joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
sub esp, 0x1ac
push esi
push edi
push str.CPSecTS
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x41da74], eax
je 0x401197
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401197
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
test eax, eax
mov dword [0x41da78], eax
jne 0x40105d
mov eax, dword [0x41da74]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1ac
ret 0x10
lea ecx, [esp + 0x24]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401095
mov edx, dword [0x41da74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x41da78]
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x1ac
ret 0x10
mov ax, word [esp + 0x24]
cmp al, 2
jne 0x40117a
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x40117a
mov esi, dword [esp + 0x1b8]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x41d9c4
push 0x67
push esi
call edi
push 0x64
push 0x41d960
push 0x6d
push esi
call edi
push esi
call fcn.004011b0
mov edx, dword [esp + 0x1c8]
push edx
push esi
call fcn.00401240
add esp, 0xc
test eax, eax
jne 0x401108
mov eax, dword [0x41da74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x41da78]
push ecx
jmp 0x40118f
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
call esi
test eax, eax
je 0x40114c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
push 0
push 0
lea edx, [esp + 0x14]
push 0
push edx
call esi
test eax, eax
jne 0x40112c
pop ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x41da74]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x41da78]
push ecx
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
pop edi
pop esi
mov eax, dword [esp + 8]
add esp, 0x1ac
ret 0x10
mov edx, dword [0x41da74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x41da78]
push eax
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
xor eax, eax
pop esi
add esp, 0x1ac
ret 0x10

Function at 0x401240
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0
push 0
push 0
push closesocket
push 0
push closesocket
push 0xcf0000
push 0x41d9c4
push 0x41d960
push 0
mov dword [0x41da2c], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x41da28], eax
jne 0x40127f
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x41da28]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
ret
Function at 0x4013e0
Capabilities:
Enumerate services

Disassembly:
sub esp, 8
push esi
push edi
push reloc.WS2_32.dll_connect
push 0
mov esi, ecx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x401402
pop edi
pop esi
add esp, 8
ret
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push esi
push ecx
lea edx, [esi + 0x804]
push 0x4800
push edx
push 3
push 0x30
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x401436
pop edi
pop esi
add esp, 8
ret
mov ecx, esi
call fcn.00401790
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x401490
Capabilities:
Stop service

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [esi + edi*4 + 4]
push eax
call fcn.00401740
lea ecx, [edi + edi*8]
mov ebx, eax
lea edx, [esi + ecx*4 + 0x80c]
push edx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push ebx
jne 0x4014cc
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebx
ret 4

Function at 0x4014e0
Capabilities:
Pause service

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [esi + edi*4 + 4]
push eax
call fcn.00401740
lea ecx, [edi + edi*8]
mov ebx, eax
lea edx, [esi + ecx*4 + 0x80c]
push edx
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push ebx
jne 0x40151c
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebx
ret 4

Function at 0x401530
Capabilities:
Continue service

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [esi + edi*4 + 4]
push eax
call fcn.00401740
lea ecx, [edi + edi*8]
mov ebx, eax
lea edx, [esi + ecx*4 + 0x80c]
push edx
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push ebx
jne 0x40156c
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, 1
pop ebx
ret 4

Function at 0x401580
Capabilities:
Modify service

Disassembly:
mov eax, dword [esp + 4]
push esi
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.00401740
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov esi, eax
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
push esi
jne 0x4015bd
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
ret 4
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop esi
ret 4
Function at 0x401670
Capabilities:
Query service configuration

