joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432615
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00432591
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x432784
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x432784
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x432739
jg 0x432671
test eax, eax
je 0x43272f
push 1
push 0x1000
call fcn.0042441c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x432694
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x432726
push 0x8000
push ebx
call fcn.004214b0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4326bd
jg 0x4326b8
cmp ecx, 0x1000
jb 0x4326bd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0042507f
add esp, 0x10
cmp eax, 0xffffffff
je 0x432702
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4326b8
jl 0x4326e9
test ecx, ecx
jne 0x4326aa
push dword [ebp - 0xc]
push ebx
call fcn.004214b0
push esi
call fcn.0042529b
add esp, 0xc
xor ebx, ebx
jmp 0x432792
cmp byte [edi + 0x24], 0
je 0x432719
cmp dword [edi + 0x20], 5
jne 0x432719
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x432724
mov ebx, dword [edi + 0x18]
jmp 0x432726
xor ebx, ebx
push esi
call fcn.0042529b
pop ecx
jmp 0x432792
test ecx, ecx
jg 0x4326fb
jl 0x432739
test eax, eax
jae 0x4326fb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00428fa7
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x432759
cmp byte [edi + 0x1c], 0
je 0x4326fb
jmp 0x43278a
push ebx
call fcn.0042bd83
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4326fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x432792
cmp byte [edi + 0x1c], 0
je 0x43278f
mov ebx, dword [edi + 0x18]
jmp 0x432792
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00428fa7
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x433bcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x433bcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0xb31e9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b21114
jmp 0xb31ee8
mov byte [esp + 2], dh
jmp 0xb31f06
lea esp, [esp + 0x2c]
jmp 0xb31ee2
push word [esp + 2]
mov dword [esp + 0x2c], edi
jmp 0xb31ec1
pushfd
jmp 0xb31be3
sub esp, 2
jae 0xb31f1c
rdtsc
mov cx, 0x15cf
or ecx, eax
lea esp, [esp + 2]
jmp 0xb31fba
push word [esp + 2]
jg 0xb31ed7
push word [esp + 2]
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0xb31ee2
rdtsc
jmp 0xb31f24
mov cx, 0x15cf
or ecx, eax
lea esp, [esp + 2]
jmp 0xb31fba
jmp 0xb31f93
lea edi, [esp]
sete ah
bswap edx
clc
jae 0xb31f52
bt edx, edx
jmp 0xb31f96
ror dx, cl
jp 0xb31fa0
jnp 0xb31fa0
popfd
adc dword [ecx + reloc.MSVCRT.dll_strncpy], eax
xchg edx, eax
add byte [edi - 0x6e], ah
popfd
pop ss
xchg edx, esp
adc ecx, ebx
or ah, byte [ebp - 0x7e2d5cf1]
in al, dx
rol byte [eax], 0
add byte [ebx - 0x1727140c], cl
sub eax, dword [eax]
add byte [eax], al
bt edx, edx
sub esp, 0xc0
mov esi, esp
jmp 0xb31f78
call 0xb31fd0
fist dword [esi - 0x3c]
mov dword [reloc.MSVCRT.dll_strncpy], eax
pop ebx
int 0x79
jmp [edx - 0x7b]
mov ebp, dword [esp + 0x2c]
lea ecx, [ecx*4]
mov dl, byte [esp]
mov ax, dx
xchg di, cx
jmp 0xb31f68

Function at 0xb3f656
Capabilities:
Hash data with md5

Disassembly:
and dword [eax], 0
mov dword [eax + 8], 0xc63c450e
pushal
pop word [esp + 2]
jmp 0xb23a3f
jmp 0xb40344
push edx
jmp 0xb753b0
pop dword [esp + 0xa]
lea esp, [esp + 2]
lea esp, [esp + 0x18]
mov dword [eax + 0xc], 0xd5d8088f
jmp 0xb23a29
jmp 0xb23a13
lea esp, [esp + 4]
jmp 0xb23a6b
and dword [eax + 4], 0
jmp 0xb239ec
lea edi, reloc.MSVCRT.dll_strncpy
pushal
push dword [esp + 8]
lea esp, [esp + 0x24]
mov dword [edx], edi
jmp 0xb753d3
mov edx, eax
lea edx, [edx + 0x10]
push edi
mov edi, 0xd6f02362
jmp 0xb75394
pop edi
pop edx
call fcn.00b753bd
mov word [esp + 7], cx
jmp 0xb753f2
lea esp, [esp + 0x24]
and dword [eax + 4], 0
jmp 0xb754ef
mov dword [eax + 0x10], reloc.MSVCRT.dll_strncpy
mov dword [eax + 0x14], 0x10325476
ret
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
jmp 0xb754ac

Function at 0xb3f772
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], edi
mov dword [esp], ebx
mov bx, word [esp]
jmp 0xb3f7d2
bswap ebx
mov ebx, 0x3df3856
mov bx, dx
lea ebx, [esp + 0x4e]
bswap ebx
jmp 0xb3f7e4
not bl
lea ebx, reloc.MSVCRT.dll_strncpy
not bl
xchg bl, bh
push eax
bswap ebx
jmp 0xb3f7bc
lea eax, [ebx + ebp]
push edx
mov eax, 0x6ae5833
mov ebx, 0x7ccb2baa
lea edx, [esp + ebp]
rdtsc
jmp 0xb3f8ad
lea eax, reloc.MSVCRT.dll_strncpy
setne ah
mov bx, word [esp]
mov edx, esi
mov eax, ebx
pushal
mov edx, dword [esp + 0x20]
not bl
mov bx, di
jmp 0xb3f86f
Function at 0xb844d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
js 0xb84108
jmp 0xb840f2
mov byte [esp + 1], ah
lea esp, [esp + 8]
jmp 0xb844c1

Function at 0xbd395e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebp + ebp]
mov dl, 0x24
jmp 0xbd39a4
mov di, 0x7b05
lea edi, [ebx + ebp]
mov di, word [esp + 0x34]
xchg dl, al
mov ax, bx
jmp 0xbd398e
xchg word [esp + 0x1c], ax
mov dx, 0xfec8
mov dword [esp + 0x29], eax
jmp 0xbd39d8
bsr edx, edi
lea eax, reloc.MSVCRT.dll_strncpy
or edi, 0x1f71c7fe
mov word [esp + 0x1b], cx
mov al, byte [esp + 0x2f]
jmp 0xbd3966
mov byte [esp + 0x1f], bl
xchg byte [esp + 1], dh
pop word [esp + 0x1d]
mov dx, si
lea edx, reloc.MSVCRT.dll_strncpy
mov dh, 0x63
jmp 0xbd3ab4
push word [esp + 0x13]
mov byte [esp + 8], cl
lea esp, [esp + 0xa]
xchg word [esp + 0xf], di
mov edx, dword [esp + 5]
btr eax, eax
jmp 0xbd3a7d
neg eax
mov dl, 0xac
push dword [esp + 0x17]
pop dword [esp + 0x2b]
mov al, bh
cmc
jmp 0xbd3a0c
btr di, si
xchg dword [esp + 0x1d], edi
bt dx, si
stc
jmp 0xbd3a93
lea eax, [ecx + edx]
mov ah, byte [esp + 0x16]
pop dx
mov edx, dword [esp + 0x1b]
mov dl, byte [esp + 9]
xchg dword [esp + 0xf], edx
jmp 0xbd3a46
lea esp, [esp + 8]
pop edx
push word [esp + 5]
push dword [esp + 5]
pop dword [esp + 0xe]
bswap edi
jmp 0xbd3a5c
lea edi, reloc.MSVCRT.dll_strncpy
add esp, 0x19
mov di, bx
xchg dword [esp + 1], edi
dec al
shr ah, cl
jmp 0xbd3f29
mov byte [esp + 0x28], bl
mov dl, byte [esp + 0xa]
mov di, word [esp + 0x26]
mov dx, 0x82c9
sete dh
lea eax, [edi*4]
jmp 0xbd3a35
not dh
xchg edi, eax
pushal
bswap eax
setne dl
pop word [esp + 0x1d]
jmp 0xbd3b1a
seto al
mov edi, esi
bswap edx
lea edi, reloc.MSVCRT.dll_strncpy
sub edx, ebx
mov edx, eax
jmp 0xbd3ad4
neg ah
rdtsc
call fcn.00bd3afd
lea esp, [esp + 0x19]
xchg al, dl
mov ax, word [esp + 1]
jmp 0xbd3b91
lea eax, [esp + 0xa8]
bswap edi
lea edi, [edi*4]
std
mov edi, 0xddd8773b
neg edx
jmp 0xbd3aea
xchg word [esp], ax
not dx
mov ah, bh
push word [esp + 1]
jmp 0xbd3bad
mov eax, 0xf59d44c7
mov edi, dword [esp + 1]
lea edx, reloc.MSVCRT.dll_strncpy
setl dh
lea esp, [esp + 3]
xchg word [esp], di
jmp 0xbd3b7b
mov dword [esp], edx
neg dh
call fcn.00bd3d90
cmp bh, byte [eax + 0x6cb8492e]
adc al, 0x95
add eax, 0x847b9f6c
aaa
push ds
mov eax, 0x2551696a
push esi
mov word [esp], ax
xchg word [esp + 4], ax
lea edx, [eax + ebp]
xchg word [esp + 4], di
jmp 0xbd3b5e
xchg byte [esp + 4], ah
add esp, 6
pop di
mov edi, dword [esp]
rdtsc
mov di, 0xb0e5
jmp 0xbd3bc6

Function at 0xbd3d26
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 1], edx
bt di, ax
clc
pop dx
jmp 0xbd3d5f
rcl eax, cl
lea edx, [esp + edx]
rol di, 0xb
lea edi, [ebp*4]
xchg dword [esp], edi
and dh, dh
jmp 0xbd3d49
Function at 0xbd4139
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
xchg word [esp + 2], di
not ax
mov di, dx
mov dword [esp + 5], ecx
mov edx, 0xc9d404f
jmp 0xbd4050
mov ax, 0xc7ce
xor edx, 0xe1f99082
xchg dword [esp + 9], edi
pop word [esp + 7]
rdtsc
neg dx
jmp 0xbd3ff4
xchg dword [esp + 8], edi
xchg dword [esp + 5], eax
xchg word [esp + 3], ax
jmp 0xbd4078
stc
rdtsc
btr edi, edx
pop dword [esp + 0xa]
pop ax
mov eax, dword [esp + 4]
jmp 0xbd403a
lea eax, [eax - 0xc9]
pop eax
xchg dx, ax
call fcn.00bd4062
mov di, bx
push dx
mov di, word [esp + 0x13]
xchg word [esp + 0x16], dx
dec edi
mov al, dl
jmp 0xbd4020
mov eax, dword [esp + 0xc]
bswap edx
setno ah
xchg dh, dl
std
jmp 0xbd40a8

Function at 0xbd41ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xbd4228
setge dh
rdtsc
add esp, 9
mov edx, 0x78275c78
neg dx
std
jmp 0xbd4212
sub esp, 0x12
push dword [esp + 0x1b]
xchg word [esp + 0x11], dx
mov word [esp + 7], di
pop eax
push dword [esp + 5]
xchg word [esp + 0xe], di
neg dh
pop word [esp + 1]
jmp 0xbd41f1

Function at 0xbd448f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + edx]
add esp, 9
mov dl, 0x9b
mov byte [esp], al
xchg byte [esp], dl
xchg edi, eax
jmp 0xbd44d3
not eax
rdtsc
mov word [esp + 6], di
jmp 0xbd4479
lea esp, [esp + 1]
rdtsc
std
neg edx
bsr ax, ax
bswap edx
jmp 0xbd46bb
mov ax, 0xd26b
xchg al, ah
adc ax, 0x837d
not ah
not dx
std
jmp 0xbd44bd
xchg byte [esp], dh
inc di
setl dh
call fcn.00bd45c0
neg edx
xchg ah, al
mov al, byte [esp + 3]
lea edx, reloc.MSVCRT.dll_strncpy
pushfd
not di
jmp 0xbd469f
neg edi
mov al, bh
pop word [esp + 2]
mov dh, 0x2f
lea esp, [esp + 0xd]
call fcn.00bd4642
dec eax
rol dword [ebx + 0x26], cl
aad 0x3a
salc
inc ecx
dec dx
btr di, ax
mov edx, dword [esp]
mov eax, ecx
not al
xchg byte [esp], al
jmp 0xbd4621

Function at 0xbd4508
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0xbd453f
bswap eax
mov ah, byte [esp + 7]
push dword [esp + 6]
neg al
jmp 0xbd4588
std
mov di, 0x50fc
bt di, ax
setl al
mov edi, 0x3e8acbfe
mov edx, 0x11202097
jmp 0xbd4529
dec dx
pushfd
mov ah, 0x5e
shr eax, 3
xchg dl, dh
pop dword [esp + 0x11]
jmp 0xbd4599
xchg word [esp + 4], ax
neg ax
xchg al, dl
add eax, ecx
pushal
mov edi, esi
jmp 0xbd456f
mov byte [esp + 0x1f], cl
push dword [esp + 0xe]
btr edi, ecx
std
rcr ax, 0xf
ror dl, 7
jmp 0xbd45e3
pop word [esp + 0x10]
xchg di, dx
mov byte [esp + 0xc], al
push dword [esp + 0x1a]
jmp 0xbd45fb
push dx
mov edi, ecx
pop dword [esp + 7]
xchg dword [esp + 0x13], edx
push word [esp + 0x29]
mov word [esp + 0x1b], ax
jmp 0xbd45cd
mov al, byte [esp + 0x2d]
lea edi, [eax - 0x47]
mov edx, dword [esp + 0x2b]
xchg byte [esp + 0x2d], dl
lea eax, [ecx*4]
rdtsc
jmp 0xbd4686
setns al
lea esp, [esp + 3]
mov dh, bh
lea edi, reloc.MSVCRT.dll_strncpy
lea eax, [ebp*4]
inc edi
jmp 0xbd462e
mov ax, word [esp + 0x17]
rdtsc
push word [esp + 0x28]
rdtsc
lea edx, reloc.MSVCRT.dll_strncpy
add esp, 0x25
jmp 0xbd465a
Function at 0xbd499e
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00bd4010
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0xbd49bd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xbd4bf7
push eax
jmp 0xbd400b
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xbd4b5f
Function at 0x405c18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405c2f
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405c64
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x405c60
cmp edi, eax
jae 0x405c64
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x405c52
cmp edi, eax
jb 0x405c68
xor eax, eax
jmp 0x405c72
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x405dd5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x405e63
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x405e0c
cmp dword [ebp - 8], 2
jne 0x405e62
push esi
mov esi, dword [ebp + 0xc]
call fcn.00405ae2
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004059e3
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x405e4a
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x405e5a
push eax
call fcn.004f0e34
pop ecx
mov edx, esi
call fcn.004059aa
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x406b8c
Capabilities:
Get disk information

Disassembly:
mov eax, 0x5107e9
call fcn.0050debc
sub esp, 0x2f4
push ebx
push esi
push edi
xor esi, esi
push 0xd2
lea eax, [ebp - 0xee]
push esi
push eax
mov word [ebp - 0xf0], si
call fcn.004f04c0
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, esi
jne 0x406bd7
xor eax, eax
jmp 0x406c9b
cdq
and edx, 3
add eax, edx
mov edi, eax
push 0x208
lea eax, [ebp - 0x2fe]
push esi
push eax
sar edi, 2
mov word [ebp - 0x300], si
call fcn.004f04c0
mov word [ebp - 0xf8], si
mov esi, dword [ebp + 8]
add esp, 0xc
add esi, 4
lea ebx, [ebp - 0xf0]
call fcn.00407274
test edi, edi
jle 0x406c98
mov dword [ebp - 0x10], edi
and word [ebx + 4], 0
push 0x104
lea eax, [ebp - 0x300]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x406c90
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00405b22
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
mov edi, esi
call fcn.00407219
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004058b2
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00405b22
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 1
call fcn.00407219
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004058b2
add ebx, 8
dec dword [ebp - 0x10]
jne 0x406c1d
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x406cd2
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esi + 0x14], ebx
jne 0x406d53
push str.PSAPI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x406d53
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push eax
call edi
push str.EnumProcesses
push dword [esi + 0x18]
mov dword [esi + 8], eax
call edi
push str.GetModuleBaseNameW
push dword [esi + 0x18]
mov dword [esi], eax
call edi
push str.GetModuleFileNameExW
push dword [esi + 0x18]
mov dword [esi + 4], eax
call edi
push str.GetProcessImageFileNameW
push dword [esi + 0x18]
mov dword [esi + 0xc], eax
call edi
cmp dword [esi], ebx
mov dword [esi + 0x10], eax
pop edi
je 0x406d4e
cmp dword [esi + 4], ebx
je 0x406d4e
cmp dword [esi + 8], ebx
je 0x406d4e
cmp dword [esi + 0xc], ebx
je 0x406d4e
cmp eax, ebx
je 0x406d4e
xor eax, eax
inc eax
jmp 0x406d50
xor eax, eax
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
pop ebx
ret
Function at 0x406e82
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x50f99b
call fcn.0050debc
sub esp, 0x224
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x22e]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x18], esi
mov word [ebp - 0x230], si
call fcn.004f04c0
xor ecx, ecx
add esp, 0xc
inc ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040620e
push 0x53e98c
push eax
mov dword [ebp - 4], esi
call fcn.0040542a
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
inc bl
call fcn.004058b2
test bl, bl
je 0x407058
mov ebx, 0x53ea80
push ebx
call fcn.004f0e34
mov esi, str.SystemRoot_
push esi
mov dword [ebp - 0x1c], eax
call fcn.004f0e34
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.0040620e
push ebx
push eax
mov dword [ebp - 4], 1
call fcn.0040542a
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
inc bl
call fcn.004058b2
test bl, bl
je 0x406f71
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
sub ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
mov eax, edi
call fcn.004061be
mov dword [ebp - 4], 2
call fcn.00404ead
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
jmp 0x407027
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.0040620e
push esi
push eax
mov dword [ebp - 4], 3
call fcn.0040542a
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
inc bl
call fcn.004058b2
test bl, bl
je 0x40702f
push 0x104
lea eax, [ebp - 0x230]
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
sub ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
inc ecx
mov eax, edi
call fcn.004061be
mov esi, eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 4
call fcn.00405b22
lea ecx, [ebp - 0x20]
push esi
push ecx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0040624a
pop ecx
pop ecx
mov byte [ebp - 4], 6
call fcn.00404ead
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.004058b2
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.004058b2
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.004058b2
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
cmp ecx, 3
jg 0x407042
mov esi, edi
call fcn.00405ae2
jmp 0x40705f
cmp ecx, 1
jge 0x407051
push 0x80070057
call fcn.004059cb
cmp word [eax + 2], 0x3a
jne 0x407039
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x407071
Capabilities:
Terminate process

Disassembly:
push esi
push dword [esp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40709b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x407c7a
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x407ca8
push dword [esp + 0xc]
call fcn.004f0e34
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407ca8
inc edi
mov eax, edi
pop edi
ret 8

Function at 0x407cc2
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x407d4b
push ebx
call fcn.004ed13b
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x407d3c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x53e98c
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x407d3c
cmp dword [ebp - 0xc], ebx
je 0x407d3c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x407d4b
push dword [ebp - 4]
call fcn.004f04b5
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret

Function at 0x407e1b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x50f268
call fcn.0050debc
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x55fb0c
mov dword [ebp - 0x10], edi
call fcn.00405b65
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.004f04c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00405d3d
push esi
call fcn.00407d87
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x407f76
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.004f04c0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x407fcf
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x408085
mov eax, dword [ebp - 0x94]
dec eax
je 0x408071
dec eax
jne 0x408085
mov eax, dword [ebp - 0xa0]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x40801e
cmp dword [ebp - 0x9c], edx
jne 0x408008
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x40806d
cmp dword [ebp - 0x9c], edi
jne 0x408056
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x40806d
cmp eax, 5
jne 0x408048
cmp dword [ebp - 0x9c], 2
jne 0x40802f
push eax
jmp 0x40804f
cmp dword [ebp - 0x9c], 1
jne 0x40803c
mov edi, ecx
jmp 0x408085
cmp dword [ebp - 0x9c], edi
jne 0x408085
push 3
jmp 0x40804f
cmp eax, 4
ja 0x408052
push 4
pop edi
jmp 0x408085
cmp eax, ecx
jb 0x408085
cmp dword [ebp - 0x9c], 2
jae 0x408063
cmp eax, ecx
jbe 0x408085
cmp byte [ebp + 0x76], dl
jne 0x408085
call fcn.00407e9e
mov edi, eax
jmp 0x408085
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x408ed2
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408ef7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408fb8
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 4], 0x490
call fcn.004f04c0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408f67
lea eax, [ebp - 0x20c]
push 0x53eb98
push eax
call fcn.004f1a36
test eax, eax
pop ecx
pop ecx
je 0x408f5b
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x408f31
jmp 0x408f70
mov edi, dword [ebp - 0x228]
and dword [ebp - 4], 0
jmp 0x408f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x408f95
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408fb7
push dword [ebp + 8]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408fb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret