joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4758d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x47592e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.00475938
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475935
ret

Function at 0x47b1cc
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x47b202
jmp 0x47b2a8
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x47b246
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x168], 0
je 0x47b246
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x168]
mov eax, dword [eax + 0x14]
jmp 0x47b256
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x164]
test edx, edx
je 0x47b256
mov eax, dword [edx + 0x14]
test eax, eax
je 0x47b26f
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00477bc0
jmp 0x47b2a8
mov dl, 1
mov eax, dword [0x423f54]
call fcn.00425f38
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.004269a8
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xbc]
mov eax, dword [esi + 0x10]
call fcn.00425ae8
mov edx, esp
mov eax, esi
call fcn.0042663c
mov eax, esi
call fcn.00403840
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x47d874
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.00450c64
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0044a250
pop ebx
ret
Function at 0x483884
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48393e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404d64
mov eax, dword [0x4ff088]
cmp byte [eax], 0
je 0x4838f3
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004050c4
mov eax, dword [ebx]
call fcn.00404ef0
push eax
mov eax, dword [ebx]
call fcn.00404ee0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404ef0
mov edx, eax
dec edx
mov eax, ebx
call fcn.004050c4
jmp 0x483925
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409b08
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404ed0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483945
lea eax, [ebp - 0x3f0]
call fcn.00404630
ret

Function at 0x48394c
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409b08
add esp, 0x3ec
pop ebx
ret

Function at 0x483b0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov ebp, edx
mov esi, eax
mov edx, ebp
mov eax, dword [esi + 0x3c]
call dword [esi + 0x38]
cmp dword [ebp + 0xc], 0
jne 0x483bc5
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00461e60
mov ebx, eax
mov dx, word [ebp + 4]
mov eax, esi
call fcn.004837c8
mov edi, eax
test edi, edi
je 0x483b6b
mov al, byte [0x483bd0]
cmp al, bl
jne 0x483b6b
mov edx, edi
mov eax, esi
call fcn.00483700
mov dword [ebp + 0xc], 1
mov byte [esi + 0x31], 1
jmp 0x483bc5
cmp byte [esi + 0x161], 2
jne 0x483b96
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp + 4]
mov eax, dword [0x4ff87c]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov edx, 0xb006
call fcn.0044b4e4
test eax, eax
jne 0x483bc5
jmp 0x483bc0
mov eax, dword [0x4ff64c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
cmp eax, dword [esi + 0x128]
je 0x483bc0
mov edx, dword [ebp + 8]
push edx
movzx ecx, word [ebp + 4]
mov edx, dword [0x4ff64c]
mov edx, 0xb006
call fcn.0044b4e4
xor eax, eax
mov dword [ebp + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x489b2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x489b60
cmp eax, dword [esp]
pop edx
pop eax
jae 0x489b9c
jmp 0x489b64
pop edx
pop eax
jge 0x489b9c
mov eax, dword [0x4ff87c]
mov eax, dword [eax]
mov dword [eax + 0x44], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004849a4
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x489bc1
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x489bc1
cmp dword [ebx + 0x11c], 0
je 0x489bc1
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00432f0c
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4945cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49473d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x494722
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409b08
mov dl, 1
mov eax, dword [0x46cd3c]
call fcn.0046cd94
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x419654]
call fcn.00403810
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0046ce10
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x49471f
mov dl, 1
mov eax, dword [0x46deb4]
call fcn.0046df1c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x494754
call fcn.0046d15c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040493c
xor eax, eax
push ebp
push 0x494718
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0046e21c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0049475c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49471f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00403840
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403840
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403840
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494744
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404654
ret

Function at 0x4b9020
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov eax, ebx
call fcn.00404630
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4b9051
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.00404720
add esp, 0x14
pop ebx
ret
Function at 0x4bc398
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bc410
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 8]
mov eax, dword [esi + 0x30]
call fcn.00408e84
mov eax, dword [ebp - 8]
mov esi, dword [0x4ff034]
mov esi, dword [esi]
mov edx, dword [ebx]
call esi
test eax, eax
je 0x4bc3f1
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404c7c
jmp 0x4bc3fa
mov eax, ebx
xor edx, edx
call fcn.00404c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc417
lea eax, [ebp - 8]
call fcn.00404630
ret

Function at 0x4bd154
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4bd1ae
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004bd148
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004bb7c0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004bb2fc
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd1b5
lea eax, [ebp - 4]
call fcn.00404630
ret
Function at 0x4dbda0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418288]
call fcn.00405128
xor eax, eax
push ebp
push 0x4dbee4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fc06c], 0
jne 0x4dbdf3
mov ecx, dword [0x4fef60]
mov dl, 1
mov eax, dword [0x407e0c]
call fcn.0040d628
call fcn.00403fcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403114
mov eax, ebx
call fcn.00404ee0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4dbef4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004062fc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404ef0
test eax, eax
jle 0x4dbe8b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4dbe84
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004048b8
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004048a0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d90
test eax, eax
jne 0x4dbe84
mov ebx, 0x15
jmp 0x4dbe90
mov ebx, 0x10
jmp 0x4dbe90
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4fc06c]
call fcn.004dbcf8
mov eax, dword [ebp - 8]
call fcn.004dbcf8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbeeb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404654
lea eax, [ebp - 0x10]
mov edx, dword [0x418288]
call fcn.004051f8
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0xec41b46
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x1de2110b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40161b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x405b08
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x401631
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret
Function at 0x4019e3
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcscpy]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscat]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 1
lea eax, [ebp - 0x268]
xor esi, esi
push eax
mov eax, dword [ebp - 8]
dec eax
push esi
neg eax
sbb eax, eax
push esi
and al, 0xeb
mov word [ebp - 0x268], si
add eax, 0x17
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x401af6
lea ecx, [ebp - 0x268]
call fcn.004015b0
lea eax, [ebp - 0x268]
push str.7_Zip_
push eax
call edi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
add esp, 0xc
lea esi, [ebp + eax*2 - 0x268]
cmp dword [ebp - 4], 0
mov eax, str.7_Zip_File_Manager.lnk
je 0x401a7c
mov eax, str.7_Zip_Help.lnk
push eax
push esi
call ebx
lea eax, [ebp - 0x4c0]
push 0x405b08
push eax
call ebx
add esp, 0x10
cmp dword [ebp - 4], 0
mov eax, str.7zFM.exe
je 0x401aa1
mov eax, str.7_zip.chm
push eax
lea eax, [ebp - 0x4c0]
push eax
call edi
pop ecx
lea edx, [ebp - 0x4c0]
pop ecx
lea ecx, [ebp - 0x268]
call fcn.00401b08
test eax, eax
jne 0x401ad6
lea eax, [ebp - 0x268]
mov dword [ebp - 0xc], 1
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jb 0x401a6c
cmp dword [ebp - 0xc], 0
je 0x401af6
and word [esi], 0
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x401a05
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ec8
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x405b08
jmp fcn.00401631

Function at 0x401f0e
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x405b08
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401f2b
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x401f30
push 1
pop eax
pop esi
ret
call fcn.00401ec8
pop esi
ret
Function at 0x403ad4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x48e190]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, ecx
cmp byte [esi + 0x340], 0
je 0x403b40
push 0x110
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044b880
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x403b31
mov ecx, esi
call fcn.00403794
jmp 0x403b42
cmp dword [esp + 0xc], 6
jb 0x403b40
push esi
call fcn.00402db7
jmp 0x403b42
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
call fcn.00447c3d
mov esp, ebp
pop ebp
ret
Function at 0x40994b
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x462a2c
call fcn.0044c102
mov ebx, ecx
cmp dword [ebx + 0x3c], 0
mov dword [ebp - 0x38], ebx
je 0x409a60
cmp byte [ebx + 0x41], 0
je 0x409a60
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x409983
xor al, al
jmp 0x409a62
push 0
push 8
pop edi
lea esi, [ebp - 0x30]
call fcn.00409283
and dword [ebp - 4], 0
lea eax, [ebx + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.004081a6
mov esi, eax
call fcn.004085b7
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.004081a6
mov esi, eax
call fcn.004085b7
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x40]
add edi, esi
push edi
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x4099f8
dec eax
je 0x4099fc
dec eax
dec eax
je 0x409a5c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0040949a
mov al, bl
jmp 0x409a62
mov byte [ebx + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.004081a6
mov esi, eax
call fcn.004085b7
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x409a3a
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x30]
call fcn.004081a6
mov esi, eax
call fcn.004085b7
push dword [ebx + 0x4c]
push edi
push 1
push eax
call fcn.0044886c
add esp, 0x10
cmp edi, eax
jne 0x4099e6
cmp byte [ebx + 0x41], 0
je 0x409a5c
test edi, edi
jne 0x40999a
push edi
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.004092e7
mov ebx, dword [ebp - 0x38]
jmp 0x40999a
mov bl, 1
jmp 0x4099e8
mov al, 1
call fcn.0044c185
ret

Function at 0x40cae5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cb49
cmp dword [ebp + 0xc], 1
je 0x40cb21
cmp dword [ebp + 0xc], 2
je 0x40cb21
push 0xd
pop eax
jmp 0x40cb49
mov eax, dword [ebp - 4]
test edi, edi
je 0x40cb43
test eax, eax
je 0x40cb3e
test al, 1
jne 0x40cb1c
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40cb43
jmp 0x40cb1c
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x40def0
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004403c5
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [esi + 0x64]
call edi
push 1
push dword [esi + 0x68]
call edi
push 0
push 0
push dword [esi + 0x58]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
ret
Function at 0x4135e8
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x4c
mov eax, 0x467425
call fcn.0044c099
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x30]
push ecx
push 4
push eax
push 0x4413c2
xor esi, esi
push esi
push esi
call fcn.0044abff
add esp, 0x18
cmp eax, esi
je 0x41363c
mov ecx, dword [edi]
xor edx, edx
add ecx, 4
inc edx
lock xadd dword [ecx], edx
mov ecx, dword [edi]
push eax
lea esi, [ecx + 8]
call fcn.00413325
mov edi, dword [edi]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.0044c171
ret
lea eax, [ebp - 0x58]
call fcn.00401a92
push eax
mov dword [ebp - 4], esi
call fcn.0040b23e
int3

Function at 0x414459
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467094
mov eax, dword fs:[0]
push eax
mov eax, 0x107c
call fcn.0045b480
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push ecx
push edi
push str.Bootstrapper::CreateProcess_module___S__args___S
lea esi, [eax + 0x1ac]
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], edx
call fcn.00409019
add esp, 0xc
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x1080]
push ebx
push eax
call fcn.0044b880
add esp, 0xc
xor eax, eax
push 0xffe
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push ebx
push eax
mov dword [ebp - 0x1084], 0x44
call fcn.0044b880
add esp, 0xc
cmp word [edi], 0x22
mov esi, 0x800
lea eax, [ebp - 0x1014]
je 0x41452f
push 0x472d34
push esi
push eax
call fcn.00449d81
add esp, 0xc
push edi
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00449df0
add esp, 0xc
push 0x472d34
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00449df0
jmp 0x414537
push edi
push esi
push eax
call fcn.00449d81
add esp, 0xc
push 0x472d38
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00449df0
add esp, 0xc
push dword [ebp - 0x101c]
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.00449df0
add esp, 0xc
push edi
push str.CreateProcess__S_failed
lea esi, [ebp - 0x1038]
call fcn.0042c8fb
pop ecx
pop ecx
mov esi, eax
push dword [ebp - 0x1018]
lea eax, [ebp - 0x1084]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1014]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4145aa
mov eax, esi
call fcn.00429e18
push ebx
push 1
lea ecx, [ebp - 0x1038]
call fcn.0040949a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00447c3d
leave
ret 4
Function at 0x414a93
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0044b880
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x414ae6
cmp dword [ebp - 0x70], 2
jne 0x414ae6
cmp dword [ebp - 0x7c], 5
jne 0x414ae6
mov al, 1
jmp 0x414ae8
xor al, al
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00447c3d
add ebp, 0x98
leave
ret

Function at 0x414afd
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x48e190]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0044b880
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x414b4e
cmp dword [ebp - 0x7c], 6
jne 0x414b4e
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
je 0x414b50
xor al, al
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00447c3d
add ebp, 0x98
leave
ret
Function at 0x414d4d
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4648f3
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x48e190]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov eax, dword [0x48e190]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, vtable.ATL::CAccessToken.0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x34]
mov byte [esp + 0xa8], 1
call fcn.00414cbf
mov byte [esp + 0xa8], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x10]
push ecx
push 1
mov edi, 0x2000a
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x414e09
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x414e1c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
call dword [eax + 4]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x414e44
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x24]
call dword [eax + 4]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x414e63
cmp dword [esp + 0x10], ebx
setne bl
lea ecx, [esp + 0x34]
call fcn.00414c48
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], esi
call fcn.00414d0f
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.00414d0f
mov al, bl
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00447c3d
mov esp, ebp
pop ebp
ret