joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40668f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x409cec
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004056fc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x406850
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x417088]
test eax, eax
je 0x40688f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40688f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40688f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40688f
cmp dword [ecx + 0x74], 0xe
jbe 0x40688f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x412ce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412d0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412d0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2b001859
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2b03bee0]
jne 0x2b001863
repz ret
jmp fcn.2b02c235

Function at 0x2b004abc
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x2b004ae4
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x2b004ae2
mov ecx, esi
pop esi
jmp fcn.2b004af5
pop esi
ret

Function at 0x2b0058aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2b0058b9
pop dword [ebp - 0x40]
mov eax, 0xa11c4019
sub eax, 0x761be760
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x9968c4ec
sub dword [ebp - 0x50], 0x4b167fa1
mov dword [ebp - 0x4c], 0xb3ff33d
add dword [ebp - 0x4c], 0x26f35908
mov dword [ebp - 0x48], 0x5955eced
add dword [ebp - 0x48], 0xf2f65741
mov dword [ebp - 0x44], 0x7109ff18
add dword [ebp - 0x44], 0x8ef600e8
lea eax, [ebp - 0x50]
push eax
mov eax, 0xf3d5b97f
add eax, 0x372d4705
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x538ebc2d
add dword [ebp - 0x50], 0x20e3ad29
mov dword [ebp - 0x4c], 0x5ac9f69a
sub dword [ebp - 0x4c], 0x195d9525
mov dword [ebp - 0x48], 0x4121d8d6
sub dword [ebp - 0x48], 0xddb26c6a
mov dword [ebp - 0x44], 0x4bf4ffdf
sub dword [ebp - 0x44], 0x4bf4ffdf
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x8f30aaff
add eax, 0x9bd25591
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4589a
push 0
call eax
mov ecx, 0x6f19ef7
add ecx, 0xf90eb31f
mov edi, eax
mov esi, 0x100bb56e
add esi, 0x1af8f892
add esi, dword [ebp - 0x40]
mov ebx, 0x901677c0
sub ebx, 0xff5b5446
mov edx, dword [esi]
add dword [ebp - 4], 0x5c335e40
xor edx, ebx
xor dword [ebp - 0x30], edi
mov dword [edi], edx
mov dword [ebp - 0x28], 0xbc4efde9
add edi, 4
add esi, 0x889c2700
sub esi, 0x889c26fc
loop 0x2b0059db
add eax, 0x20c3501b
sub eax, 0x20c214f0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2b000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.25815b05
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.25815b05
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.25815b05
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.25815b05
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.25815b05
pop ecx
jmp 0x258071e5
Function at 0x25815b05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x25815b14
pop dword [ebp - 8]
mov eax, 0x25815b14
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xa2c96912
add dword [ebp - 0x18], 0xab88dc39
mov dword [ebp - 0x14], 0x5431824c
sub dword [ebp - 0x14], 0x21fe3607
mov dword [ebp - 0x10], 0x7f2de5ec
sub dword [ebp - 0x10], 0x32e1a1be
mov dword [ebp - 0xc], 0x111f6bb5
add dword [ebp - 0xc], 0xeee0944b
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd194b039
add dword [ebp - 0x18], 0xa2ddb91d
mov dword [ebp - 0x14], 0xc359c46e
add dword [ebp - 0x14], 0x7e129d07
mov dword [ebp - 0x10], 0x625fc715
add dword [ebp - 0x10], 0x10fa557
mov dword [ebp - 0xc], 0x62aa6089
add dword [ebp - 0xc], 0x9d559f77
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xb4b60a99
sub eax, 0x8f343a19
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x38749
push 0
call eax
mov ecx, 0x15454c5d
add ecx, 0xeabaeb49
xor edx, edx
add edx, eax
mov ebx, 0x9bf8ecb4
sub ebx, 0x767656b4
add ebx, dword [ebp - 8]
mov esi, 0x2126e2b1
sub esi, 0x610239e
mov dword [ebp - 4], 0x85703ceb
mov edi, dword [ebx]
sub dword [ebp - 4], edx
sub edi, esi
mov dword [edx], edi
xor dword [ebp - 4], 0x835e14b5
add edx, 4
add ebx, 4
loop 0x25815c2e
add eax, 0xd16b
mov ebx, eax
add eax, 0xe2a04bc1
sub eax, 0xe2a04bbc
mov ecx, 0x25800000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401b6c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bab
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bab
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bab
cmp dword [ecx + 0x74], 0xe
jbe 0x401bab
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406419
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406464
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406636
test al, al
jne 0x40645e
sub edx, 2
cmp edx, edi
jne 0x406444
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406486
lea eax, [edi + 2]
cmp edx, eax
je 0x406486
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406365
add esp, 0x10
jmp 0x406580
push esi
lea ecx, [ebp - 0x255]
call fcn.00406636
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4064c9
push dword [ebp - 0x25c]
jmp 0x406476
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406506
cmp word [ebp - 0x226], 0
je 0x406527
cmp word [ebp - 0x226], ax
jne 0x406506
cmp word [ebp - 0x224], 0
je 0x406527
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406365
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406573
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4064e0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40655b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x406580
push 0x406195
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004091e0
add esp, 0x10
jmp 0x406550
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040133c
leave
ret

Function at 0x4080b3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40fffc
push 0x40fff4
push str.FlsAlloc
push 0x1f
call fcn.00407fee
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4080e7
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e154]
call esi
jmp 0x4080ed
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x408131
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41000c
push 0x410004
push str.FlsGetValue
push 0x21
call fcn.00407fee
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408168
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408170
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410014
push 0x41000c
push str.FlsSetValue
push 0x22
call fcn.00407fee
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4081aa
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x401230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
lea ecx, [ebp - 0x54]
call fcn.004016a0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x41237c
lea edx, [ebp - 0x54]
push edx
call fcn.00402230
add esp, 0x10
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.004016c0
lea ecx, [ebp - 4]
push ecx
call fcn.004010f0
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.00407a00
add esp, 0xc
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 4]
call fcn.00407300
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x54]
call fcn.00401660
push eax
lea ecx, [ebp + 8]
call fcn.00401660
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x6c], edx
lea ecx, [ebp - 4]
call fcn.00401720
lea ecx, [ebp - 0x54]
call fcn.00401720
lea ecx, [ebp + 8]
call fcn.00401720
lea ecx, [ebp + 0xc]
call fcn.00401720
mov eax, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret

Function at 0x402c10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x41610c]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x4123dc
lea ecx, [ebp - 4]
call fcn.004016e0
lea eax, [ebp - 0x25c]
push eax
call fcn.004010a0
add esp, 4
lea ecx, [ebp - 0x258]
push ecx
push 0x4123ec
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x268]
push eax
call fcn.00402ec0
add esp, 0xc
mov ecx, eax
call fcn.00407300
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
lea ecx, [ebp - 0x268]
call fcn.00401720
xor ecx, ecx
cmp dword [ebp - 0x264], 0xffffffff
setne cl
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
je 0x402cf8
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x402cdc
push ecx
mov ecx, esp
lea eax, [ebp - 0x22c]
push eax
call fcn.004016e0
push ecx
mov ecx, esp
lea edx, [ebp - 4]
push edx
call fcn.004016c0
call fcn.00401570
add esp, 8
test eax, eax
je 0x402cdc
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 4]
call fcn.00401760
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x260], eax
jmp 0x402c92
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 4]
push ecx
push 0x4123f4
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x274]
push eax
call fcn.00402ec0
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402e60
add esp, 0xc
lea ecx, [ebp - 0x274]
call fcn.00401720
lea ecx, [ebp - 0x25c]
call fcn.00401720
lea ecx, [ebp - 4]
call fcn.00401720
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004079e4
mov esp, ebp
pop ebp
ret
Function at 0x4044a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x41610c]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00403e10
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.00407290
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404790
lea ecx, [ebp - 0x438]
call fcn.00407290
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404240
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40451e
call fcn.00403e70
mov dword [ebp - 0x444], eax
jmp 0x404673
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x40454f
call fcn.00403e70
mov dword [ebp - 0x444], eax
jmp 0x404673
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x40457f
call fcn.00403e70
mov dword [ebp - 0x444], eax
jmp 0x404673
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x4045cf
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.004072e0
lea ecx, [ebp - 0x2c]
call fcn.00406f30
mov eax, dword [ebp - 0x44c]
jmp 0x4046a8
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.004072b0
lea ecx, [ebp - 0x438]
call fcn.00407300
test eax, eax
jne 0x4045fc
mov dword [ebp - 0x444], 0x8007000e
jmp 0x404673
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.00407300
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.00403e10
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x40463e
call fcn.00403e70
mov dword [ebp - 0x444], eax
jmp 0x404673
lea ecx, [ebp - 0x438]
call fcn.00407300
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.00407300
push eax
lea ecx, [ebp - 0x18]
call fcn.004047c0
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x404683
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.004072e0
lea ecx, [ebp - 0x2c]
call fcn.00406f30
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004079e4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405fe0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41610c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00405db0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00405f80
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40604b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00405de0
mov eax, dword [ebp - 0x224]
jmp 0x4060dc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4060b1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00405fe0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4060a8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00405de0
mov eax, dword [ebp - 0x228]
jmp 0x4060dc
mov dword [ebp - 4], 0x100
jmp 0x406052
lea ecx, [ebp - 0x14]
call fcn.00405ec0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00405e60
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00405de0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004079e4
mov esp, ebp
pop ebp
ret 4
Function at 0x406640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x406649
xor ecx, ecx
jne 0x406649
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x40666a
mov eax, 0xd
jmp 0x4066c5
xor eax, eax
jne 0x406651
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x40667b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x4079e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41610c]
jne 0x4079ee
repz ret
jmp fcn.004087fd
Function at 0x40fc2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040bece
and dword [ebp - 4], 0
cmp dword [0x417c4c], 0
mov ebx, eax
jne 0x40fce0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fd91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40fd91
push eax
call fcn.0040be5c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x417c4c], eax
call esi
push eax
call fcn.0040be5c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x417c50], eax
call esi
push eax
call fcn.0040be5c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x417c54], eax
call esi
push eax
call fcn.0040be5c
pop ecx
mov dword [0x417c5c], eax
test eax, eax
je 0x40fce0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040be5c
pop ecx
mov dword [0x417c58], eax
mov eax, dword [0x417c58]
cmp eax, ebx
je 0x40fd38
cmp dword [0x417c5c], ebx
je 0x40fd38
push eax
call fcn.0040bed7
push dword [0x417c5c]
mov esi, eax
call fcn.0040bed7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40fd38
test edi, edi
je 0x40fd38
call esi
test eax, eax
je 0x40fd2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40fd2f
test byte [ebp - 0xc], 1
jne 0x40fd38
or dword [ebp + 0x10], 0x200000
jmp 0x40fd71
mov eax, dword [0x417c50]
cmp eax, ebx
je 0x40fd71
push eax
call fcn.0040bed7
pop ecx
test eax, eax
je 0x40fd71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40fd71
mov eax, dword [0x417c54]
cmp eax, ebx
je 0x40fd71
push eax
call fcn.0040bed7
pop ecx
test eax, eax
je 0x40fd71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417c4c]
call fcn.0040bed7
pop ecx
test eax, eax
je 0x40fd91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fd93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401181
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4011e1
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], ebx
cmovne ebx, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040d390
leave
ret

Function at 0x4011f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ecx
call fcn.0040115f
pop ecx
test eax, eax
jne 0x401207
push 0xb
pop eax
jmp 0x401228
call fcn.004010b0
test eax, eax
jne 0x401215
call fcn.00401181
push 1
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ecx
pop ebp
ret

Function at 0x4012f3
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x401389
xor ebx, ebx
push ebx
push 0x1a
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401389
push edi
push 0x411a64
mov edi, 0x104
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x411a70
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.zoomtest
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop edi
test eax, eax
je 0x401389
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x40138b
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d390
leave
ret