joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b94c0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x56f8f4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004cfa80
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4b9525
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4b9525
lea edx, [esp]
push edx
call dword [0x56f87c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004c3202
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004c3202
add esp, 0x108
ret
jmp 0x4b94c0

Function at 0x4b9540
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x56f8f4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004cfa80
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4b9525
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4b9525
lea edx, [esp]
push edx
call dword [0x56f87c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004c3202
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004c3202
add esp, 0x108
ret
jmp 0x4b94c0
Function at 0x4bcf00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x4bcf19
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0049bbe0
push edx
push eax
call fcn.0049bc10
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x4bcf66
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.0049bbe0
push edx
push eax
call fcn.0049bc10
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x4bcf68
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x4c3202
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x56f8f4]
jne 0x4c320c
repz ret
jmp fcn.004d025c

Function at 0x4de7bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004cfba3
and dword [ebp - 4], 0
cmp dword [0x573810], 0
mov ebx, eax
jne 0x4de870
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4de921
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4de921
push eax
call fcn.004cfb31
mov dword [esp], 0x533ec0
push edi
mov dword [0x573810], eax
call esi
push eax
call fcn.004cfb31
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x573814], eax
call esi
push eax
call fcn.004cfb31
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x573818], eax
call esi
push eax
call fcn.004cfb31
pop ecx
mov dword [0x573820], eax
test eax, eax
je 0x4de870
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004cfb31
pop ecx
mov dword [0x57381c], eax
mov eax, dword [0x57381c]
cmp eax, ebx
je 0x4de8c8
cmp dword [0x573820], ebx
je 0x4de8c8
push eax
call fcn.004cfbac
push dword [0x573820]
mov esi, eax
call fcn.004cfbac
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4de8c8
test edi, edi
je 0x4de8c8
call esi
test eax, eax
je 0x4de8bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4de8bf
test byte [ebp - 0xc], 1
jne 0x4de8c8
or dword [ebp + 0x10], 0x200000
jmp 0x4de901
mov eax, dword [0x573814]
cmp eax, ebx
je 0x4de901
push eax
call fcn.004cfbac
pop ecx
test eax, eax
je 0x4de901
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4de901
mov eax, dword [0x573818]
cmp eax, ebx
je 0x4de901
push eax
call fcn.004cfbac
pop ecx
test eax, eax
je 0x4de901
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x573810]
call fcn.004cfbac
pop ecx
test eax, eax
je 0x4de921
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4de923
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ffc90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50fe63
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x56f8f4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x573840
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x573840
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x537b82
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.004fefc0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5055c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00403cc0
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x50562b
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00403cc0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 4

Function at 0x505760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00505520
movzx eax, al
test eax, eax
jne 0x50577a
xor al, al
jmp 0x5057b3
mov ecx, dword [ebp + 0xc]
call fcn.004017b0
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403cc0
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00403cc0
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5057b1
xor al, al
jmp 0x5057b3
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x505aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51092b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x44]
call fcn.00505520
movzx eax, al
test eax, eax
jne 0x505afa
mov ecx, dword [ebp + 8]
call fcn.00403ce0
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 8]
jmp 0x505bf8
lea edx, [ebp - 0x14]
push edx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00403cc0
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x505b32
cmp dword [ebp - 0x10], 1
je 0x505b4b
cmp dword [ebp - 0x10], 2
je 0x505b4b
cmp dword [ebp - 0x10], 6
je 0x505b4b
mov ecx, dword [ebp + 8]
call fcn.00403ce0
mov eax, dword [ebp - 0x40]
or eax, 1
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
jmp 0x505bf8
cmp dword [ebp - 0x14], 0
jbe 0x505be4
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004046f0
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00414360
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00403cc0
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00404730
mov byte [eax], 0
lea ecx, [ebp - 0x3c]
call fcn.00414360
push eax
lea ecx, [ebp - 0x34]
call fcn.004045c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403d30
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d70
mov eax, dword [ebp + 8]
jmp 0x505bf8
mov ecx, dword [ebp + 8]
call fcn.00403ce0
mov eax, dword [ebp - 0x40]
or eax, 1
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret 8
Function at 0x505d30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x505d4f
cmp dword [ebp + 0xc], 0
jne 0x505d56
xor eax, eax
jmp 0x505e73
lea eax, [ebp - 0x400]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x505e63
mov dword [ebp - 8], 0
jmp 0x505d82
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [ebp + edx*2 - 0x400]
test eax, eax
je 0x505e63
push 0x53793c
mov ecx, dword [ebp - 8]
lea edx, [ebp + ecx*2 - 0x400]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x505dc9
push 0x537944
mov eax, dword [ebp - 8]
lea ecx, [ebp + eax*2 - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x505dcb
jmp 0x505d79
mov edx, dword [ebp - 8]
mov ax, word [ebp + edx*2 - 0x400]
mov word [ebp - 0x14], ax
mov ecx, dword [ebp - 8]
mov dx, word [ebp + ecx*2 - 0x3fe]
mov word [ebp - 0x12], dx
xor eax, eax
mov word [ebp - 0x10], ax
push 0x64
lea ecx, [ebp - 0x4c8]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x505e0a
xor eax, eax
jmp 0x505e73
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x4c8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ca562
add esp, 0xc
test eax, eax
jne 0x505e5e
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
jmp 0x505e73
jmp 0x505d79
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret

Function at 0x505f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x505f97
xor al, al
jmp 0x505fbd
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x506110
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004c3b30
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x5061c6
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.004c3b30
add esp, 0xc
push 0x208
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x214]
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.00505d30
add esp, 8
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004016b0
mov edx, dword [ebp - 0x424]
or edx, 1
mov dword [ebp - 0x424], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret

Function at 0x506830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5104c5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x2c]
call fcn.00403ce0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x5068d4
mov dword [ebp - 0x38], 1
mov ecx, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401570
lea edx, [ebp + 0x18]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00401550
push eax
lea eax, [ebp - 0x38]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call fcn.00401550
push eax
mov ecx, dword [ebp + 8]
call fcn.004045c0
mov ecx, dword [ebp - 0x3c]
or ecx, 1
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret
Function at 0x506920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51050a
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00403ce0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x506a16
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.004045c0
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 1
push 0x53790c
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.004031b0
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.004031b0
add esp, 0xc
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x98], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.00403d70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00403d70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00403d70
jmp 0x506a22
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403ca0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403cc0
push eax
push 0x537910
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret
Function at 0x506cb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51056a
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.004c3b30
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x506d14
xor al, al
jmp 0x506daf
mov dword [ebp - 0x244], 0x22c
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x506da3
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.00506a70
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.00403cc0
push eax
lea ecx, [ebp - 0x260]
call fcn.00403cc0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x506d7d
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00403d70
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x506d32
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret

Function at 0x507280
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00507040
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.00401770
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5072dc
push 3
push 0
mov ecx, dword [ebp + 8]
call fcn.00401770
push eax
lea ecx, [ebp - 0x20]
call fcn.00401770
push eax
push 0x537a44
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
jae 0x507301
push 3
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00401770
push eax
push 0x537a50
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
jae 0x507329
push 3
push 0
mov ecx, dword [ebp + 8]
call fcn.00401770
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x25], cl
lea ecx, [ebp - 0x20]
call fcn.00401730
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret
Function at 0x507c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.004168a0
jmp 0x507c2f
push 0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 8]
call fcn.00414f90
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 8]
call fcn.004168d0
push eax
lea ecx, [ebp - 8]
call fcn.00414fd0
movzx eax, al
test eax, eax
je 0x507caf
lea ecx, [ebp - 8]
call fcn.00402320
mov ecx, eax
call fcn.00403cc0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
push ecx
call fcn.00506200
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x28]
push edx
call fcn.00418200
add esp, 0x20
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00401770
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x507ca2
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x28]
call fcn.00401730
mov al, byte [ebp - 0x3d]
jmp 0x507cb1
lea ecx, [ebp - 0x28]
call fcn.00401730
jmp 0x507c21
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret 4

Function at 0x507cd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.004168a0
jmp 0x507cff
push 0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 8]
call fcn.00414f90
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 8]
call fcn.004168d0
push eax
lea ecx, [ebp - 8]
call fcn.00414fd0
movzx eax, al
test eax, eax
je 0x507d7f
lea ecx, [ebp - 8]
call fcn.00402320
mov ecx, eax
call fcn.00403cc0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
push ecx
call fcn.00506200
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x28]
push edx
call fcn.00418200
add esp, 0x20
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00401770
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x507d72
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x28]
call fcn.00401730
mov al, byte [ebp - 0x3d]
jmp 0x507d81
lea ecx, [ebp - 0x28]
call fcn.00401730
jmp 0x507cf1
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ef08
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063e1b
call fcn.10063438
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x428a
mov eax, edx
cmp dword [ebp - 0x14], 0x4398
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
jle 0x1001ef69
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1060d4b8
xor eax, esi
cdq
push edx
push eax
call fcn.1001a685
inc ebx
cmp ebx, 0x4e1c
jl 0x1001ef43
inc esi
cmp esi, 0x4d1b
jl 0x1001ef41
mov eax, dword [ebp - 0x18]
cmp eax, 0x49adf0ae
jae 0x1001ef7a
sub dword [0x1060ccb8], 0x4f98ac29
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x427d
jge 0x1001efb5
mov edx, 0x10008dd0
mov ecx, 0x1060d4b8
call fcn.1001cb90
jmp 0x1001efb5
mov eax, dword [0x1060e5e0]
test al, 1
jne 0x1001efd2
or eax, 1
mov dword [0x1060e5e0], eax
call fcn.10022ec1
mov dword [0x1060e674], eax
jmp 0x1001efd7
mov eax, dword [0x1060e674]
mov eax, dword fs:[eax]
mov ecx, dword [ebp - 0xc]
mov dword [edi], eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002defa
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002df27
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 1
push 0x5e26
push dword [ebp - 8]
push 0x4c1d
call fcn.1002df63
add esp, 0x10
jmp 0x1002df5f
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002df4f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002df4d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1002df5f
push 0x1dda
push 0x138e
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov esp, ebp
pop ebp
ret

Function at 0x1002f1de
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002f20a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.10035bd9
add esp, 0xc
jmp 0x1002f231
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002f229
push 0
push 0x1eff
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x1002f231
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret