joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41096f
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test esi, esi
push ebx
mov ebx, eax
jne 0x41097f
xor eax, eax
jmp 0x4109f4
test ebx, ebx
jne 0x410988
mov byte [esi], 0
jmp 0x41097b
jge 0x4109ae
push edi
call fcn.00412cb9
mov edi, eax
sub edi, dword [ebp + 8]
push ebx
call fcn.0051209e
cmp edi, eax
pop ecx
jge 0x4109a4
mov ebx, edi
jmp 0x4109ad
push ebx
call fcn.0051209e
pop ecx
mov ebx, eax
pop edi
mov ax, word [ebp + 8]
mov word [ebp - 8], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 6], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
push esi
call fcn.00412d51
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x4109e4
cmp eax, ebx
jg 0x410983
mov byte [eax + esi], 0
jmp 0x41097b
cmp eax, ebx
jg 0x4109ee
mov byte [eax + esi], 0
jmp 0x4109f1
mov byte [esi], 0
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x410f02
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x22c]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x230], ebx
call fcn.005117f0
add esp, 0xc
push 0xff
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.005117f0
add esp, 0xc
push 9
xor eax, eax
pop ecx
mov dword [ebp - 0x25c], ebx
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
mov eax, esi
call fcn.004c75e1
test eax, eax
jne 0x410f91
cmp esi, ebx
je 0x410f7f
push str.GetAllProcesses___was_passed_an_invalid_string_list.
call fcn.004265da
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x234], eax
jne 0x410fab
push str.GetAllProcesses___FAILED:_CreateToolhelp32Snapshot___FAILED_
jmp 0x410f79
lea ecx, [ebp - 0x230]
push ecx
push eax
mov dword [ebp - 0x230], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x410fe3
push str.GetAllProcesses___FAILED:_Process32First___FAILED_
call fcn.004265da
pop ecx
or esi, 0xffffffff
mov edi, dword [ebp - 0x234]
call fcn.0042dbeb
mov eax, esi
jmp 0x410f82
xor edi, edi
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x100
lea eax, [ebp - 0x108]
call fcn.004c3b66
pop ecx
push ebx
push eax
push esi
call fcn.004c75fc
add esp, 0xc
push dword [ebp - 0x228]
or eax, 0xffffffff
mov ecx, esi
call fcn.004c7f02
pop ecx
push dword [ebp - 0x21c]
mov eax, esi
call fcn.004c7f99
pop ecx
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
inc edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x410fe5
mov esi, edi
jmp 0x410fd4
Function at 0x4110c5
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x124
lea eax, [ebp - 0x12c]
push esi
push eax
mov dword [ebp - 0x130], esi
call fcn.005117f0
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x13c], esi
call fcn.004c3b34
test eax, eax
je 0x41111b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x13c], eax
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x138], eax
jne 0x41114f
push esi
push esi
push str.GetProcessThreadCount__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.004265da
add esp, 0xc
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
lea ecx, [ebp - 0x130]
push ecx
push eax
mov dword [ebp - 0x130], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41118b
push esi
push esi
push str.GetProcessThreadCount__s___d__FAILED:_Process32First___FAILED_
call fcn.004265da
add esp, 0xc
or esi, 0xffffffff
mov edi, dword [ebp - 0x138]
call fcn.0042dbeb
mov eax, esi
jmp 0x411140
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x128], eax
jne 0x4111a7
mov dword [ebp - 0x134], 1
cmp dword [ebp - 0x134], esi
je 0x4111b5
add ebx, dword [ebp - 0x11c]
inc edi
cmp edi, 0x300
jle 0x4111dc
cmp edi, 0x309
jge 0x4111f2
lea eax, [ebp - 0x10c]
push eax
push esi
push esi
push str.:9:GetProcessThreadCount__s___d__FAILED:_Process32Next__s__wont_stop_
call fcn.004265da
add esp, 0x10
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x138]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41118f
mov esi, ebx
jmp 0x41117c
Function at 0x4111f6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x130]
push ebx
push eax
mov dword [ebp - 0x134], ebx
call fcn.005117f0
add esp, 0xc
cmp esi, ebx
je 0x4112e2
cmp byte [esi], bl
je 0x4112e2
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x411260
push dword [ebp + 8]
push esi
push str.CountProcesses__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.004265da
add esp, 0xc
or eax, 0xffffffff
jmp 0x4112e4
lea eax, [ebp - 0x134]
push eax
push edi
mov dword [ebp - 0x134], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x411293
push dword [ebp + 8]
push esi
push str.CountProcesses__s___d__FAILED:_Process32First___FAILED_
call fcn.004265da
add esp, 0xc
call fcn.0042dbeb
jmp 0x411258
mov dword [ebp - 0x138], ebx
cmp dword [ebp + 8], ebx
push esi
lea eax, [ebp - 0x110]
push eax
je 0x4112b3
call fcn.00512a33
test eax, eax
pop ecx
pop ecx
je 0x4112be
jmp 0x4112c4
call fcn.004c48c1
test eax, eax
pop ecx
pop ecx
je 0x4112c4
inc dword [ebp - 0x138]
lea eax, [ebp - 0x134]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x411299
call fcn.0042dbeb
mov eax, dword [ebp - 0x138]
jmp 0x4112e4
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x411e22
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 8], 0
push esi
push edi
mov edi, eax
jne 0x411e31
xor eax, eax
jmp 0x411e80
test edi, edi
jne 0x411e3a
mov edi, 0x5304ba
push edi
call fcn.005120b0
pop ecx
inc eax
push eax
push edi
push 1
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x411e7d
push esi
push str._GetLastError_
push edi
push dword [esp + 0x1c]
push str.:4:SetRegString___s_____s___FAILED:_RegSetValueEx___FAILED:__s_ld
call fcn.00426c01
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x411e2d
xor eax, eax
inc eax
pop edi
pop esi
ret

Function at 0x411f0e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1a4]
mov esi, 0x207
xor ebx, ebx
push esi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.005117f0
add esp, 0xc
cmp dword [ebp + 0x1a8], ebx
mov dword [ebp - 0x7c], ebx
jge 0x411f66
mov dword [ebp + 0x1a8], esi
push 0x208
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.005117f0
mov eax, dword [ebp - 0x78]
add esp, 0xc
call fcn.004c3ab2
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x411f8f
xor eax, eax
jmp 0x411fdd
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
je 0x411fc9
push esi
push str._GetLastError_
push edi
push str.:4:GetRegString___s___FAILED:_RegQueryValueEx___FAILED:__s_ld
call fcn.00426c01
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x411f8b
mov ecx, dword [ebp + 0x1a8]
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x78]
dec ecx
call fcn.004c3b66
pop ecx
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
add ebp, 0x198
leave
ret

Function at 0x411ff4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
jne 0x412002
xor eax, eax
jmp 0x412043
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x412040
push esi
push str._GetLastError_
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.:4:SetRegDword___s____ld__FAILED:_RegSetValueEx___FAILED:__s_ld
call fcn.00426c01
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x411ffe
xor eax, eax
inc eax
pop esi
pop ebp
ret
Function at 0x412046
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push esi
jne 0x41205a
xor eax, eax
jmp 0x4120a1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x41209e
push esi
push str._GetLastError_
push dword [ebp + 0xc]
push str.:4:GetRegDword___s___FAILED:_RegQueryValueEx___FAILED:__s_ld
call fcn.00426c01
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x412056
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x412815
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 2]
stosw word es:[edi], ax
call fcn.00412d51
test eax, eax
mov ecx, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov word [ebp - 4], cx
mov word [ebp - 2], bx
mov edi, dword [ebp - 4]
je 0x412854
cmp eax, 0xffffffff
je 0x412854
push edi
push eax
call esi
mov dword [ebp - 8], eax
jmp 0x412869
push str._GetLastError_
push eax
push ebx
push ecx
push str.:7:SetConsoleCursorPosServer__d___d_:_FAILED___x:__s
call fcn.004265da
add esp, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call ebx
test eax, eax
je 0x412880
cmp eax, 0xffffffff
je 0x412880
push edi
push eax
call esi
push 0xfffffffffffffff4
call ebx
test eax, eax
je 0x412891
cmp eax, 0xffffffff
je 0x412891
push edi
push eax
call esi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push str.CONOUT_
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4128b7
push edi
push eax
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414424
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x5dc48c]
test eax, eax
push ebx
push edi
mov edi, dword [esp + 0xc]
je 0x414465
xor ebx, ebx
inc ebx
test eax, eax
mov dword [0x5dc490], ebx
je 0x41444d
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x5dc48c]
test edi, edi
je 0x414457
test eax, eax
jne 0x414433
jmp 0x414468
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x414571
xor ebx, ebx
inc ebx
test edi, edi
je 0x41456f
push esi
mov esi, 0x5dc498
push edi
mov ecx, 0x104
mov eax, esi
call fcn.004c3b66
pop ecx
mov eax, edi
call fcn.004c3ab2
mov cl, byte [0x5dc498]
xor edx, edx
xor eax, eax
jmp 0x4144c1
test edx, edx
je 0x4144ab
cmp cl, 0x29
jne 0x4144a2
xor edx, edx
mov byte [eax + 0x5dc5a0], 0x20
jmp 0x4144ba
cmp cl, 0x28
jne 0x4144b4
mov edx, ebx
jmp 0x4144a2
mov byte [eax + 0x5dc5a0], cl
mov cl, byte [eax + 0x5dc499]
inc eax
test cl, cl
jne 0x414497
push ebp
mov ebp, 0x5dc5a0
push ebp
push esi
mov byte [eax + 0x5dc5a0], cl
call fcn.005122c0
test eax, eax
pop ecx
pop ecx
je 0x41454e
call fcn.004142c2
test eax, eax
jne 0x41454e
and dword [esp + 0x14], eax
and dword [0x5dc490], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebx, 0x5dc490
call fcn.00410230
test eax, eax
jne 0x414542
cmp dword [esp + 0x14], eax
mov dword [0x5dc48c], 1
je 0x41451f
push ebp
call edi
mov eax, 0x2ee
jmp 0x414527
push esi
call edi
mov eax, 0x5dc
call fcn.004f15fe
xor eax, eax
cmp dword [esp + 0x14], eax
sete al
cmp dword [0x5dc490], 0
mov dword [esp + 0x14], eax
je 0x4144fc
push esi
call edi
and dword [0x5dc48c], 0
jmp 0x41456d
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
and dword [0x5dc48c], 0
push 0x3e8
mov dword [0x5dc490], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
pop esi
xor eax, eax
pop edi
pop ebx
ret 4
Function at 0x414576
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and word [ebp - 4], 0
push ebx
push esi
mov ebx, eax
xor eax, eax
and dword [ebp - 8], eax
test ebx, ebx
push edi
lea edi, [ebp - 2]
mov esi, ecx
stosw word es:[edi], ax
jne 0x4145a7
cmp esi, 0x100
mov ebx, 0x5dc6a8
jb 0x4145a7
mov esi, 0xff
mov eax, ebx
call fcn.004c3ab2
test esi, esi
jg 0x4145c6
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.:3:GetConsoleText__d___d___d__FAILED:_iCount_is_invalid:__d
call fcn.00426c01
jmp 0x414611
mov ax, word [ebp + 8]
mov edi, dword [ebp + 0xc]
mov word [ebp - 4], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 2], di
push dword [ebp - 4]
push esi
push ebx
call fcn.00412d51
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
jne 0x414614
cmp byte [0x5dbeba], al
jne 0x414614
push str._GetLastError_
push esi
push edi
push dword [ebp + 8]
push str.:3:GetConsoleText__d___d___d__FAILED:_ReadConsoleOutputCharacter___FAILED:__s
call fcn.00426c01
mov byte [0x5dbeba], 1
add esp, 0x14
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x414668
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xa8]
mov ebx, 0x100
lea esi, [ebx - 1]
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6f]
push 0
push eax
mov byte [ebp - 0x70], 0
call fcn.005117f0
and word [ebp - 0x74], 0
xor eax, eax
and dword [ebp - 0x80], eax
lea edi, [ebp - 0x72]
stosw word es:[edi], ax
mov eax, dword [ebp - 0x78]
add esp, 0xc
call fcn.004c3b56
test eax, eax
je 0x4146d5
xor eax, eax
jmp 0x414781
push dword [ebp - 0x7c]
lea edi, [ebp - 0x70]
push dword [ebp - 0x78]
mov eax, edi
push esi
push eax
jmp 0x414712
lea eax, [ebp - 0x70]
cmp edi, eax
je 0x4146f2
push edi
call fcn.00511758
pop ecx
add ebx, ebx
lea eax, [ebx + 0xa]
push eax
push 1
call fcn.00511988
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4146ce
push dword [ebp - 0x7c]
lea eax, [ebx - 1]
push dword [ebp - 0x78]
push eax
push edi
call fcn.005140d9
add esp, 0x10
cmp eax, 0xffffffff
je 0x4146e4
mov ebx, dword [ebp + 0x9c]
mov esi, dword [ebp + 0xa0]
lea ecx, [ebp - 0x80]
push ecx
mov word [ebp - 0x74], bx
mov word [ebp - 0x72], si
push dword [ebp - 0x74]
push eax
push edi
call fcn.00412d51
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
test eax, eax
jne 0x414770
cmp byte [0x5dbebb], al
jne 0x414770
push str._GetLastError_
push edi
push esi
push ebx
push str.:3:OutConsole__d___d___s__FAILED:_WriteConsoleOutputCharacter___FAILED:__s
call fcn.00426c01
add esp, 0x14
mov byte [0x5dbebb], 1
lea eax, [ebp - 0x70]
cmp edi, eax
je 0x41477e
push edi
call fcn.00511758
pop ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
add ebp, 0x94
leave
ret
Function at 0x415911
Capabilities:
Shutdown system

Disassembly:
push esi
push 0x80040002
push 1
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExA]
test eax, eax
jne 0x41593e
push esi
push esi
push 1
push str.:3:RestartWindows__d___d___d__FAILED:_InitiateSystemShutdownEx___FAILED_
call fcn.004265da
add esp, 0x10
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret

Function at 0x415943
Capabilities:
Get disk size
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0xf0]
push 0x90
mov dword [ebp - 0xf4], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
push esi
push eax
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
call fcn.005117f0
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0xd4], esi
lea edi, [ebp - 0xd0]
rep stosd dword es:[edi], eax
mov edi, 0x94
push edi
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.005117f0
push 0x24
lea eax, [ebp - 0xd4]
push esi
push eax
call fcn.005117f0
push 0x20
lea eax, [ebp - 0xf4]
push esi
push eax
call fcn.005117f0
add esp, 0x30
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x415a13
push str._GetLastError_
push str.:6:CalculateHardwareID___FAILED:_GetVersionEx___FAILED:__s
call fcn.00426c01
pop ecx
pop ecx
xor eax, eax
jmp 0x415a99
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push esi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb0]
push eax
push esi
push esi
call fcn.00489f49
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x415a61
push str._GetLastError_
push str.:6:CalculateHardwareID___FAILED:_GetDiskFreeSpaceEx___FAILED:__s
call fcn.004265da
jmp 0x415a0a
movzx eax, word [ebp - 0xb2]
add eax, dword [ebp - 0xa8]
movzx ecx, word [ebp - 0xd4]
add ecx, eax
add ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x9c]
add ecx, dword [ebp - 0x98]
lea eax, [ecx + eax + 0x2222]
cmp eax, esi
jne 0x415a99
mov eax, 0x111
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051291c
leave
ret
Function at 0x415cc5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x90
lea eax, [ebp - 0x1a4]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x1b8], edi
mov dword [ebp - 0x1a8], ebx
call fcn.005117f0
add esp, 0xc
mov esi, 0x94
push esi
lea eax, [ebp - 0x1a8]
push ebx
push eax
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0x1a8]
push eax
mov dword [ebp - 0x1a8], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x415d46
push str._GetLastError_
push str.:3:IsWindowsVISTA___FAILED:_GetVersionEx___FAILED:__s
call fcn.00426c01
pop ecx
pop ecx
mov dword [ebp - 0x1b0], ebx
jmp 0x415d56
cmp dword [ebp - 0x1a4], 6
sbb eax, eax
inc eax
mov dword [ebp - 0x1b0], eax
cmp edi, ebx
je 0x415e46
cmp dword [ebp - 0x1b0], ebx
je 0x415e3e
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.005117f0
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ecx, 0x104
lea eax, [ebp - 0x110]
mov dword [ebp - 0x1ac], ebx
call fcn.004c3b66
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop ecx
push ebx
lea eax, [ebp - 0x1ac]
push eax
push ebx
mov edi, 0x20019
push edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push closesocket
call esi
cmp eax, ebx
mov dword [ebp - 0x1b4], eax
je 0x415e18
push ebx
lea eax, [ebp - 0x1ac]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push closesocket
call esi
test eax, eax
je 0x415e0a
push dword [ebp - 0x1b4]
push str._GetLastError_
push str.:8:IsWindowsVISTA___FAILED_to_detect_UAC:_RegCreateKeyEx___FAILED:__s_ld
call fcn.004265da
add esp, 0xc
jmp 0x415e10
mov dword [ebp - 0x1b4], ebx
cmp dword [ebp - 0x1b4], ebx
jne 0x415e3e
push str.EnableLUA
push dword [ebp - 0x1ac]
call fcn.00412046
pop ecx
pop ecx
push dword [ebp - 0x1ac]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1b8]
mov dword [eax], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1b0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x416c84
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
jle 0x416cdf
cmp dword [ebp + 0x10], ebx
jle 0x416cdf
push 1
mov esi, 0x410
push esi
call fcn.00511988
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x416cdf
push esi
push ebx
push edi
call fcn.005117f0
mov eax, dword [0x5dcdfc]
add esp, 0xc
cmp eax, ebx
jne 0x416cc9
call fcn.004a8f27
mov dword [0x5dcdfc], eax
push edi
call fcn.004a9020
cmp dword [0x5dcdfc], ebx
pop ecx
jne 0x416ce6
push edi
call fcn.00511758
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [edi + 0x1b8]
push 0x5395ac
push eax
call fcn.005123e0
mov dword [edi + 0x174], ebx
mov dword [edi + 0x190], ebx
lea ebx, [edi + 0x250]
push str..ConsoleField.c
push ebx
mov dword [edi + 0x15c], 1
mov dword [edi + 0x18c], 2
call fcn.0043266e
add esp, 0x10
test eax, eax
jne 0x416d3a
push str.:5:CreateConField___EAP:_InitializeLock___FAILED.
call fcn.004265da
pop ecx
mov esi, str.A_Console_Field_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0043296d
mov eax, 0xbb8
mov ecx, ebx
call fcn.004329aa
mov eax, edi
call fcn.0041bce2
push 0x530248
push 0xffffffffffffffff
push dword [ebp + 0x10]
mov eax, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00416f67
add esp, 0x14
test eax, eax
jne 0x416d83
mov eax, edi
call fcn.00416d99
jmp 0x416cdf
mov esi, edi
call fcn.00417437
push 0x5f
call fcn.0041746b
pop ecx
mov eax, edi
jmp 0x416ce1
Function at 0x421689
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3ff
xor ebx, ebx
lea eax, [ebp - 0x407]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x408], 0
call fcn.005117f0
add esp, 0xc
mov edx, esi
call fcn.004c3b34
test eax, eax
je 0x4216d1
xor eax, eax
jmp 0x421770
push 0xd1e
push str..CURL.c
mov edx, 0x530488
mov ecx, esi
call fcn.0042d2c6
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x410], eax
je 0x4216ca
push eax
mov esi, 0x400
push esi
lea eax, [ebp - 0x408]
push 1
push eax
mov dword [ebp - 0x40c], ebx
call fcn.00511c63
mov edi, 0x7ffffe56
jmp 0x42174b
xor ecx, ecx
test eax, eax
jle 0x421730
movzx edx, byte [ebp + ecx - 0x408]
add ebx, edx
cmp ebx, edi
jb 0x42172b
sub ebx, edi
inc ecx
cmp ecx, eax
jl 0x42171b
push dword [ebp - 0x410]
add dword [ebp - 0x40c], eax
push esi
lea eax, [ebp - 0x408]
push 1
push eax
call fcn.00511c63
add esp, 0x10
test eax, eax
ja 0x421715
add ebx, dword [ebp - 0x40c]
cmp ebx, edi
jb 0x42175e
sub ebx, edi
test ebx, ebx
jne 0x421763
inc ebx
mov ecx, dword [ebp - 0x410]
call fcn.0042d70e
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x427e15
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edx, ebp
call fcn.004c3b34
test eax, eax
je 0x427e30
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [0x5dfeec], 0
je 0x427e3d
xor eax, eax
jmp 0x427e2b
push 0
mov ecx, ebp
mov dword [0x5dfeec], 1
call fcn.0042b397
pop ecx
mov ebx, 0x80000
cmp eax, ebx
ja 0x427e65
xor eax, eax
and dword [0x5dfeec], 0
jmp 0x427e2b
push ebp
call fcn.0042bf02
mov edi, eax
test edi, edi
pop ecx
jne 0x427e77
or eax, 0xffffffff
jmp 0x427e5c
mov esi, dword [edi]
cmp esi, ebx
ja 0x427e86
push edi
call fcn.00511758
pop ecx
jmp 0x427e72
lea ebx, [esi - 0x80000]
cmp byte [ebx + edi + 4], 0xa
je 0x427ea0
inc ebx
lea eax, [esi - 0x20000]
cmp ebx, eax
jb 0x427e8c
jmp 0x427ea1
inc ebx
push 0x4e6
push str..Error.c
mov edx, 0x530484
mov ecx, ebp
call fcn.0042d2c6
mov ebp, eax
test ebp, ebp
pop ecx
pop ecx
je 0x427e7d
push ebp
sub esi, ebx
push esi
lea eax, [ebx + edi + 4]
push 1
push eax
call fcn.005110f1
mov ecx, ebp
call fcn.0042d70e
push edi
call fcn.00511758
xor eax, eax
add esp, 0x14
inc eax
jmp 0x427e5c