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.00401740
push 0x400
mov ebx, eax
call fcn.004107e2
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x400
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x4016b5
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebx
ret 4
mov eax, dword [esi + 4]
push edi
sub eax, 2
je 0x4016d9
dec eax
je 0x4016d2
dec eax
je 0x4016cb
mov edi, 4
jmp 0x4016de
mov edi, 3
jmp 0x4016de
mov edi, 2
jmp 0x4016de
mov edi, 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call fcn.0041080b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4018b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
test edx, edx
mov dword [esp], edx
jne 0x4018c9
xor al, al
add esp, 0x2c
ret
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
xor ebx, ebx
mov eax, edx
mov ecx, ebx
sar eax, cl
test eax, eax
je 0x401962
test al, 1
je 0x401958
mov al, bl
lea ecx, [esp + 0x18]
add al, 0x41
push ecx
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, eax
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x30]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x44], esi
mov esi, edi
mov edi, dword [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x30]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x41a0a8]
mov dword [esp + 0x38], edx
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x18]
push ebp
push edx
push 0xc
push eax
push ecx
call fcn.004049c0
mov edx, dword [esp + 0x28]
add esp, 0x18
inc ebx
cmp ebx, 0x1a
jl 0x4018d3
mov eax, dword [0x41a0a8]
xor edx, edx
mov dword [esp + 0x26], edx
push eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2e], edx
lea ecx, [esp + 0x18]
mov word [esp + 0x32], dx
push ebp
push ecx
lea edx, [esp + 0x30]
push 0xc
push edx
push eax
mov byte [esp + 0x3c], 1
mov byte [esp + 0x3d], 1
call fcn.004049c0
add esp, 0x18
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x402400
Capabilities:
Delete file

Disassembly:
mov eax, 0x120c
call fcn.00406ae0
mov eax, dword [0x41a0a8]
push ebx
mov ebx, dword [esp + 0x1218]
push ebp
mov ebp, dword [esp + 0x1218]
push esi
push edi
push eax
lea ecx, [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x20]
push 0x208
push edx
push ebp
call fcn.00404a50
add esp, 0x18
test al, al
je 0x40255c
cmp dword [esp + 0x10], 0x208
jne 0x40255c
lea eax, [esp + 0x14]
push 0x41a0f4
push eax
call fcn.00406acd
mov edi, eax
add esp, 8
test edi, edi
je 0x40255c
mov eax, dword [esp + 0x214]
xor esi, esi
test eax, eax
jbe 0x402532
mov ecx, eax
sub ecx, esi
cmp ecx, 0x1000
jbe 0x4024e3
mov edx, dword [0x41a0a8]
lea eax, [esp + 0x10]
push edx
push ebx
push eax
lea ecx, [esp + 0x228]
push 0x1000
push ecx
push ebp
call fcn.00404a50
add esp, 0x18
test al, al
push edi
je 0x40258a
push 0x1000
lea edx, [esp + 0x224]
push 1
push edx
call fcn.00406963
add esp, 0x10
cmp eax, 0x1000
jne 0x402548
add esi, eax
mov eax, dword [esp + 0x214]
cmp esi, eax
jae 0x402532
jmp 0x40247e
mov ecx, dword [0x41a0a8]
lea edx, [esp + 0x10]
push ecx
push ebx
sub eax, esi
push edx
push eax
lea eax, [esp + 0x22c]
push eax
push ebp
call fcn.00404a50
add esp, 0x18
test al, al
push edi
je 0x402569
mov ecx, dword [esp + 0x218]
lea edx, [esp + 0x220]
sub ecx, esi
push ecx
push 1
push edx
call fcn.00406963
mov ecx, dword [esp + 0x224]
add esp, 0x10
sub ecx, esi
cmp eax, ecx
jne 0x402589
push edi
call fcn.004068e6
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120c
ret
push edi
call fcn.004068e6
add esp, 4
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x120c
ret
call fcn.004068e6
add esp, 4
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x120c
ret
push edi
call fcn.004068e6
add esp, 4
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x120c
ret

Function at 0x402720
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x41a0a8]
sub esp, 0x214
lea ecx, [esp]
lea edx, [esp + 0xc]
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [esp + 0x220]
push eax
push esi
push ecx
push 0x208
push edx
push edi
call fcn.00404a50
add esp, 0x18
test al, al
je 0x4027a5
cmp dword [esp + 8], 0x208
jne 0x4027a5
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [0x41a0a8]
lea edx, [esp + 8]
neg eax
sbb eax, eax
push ecx
add eax, 0x2711
push esi
mov dword [esp + 0x14], eax
push edx
lea eax, [esp + 0x18]
push 8
push eax
push edi
call fcn.004049c0
add esp, 0x18
mov al, 1
pop edi
pop esi
add esp, 0x214
ret
pop edi
xor al, al
pop esi
add esp, 0x214
ret
Function at 0x4027b0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x41a0a8]
mov ecx, dword [esp + 8]
sub esp, 0x20c
lea edx, [esp]
push eax
push ecx
mov ecx, dword [esp + 0x218]
push edx
lea eax, [esp + 0x10]
push 0x208
push eax
push ecx
call fcn.00404a50
add esp, 0x18
test al, al
je 0x40280f
cmp dword [esp], 0x208
jne 0x40280f
push 1
push 0
lea edx, [esp + 0xc]
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
add esp, 0x20c
ret
xor al, al
add esp, 0x20c
ret

Function at 0x402820
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x214
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x228]
mov eax, dword [0x41a0a8]
lea ecx, [esp + 0x10]
push eax
push esi
push ecx
lea edx, [esp + 0x28]
push 0x208
push edx
push edi
call fcn.00404a50
add esp, 0x18
test al, al
je 0x4028c9
cmp dword [esp + 0x10], 0x208
jne 0x4028c9
cmp byte [esp + 0x1c], 1
jne 0x40287f
cmp byte [esp + 0x1d], 1
je 0x4028d6
mov al, byte [esp + 0x220]
test al, al
je 0x402893
lea eax, [esp + 0x1c]
push eax
call ebp
jmp 0x40289a
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov edx, dword [0x41a0a8]
lea ecx, [esp + 0x14]
neg eax
sbb eax, eax
push edx
add eax, 0x2711
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 8
push ecx
push edi
call fcn.004049c0
add esp, 0x18
jmp 0x402844
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x214
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x214
ret
Function at 0x4034b0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1838
call fcn.00406ae0
push ebx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x1848]
lea ecx, [esp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41a0a8]
lea edx, [esp + 0x11c]
push eax
mov eax, dword [esp + 0x1848]
push ebx
push ecx
push 0x290
push edx
push eax
call fcn.00404a50
add esp, 0x18
test al, al
jne 0x40350e
pop edi
pop ebx
add esp, 0x1838
ret
lea edi, [esp + 0x2ac]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call fcn.00406e62
add esp, 4
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x40366d
lea edx, [esp + 0x1c]
lea eax, [esp + 0x844]
push edx
push 0x1000
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40366d
push ebp
mov dword [esp + 0x18], 0
lea ebp, [esp + 0x848]
mov edx, dword [ebp]
lea ecx, [esp + 0x4b4]
push 0x104
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x40364a
lea edi, [esp + 0x4b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x3b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp]
push ecx
push str.0x_08x
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x3c0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x130]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x41a0a8]
push ecx
mov ecx, dword [esp + 0x185c]
push ebx
push edx
push 0x290
push eax
push ecx
call fcn.004049c0
mov esi, dword [esp + 0x40]
add esp, 0x24
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
inc eax
add ebp, 4
shr edx, 2
cmp eax, edx
mov dword [esp + 0x18], eax
jbe 0x403590
mov byte [esp + 0x13], 1
pop ebp
jmp 0x403672
mov byte [esp + 0xf], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xa3
xor eax, eax
lea edi, [esp + 0x5b6]
mov byte [esp + 0x5b4], 1
mov byte [esp + 0x5b5], 1
lea edx, [esp + 0x5b4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x41a0a8]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x184c]
push ebx
push ecx
push 0x290
push edx
push eax
call fcn.004049c0
mov al, byte [esp + 0x27]
add esp, 0x18
pop esi
pop edi
pop ebx
add esp, 0x1838
ret
Function at 0x4036e0
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x33c
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x141]
mov byte [esp + 0x140], 0
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x354]
mov ebx, dword [esp + 0x350]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41a0a8]
lea ecx, [esp + 0x10]
push eax
push ebp
push ecx
lea edx, [esp + 0x40]
push 0x10c
push edx
push ebx
call fcn.00404a50
add esp, 0x18
test al, al
jne 0x403741
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x33c
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x140]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x140]
push ecx
call fcn.00406e62
add esp, 4
mov dword [esp + 0x14], eax
xor esi, esi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], esi
push esi
rep stosd dword es:[edi], eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4037ac
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x33c
ret
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x1c
push edx
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x403816
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jne 0x403803
mov ecx, dword [esp + 0x20]
mov eax, dword [0x41a0a8]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x38], ecx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], edx
push ebp
push ecx
lea edx, [esp + 0x40]
push 0x10c
push edx
push ebx
mov dword [esp + 0x4c], esi
call fcn.004049c0
add esp, 0x18
inc esi
lea eax, [esp + 0x18]
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4037c3
mov bl, 1
jmp 0x403818
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x242]
mov byte [esp + 0x240], 1
mov byte [esp + 0x241], 1
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41a0a8]
push ecx
mov ecx, dword [esp + 0x354]
stosw word es:[edi], ax
push ebp
push edx
lea eax, [esp + 0x24c]
push 0x10c
push eax
push ecx
call fcn.004049c0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x33c
ret
Function at 0x403880
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1d4
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x1ec]
mov ebp, dword [esp + 0x1e8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41a0a8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea edx, [esp + 0x120]
push 0xce
push edx
push ebp
call fcn.00404a50
add esp, 0x18
test al, al
jne 0x4038de
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d4
ret
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.00406e62
add esp, 4
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403966
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x41a0a8]
lea eax, [esp + 0x10]
push edx
push ebx
push eax
lea ecx, [esp + 0x120]
push 0xce
push ecx
push ebp
call fcn.004049c0
add esp, 0x18
test al, al
jne 0x40395f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d4
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1d4
ret

Function at 0x403980
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x41a0a8]
sub esp, 0x3e8
lea ecx, [esp]
lea edx, [esp + 0x128]
push ebx
mov ebx, dword [esp + 0x3f0]
push esi
mov esi, dword [esp + 0x3f8]
push eax
push esi
push ecx
push 0x2c0
push edx
push ebx
call fcn.00404a50
add esp, 0x18
test al, al
jne 0x4039c5
pop esi
pop ebx
add esp, 0x3e8
ret
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x44
lea edx, [esp + 0x134]
rep stosd dword es:[edi], eax
mov eax, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
lea eax, [esp + 0x54]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x41a0a8]
lea ecx, [esp + 0xc]
push eax
push esi
push ecx
lea edx, [esp + 0x70]
push 0xce
push edx
push ebx
call fcn.004049c0
add esp, 0x18
test al, al
pop edi
pop esi
setne al
pop ebx
add esp, 0x3e8
ret
Function at 0x403ad0
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x41587f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x41a574]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], 1
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403b61
lea edx, [esp + 0xc]
lea eax, [esp + 0x24]
push edx
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x403b5a
push 0x104
push 0x104
lea ecx, [esp + 0xc]
call fcn.00410c67
mov ecx, dword [esp + 0x28]
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.00410cb6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x20]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.00410816
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 0
call fcn.00410a83
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x404280
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [0x41a0a8]
sub esp, 0xb64
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xb70]
push eax
mov eax, dword [esp + 0xb70]
push ebp
push ecx
push 0x52c
push edx
push eax
call fcn.00404a50
add esp, 0x18
test al, al
jne 0x4042c0
pop ebp
add esp, 0xb64
ret
lea ecx, [esp + 0x10]
push ecx
call fcn.00403e40
add esp, 4
test eax, eax
jne 0x4042db
xor al, al
pop ebp
add esp, 0xb64
ret
lea edx, [esp + 4]
lea ecx, [esp + 0x30]
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4042fa
xor al, al
pop ebp
add esp, 0xb64
ret
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push edi
lea edx, [esp + 0x3c]
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x1c]
push 0x100
push edx
rep stosd dword es:[edi], eax
push eax
mov eax, dword [esp + 0x1c]
push eax
xor ebx, ebx
call esi
cmp eax, 0x103
je 0x4043d5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x3c]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404371
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x548]
push 0x100
push ecx
push eax
push edx
call esi
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x544], eax
jmp 0x404387
mov eax, dword [esp + 0x18]
mov dword [esp + 0x544], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x41a0a8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xb7c]
push ebp
push edx
lea eax, [esp + 0x28]
push 0x52c
push eax
push ecx
call fcn.004049c0
add esp, 0x18
call edi
cmp eax, 0xf5555555
je 0x4043d5
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x3c]
inc ebx
push 0x100
push edx
push ebx
push eax
call esi
cmp eax, 0x103
jne 0x404335
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
mov ecx, 0x14a
xor eax, eax
lea edi, [esp + 0x64a]
mov edx, dword [0x41a0a8]
mov byte [esp + 0x648], bl
mov byte [esp + 0x649], bl
push edx
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0xb7c]
push ebp
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x650]
push eax
push 0x52c
push ecx
push edx
call fcn.004049c0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xb64
ret