joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a1f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a0b70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], 0x104
push 0x104
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0042e7f0
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00401fc0
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x48c0f0
mov ecx, dword [ebp + 0x10]
call fcn.00401fc0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00401ec0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042e0e3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45a690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d44e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push str.Notify...
lea ecx, [ebp - 0x24]
call fcn.00401ee0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00405260
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0
mov ecx, 1
test ecx, ecx
je 0x45a794
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x34]
add ecx, 0x14
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x45a732
jmp 0x45a794
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xe7
je 0x45a78d
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Could_not_find_ARM_server_to_notify
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov dword [ebp - 4], 1
push 0x3e8
lea eax, [ebp - 0x28]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405260
xor eax, eax
jmp 0x45a8a2
jmp 0x45a794
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x14], 0xe7
jne 0x45a7f9
push 0x7d0
mov ecx, dword [ebp - 0x34]
add ecx, 0x14
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x45a7f9
push str.Wait_to_notify_ARM_Server_failed
lea ecx, [ebp - 0x2c]
call fcn.00401ee0
mov dword [ebp - 4], 2
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405260
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], 2
jne 0x45a887
mov dword [ebp - 0x20], 0
cmp dword [ebp + 8], 0
je 0x45a819
mov dword [ebp - 0x38], 1
jmp 0x45a82d
mov ecx, 0x4a4b78
call fcn.004046d0
neg eax
sbb eax, eax
add eax, 3
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], edx
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x45a887
push str.Notify_ARM_Server_failed
lea ecx, [ebp - 0x30]
call fcn.00401ee0
mov dword [ebp - 4], 3
push 0
lea eax, [ebp - 0x30]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405260
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x10], 0xffffffff
je 0x45a897
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x45adf0
Capabilities:
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f921
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push str.StartServer...
lea ecx, [ebp - 0x24]
call fcn.00401ee0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00405260
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0045a4e0
add esp, 4
test eax, eax
jne 0x45aeab
push str.Create_DACL_failed
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x28]
push edx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405260
mov eax, dword [ebp - 0x1c]
jmp 0x45afe7
lea eax, [ebp - 0x18]
push eax
push 0
push 4
push 4
push 0xff
push 6
push 1
mov ecx, dword [ebp - 0x38]
add ecx, 0x14
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x38]
cmp dword [edx + 8], 0xffffffff
je 0x45af68
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 8]
mov dword [eax + 4], edx
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, dword [ebp - 0x38]
add ecx, 4
push ecx
push 0x45aa40
push 0
push 0
call fcn.0042f096
add esp, 0x18
mov edx, dword [ebp - 0x38]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xc], 0xffffffff
jne 0x45af5f
mov dword [ebp - 0x1c], 0
push str._beginthreadex_failed_in_Notify.
lea ecx, [ebp - 0x2c]
call fcn.00401ee0
mov dword [ebp - 4], 2
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405260
jmp 0x45af66
mov dword [ebp - 0x1c], 1
jmp 0x45af9b
push str.Create_ARM_Server_failed
lea ecx, [ebp - 0x30]
call fcn.00401ee0
mov dword [ebp - 4], 3
push 0
lea edx, [ebp - 0x30]
push edx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405260
cmp dword [ebp - 0x14], 0
je 0x45afab
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1c], 0
je 0x45afe4
push str.ARM_Server_started
lea ecx, [ebp - 0x34]
call fcn.00401ee0
mov dword [ebp - 4], 4
push 0
lea ecx, [ebp - 0x34]
push ecx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00405260
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45e4a0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e9ba
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push str.Cleanup...
lea ecx, [ebp - 0x10]
call fcn.00401ee0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405260
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0xbc], 0
jne 0x45e5c5
push 0x80
mov ecx, dword [ebp - 0x1c]
add ecx, 0xcc
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x6a9
mov ecx, 0x4a4b78
call fcn.004010e0
movzx edx, al
test edx, edx
jne 0x45e554
mov ecx, dword [ebp - 0x1c]
add ecx, 0xcc
call fcn.00401fc0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45e5a5
mov eax, dword [ebp - 0x1c]
add eax, 0xcc
push eax
push str.Delete_file:
lea ecx, [ebp - 0x14]
push ecx
call fcn.004015a0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x24]
push eax
push 0x6a9
mov ecx, dword [ebp - 0x1c]
call fcn.00401100
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405260
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x530
call fcn.00401040
mov dword [ebp - 0x28], eax
call fcn.0044a960
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45f2f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f778
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
push str.ExecuteInstalls...
lea ecx, [ebp - 0x24]
call fcn.00401ee0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00405260
push 1
push 7
mov ecx, dword [ebp - 0x30]
call fcn.0045f2b0
mov dword [ebp - 0x10], 1
mov ecx, 0x4a4b78
call fcn.004030c0
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x48], eax
push 0
push str.Acrobat_Instance_Mutex
push 0
lea ecx, [ebp - 0x20]
call fcn.0041562b
mov dword [ebp - 4], 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.004156bb
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x634], 0
jne 0x45f3bb
push 0x3a98
push 0xd80
mov ecx, dword [ebp - 0x30]
call fcn.0045ea40
push 0x5dc
mov ecx, 0x4a4b78
call fcn.004010e0
movzx eax, al
test eax, eax
jne 0x45f3e3
mov ecx, dword [ebp - 0x30]
add ecx, 0x514
call fcn.00451c80
test eax, eax
jne 0x45f41f
push 0x48f650
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 0x5dc
mov ecx, dword [ebp - 0x30]
call fcn.00401100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405260
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x634], 0
jne 0x45f433
mov ecx, dword [ebp - 0x30]
call fcn.0045d920
cmp dword [ebp - 0x18], 0
je 0x45f441
lea ecx, [ebp - 0x20]
call fcn.0041567e
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x610
call fcn.0045a8c0
mov eax, dword [ebp - 0x14]
or esi, 0xffffffff
sub esi, dword [eax + 0x48]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x48], esi
push 4
mov ecx, dword [ebp - 0x14]
call fcn.00467b50
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00415673
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x466b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov byte [0x4a4ad4], 1
mov dword [0x4a4ac8], 1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, 0x4a4b5c
call fcn.00401fc0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x466b86
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x4a4b60
call fcn.00401fc0
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x466b9c
cmp dword [ebp - 0xc], 1
jne 0x466b9c
mov dword [0x4a4ac8], 2
mov esp, ebp
pop ebp
ret
Function at 0x467e40
Capabilities:
Enumerate gui resources
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3440
call fcn.004361d0
mov eax, dword [0x4a0b70]
xor eax, ebp
mov dword [ebp - 0x1020], eax
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x467e7d
xor eax, eax
jmp 0x46804f
mov dword [ebp - 0x1008], 0
mov edx, dword [ebp - 0x100c]
shr edx, 2
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1004], 1
mov dword [ebp - 0x1018], 0
jmp 0x467ec5
mov eax, dword [ebp - 0x1018]
add eax, 1
mov dword [ebp - 0x1018], eax
mov ecx, dword [ebp - 0x1018]
cmp ecx, dword [ebp - 0x1010]
jae 0x468049
mov edx, dword [ebp - 0x1018]
cmp dword [ebp + edx*4 - 0x1000], 0
je 0x468044
mov eax, dword [ebp - 0x1018]
mov ecx, dword [ebp + eax*4 - 0x1000]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0
je 0x468044
mov dword [ebp - 0x122c], 0
xor edx, edx
mov word [ebp - 0x1228], dx
push 0x206
push 0
lea eax, [ebp - 0x1226]
push eax
call fcn.0042e7f0
add esp, 0xc
lea ecx, [ebp - 0x122c]
push ecx
push 0x2000
lea edx, [ebp - 0x3230]
push edx
mov eax, dword [ebp - 0x101c]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x467f84
push 0x104
lea ecx, [ebp - 0x1228]
push ecx
mov edx, dword [ebp - 0x3230]
push edx
mov eax, dword [ebp - 0x101c]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameW
mov ecx, dword [ebp - 0x122c]
shr ecx, 2
mov dword [ebp - 0x1230], ecx
mov dword [ebp - 0x3234], 0
jmp 0x467fae
mov edx, dword [ebp - 0x3234]
add edx, 1
mov dword [ebp - 0x3234], edx
mov eax, dword [ebp - 0x3234]
cmp eax, dword [ebp - 0x1230]
jge 0x468037
push 0x104
lea ecx, [ebp - 0x3440]
push ecx
mov edx, dword [ebp - 0x3234]
mov eax, dword [ebp + edx*4 - 0x3230]
push eax
mov ecx, dword [ebp - 0x101c]
push ecx
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jbe 0x468032
lea edx, [ebp - 0x3440]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042e926
add esp, 8
test eax, eax
je 0x468032
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1018]
mov eax, dword [ebp + edx*4 - 0x1000]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x1018]
mov edx, dword [ebp + ecx*4 - 0x1000]
push edx
push 0x467d60
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x1008], 1
jmp 0x467f9f
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x467eb6
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x1020]
xor ecx, ebp
call fcn.0042e0e3
mov esp, ebp
pop ebp
ret
Function at 0x468060
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46cce7
mov eax, dword fs:[0]
push eax
sub esp, 0xa44
mov eax, dword [0x4a0b70]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x47b29c]
mov dword [ebp - 0x21c], eax
mov ecx, dword [str.nknown_]
mov dword [ebp - 0x218], ecx
mov edx, dword [0x47b2a4]
mov dword [ebp - 0x214], edx
mov eax, dword [0x47b2a8]
mov dword [ebp - 0x210], eax
mov ecx, dword [0x47b2ac]
mov dword [ebp - 0x20c], ecx
push 0x1f4
push 0
lea edx, [ebp - 0x208]
push edx
call fcn.0042e7f0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46825a
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x228]
push ecx
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x468142
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameW
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x46825a
mov ecx, dword [ebp + 0x10]
call fcn.00403350
movzx ecx, al
test ecx, ecx
jne 0x4681cf
push 0x400
lea edx, [ebp - 0xa2c]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jbe 0x4681ca
lea ecx, [ebp - 0xa2c]
push ecx
lea ecx, [ebp - 0xa34]
call fcn.00401ee0
mov dword [ebp - 0xa44], eax
mov edx, dword [ebp - 0xa44]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004069e0
add esp, 8
mov byte [ebp - 0xa2d], al
lea ecx, [ebp - 0xa34]
call fcn.00405260
movzx ecx, byte [ebp - 0xa2d]
test ecx, ecx
je 0x4681ca
mov eax, 1
jmp 0x46826c
jmp 0x46825a
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0xa3c]
call fcn.00401ee0
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xa40]
call fcn.00401ee0
mov dword [ebp - 0xa50], eax
mov edx, dword [ebp - 0xa4c]
push edx
mov eax, dword [ebp - 0xa50]
push eax
call fcn.004069e0
add esp, 8
mov byte [ebp - 0xa35], al
lea ecx, [ebp - 0xa40]
call fcn.00405260
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa3c]
call fcn.00405260
movzx ecx, byte [ebp - 0xa35]
test ecx, ecx
je 0x46825a
mov eax, 1
jmp 0x46826c
cmp dword [ebp - 0x10], 0
je 0x46826a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042e0e3
mov esp, ebp
pop ebp
ret
Function at 0x468290
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d182
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.004361d0
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea ecx, [ebp - 0x100c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x4682df
xor eax, eax
jmp 0x4683a7
mov edx, dword [ebp - 0x1014]
shr edx, 2
mov dword [ebp - 0x1018], edx
mov dword [ebp - 0x1010], 0
jmp 0x468309
mov eax, dword [ebp - 0x1010]
add eax, 1
mov dword [ebp - 0x1010], eax
mov ecx, dword [ebp - 0x1010]
cmp ecx, dword [ebp - 0x1018]
jae 0x4683a5
mov edx, dword [ebp - 0x1010]
cmp dword [ebp + edx*4 - 0x100c], 0
je 0x4683a0
push 0
lea ecx, [ebp - 0x1020]
call fcn.00401ee0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1020]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1010]
mov eax, dword [ebp + edx*4 - 0x100c]
push eax
call fcn.00468060
add esp, 0xc
mov dword [ebp - 0x101c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1020]
call fcn.00405260
cmp dword [ebp - 0x101c], 0
je 0x4683a0
cmp dword [ebp + 0xc], 0
je 0x468399
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1010]
mov eax, dword [ebp + edx*4 - 0x100c]
mov dword [ecx], eax
mov eax, 1
jmp 0x4683a7
jmp 0x4682fa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x468590
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d1e6
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x4a4b78
call fcn.004067f0
mov ecx, eax
call fcn.00405020
push eax
lea ecx, [ebp - 0x14]
call fcn.00401fa0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 4
jne 0x468794
mov dword [ebp - 0x20], 0
mov ecx, 0x4a4b78
call fcn.004075d0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.00408230
mov ecx, 0x4a4b78
call fcn.004067f0
mov ecx, eax
call fcn.004081f0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
jmp 0x46862c
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
call fcn.00406d70
cmp dword [ebp - 0x24], eax
jge 0x468749
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004076c0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
cmp dword [edx], 0
je 0x468744
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call fcn.004081d0
test eax, eax
jne 0x468744
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
call fcn.00407ad0
push eax
lea ecx, [ebp - 0x34]
call fcn.00401fa0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401fc0
push eax
push 0x47b1d8
lea ecx, [ebp - 0x34]
call fcn.00403150
push 0x47b1f4
lea ecx, [ebp - 0x34]
call fcn.004011d0
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx]
call fcn.00402de0
push eax
lea ecx, [ebp - 0x34]
call fcn.004011b0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call fcn.00406750
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jne 0x4686f8
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00401670
push eax
call fcn.00467e40
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4686f6
mov dword [ebp - 0x20], 1
jmp 0x468738
cmp dword [ebp - 0x2c], 0
jne 0x468738
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call fcn.00402de0
mov ecx, eax
call fcn.00401fc0
push eax
call fcn.00468290
add esp, 8
cmp dword [ebp - 0x30], 0
je 0x468738
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x30]
push ecx
push 0x467d60
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00405260
jmp 0x468623
cmp dword [ebp - 0x20], 0
je 0x468788
mov ecx, 0x4a4b78
call fcn.004010a0
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00452d10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2bc]
call fcn.0041d7f1
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
call fcn.00452c30
jmp 0x46878f
mov dword [ebp - 0x10], 1
jmp 0x4685e0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c0], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405260
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4687d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e15c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a0b70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x468849
push str.OpenProcessToken_failed_in_RebootOS.
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405260
jmp 0x468910
lea edx, [ebp - 0x20]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4688c2
push str.AdjustTokenPrivileges_failed_in_RebootOS.
lea ecx, [ebp - 0x2c]
call fcn.00401ee0
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x2c]
push edx
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405260
jmp 0x468910
push SysReAllocStringLen
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x468910
push str.ExitWindowsEx_failed_in_RebootOS.
lea ecx, [ebp - 0x30]
call fcn.00401ee0
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x30]
push eax
push 2
call fcn.00467240
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x1a8170c3
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..tls
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x48973df1
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219