joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414980
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dad0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x452550]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004029d0
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
push edx
mov ecx, 0x5b750c
call fcn.004041e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404200
push 0x44aa90
lea ecx, [ebp - 0x1c]
call fcn.00404bb0
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], 0x34
push 0
mov ecx, 0x5b750c
call fcn.00403660
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x414adb
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
call fcn.0041590f
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, 0x5b750c
call fcn.00403660
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x414ac9
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x44aa94
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x414ac9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
push str._d._d._d._d
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00403e30
add esp, 0x18
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.0041590a
add esp, 4
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403ea0
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404200
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4167fa
Capabilities:
Get disk information

Disassembly:
push 0x158
mov eax, 0x43dc0b
call fcn.0042a2af
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
mov edi, dword [ebp + 0x10]
setne al
mov dword [ebp - 0x158], esi
test eax, eax
jne 0x416828
call fcn.00415ea3
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x416823
lea eax, [ebp - 0x154]
push eax
push esi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x416870
push 0xffffffffffffffff
push ebx
push 0x104
push esi
call fcn.0042a079
push eax
call fcn.004038a0
add esp, 0x14
push ebx
push edi
call fcn.004167cd
xor eax, eax
jmp 0x416991
cmp eax, 0x104
jb 0x41688d
test edi, edi
je 0x416869
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.00404b40
jmp 0x416869
call fcn.00416390
push eax
lea ecx, [ebp - 0x15c]
call fcn.00404220
and dword [ebp - 4], 0
lea eax, [ebp - 0x15c]
push eax
push esi
call fcn.00416783
mov esi, dword [ebp - 0x15c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x416986
xor ecx, ecx
lea eax, [ebp - 0x160]
push ecx
push ecx
push eax
lea eax, [ebp - 0x164]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4168f8
push ebx
push edi
call fcn.004167cd
lea ecx, [esi - 0x10]
call fcn.00404650
jmp 0x416869
mov eax, dword [ebp - 0x160]
test al, 2
jne 0x416914
push dword [ebp - 0x158]
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x160]
test al, 4
jne 0x416986
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x416986
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x4168e4
cmp eax, dword [ebp - 0x158]
jbe 0x4168e4
lea eax, [ebp - 0x124]
push eax
call fcn.00429c50
mov edx, dword [ebp - 0x154]
sub edx, dword [ebp - 0x158]
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x416999
lea eax, [ebp - 0x124]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x154]
call fcn.0042abb7
push eax
call fcn.004038a0
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.00404650
xor eax, eax
inc eax
call fcn.0042a25e
ret 0xc
test edi, edi
je 0x4168eb
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.00404b40
jmp 0x4168eb

Function at 0x419493
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4194d8
call fcn.00417844
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4194d8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4194f4
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00415438
mov ebx, eax
test edi, edi
je 0x4194f2
test esi, esi
je 0x4194f2
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x423245
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x452550]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4232d7
test esi, esi
je 0x4232d7
push esi
call fcn.00429c50
push 0xff
mov ebx, eax
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x103]
push 0
push eax
call fcn.00429bc0
mov eax, 0x100
add esp, 0x10
cmp ebx, eax
ja 0x4232bc
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
jne 0x4232bc
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4232c4
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427fb1
mov esp, ebp
pop ebp
ret 8
call fcn.00415ea3
int3
Function at 0x437044
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x452550]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042faa2
mov dword [ebp - 0x14], eax
cmp dword [0x5b71cc], esi
jne 0x437137
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4370c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x437217
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x437217
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437217
push eax
call ebx
push 0x4433b4
push edi
mov dword [0x5b71cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4433c4
push edi
mov dword [0x5b71d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5b71d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5b71dc], eax
test eax, eax
je 0x437134
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5b71d8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43715c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43714f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x437171
push 4
pop eax
jmp 0x437219
cmp dword [ebp - 0x14], esi
je 0x437171
push dword [0x5b71cc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x437156
mov eax, dword [0x5b71d8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4371cf
cmp dword [0x5b71dc], edi
je 0x4371cf
push eax
call ebx
push dword [0x5b71dc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4371cf
test eax, eax
je 0x4371cf
call ecx
test eax, eax
je 0x4371c4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4371c4
test byte [ebp - 8], 1
jne 0x4371cf
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4371ff
mov eax, dword [0x5b71d0]
cmp eax, edi
je 0x4371fc
push eax
call ebx
test eax, eax
je 0x4371fc
call eax
mov esi, eax
test esi, esi
je 0x4371fc
mov eax, dword [0x5b71d4]
cmp eax, edi
je 0x4371fc
push eax
call ebx
test eax, eax
je 0x4371fc
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5b71cc]
call ebx
test eax, eax
je 0x437217
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x437219
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427fb1
mov esp, ebp
pop ebp
ret
Function at 0x444971
Capabilities:
Check for software breakpoints

Disassembly:
push eax
call 0x444977
pop ebx
sub ebx, 0x1a2
mov ecx, 0x137d5
sub ebx, ecx
mov esi, ebx
sub ebx, 0x30000
mov edi, ebx
sub ebx, 0x1000
push edi
push ecx
push esi
call fcn.00444826
add esp, 0xc
mov ebp, dword [ebx + 0xc0]
lea ebp, [ebx + ebp]
dec ebp
mov cl, byte [ebp]
cmp cl, 0xcc
je 0x4449a9
sub ebp, 9
mov edx, ebx
sub edx, dword [ebx + 0x74]
add dword [ebp], edx
add ebp, 6
add dword [ebp], edx
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, ebx
add esi, dword [edx + 0x10c]
mov edi, dword [edx + 0x104]
mov ecx, 0x1cc86
call fcn.00444947
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x444a33
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x444a2e
pushal
test eax, 0x80000000
je 0x444a18
and eax, 0x7fffffff
jmp 0x444a1c
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x444a03
add esi, 0x14
jmp 0x4449e9
pop edx
mov ebp, ebx
sub ebp, dword [edx + 0x34]
mov esi, dword [edx + 0xa0]
add esi, ebx
cmp esi, ebx
je 0x444a7d
push edx
mov eax, dword [esi + 4]
or eax, eax
je 0x444a7c
mov ecx, dword [esi]
add ecx, ebx
add esi, 8
sub eax, 8
shr eax, 1
mov edx, esi
lea edi, [eax + esi]
lea esi, [eax + edi]
xor eax, eax
add al, byte [edx]
adc ah, byte [edi]
test ah, 0x30
je 0x444a74
push eax
and ah, 0xf
add dword [ecx + eax], ebp
pop eax
inc edx
inc edi
cmp edi, esi
jb 0x444a63
jmp 0x444a46
pop edx
pop eax
cmp eax, 0xd0dec0de
je 0x444a8a
add ebx, dword [edx + 0x28]
jmp ebx
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4cf66c60
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, str.wz
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x263705ca
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x5054759e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x188676cd
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3c6440be
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x4d5536c
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x413710
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x443340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x4446e0], esi
jne 0x4137e6
xor eax, eax
push 0xfe
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push 2
push 0x407268
push 0x4071f8
push 0x80000001
mov dword [ebp - 0x108], 0x100
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, esi
je 0x41379c
mov ecx, dword [0x44333c]
cmp ecx, esi
je 0x4137e6
push eax
push 0x407190
push esi
push 0x50
push ecx
jmp 0x4137cf
push esi
push 0x400
lea eax, [ebp - 0x104]
push eax
call sub.sqmapi.dll_SqmGetSession
cmp eax, esi
jne 0x4137d9
cmp dword [0x44333c], esi
je 0x4137e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x407150
push esi
push 0x50
push dword [0x44333c]
call fcn.004264d9
add esp, 0x14
jmp 0x4137e6
push esi
push eax
push 0x4446e0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov ecx, dword [ebp - 4]
mov eax, dword [0x4446e0]
xor ecx, ebp
pop esi
call fcn.004217ea
leave
ret

Function at 0x413ed4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
xor ebx, ebx
cmp dword [esi + 4], edi
je 0x413eee
mov ebx, 0x80004004
jmp 0x413f44
cmp dword [esi], edi
jne 0x413ef9
mov ebx, 0x8000ef5c
jmp 0x413f44
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x4127cf
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x413f3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x413f36
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov dword [esi + 4], edi
jmp 0x413f44
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
Function at 0x413f4d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x443340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x228], ebx
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [esi], 0xffffffff
je 0x413fae
mov dword [ebp - 0x210], 0x80004004
jmp 0x414073
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x413fe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x413fd9
mov dword [ebp - 0x210], eax
jmp 0x414073
and eax, 0xffff
or eax, 0x80070000
jmp 0x413fce
push dword [0x443004]
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00413e60
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x414073
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, ebx
je 0x41404e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], 2
mov dword [ebp - 0x220], edi
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x414068
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x414062
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
cmp edi, ebx
je 0x414073
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004217ea
leave
ret 4
Function at 0x4154f9
Capabilities:
Enumerate process modules

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
xor ebx, ebx
push 0x40
pop edi
cmp dword [ebp + 8], esi
je 0x4155ed
cmp dword [ebp + 0xc], esi
je 0x4155ed
xor ecx, ecx
push 4
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004216f9
mov esi, eax
pop ecx
test esi, esi
jne 0x415542
mov ebx, 0x8007000e
jmp 0x4155f2
lea eax, [ebp - 4]
push eax
push 0x100
push esi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x415570
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x415569
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x4155f2
mov eax, dword [ebp - 4]
mov ecx, edi
shl ecx, 2
cmp eax, ecx
jne 0x4155d8
push esi
call fcn.004216ed
add edi, edi
xor ecx, ecx
push 4
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004216f9
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4155a7
mov ebx, 0x8007000e
lea eax, [ebp - 4]
push eax
mov eax, edi
shl eax, 2
push eax
push esi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x4155d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4155cf
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jge 0x415570
mov eax, dword [ebp - 4]
test ebx, ebx
jl 0x4155f2
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
xor esi, esi
shr eax, 2
mov dword [ecx], eax
jmp 0x4155f2
mov ebx, 0x80070057
test esi, esi
je 0x4155fd
push esi
call fcn.004216ed
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x415606
Capabilities:
Enumerate process modules

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x443340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x214]
push eax
xor edi, edi
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
call fcn.004154f9
mov esi, eax
cmp esi, edi
jl 0x415746
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x415685
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x415683
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
push ebx
mov ebx, dword [ebp - 0x210]
jl 0x41573e
cmp edi, dword [ebp - 0x214]
jae 0x41573e
lea eax, [ebp - 0x210]
push eax
push dword [ebx + edi*4]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x415732
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x21c]
jne 0x415732
push dword [ebx + edi*4]
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x415732
lea eax, [ebp - 0x228]
push eax
push 4
lea eax, [ebp - 0x220]
push eax
push esi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x41572b
push 0x103
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x220]
push esi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
je 0x41572b
push dword [ebp - 0x224]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x415738
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x415694
mov dword [ebp - 0x218], esi
push ebx
call fcn.004216ed
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
xor ecx, ebp
pop esi
call fcn.004217ea
leave
ret 4
Function at 0x4159ba
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa6c
mov eax, dword [0x443340]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x44333c]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xa18], esi
cmp ecx, esi
je 0x4159f1
push 0x408800
push esi
push 0x64
call fcn.00426404
lea eax, [ebp - 0xa18]
push eax
call fcn.0041575c
mov ebx, eax
cmp ebx, esi
jl 0x415a2b
mov ecx, dword [0x44333c]
cmp ecx, esi
je 0x415a1a
push 0x408780
push esi
push 0x3c
call fcn.00426404
push dword [ebp - 0xa18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415b34
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x24
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
cmp ebx, esi
jl 0x415b1d
push 0x408378
lea eax, [ebp - 0x210]
push eax
push 0x408764
lea eax, [ebp - 0xa14]
push 0x400
push eax
call fcn.00415825
xor eax, eax
lea edi, [ebp - 0xa28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0xa6c]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [0x44333c]
add esp, 0x20
mov dword [ebp - 0xa6c], edi
cmp eax, esi
je 0x415ac7
lea ecx, [ebp - 0xa14]
push ecx
push 0x408700
push esi
push 0x64
push eax
call fcn.004264d9
mov ecx, dword [0x44333c]
add esp, 0x14
cmp ecx, esi
je 0x415ac7
push 0x408678
push esi
push 0x64
call fcn.00426404
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa6c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xa14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x415b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x415b01
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x415b34
push dword [ebp - 0xa24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0xa28]
call edi
jmp 0x415b34
mov ecx, dword [0x44333c]
cmp ecx, esi
je 0x415b4b
push 0x408610
push esi
push 0x3c
call fcn.00426404
mov ecx, dword [0x44333c]
cmp ecx, esi
je 0x415b4b
push 0x4085e4
push esi
push 0x64
call fcn.00426404
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004217ea
leave
ret
Function at 0x4161ed
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x44333c]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x416210
push 0x408dd8
push esi
push 0x64
call fcn.00426404
push esi
call sub.WINSTA.dll_WinStationServerPing
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push 0x4160a7
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x416239
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042cfa8
adc dword [edx + 0x6dcb8008], edx
add dword [eax + 0xc], esi
dec ecx
add al, 0x80
jno 0x41624c
add byte [eax - 0x75], al
invalid