ebp - 8]
mov esi, edi
call fcn.00405f9d
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebx + 0x254]
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
push dword [edi]
push dword [ebx + 0x254]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp eax, esi
je 0x406fb8
cmp ecx, 1
jle 0x406fb8
push ecx
push eax
call fcn.00401923
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov esi, dword [eax]
cmp ecx, 4
jl 0x406fd9
add ecx, 0xfffffffc
push ecx
lea ecx, [eax + 4]
push ecx
push eax
call fcn.00412d60
add esp, 0xc
add dword [edi + 4], 0xfffffffc
mov eax, dword [edi + 4]
mov ecx, eax
sub ecx, esi
cmp ecx, eax
jg 0x406fe9
sub eax, ecx
mov dword [edi + 4], eax
cmp byte [ebp - 1], 0
jne 0x406ff6
mov edi, ebx
call fcn.00406db6
mov al, 1
jmp 0x406ffc
xor al, al
pop edi
pop esi
leave
ret
Function at 0x40778f
Capabilities:
Accept command line arguments
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
push edi
lea eax, [esi + 0x57ec]
push eax
call fcn.00405caf
call fcn.004070c5
test al, al
je 0x4078ac
call fcn.0040354f
call fcn.004066e2
cmp eax, 3
jl 0x4077d5
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push str.SeDebugPrivilege
call fcn.0040251f
push str.SeChangeNotifyPrivilege
call fcn.0040251f
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00402bc9
xor ecx, ecx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov dword [ebp - 8], ebx
cmp ecx, eax
je 0x40781d
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.EnableBalloonTips
push eax
push 0x80000001
call fcn.0040697b
call fcn.004066e2
cmp eax, 0x309
jne 0x40783e
push ebx
call fcn.004016c1
push eax
xor edi, edi
call fcn.00402aaf
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x407862
cmp dword [ebp - 0xc], 1
jne 0x407862
mov edi, esi
call fcn.0040462d
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, esi
call fcn.004043f5
xor ebx, ebx
jmp 0x4078a4
mov edi, esi
call fcn.0040454f
mov ecx, esi
call fcn.00402ff5
test al, al
jne 0x4078b1
mov ecx, esi
call fcn.00402be5
test al, al
jne 0x4078b1
mov edi, 0x168
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
jne 0x407896
cmp byte [esi + 0x5958], bl
je 0x407874
pop edi
pop esi
pop ebx
leave
ret
call fcn.0040374c
push ebx
jmp 0x407838
Function at 0x407bb0
Capabilities:
Register raw input devices
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 0x30
pop esi
push esi
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.004130d0
mov eax, dword [edi + 0x5804]
mov dword [ebp - 0x20], eax
add esp, 0xc
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x34]
mov esi, str.svchost
push eax
mov dword [ebp - 0x30], 0x4000
mov dword [ebp - 0x2c], 0x4078bc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov edi, dword [edi + 0x5804]
push ebx
push edi
push ebx
push ebx
mov eax, 0x190
push eax
push eax
push ebx
push ebx
mov edi, 0x2000000
push edi
push str.hidden_window
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push edi
push 0xfffffffffffffff0
push eax
mov dword [ebp - 4], eax
call esi
mov edi, dword [ebp - 4]
push 0x8000000
push 0xffffffffffffffec
push edi
call esi
push ebx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x42ca0c], ebx
jne 0x407c6a
call fcn.00405c10
cmp al, bl
je 0x407c8c
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x1c
push 8
push dword [0x42ca0c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x407c90
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor al, al
jmp 0x407cc8
xor ecx, ecx
push 6
inc ecx
mov word [eax], cx
pop ecx
mov word [eax + 2], cx
xor edx, edx
mov ecx, 0x100
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
push 2
inc edx
mov word [eax + 0xc], dx
pop edx
push 0xc
push edx
push eax
mov word [eax + 0xe], dx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edi
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40805f
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x674]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x421a50
lea eax, [ebp - 0x674]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x674]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x4080b0
xor al, al
jmp 0x408253
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0
call esi
push 0xa
call esi
push 0
call esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
cmp dword [eax], 0
jne 0x408248
push dword [ebp + 0xc]
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4215cc
lea eax, [ebp - 0x46c]
push eax
call edi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x46c]
push eax
call edi
test byte [ebp - 0x264], 0x10
jne 0x4081c6
push dword [ebp + 0xc]
lea edi, [ebp - 0x10]
lea eax, [ebp - 0x264]
mov ecx, ebx
call fcn.00407f7f
test al, al
je 0x4081a2
mov edi, dword [ebx + 4]
call fcn.004046cc
push eax
mov dword [ebp - 8], eax
call fcn.00403aef
push 0
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0x70941102
push dword [ebp - 8]
call fcn.00405084
push edi
push 0x407f74
push dword [ebp - 0x14]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0x70941101
push dword [ebp - 8]
call fcn.004052e6
test al, al
je 0x4081a2
call fcn.004046cc
lea eax, [ebx + 0x30]
mov ebx, dword [ebp - 0x10]
call fcn.00401872
push 0xa
call esi
push 0
call esi
mov ebx, dword [ebp + 8]
call fcn.004046cc
call fcn.00403925
mov edi, eax
sub eax, dword [ebx]
cmp eax, 0xb4
jbe 0x408220
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + 0x30]
call fcn.00406e3e
mov dword [ebx], edi
jmp 0x408220
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x421a58
lea eax, [ebp - 0x238]
push eax
call edi
test eax, eax
je 0x408230
push 0x421a5c
lea eax, [ebp - 0x238]
push eax
call edi
test eax, eax
je 0x408230
lea eax, [ebp - 0x46c]
push 0x42cd24
push eax
call fcn.00407f19
pop ecx
pop ecx
test al, al
jne 0x408220
call fcn.004046cc
lea edi, [ebp - 0x46c]
call fcn.00403fca
push eax
lea ecx, [ebx + 0x18]
call fcn.00406161
push 0xa
call esi
push 0
call esi
mov eax, dword [ebx + 4]
cmp dword [eax], 0
jne 0x408248
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4080be
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc