joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409920
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x409937
cmp esi, 0x20
jne 0x409b0b
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x409b0a
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x4099a2
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x409975
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x409a8a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x409a20
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x422078]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + str.cw]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx ebx, byte [ebx + str.cw]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x409a6d
cmp esi, 6
jbe 0x409a6d
cmp edx, 4
jne 0x409a6d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x4099c0
xor esi, esi
sub ecx, 1
js 0x409b09
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x409af9
cmp ecx, 4
jb 0x409af9
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x421478]
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x421878]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x421078]
movzx eax, bl
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x421c78]
mov eax, dword [ebp + 8]
jmp 0x409afb
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x409a97
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40a230
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x40a408
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x40a408
test bl, 3
jne 0x40a408
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x40a27a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x40a408
cmp byte [eax], 0x3d
je 0x40a267
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x40a3fd
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x40a2a2
sub al, 0x41
jmp 0x40a2d1
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x40a2ae
sub al, 0x47
jmp 0x40a2d1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x40a2ba
add al, 4
jmp 0x40a2d1
cmp al, 0x2b
jne 0x40a2c2
mov al, 0x3e
jmp 0x40a2d1
cmp al, 0x2f
jne 0x40a2ca
mov al, 0x3f
jmp 0x40a2d1
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x40a2e1
sub dl, 0x41
jmp 0x40a315
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x40a2ee
sub dl, 0x47
jmp 0x40a315
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x40a2fb
add dl, 4
jmp 0x40a315
cmp dl, 0x2b
jne 0x40a304
mov dl, 0x3e
jmp 0x40a315
cmp dl, 0x2f
jne 0x40a30d
mov dl, 0x3f
jmp 0x40a315
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x40a324
sub bl, 0x41
jmp 0x40a358
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x40a331
sub bl, 0x47
jmp 0x40a358
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x40a33e
add bl, 4
jmp 0x40a358
cmp bl, 0x2b
jne 0x40a347
mov bl, 0x3e
jmp 0x40a358
cmp bl, 0x2f
jne 0x40a350
mov bl, 0x3f
jmp 0x40a358
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x40a36a
sub ah, 0x41
jmp 0x40a3a2
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x40a379
sub ah, 0x47
jmp 0x40a3a2
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x40a388
add ah, 4
jmp 0x40a3a2
cmp ah, 0x2b
jne 0x40a391
mov ah, 0x3e
jmp 0x40a3a2
cmp ah, 0x2f
jne 0x40a39a
mov ah, 0x3f
jmp 0x40a3a2
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x40a408
cmp dl, 0xff
je 0x40a408
cmp bl, 0xff
je 0x40a408
cmp ah, 0xff
je 0x40a408
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x40a293
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a6e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x40a853
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40a853
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x40a84c
xor eax, eax
test ebx, ebx
je 0x40a7b0
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x40a740
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x40a817
sub ecx, 1
jne 0x40a849
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40c220
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40c3f2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3f0
jne 0x40c3f2
push edi
mov ecx, esi
call fcn.0040c470
mov edi, eax
cmp edi, 0xffffffff
je 0x40c3e9
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xffffffff
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40c3d5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40c3cb
test eax, eax
je 0x40c3cb
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40c2d6
call ebx
cmp eax, 0x7a
jne 0x40c3cb
push dword [ebp - 4]
call fcn.0040cf14
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 4]
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40c3c2
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c3c2
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x40c3c2
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40c348
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40c3cb
push dword [ebp - 4]
call fcn.0040cf14
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40c3af
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40c3af
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x40c3af
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x18]
cmp eax, 1
sete bl
call fcn.0040cf1d
push dword [ebp - 8]
call fcn.0040cf1d
add esp, 8
test bl, bl
jne 0x40c3d5
jmp 0x40c3cb
push ebx
call fcn.0040cf1d
push dword [ebp - 8]
call fcn.0040cf1d
add esp, 8
jmp 0x40c3cb
push ebx
call fcn.0040cf1d
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esi], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x40c3e9
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c470
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dd1b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x431f1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0xffffffff
push eax
mov dword [ebp - 0x248], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40c680
cmp dword [ebp - 0x248], 0xffffffff
je 0x40c680
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
je 0x40c649
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push ebx
push eax
call fcn.0040f0d0
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40c5c0
jmp 0x40c550
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.00411f35
add esp, 8
test eax, eax
jne 0x40c59e
cmp edi, ebx
je 0x40c57f
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x258], edi
jmp 0x40c59e
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.0040c0c0
mov ebx, dword [ebp - 0x254]
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40c550
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x40c649
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40c634
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jne 0x40c634
push dword [esi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x40c634
lea ecx, [ebp - 0x244]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x250]
test eax, eax
jne 0x40c63d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x40c5d0
jmp 0x40c643
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x244]
test esi, esi
je 0x40c67c
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x40c672
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c6a2
push ebx
push esi
call fcn.0040cf06
add esp, 8
mov eax, edi
jmp 0x40c686
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d173
mov esp, ebp
pop ebp
ret
call fcn.00410b2a
int3

Function at 0x414e7b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004149ce
Function at 0x4017c0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1114
call fcn.00405410
mov eax, dword [0x408348]
push esi
mov esi, dword [esp + 0x111c]
push edi
cmp esi, eax
jb 0x401981
mov eax, dword [esp + 0x1124]
test eax, eax
je 0x401981
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x1c]
cmp esi, 8
rep stosd dword es:[edi], eax
mov ecx, 0x240
lea edi, [esp + 0x81c]
rep stosd dword es:[edi], eax
jbe 0x401811
xor esi, esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x16]
mov eax, dword [esp + 0x14]
push str.GWCLI
shl esi, 4
add esi, 0x408350
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
push edx
mov edx, dword [esp + 0x1e]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea eax, [esp + 0x3c]
push 0x800
push eax
call fcn.00401990
mov edx, dword [esp + 0x114c]
lea ecx, [esp + 0x1150]
push ecx
push edx
lea eax, [esp + 0x84c]
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
lea ecx, [esp + 0x854]
push 0x7ff
lea edx, [esp + 0x58]
push ecx
push edx
call esi
add esp, 0x44
lea eax, [esp + 0x1c]
mov byte [esp + 0x81b], 0
push 0x408434
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x7ff
lea ecx, [esp + 0x20]
push 0x408438
push ecx
call esi
mov al, byte [0x40834c]
add esp, 0xc
test al, 1
mov byte [esp + 0x81b], 0
je 0x4018fd
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x40834c], 2
je 0x401981
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push str.c:gwlog.txt
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401981
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0
push esi
call edi
cmp eax, 0x20000
jbe 0x401958
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 8]
push 0
push eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x1114
ret
Function at 0x401ac0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebp
xor ebp, ebp
push esi
push ebp
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401b42
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401b2e
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
je 0x401b1c
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401b2e
jmp 0x401aff
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x18]
mov ebp, 1
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret

Function at 0x401f40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x15c
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x65]
mov byte [esp + 0x64], bl
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x16c]
push 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x68]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [esp + 0x178]
mov dword [esp + 0x20], 0x44
cmp edx, ebx
je 0x401fd1
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401fd1
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x170]
lea ecx, [esp + 0x64]
push eax
push esi
push str.__s___s
push 0x104
push ecx
mov word [esp + 0x64], 5
mov dword [esp + 0x60], 1
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
xor esi, esi
mov dword [esp + 0xc], ebx
call fcn.004019d0
test eax, eax
je 0x40201d
lea edx, [esp + 0xc]
push edx
call fcn.00401a60
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x80]
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402043
or esi, 0xffffffff
call fcn.004019d0
test eax, eax
je 0x402059
mov eax, dword [esp + 0xc]
push eax
call fcn.00401a90
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x15c
ret
Function at 0x402660
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
push esi
lea eax, [esp + 0xa0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov dword [esp + 8], 0x9c
push ecx
call esi
test eax, eax
jne 0x4026b6
lea edx, [esp + 8]
mov dword [esp + 8], 0x94
push edx
call esi
pop edi
xor eax, eax
pop esi
add esp, 0xc0
ret
cmp dword [esp + 0xc], 6
jne 0x4026ab
cmp dword [esp + 0x10], 2
jb 0x4026ab
pop edi
mov eax, 1
pop esi
add esp, 0xc0
ret

Function at 0x4027f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
xor edi, edi
push edi
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x402857
lea eax, [esp + 8]
push ebx
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402844
mov ebx, dword [esp + 0x138]
cmp dword [esp + 0x14], ebx
je 0x40283f
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402844
jmp 0x402828
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x128
ret
mov eax, edi
pop edi
pop esi
add esp, 0x128
ret

Function at 0x402870
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebp
xor ebp, ebp
push esi
push ebp
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4028e5
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4028d1
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
je 0x4028cc
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4028d1
jmp 0x4028af
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
Function at 0x402c80
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x534
push ebx
mov ebx, dword [esp + 0x53c]
test ebx, ebx
mov byte [esp + 7], 0
jne 0x402ca1
xor al, al
pop ebx
add esp, 0x534
ret
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x148]
push eax
push 0xa
rep stosd dword es:[edi], eax
mov esi, 1
mov dword [esp + 0x14c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x402d54
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402d4d
mov edx, dword [esp + 0x34]
cmp edx, ebx
jne 0x402d0d
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x13], 1
mov dword [esp + esi*4 + 0x144], ecx
inc esi
cmp esi, 0x100
jb 0x402d3e
jmp 0x402d3c
xor eax, eax
test esi, esi
jbe 0x402d3e
lea ecx, [esp + 0x144]
cmp edx, dword [ecx]
je 0x402d28
inc eax
add ecx, 4
cmp eax, esi
jb 0x402d1a
jmp 0x402d3e
mov edx, dword [esp + 0x24]
mov dword [esp + esi*4 + 0x144], edx
inc esi
cmp esi, 0x100
jb 0x402d3e
xor esi, esi
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402cea
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jbe 0x402e16
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x144]
mov dword [esp + 0x18], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
test edi, edi
je 0x402dfc
push edi
push str.KillChildProcess:_d
push 4
call fcn.004017c0
add esp, 0xc
push edi
push 0
push 1
call ebx
mov ebp, eax
test ebp, ebp
je 0x402de9
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
test al, al
mov byte [esp + 0x13], al
je 0x402dcd
push edi
push str.KillChildProcess:_d_OK
push 4
call fcn.004017c0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402dfc
call esi
push eax
push edi
push str.KillChildProcess:_d_Failed_err:_d
push 4
call fcn.004017c0
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402dfc
call esi
push eax
push edi
push str.KillChildProcess:_d_Failed_Cant_Open_err:_d
push 4
call fcn.004017c0
add esp, 0x10
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add ecx, 4
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x402d77
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x534
ret

Function at 0x403120
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push eax
mov eax, dword [esp + 8]
push edx
push 3
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc