joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485700
Capabilities:
Check if file exists

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b015c
push eax
mov dword fs:[0], esp
sub esp, 0x354
push ebx
push ebp
mov ebp, dword [esp + 0x370]
xor bl, bl
push edi
mov edi, ecx
test ebp, ebp
jbe 0x4858c0
push 0
push str.All_Files__._.
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x38]
call sub.MFC42u.DLL_CFileDialog::CFileDialog
lea ecx, [esp + 0x20]
mov dword [esp + 0x368], 0
call sub.MFC42u.DLL_CFileDialog::DoModal
cmp eax, 1
jne 0x485895
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CFileDialog::GetPathName
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x36c], 1
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4857b4
mov eax, dword [0x545f7c]
push 0x34
mov ecx, edi
mov edx, dword [eax*4 + 0x515038]
mov eax, dword [eax*4 + 0x51502c]
push edx
push eax
call sub.MFC42u.DLL_CWnd::MessageBoxW
cmp eax, 6
jne 0x485883
push ebp
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x485865
mov ecx, dword [esp + 0x374]
mov edx, dword [edi + 0x214]
mov eax, dword [edi + 0x210]
push esi
push ebp
push ecx
push edx
push eax
call fcn.00430120
add esp, 0x14
cmp al, 1
jne 0x48583d
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFile::CFile
mov ecx, dword [esp + 0x10]
push 0
push 0x1001
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x378], 2
call sub.MFC42u.DLL_CFile::Open
test eax, eax
je 0x48582c
push ebp
push esi
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CFile::Write
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFile::Close
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x36c], 1
call fcn.004a62be
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
cmp bl, 1
jne 0x485865
mov eax, dword [0x545f7c]
push 0
mov edx, dword [eax*4 + 0x515038]
mov eax, dword [eax*4 + 0x515044]
push edx
push eax
jmp 0x48587c
mov eax, dword [0x545f7c]
push 0
mov ecx, dword [eax*4 + 0x515038]
mov edx, dword [eax*4 + 0x515050]
push ecx
push edx
mov ecx, edi
call sub.MFC42u.DLL_CWnd::MessageBoxW
lea ecx, [esp + 0x10]
mov byte [esp + 0x36c], 0
call sub.MFC42u.DLL_CString::CString
pop esi
lea ecx, [esp + 0xd0]
mov dword [esp + 0x368], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x368], 0xffffffff
call fcn.004a6198
mov ecx, dword [esp + 0x360]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x360
ret 8
Function at 0x489ca6
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x4b0718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x60]
mov ecx, edi
call fcn.00415760
mov ecx, esi
call fcn.00489a30
test eax, eax
jne 0x489ccb
push esi
push 0x489850
call dword [sym.imp.USER32.dll_EnumWindows]
push 3
mov ecx, edi
call fcn.00415b50
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_5
mov eax, dword [esi + 0xd0]
push 0
test eax, eax
push 0
mov dword [esp + 0x1c], 0
push 0x1004
jne 0x489d2f
mov eax, dword [esi + 0x80]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x545f7c]
push eax
mov eax, dword [esi + 0xcc]
mov edx, dword [ecx*4 + 0x515bd0]
lea ecx, [esp + 0xc]
push edx
push eax
push str.__s__s__d_
push ecx
call sub.MFC42u.DLL_CString::Format
add esp, 0x14
jmp 0x489d5c
mov edx, dword [esi + 0x80]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov eax, dword [0x545f7c]
lea edx, [esp + 0xc]
mov ecx, dword [eax*4 + 0x515bd0]
push ecx
push str._s__d_
push edx
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
mov eax, dword [esp + 8]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CWnd::SetWindowTextW
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48b170
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x586158]
push ebx
cmp eax, 1
push ebp
jne 0x48b1d7
mov ebx, dword [esp + 0xc]
push 1
lea eax, [ebx + 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x48b1d7
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ecx, 0x10
mov edi, ebp
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
je 0x48b1ac
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x48b1d7
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp]
mov dword [ebx], edx
mov eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebx + 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0xc], edx
pop ebp
pop ebx
ret

Function at 0x48b1e0
Capabilities:
Continue service
Query service status
Start service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x48b261
push ebx
push esi
push 0x54
push str.CryptSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x48b25c
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x48b259
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x48b246
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x1c
ret
cmp eax, 7
jne 0x48b259
lea ecx, [esp + 0xc]
push ecx
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x1c
ret
Function at 0x48b590
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb158
push 0x4a671c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x34], edi
cmp edi, 0xffffffff
je 0x48b697
call fcn.0048b1e0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48b684
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x28]
push eax
push ebx
lea ecx, [ebp - 0x20]
push ecx
push 0x48b560
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x48b690
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x48b639
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0x20100607
jne 0x48b663
mov ebx, 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x48b690
push edi
push esi
call fcn.0048b270
add esp, 8
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b0a10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
mov ebx, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], edi
mov word [esp + 0x14], di
mov dword [esp + 0x16], ebx
mov word [esp + 0x1a], ax
call sub.MFC42u.DLL_CString::CString_5
push 0x515f9c
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call fcn.004a62ac
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 8]
cmp eax, edi
mov dword [esp + 0x10], eax
jle 0x48c8fc
push ebp
lea ebp, [esp + 0x18]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
mov si, word [edx + edi*2]
push esi
call sub.MFC42u.DLL_CString::operator_2
cmp si, 0x2e
jne 0x48c8f2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
lea ecx, [esp + 0x10]
mov word [ebp], ax
push 0x545dc4
call fcn.004a6252
mov ebx, dword [esp + 0x1a]
add ebp, 2
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x48c8b3
pop ebp
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
and esi, 0xffff
mov edx, dword [esp + 0x1a]
shl esi, 8
and ebx, 0xffff
and ecx, 0xffff
add esi, ebx
and edx, 0xffff
shl esi, 8
add esi, ecx
lea ecx, [esp + 0xc]
shl esi, 8
add esi, edx
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x48cb30
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4b0a53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push eax
push 0xcb
mov dword [esp + 0x18], ebp
call sub.MFC42u.DLL_CDialog::CDialog
mov dword [ebp], 0x4b2d44
xor edi, edi
lea ecx, [ebp + 0x60]
mov dword [esp + 0x24], edi
call fcn.00414e60
mov ebx, 1
mov dword [ebp], 0x4bb230
mov byte [esp + 0x24], bl
mov dword [ebp + 0xcc], edi
mov dword [ebp + 0xd0], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x48cba2
mov dword [ebp + 0xd0], ebx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, edi
je 0x48cc55
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlFormatCurrentUserKeyPath
push esi
call edi
push str.RtlFreeUnicodeString
push esi
mov ebx, eax
call edi
mov esi, eax
test ebx, ebx
mov dword [esp + 0x2c], esi
je 0x48cc55
test esi, esi
je 0x48cc55
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
jne 0x48cc55
mov edx, dword [esp + 0x14]
and edx, 0xffff
add edx, 2
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp + 0xcc], edi
je 0x48cc4e
mov ecx, dword [esp + 0x14]
xor eax, eax
and ecx, 0xffff
add ecx, 2
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edi, dword [ebp + 0xcc]
and ecx, 0xffff
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
call esi
push ebp
push 0x600
mov ecx, ebp
call fcn.0040a940
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x48f610
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x214]
push edi
mov edi, ecx
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x48f6c0
push 0x25
mov ecx, esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x48f685
mov edx, dword [edi]
push esi
mov ecx, edi
call dword [edx + 0xf0]
test al, al
jne 0x48f685
mov eax, dword [esi]
lea ecx, [esp + 8]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x48f685
cmp eax, 0x103
jae 0x48f685
lea edx, [esp + 8]
mov word [esp + 0x210], 0
push edx
push 0x4cb1f8
push esi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
mov eax, dword [esi]
lea ecx, [esp + 8]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jbe 0x48f6c0
cmp eax, 0x103
jae 0x48f6c0
lea edx, [esp + 8]
mov word [esp + 0x210], 0
push edx
push 0x4cb1f8
push esi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
pop edi
pop esi
add esp, 0x20c
ret 4
Function at 0x495700
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
push esi
test eax, eax
mov esi, 0x529570
je 0x495767
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push 0x2001b
push 0
push ecx
push 0x80000001
call edi
test eax, eax
jne 0x49575a
mov ecx, dword [esp + 0x10]
lea edx, [esi + 8]
push 4
push edx
push 4
push eax
mov eax, dword [esi + 4]
push eax
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esi + 0xc]
add esi, 0xc
test eax, eax
jne 0x495725
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret

Function at 0x49afc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbd08
push 0x4a671c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2c], edi
cmp dword [0x5861dc], edi
jne 0x49b145
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, edi
je 0x49b145
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xff
xor edx, edx
mov dl, ah
and edx, 0xff
mov eax, edx
cmp ecx, 5
jne 0x49b080
cmp eax, edi
jne 0x49b048
mov dword [ebp - 0x20], 0x5439b0
mov dword [ebp - 0x1c], 0x10
jmp 0x49b0c8
cmp eax, 1
jne 0x49b05d
mov dword [ebp - 0x20], 0x5439a4
mov dword [ebp - 0x1c], 0xb
jmp 0x49b0c8
cmp eax, 2
jne 0x49b0c8
mov dword [ebp - 0x20], 0x5439a4
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x2c], 0x543994
mov dword [ebp - 0x38], 0xe
jmp 0x49b0c8
cmp ecx, 6
jne 0x49b0c8
cmp eax, edi
jne 0x49b0a7
mov dword [ebp - 0x20], 0x54398c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x2c], 0x543980
mov dword [ebp - 0x38], 0xa
jmp 0x49b0c8
cmp eax, 1
jne 0x49b0c8
mov dword [ebp - 0x20], 0x543974
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x2c], 0x543964
mov dword [ebp - 0x38], 0xd
cmp dword [ebp - 0x20], edi
je 0x49b145
mov dword [ebp - 4], edi
xor ebx, ebx
mov dword [ebp - 0x40], ebx
cmp ebx, 0x70000
jae 0x49b13e
lea edx, [ebx + esi]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x49b0f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x49b112
mov edi, dword [ebp - 0x2c]
test edi, edi
je 0x49b12c
mov ecx, dword [ebp - 0x38]
mov esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x49b10e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x49b12c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebx + ecx - 4]
mov dword [ebp - 0x34], eax
cmp eax, ecx
jbe 0x49b12c
cmp eax, 0x80000000
jae 0x49b12c
mov dword [0x5861dc], eax
inc ebx
mov dword [ebp - 0x40], ebx
mov esi, dword [ebp - 0x24]
jmp 0x49b0d5
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c410
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x16
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop edi
ret

Function at 0x4a3f10
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 8]
push ebp
xor eax, eax
push esi
cmp edx, 0x40
push edi
jbe 0x4a3fc6
mov ebp, dword [esp + 0x10]
cmp word [ebp], 0x5a4d
jne 0x4a3fc6
mov esi, dword [ebp + 0x3c]
add esi, ebp
cmp edx, 0x18
jbe 0x4a3fc6
cmp dword [esi], 0x4550
jne 0x4a3fc6
xor ecx, ecx
mov cx, word [esi + 0x14]
lea edi, [ecx + 0x18]
cmp edi, edx
jae 0x4a3fc6
lea edi, [ecx + 0x40]
cmp edi, edx
ja 0x4a3fc6
mov ecx, dword [ecx + esi + 0x2c]
add ecx, 0x1ff
and ecx, 0xfffffe00
cmp ecx, 0x400
jae 0x4a3f7b
mov ecx, 0x400
jmp 0x4a3f88
cmp ecx, 0x1000
jbe 0x4a3f88
mov ecx, 0x1000
cmp ecx, edx
ja 0x4a3fc6
cmp ecx, 0x40
jbe 0x4a3fc6
mov di, word [esi + 0x40]
add ecx, 0xffffffc0
push ebx
mov bx, word [esi + 0x42]
add ebp, 0x40
push ecx
push ebp
mov word [esi + 0x40], ax
mov word [esi + 0x42], ax
call fcn.004a4080
mov ecx, dword [esp + 0x24]
add esp, 8
mov dword [ecx], eax
mov word [esi + 0x42], bx
mov word [esi + 0x40], di
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4a4080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x4a40ba
push ebx
push edi
mov edi, dword [esp + 0x10]
mov dl, byte [ecx + edi]
mov ebx, eax
and edx, 0xff
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x545160]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x4a4094
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x4a4780
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov byte [esp + 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a47dd
mov edx, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Version
push eax
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a47d2
mov byte [esp + 4], 1
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
and eax, 0xff
add esp, 0xc
ret
Function at 0x11386
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1401c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x204]
push eax
xor esi, esi
call fcn.0001106e
cmp word [ebp - 0x204], si
jne 0x113ba
xor eax, eax
jmp 0x11481
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
push esi
push 0x820
push 3
push 3
push 0x80
lea eax, [ebp - 0x238]
mov dword [ebp - 0x228], eax
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x230]
push eax
push 0x120116
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x230], 0x18
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x224], 0x40
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x1147f
mov eax, dword [ebp + 8]
push esi
push esi
push 8
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x218], 0x58
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jl 0x11473
mov esi, dword [ebp - 0x20c]
push dword [ebp - 0x208]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.000122d9
leave
ret 4
Function at 0x15c04
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor edi, edi
push edi
push 0xa
push edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call esi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push edi
push ebx
cmp eax, 0xc0000004
jne 0x15d0e
mov ebx, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call ebx
push edi
push dword [ebp - 8]
push edi
call esi
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x15d14
push edi
push dword [ebp - 8]
push esi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x15c7a
push edi
push esi
call ebx
jmp 0x15d14
push 0x800
lea eax, [ebp - 0x818]
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], edi
push dword [esi + 0x44]
call fcn.00011496
test eax, eax
jl 0x15cc2
mov ecx, dword [esi + 0x44]
xor eax, eax
mov edx, dword [ebp - 0x14]
cmp dword [eax + edx], ecx
je 0x15cb9
inc eax
cmp eax, 0x200
jb 0x15ca7
jmp 0x15cc2
lea eax, [ebp + eax*4 - 0x818]
inc dword [eax]
mov eax, dword [esi]
cmp eax, edi
je 0x15ccc
add esi, eax
jmp 0x15c8f
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x818]
cmp dword [ebp - 0x10], ecx
jae 0x15ce0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
inc eax
cmp eax, 0x200
jb 0x15cce
mov eax, dword [ebp - 4]
cmp eax, edi
jbe 0x15cf6
mov dword [ebp - 0xc], 1
push edi
push dword [ebp - 0x18]
mov dword [0x1425c], eax
add eax, 4
mov dword [0x14260], eax
call ebx
mov eax, dword [ebp - 0xc]
jmp 0x15d16
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x15fe2
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push esi
push edi
push 0x18
pop edi
push 0x820
mov dword [ebp - 0x1c], eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
xor esi, esi
push 0x120089
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jge 0x16033
xor eax, eax
jmp 0x160a4
push 5
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jge 0x16056
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1602f
push esi
push dword [ebp - 0x34]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
cmp edi, esi
je 0x1604b
push esi
push esi
push dword [ebp - 0x34]
lea eax, [ebp - 0xc]
push edi
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
push dword [ebp - 4]
test eax, eax
jge 0x16094
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1602f
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x16104
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor ebx, ebx
push ebx
push 0xa
push ebx
call esi
mov edi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push ebx
push edi
cmp eax, 0xc0000004
jne 0x161c5
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call edi
push ebx
push dword [ebp - 4]
push ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x161cb
push ebx
push dword [ebp - 4]
push esi
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jge 0x16164
push ebx
push esi
call edi
jmp 0x161cb
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0x20]
push 0x5c
push eax
call dword [sym.imp.ntoskrnl.exe_strrchr]
pop ecx
pop ecx
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, ecx
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
cmp dx, bx
jne 0x161a4
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push ebx
push esi
call edi
mov eax, dword [ebp - 8]
jmp 0x161cd
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc