joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1e7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x4c202f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00428438
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00455f54
call fcn.004a83a4
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x4c1f00
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00422c9c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00428438
mov eax, dword [eax + 0xc]
pop edx
call fcn.00422ca4
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422b84
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00409804
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00428438
call fcn.00423a44
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422bf8
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422c34
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422c34
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422c34
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422c9c
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00428438
mov eax, dword [eax + 0xc]
pop edx
call fcn.00422b30
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00428438
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x23
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*4 + 0xc]
call fcn.00422974
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2036
lea eax, [ebp - 4]
call fcn.004046d8
ret
Function at 0x4d8938
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4d8950
mov eax, ebx
call fcn.004d8208
cmp dword [ebx + 0x68], 0
jne 0x4d895d
mov eax, ebx
call fcn.004d8190
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.004d8010
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004d92e0
cmp eax, dword [esp]
je 0x4d89cb
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004d92f4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4d89a7
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004d92e0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4d89c0
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x4d89e6
push 3
mov eax, dword [esi + 0x10]
call fcn.0044a0b8
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x4d89f3
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.00442fd0
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00442ff4
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0044301c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00443040
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00417c90
mov eax, ebp
mov edx, dword [0x4fc988]
mov byte [edx + 2], al
mov eax, dword [0x4fc988]
mov byte [eax], 0
mov eax, dword [0x4fc988]
mov byte [eax + 1], 0
mov eax, dword [0x4fc988]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044a0b8
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044a0b8
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044a0b8
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x4fc988]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00428438
call fcn.00423a44
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044a0b8
push eax
mov eax, dword [0x4fc960]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0044a0b8
push eax
call sub.user32.dll_ShowWindow
push 0
push esi
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d96c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x4fcc34]
mov eax, dword [eax]
call fcn.00463880
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x4d96d3
pop esi
pop ebx
ret
Function at 0x4d9c08
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409444
test al, al
je 0x4d9c8f
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403340
or esi, 0x100
test esi, esi
jns 0x4d9c43
call fcn.00403888
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404b98
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4d9c8f
mov dl, 1
mov eax, dword [0x421ae8]
call fcn.00429a5c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00429e2c
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4d9c8f
mov eax, esp
call fcn.0040e478
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x4e41ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x4fdfac
test esi, esi
jne 0x4e4206
xor eax, eax
jmp 0x4e4308
cmp dword [ebp], 0
jne 0x4e4211
call fcn.004e417c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4e42e1
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4e421d
test edi, edi
jbe 0x4e4303
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4e42e5
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f5114
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b88
xor eax, eax
push ebp
push 0x4f5276
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00408b30
mov edx, dword [ebp - 0x2c]
mov eax, 0x4f5290
call fcn.00404cdc
test eax, eax
jne 0x4f516d
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4f5290
call fcn.004049e4
mov byte [ebp - 9], 0
push 0
push 0
push 0
push 0
push 0x4f5298
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 4
lea eax, [ebp - 8]
push eax
push 2
push ebx
call sub.wininet.dll_InternetSetOptionA
test ebx, ebx
je 0x4f5253
mov edi, 1
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b98
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
jne 0x4f51e5
inc edi
call sub.kernel32.dll_GetLastError
cmp edi, 5
jg 0x4f51e5
cmp eax, 0x2ee2
jne 0x4f51e5
cmp eax, 0x2f78
jne 0x4f51e5
push 0x7d0
call sub.kernel32.dll_Sleep_1
jmp 0x4f51a0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoA
lea edi, [ebp - 0x28]
lea eax, [ebp - 0x30]
mov edx, edi
call fcn.004048d0
mov eax, dword [ebp - 0x30]
mov edx, 0x194
call fcn.00408fd0
add eax, 0xffffff38
sub eax, 0x64
jb 0x4f5233
add eax, 0xffffff9b
sub eax, 3
jb 0x4f5239
jmp 0x4f523f
mov byte [ebp - 9], 1
jmp 0x4f5243
mov byte [ebp - 9], 1
jmp 0x4f5243
mov byte [ebp - 9], 0
test esi, esi
je 0x4f524d
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f527d
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004046fc
lea eax, [ebp - 4]
call fcn.004046d8
ret
Function at 0x4f60cc
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b88
xor eax, eax
push ebp
push 0x4f622e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00408b30
mov edx, dword [ebp - 0x2c]
mov eax, 0x4f6248
call fcn.00404cdc
test eax, eax
jne 0x4f6125
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4f6248
call fcn.004049e4
mov byte [ebp - 9], 0
push 0
push 0
push 0
push 0
push 0x4f6250
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 4
lea eax, [ebp - 8]
push eax
push 2
push ebx
call sub.wininet.dll_InternetSetOptionA
test ebx, ebx
je 0x4f620b
mov edi, 1
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b98
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
jne 0x4f619d
inc edi
call sub.kernel32.dll_GetLastError
cmp edi, 5
jg 0x4f619d
cmp eax, 0x2ee2
jne 0x4f619d
cmp eax, 0x2f78
jne 0x4f619d
push 0x7d0
call sub.kernel32.dll_Sleep_1
jmp 0x4f6158
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoA
lea edi, [ebp - 0x28]
lea eax, [ebp - 0x30]
mov edx, edi
call fcn.004048d0
mov eax, dword [ebp - 0x30]
mov edx, 0x194
call fcn.00408fd0
add eax, 0xffffff38
sub eax, 0x64
jb 0x4f61eb
add eax, 0xffffff9b
sub eax, 3
jb 0x4f61f1
jmp 0x4f61f7
mov byte [ebp - 9], 1
jmp 0x4f61fb
mov byte [ebp - 9], 1
jmp 0x4f61fb
mov byte [ebp - 9], 0
test esi, esi
je 0x4f6205
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6235
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004046fc
lea eax, [ebp - 4]
call fcn.004046d8
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401545
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401586
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401582
nop word [eax + eax]
cmp esi, edx
jae 0x401586
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401570
cmp esi, edx
jb 0x40158b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x401ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x52e474]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
mov dword [ebp - 0x10c], 0
call fcn.004938a0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x108], 0
jne 0x401b39
xor ecx, ecx
jmp 0x401b4b
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b42
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00405360
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00491b3a
mov esp, ebp
pop ebp
ret
Function at 0x401b70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2038
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x52e474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x22c
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.004938a0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x401bd7
xor al, al
jmp 0x401cd0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401cc7
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401e20
add esp, 8
mov ecx, dword [ebp - 0x258]
lea esi, [ebp - 0x28]
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
cmovae esi, dword [ebp - 0x28]
call fcn.00402fa0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401c75
mov eax, dword [ebp - 0x24c]
mov ecx, ebx
mov esi, dword [ebx]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x25c]
push eax
push dword [esi + 4]
push esi
call fcn.00403ce0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jb 0x401cec
lea ecx, [eax + 1]
mov dword [ebx + 4], ecx
mov dword [esi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x401cb2
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jb 0x401ca9
test al, 0x1f
jne 0x401cf6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x401cf6
sub eax, ecx
cmp eax, 4
jb 0x401cf6
cmp eax, 0x23
ja 0x401cf6
mov eax, ecx
push eax
call fcn.00491936
add esp, 4
lea eax, [ebp - 0x254]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401bf6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491b3a
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.0044410a
call fcn.0049c524
int3
Function at 0x402170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 8]
push eax
push str.SOFTWAREHintsoft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x4021b6
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4021b0
push eax
call esi
mov byte [ebp - 1], 0
jmp 0x4021d7
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov eax, dword [ebp - 8]
sete byte [ebp - 1]
test eax, eax
je 0x4021d7
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWARESicent
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x402202
mov eax, dword [ebp - 8]
test eax, eax
je 0x4021fc
push eax
call esi
mov byte [ebp - 2], 0
jmp 0x40221d
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
test eax, eax
mov eax, dword [ebp - 8]
sete byte [ebp - 2]
test eax, eax
je 0x40221d
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWAREGoyoo
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x402248
mov eax, dword [ebp - 8]
test eax, eax
je 0x402242
push eax
call esi
mov byte [ebp - 3], 0
jmp 0x402263
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
test eax, eax
mov eax, dword [ebp - 8]
sete byte [ebp - 3]
test eax, eax
je 0x402263
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.SOFTWARE_
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40228c
mov eax, dword [ebp - 8]
test eax, eax
je 0x402288
push eax
call esi
xor bl, bl
jmp 0x4022a6
push 0
push 0
push 0
push dword [ebp - 8]
call ebx
test eax, eax
mov eax, dword [ebp - 8]
sete bl
test eax, eax
je 0x4022a6
push eax
call esi
cmp byte [ebp - 1], 0
jne 0x4022c5
cmp byte [ebp - 2], 0
jne 0x4022c5
cmp byte [ebp - 3], 0
jne 0x4022c5
test bl, bl
jne 0x4022c5
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402310
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x24]
cmp ax, 9
je 0x402336
cmp ax, 6
je 0x402336
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x402340
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f20e8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52e474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
test esi, esi
je 0x40240f
cmp byte [esi], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x4023ac
xor ecx, ecx
jmp 0x4023ba
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4023b1
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00405360
push 0x51f6c0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004038e0
push edi
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.004038e0
add esp, 0x18
lea ecx, [ebp - 0x28]
push eax
call fcn.004030e0
lea ecx, [ebp - 0x58]
call fcn.00404c00
lea ecx, [ebp - 0x70]
call fcn.00404c00
lea ecx, [ebp - 0x40]
call fcn.00404c00
jmp 0x402433
cmp byte [edi], 0
jne 0x402418
xor ecx, ecx
jmp 0x402429
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402420
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00405360
push dword [ebp + 0x14]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x51f6c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x28]
call fcn.00404c00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491b3a
mov esp, ebp
pop ebp
ret
Function at 0x402480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2118
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52e474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
cmp byte [ebx], 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x4024db
xor ecx, ecx
jmp 0x4024e9
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4024e0
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405360
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edi
cmp byte [ecx + eax - 1], 0x5c
je 0x402573
or eax, 0xffffffff
sub eax, ecx
cmp eax, 1
ja 0x402527
push str.string_too_long
call fcn.0044410a
lea esi, [ecx + 1]
cmp esi, 0xfffffffe
jbe 0x402539
push str.string_too_long
call fcn.0044410a
cmp edx, esi
jae 0x40257f
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
test esi, esi
je 0x402573
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0x5c
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
mov edx, dword [ebp - 0x2c]
cmp byte [edx], 0
jne 0x402594
xor ecx, ecx
jmp 0x4025a9
test esi, esi
jne 0x402554
cmp edx, 0x10
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax], 0
jmp 0x402573
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4025a0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00404aa0
push 0x38
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.004938a0
mov eax, dword [ebp - 0x30]
add esp, 0xc
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x3c
mov dword [ebp - 0x6c], 0x440
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp byte [ebp + 0x18], 0
je 0x40261e
push 0xffffffffffffffff
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x28]
call fcn.00404c00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491b3a
mov esp, ebp
pop ebp
ret