joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c7a0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x44749f
call fcn.00441920
sub esp, 0x90
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x42c7c9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42c7c9
mov dword [edi], ebx
push esi
lea ecx, [ebp - 0x24]
push dword [ebp + 8]
call fcn.004030ba
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.0042c974
push 0x20
mov edx, eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 1
call fcn.004099df
push dword [ebp + 0xc]
mov edx, eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.0040359c
push dword [ebp - 0x9c]
call fcn.00428aef
push dword [ebp - 0x30]
call fcn.00428aef
push dword [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00428aef
add esp, 0xc
cmp byte [0x45c72c], bl
jne 0x42c8f7
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x90], 0x44
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x5e], bx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00403515
cmp dword [ebp + 0x10], ebx
mov byte [ebp - 4], 7
je 0x42c8b9
push dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
call fcn.004030ba
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.00402f4d
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.00403276
push dword [ebp - 0x30]
call fcn.00428aef
push dword [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.00428aef
mov esi, dword [ebp - 0x18]
pop ecx
pop ecx
jmp 0x42c8bb
xor esi, esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x30]
call fcn.00402f4d
lea ecx, [ebp - 0x4c]
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x30]
mov esi, eax
call fcn.00428aef
push dword [ebp - 0x18]
call fcn.00428aef
pop ecx
pop ecx
jmp 0x42c93c
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x90], 0x44
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x8c], ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x64], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov word [ebp - 0x5e], bx
push dword [ebp - 0x3c]
mov dword [ebp - 0x5c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, ebx
pop esi
jne 0x42c94b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x42c959
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
mov dword [edi], eax
push dword [ebp - 0x3c]
call fcn.00428aef
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x42d197
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x447500
call fcn.00441920
sub esp, 0x11c
push esi
xor esi, esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], esi
push 0x2001f
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ecx]
lea ecx, [ebp - 0x10]
call fcn.0042d13c
cmp eax, esi
jne 0x42d238
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x14], 0x105
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x42d225
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x10]
push eax
call fcn.0042d197
cmp eax, esi
jne 0x42d238
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x105
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x42d1ed
lea ecx, [ebp - 0x10]
call fcn.0042d171
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
call fcn.0042d188
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0042d171
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x42d284
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x42d2ab
Capabilities:
Set registry value

Disassembly:
mov eax, 0x447551
call fcn.00441920
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp byte [0x45c72c], bl
push edi
mov edi, ecx
mov dword [ebp - 0x10], ebx
je 0x42d2f1
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x42d39e
cmp dword [ebp + 0xc], esi
je 0x42d321
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.004030ba
push 1
pop esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00402f4d
push 3
pop ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], esi
mov esi, dword [eax]
xor eax, eax
cmp dword [ebp + 8], eax
je 0x42d350
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.004030ba
or ebx, 4
mov dword [ebp - 0x10], ebx
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 2
call fcn.00402f4d
mov eax, dword [eax]
or ebx, 8
push esi
push eax
mov ecx, edi
call fcn.0042d284
test bl, 8
mov esi, eax
je 0x42d36c
push dword [ebp - 0x34]
and ebx, 0xfffffff7
call fcn.00428aef
pop ecx
test bl, 4
je 0x42d37d
push dword [ebp - 0x1c]
and ebx, 0xfffffffb
call fcn.00428aef
pop ecx
test bl, 2
je 0x42d38e
push dword [ebp - 0x40]
and ebx, 0xfffffffd
call fcn.00428aef
pop ecx
test bl, 1
je 0x42d39c
push dword [ebp - 0x28]
call fcn.00428aef
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42d3af
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc

Function at 0x42d4f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x44759a
call fcn.00441920
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov dword [ebp - 0x10], ebx
mov word [eax], bx
cmp byte [0x45c72c], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0xc], ebx
je 0x42d586
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x42d544
cmp eax, 0xea
jne 0x42d634
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 8]
jl 0x42d554
push eax
mov ecx, esi
call fcn.004033c8
mov eax, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0042d4cd
mov edi, eax
mov eax, dword [esi]
xor ecx, ecx
cmp word [eax], bx
je 0x42d57a
mov edx, eax
inc ecx
inc edx
inc edx
cmp word [edx], bx
jne 0x42d572
mov word [eax + ecx*2], bx
mov dword [esi + 4], ecx
jmp 0x42d632
push 3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00403515
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
jne 0x42d5a5
xor eax, eax
jmp 0x42d5d6
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.004030ba
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00402f4d
mov dword [ebp - 0x10], 3
mov eax, dword [eax]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
push ecx
push eax
mov ecx, edi
call fcn.0042d45f
test byte [ebp - 0x10], 2
mov edi, eax
je 0x42d5f7
push dword [ebp - 0x38]
and dword [ebp - 0x10], 0xfffffffd
call fcn.00428aef
pop ecx
test byte [ebp - 0x10], 1
mov dword [ebp - 4], ebx
je 0x42d609
push dword [ebp - 0x2c]
call fcn.00428aef
pop ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.00403e2a
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040315e
push dword [ebp - 0x38]
call fcn.00428aef
push dword [ebp - 0x20]
call fcn.00428aef
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x42e50b
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
mov eax, dword [esi]
and dword [esi + 4], 0
and byte [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jne 0x42e538
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x42e56f
cmp edi, dword [esi + 8]
jl 0x42e545
push edi
mov ecx, esi
call fcn.00403515
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, esi
mov edi, eax
call fcn.00429359
test edi, edi
jne 0x42e56d
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x42e56f
mov al, 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x42e575
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4477ac
call fcn.00441920
sub esp, 0x18
cmp byte [0x45c72c], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x42e5f6
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [esi + 4], 0
and word [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
je 0x42e5e5
cmp edi, dword [esi + 8]
jl 0x42e5b8
push edi
mov ecx, esi
call fcn.004033c8
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi]
xor ebx, ebx
xor edx, edx
cmp word [ecx], bx
je 0x42e5da
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x42e5d2
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
jne 0x42e5f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x42e647
mov al, 1
jmp 0x42e647
xor esi, esi
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00403515
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
mov dword [ebp - 4], esi
call fcn.0042e50b
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov bl, al
call fcn.00403e2a
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.0040315e
push dword [ebp - 0x24]
call fcn.00428aef
push dword [ebp - 0x18]
call fcn.00428aef
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x42e7b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45c72c], 0
jne 0x42e7e2
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.004288bb
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00428aef
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
leave
ret
Function at 0x42e7eb
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and byte [ebp - 1], 0
cmp byte [0x45c72c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 8], ecx
jne 0x42e843
mov edx, ecx
lea ecx, [ebp - 0x30]
call fcn.004288bb
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebx, eax
push dword [ebp - 0x30]
neg ebx
sbb bl, bl
inc bl
call fcn.00428aef
test bl, bl
pop ecx
je 0x42e8b4
jmp 0x42e8b0
push str.GetDiskFreeSpaceExW
push 0x45a3a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42e890
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push dword [ebp - 8]
call eax
mov ebx, dword [ebp + 8]
test eax, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov eax, dword [ebp - 0x20]
setne byte [ebp - 1]
mov dword [edi + 4], eax
jmp 0x42e893
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x42e8b7
xor al, al
jmp 0x42e8f0
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mul dword [ebp - 0xc]
cmp byte [ebp - 1], 0
mov dword [esi], eax
mov dword [esi + 4], edx
jne 0x42e8ee
push edx
push dword [esi]
push 0
push dword [ebp - 0x10]
call fcn.00441be0
mov dword [ebx], eax
mov dword [ebx + 4], edx
push dword [esi + 4]
push dword [esi]
push 0
push dword [ebp - 0x14]
call fcn.00441be0
mov dword [edi], eax
mov dword [edi + 4], edx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42f4a9
Capabilities:
Get session user name

Disassembly:
mov eax, 0x447974
call fcn.00441920
sub esp, 0x334
push ebx
push esi
xor ebx, ebx
push str.Advapi32.dll
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
je 0x42f5a9
push str.LsaOpenPolicy
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x42f5a9
lea ecx, [ebp - 0x18]
call fcn.0042f5ca
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push 0xf0fff
push eax
push ebx
call esi
cmp eax, ebx
jne 0x42f5a9
push edi
push 0xb
pop ecx
mov esi, str.SeLockMemoryPrivilege
lea edi, [ebp - 0x13c]
push 0x35
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x110]
lea edx, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x13c]
call fcn.0042f630
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x100
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
pop edi
je 0x42f5a9
lea ecx, [ebp - 0x340]
call fcn.0042f652
mov esi, eax
cmp esi, ebx
je 0x42f5a9
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 0xd], bl
call fcn.0042f5fd
cmp eax, ebx
jne 0x42f597
mov byte [ebp - 0xd], 1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov bl, byte [ebp - 0xd]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042f5ca
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x438261
Capabilities:
Get disk information

Disassembly:
mov eax, 0x448884
call fcn.00441920
sub esp, 0x20
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 0x10], ecx
cmp byte [esi + 0x10], 0
mov ebx, dword [esi]
je 0x4382f2
mov edi, dword [ebp + 8]
push 1
pop ebx
lea eax, [ebp - 0x2c]
push 3
push eax
mov ecx, edi
call fcn.0040325a
mov eax, dword [ebp - 0x2c]
and dword [ebp - 4], 0
cmp word [eax + 2], 0x3a
jne 0x4382e3
cmp word [eax + 4], 0x5c
jne 0x4382e3
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
lea edx, [ebp - 0x2c]
inc eax
lea ecx, [ebp - 0x20]
push eax
call fcn.004383ee
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x20]
call fcn.00428aef
cmp dword [ebp - 0x14], 5
pop ecx
je 0x4382e1
cmp dword [ebp - 0x14], 2
jne 0x4382e3
mov ebx, dword [esi]
push dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
call fcn.00428aef
pop ecx
jmp 0x4382f5
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
je 0x438316
mov ecx, dword [edi]
lea eax, [ecx + eax*2 - 2]
cmp word [eax], 0x5c
je 0x438310
cmp eax, ecx
je 0x438316
dec eax
dec eax
jmp 0x438302
sub eax, ecx
sar eax, 1
jmp 0x438319
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
lea edi, [eax + 1]
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.00405288
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], 1
call fcn.0040315e
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x2c]
call fcn.00428aef
dec ebx
pop ecx
je 0x4383ce
dec ebx
je 0x43839c
push 3
xor eax, eax
pop esi
lea ecx, [ebp - 0x20]
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.004033c8
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
call fcn.0042af4f
test al, al
jne 0x43838b
lea eax, [ebp + 8]
push 0x44c1f8
push eax
mov dword [ebp + 8], 0x22995
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.0040311b
push dword [ebp - 0x20]
jmp 0x4383c6
add esi, 4
lea ecx, [ebp - 0x2c]
push esi
call fcn.0040311b
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.0042c216
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040311b
push dword [ebp - 0x2c]
call fcn.00428aef
pop ecx
jmp 0x4383da
mov ecx, dword [ebp + 8]
push edi
push dword [ebp - 0x10]
call fcn.0040325a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x438a4e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4489df
call fcn.00441920
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 4
xor edi, edi
pop ebx
mov dword [esi + 8], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0xc], 0x44a538
lea ecx, [esi + 0x24]
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.004033c8
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x30], 0x44b80c
push 0x45c794
mov dword [esi], 0x44b7f4
mov dword [esi + 4], 0x44b7e4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x438b86
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x448a12
call fcn.00441920
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x44b7f4
mov dword [esi + 4], 0x44b7e4
and dword [ebp - 4], 0
push 0x45c794
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edi, [esi + 0x30]
mov dword [ebp - 0x14], edi
mov dword [edi], 0x44b80c
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0042893e
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00428915
push dword [esi + 0x24]
call fcn.00428aef
add esi, 0xc
pop ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0x44a538
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.0042893e
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00428915
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x441140
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 0x20], eax
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x24], eax
ret

Function at 0x441630
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 8]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.004415c0
pop esi
ret 4

Function at 0x4417e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x441836
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x44bd24
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x441829
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x441838
xor eax, eax
pop esi
leave
ret 4
Function at 0x10011349
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10011358
pop dword [ebp - 0x1c]
mov eax, 0xef7be40b
sub eax, 0xdf7ad0b3
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push reloc.GDI32.dll_BitBlt
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x9d878716
add ecx, 0x6278bc4a
mov ebx, eax
mov esi, 0x1004ac00
add esi, dword [ebp - 0x1c]
mov edx, 0x111c53ff
add edx, 0x370c74ec
mov dword [ebp - 0x18], 0x8f46645b
mov edi, dword [esi]
xor dword [ebp - 0x10], edi
add edi, edx
sub dword [ebp - 0x18], edx
mov dword [ebx], edi
add ebx, 0xd16649b3
sub ebx, 0xd16649af
add esi, 0x366ba08e
sub esi, 0x366ba08a
loop 0x100113ac
add eax, 0xca132a42
sub eax, 0xca1229ef
mov ebx, eax
add eax, 0x51fa893d
sub eax, 0x51fa8938
mov ecx, 0x574d3b08
sub ecx, 0x474d3b08
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10011349
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx