joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411be8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4997ac], 0xffffffff
push esi
mov esi, dword [ebp + 8]
je 0x411c0d
xor eax, eax
inc eax
jmp 0x411c74
call dword [sym.imp.KERNEL32.dll_GetVersion]
push dword [0x4997a8]
and eax, 0xff
cmp eax, 5
lea eax, [ebp - 0x108]
jb 0x411c30
push str..Global_s
jmp 0x411c35
push str.._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x411c6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor eax, eax
jmp 0x411c74
mov dword [0x4997ac], eax
call fcn.00411277
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046c1d2
leave
ret 4

Function at 0x4122a1
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
push str.K7SentryDispatcher
push ebx
push ebx
push ebx
mov byte [0x49cc18], bl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x49cc14], eax
cmp eax, ebx
jne 0x412254
xor eax, eax
pop ebx
ret
push esi
mov esi, 0x4121ee
cmp byte [0x49c4c8], bl
jne 0x412267
mov esi, 0x412053
push eax
call fcn.0041145c
cmp eax, 1
jne 0x412290
push 0x49cc10
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x49cc0c], eax
cmp eax, ebx
je 0x412290
xor eax, eax
inc eax
jmp 0x41229e
push dword [0x49cc14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebx
ret
call fcn.00411ebe
mov eax, dword [esp + 4]
mov dword [0x49cc20], eax
jmp 0x412230

Function at 0x41258c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi], bl
je 0x4125d3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4125d3
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.0046bb10
cmp eax, 1
jne 0x4125d3
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00469a77
pop ecx
pop ecx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0046c1d2
leave
ret
Function at 0x4125e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp byte [edi], 0
je 0x412666
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x412666
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], esi
and dword [ebp + 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 0x14], 0x486ca4
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 0x486c98
call fcn.0046be50
add esp, 0x14
cmp byte [esi], 0
jne 0x412663
mov eax, dword [ebp + 8]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 4]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._d._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x41266c
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0xbc], eax
mov eax, dword [ebp + 0xcc]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xd0]
push esi
push 2
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x7c], edi
cmp edi, esi
je 0x412763
lea eax, [ebp - 0x6c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41275a
mov esi, dword [ebp + 0xc8]
cmp esi, dword [ebp - 0x64]
je 0x4126e2
lea eax, [ebp - 0x6c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4126c7
jmp 0x4126e8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x70], eax
push ebx
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, 0x104
mov edi, 0x100418
je 0x41272a
cmp dword [ebp - 0x78], 0
je 0x41272a
push dword [ebp + 0xc8]
push 0
push edi
call esi
mov dword [ebp - 0x80], eax
test eax, eax
je 0x41272a
push ebx
push dword [ebp - 0x78]
push 0
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x70], eax
je 0x412756
cmp dword [ebp - 0x74], eax
je 0x412756
push dword [ebp - 0x70]
push eax
push edi
call esi
mov esi, eax
test esi, esi
je 0x412756
push ebx
push dword [ebp - 0x74]
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
pop ebx
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xbc]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0046c1d2
add ebp, 0xc0
leave
ret
Function at 0x41285e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor esi, esi
push 0x2000
push esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, esi
je 0x4129e1
lea esi, [edi + 0x400]
mov dword [ebp - 4], esi
mov eax, 0x400
add esi, eax
push ebx
mov dword [ebp - 0x14], esi
mov ebx, 0x104
add esi, ebx
mov dword [ebp - 0x24], esi
add esi, ebx
mov dword [ebp - 0x18], esi
add esi, eax
lea eax, [esi + 0x400]
push edi
mov dword [ebp - 0x1c], eax
mov byte [edi], 0
call fcn.00401f60
mov dword [esp], str.K7ClnEng.dat
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x4946f4
push dword [ebp - 4]
call edi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 4]
call fcn.00401d50
add esp, 0x1c
cmp eax, 1
jne 0x4129ce
cmp dword [ebp - 0xc], 0
je 0x4129ce
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
push dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
push str.MalwareName
call dword [eax + 0x14]
mov eax, dword [ebp - 4]
cmp byte [eax], 0
je 0x4129ce
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
push edx
push dword [ebp - 0x14]
mov dword [ebp - 8], ebx
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
push str.File
push dword [ebp - 4]
call dword [eax + 0x14]
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x4129ce
push eax
push dword [ebp - 0x10]
push 0x4946f4
push esi
call edi
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4129ce
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x24]
lea edx, [ebp - 8]
push edx
push ebx
mov byte [ebx], 0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
push str.Param
push dword [ebp - 4]
call dword [eax + 0x14]
push str.K7TSHlpr.exe
push dword [ebp - 0x10]
push 0x4946f4
push dword [ebp - 0x18]
call edi
push ebx
push esi
push dword [ebp - 0x18]
push str.__s___ExecDisinfectTool__File__s___Param__s_
push dword [ebp - 0x1c]
call edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00467b80
add esp, 0x34
mov dword [ebp - 0x20], 1
push dword [ebp - 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
test ecx, ecx
je 0x4129ef
mov eax, dword [ecx]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x20]
leave
ret
Function at 0x412f59
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x4bc]
sub esp, 0x53c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x4b8], eax
mov eax, dword [ebp + 0x4c4]
and dword [ebp - 0x74], 0
push 0x5c
push eax
mov dword [ebp - 0x80], eax
call fcn.0046e8f2
pop ecx
pop ecx
test eax, eax
je 0x41306c
push 0
inc eax
push 2
mov dword [ebp - 0x7c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x78], eax
test eax, eax
je 0x41306c
push esi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call sub.KERNEL32.dll_Process32First
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x413066
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x7c]
call fcn.004708fc
pop ecx
pop ecx
test eax, eax
jne 0x413050
push dword [ebp - 0x68]
push eax
push 0x100418
call ebx
mov edi, eax
test edi, edi
je 0x413050
push 0x400
lea eax, [ebp + 0xb8]
push eax
push 0
push edi
mov byte [ebp + 0xb8], 0
call sub.PSAPI.DLL_GetModuleFileNameExA
push edi
call esi
cmp byte [ebp + 0xb8], 0
je 0x413050
push dword [ebp - 0x80]
lea eax, [ebp + 0xb8]
push eax
call fcn.004708fc
pop ecx
pop ecx
test eax, eax
jne 0x413050
push dword [ebp - 0x68]
push eax
push 0x100001
call ebx
mov edi, eax
test edi, edi
je 0x413050
push 0x4b374b4c
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [ebp - 0x74], eax
push edi
call esi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x412fce
pop edi
pop ebx
push dword [ebp - 0x78]
call esi
pop esi
mov ecx, dword [ebp + 0x4b8]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
call fcn.0046c1d2
add ebp, 0x4bc
leave
ret
Function at 0x413084
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, eax
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0xc]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4130ec
push 0x2e
push esi
call fcn.0046fabe
test byte [ebp + 0xc], 1
pop ecx
pop ecx
je 0x4130d8
push str..EXE
push eax
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4130d8
push dword [ebx + 0xc]
call fcn.00412f59
pop ecx
push edi
lea eax, [ebp - 4]
push eax
push 0
push esi
call fcn.00407168
add esp, 0x10
mov esi, eax
jmp 0x4130f3
and dword [ebp - 4], 0
xor esi, esi
inc esi
mov eax, esi
dec eax
je 0x413129
dec eax
je 0x413125
sub eax, 0xe
je 0x413121
dec eax
je 0x41311d
dec eax
dec eax
je 0x413119
dec eax
je 0x413115
dec eax
je 0x413111
mov bl, 0x66
jmp 0x41312b
mov bl, 0x70
jmp 0x41312b
mov bl, 0x72
jmp 0x41312b
mov bl, 0x71
jmp 0x41312b
mov bl, 0x6f
jmp 0x41312b
mov bl, 0x6e
jmp 0x41312b
mov bl, 0x65
jmp 0x41312b
mov bl, 0x64
xor edi, edi
cmp dword [0x49cc28], edi
jne 0x41313a
call fcn.0041234f
cmp byte [0x4997b5], 0
je 0x413166
mov eax, dword [0x49cc30]
cmp eax, edi
je 0x413166
cmp esi, 1
je 0x413156
cmp esi, 2
jne 0x413166
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push dword [ecx + 0xc]
mov dword [ebp - 8], edi
call eax
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x413502
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x18c], eax
movzx eax, word [esi + 2]
push ebx
push edi
push 0x3a
pop edx
push 0x5c
mov dword [ebp - 0x80], ecx
pop ebx
cmp dx, ax
jne 0x4135c7
mov edx, ebx
cmp dx, word [esi + 4]
jne 0x4135c7
cmp dword [0x49c440], 0
je 0x413617
xor eax, eax
mov word [ebp - 0x7c], ax
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
push edi
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x4135c1
lea edi, [esi + edi*2]
cmp bx, word [edi]
jne 0x4135c1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x7c]
push str.SYSTEM32
push eax
call fcn.0046faea
pop ecx
pop ecx
test eax, eax
je 0x4135aa
push str.Sysnative
push eax
call fcn.0046e0b5
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x7c]
push eax
push 0x486df8
push dword [ebp - 0x80]
call fcn.00407d7e
add esp, 0x10
jmp 0x41361f
push esi
push dword [ebp - 0x80]
jmp 0x413619
mov edx, ebx
cmp dx, word [esi]
jne 0x413617
cmp dx, ax
jne 0x413617
push 0x3b
pop eax
cmp ax, word [esi + 4]
jne 0x413617
push 0x12
lea edi, [esi + 6]
push str.LanmanRedirector_
push edi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x4135f6
add edi, 0x22
push ebx
push edi
call fcn.0046de6f
pop ecx
pop ecx
test eax, eax
je 0x4135c1
push eax
push 0x486dc8
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x41361f
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 0x18c]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop ebx
call fcn.0046c1d2
add ebp, 0x190
leave
ret
Function at 0x413d02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov eax, dword [esi + 0x14]
push ebx
push ebp
mov ebp, dword [esi + 8]
push edi
mov edi, dword [esi + 4]
cmp dword [edi + 8], 0xd
mov dword [esp + 0xc], eax
mov bl, 0x73
jne 0x413da7
movzx eax, byte [edi + 0x11]
sub eax, 0x4b
je 0x413d60
sub eax, 4
je 0x413d44
dec eax
jne 0x413da7
push dword [edi + 0x16c]
call fcn.004074ab
pop ecx
cmp eax, 1
jne 0x413d44
add bl, 0xf5
cmp dword [edi + 0x39c], 0x454c4946
jne 0x413da7
push ebp
call fcn.0046ab80
pop ecx
cmp eax, 1
jne 0x413d75
mov bl, 0x6e
jmp 0x413da7
push dword [edi + 0x16c]
call fcn.004074ab
pop ecx
cmp eax, 1
jne 0x413da7
mov bl, 0x78
jmp 0x413da7
cmp eax, 2
jne 0x413d7e
mov bl, 0x6f
jmp 0x413da7
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413d8e
mov bl, 0x70
jmp 0x413da7
lea eax, [esi + 0x38]
push eax
push esi
push 1
push 0x20
push dword [esp + 0x1c]
push ebp
push ebp
call fcn.00412d91
add esp, 0x1c
mov bl, al
pop edi
pop ebp
mov byte [esi + 0x21], bl
movzx eax, bl
pop ebx
pop ecx
ret
Function at 0x416912
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x88], eax
push edi
lea eax, [ebp - 0x80]
push eax
xor edi, edi
call fcn.00411be8
cmp eax, 1
je 0x41695a
lea eax, [ebp - 0x80]
push eax
call fcn.004113d3
cmp eax, 1
jne 0x41698b
lea eax, [ebp - 0x80]
push eax
call fcn.00411be8
cmp eax, 1
jne 0x41698b
lea eax, [ebp - 0x7c]
push eax
xor edi, edi
push 0x104
inc edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x7d]
cmp byte [eax], 0x5c
jne 0x416982
mov byte [eax], 0
lea eax, [ebp - 0x7c]
push eax
call fcn.0041174f
mov ecx, dword [ebp + 0x88]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0046c1d2
add ebp, 0x8c
leave
ret

Function at 0x416cc5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
xor eax, eax
or dword [eax + 0x49cce4], 0xffffffff
mov dword [eax + 0x49cce8], esi
add eax, 0x14
cmp eax, 0x208
jb 0x416cce
cmp dword [0x49c420], esi
je 0x416d10
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push 0x416ca1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x416d10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
mov eax, esi
pop esi
leave
ret

Function at 0x417af7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
lea eax, [esp]
push eax
mov dword [esp + 4], 1
call fcn.00404d3e
cmp dword [esp + 4], 0
pop ecx
je 0x417b80
push esi
push 0x1000
call fcn.0046e0d4
mov esi, eax
pop ecx
test esi, esi
je 0x417b7f
push ebx
push ebp
push edi
push esi
lea edi, [esi + 0x400]
mov byte [esi], 0
call fcn.004037a0
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, str.K7Tlmtry.exe
push ebx
push esi
push 0x4946f4
push edi
call ebp
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x417b75
push str._rtscan
push ebx
push esi
push str.__s_s___s
push edi
call ebp
add esp, 0x14
push 0
push 0
push edi
call fcn.0046bc60
push esi
call fcn.0046c1c7
pop ecx
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x4187c0
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
xor ebx, ebx
inc ebx
cmp dword [esi], 0x8000
push edi
mov dword [ebp - 4], 0x5c3a41
mov dword [ebp - 0x10], eax
jne 0x418911
cmp dword [esi + 0x10], 2
jne 0x418911
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, ebx
shl eax, cl
test dword [esi + 0x18], eax
je 0x41881b
lea eax, [ebp - 4]
add cl, 0x41
push eax
mov byte [ebp - 4], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0xc], eax
cmp eax, 5
je 0x41882e
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x20
jb 0x4187f7
cmp dword [ebp - 0xc], 5
jne 0x418911
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x118
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x418911
mov dword [esi], 2
mov dword [esi + 4], ebx
movsx ecx, byte [ebp - 4]
sub ecx, 0x41
mov eax, ebx
shl eax, cl
mov dword [esi + 0x110], ebx
mov dword [esi + 0x10c], eax
push dword [0x49c228]
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp dword [0x49c22c], eax
jne 0x418911
cmp dword [0x49c240], eax
jne 0x41889c
cmp dword [0x49c24c], eax
je 0x418911
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push 0x417d1f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4188bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4188c8
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
cmp dword [0x49c250], esi
je 0x4188e8
cmp dword [0x49c1b4], esi
jne 0x4188e8
push 0x78
push dword [ebp - 4]
push ebx
call fcn.00415298
add esp, 0xc
cmp dword [0x49c254], esi
je 0x418911
cmp dword [0x49c1b4], esi
jne 0x418911
push dword [ebp - 0x10]
mov eax, dword [ebp + 8]
push 3
push dword [eax + 0x18]
push dword [0x49c228]
call fcn.004162c8
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4189ca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [str.wndClassK7SentryMngr]
sub esp, 0x20
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4189e8
xor eax, eax
jmp 0x418a7e
push esi
xor esi, esi
push 0xc
lea eax, [ebp - 0xc]
push esi
push eax
mov dword [0x49ceec], esi
call fcn.0046e3e0
add esp, 0xc
push 1
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x49cee4
push esi
push esi
lea eax, [ebp - 0x20]
push 0x418918
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x49cee0], eax
cmp eax, esi
je 0x418a7b
push 2
mov ecx, 0x49c498
call fcn.00409471
jmp 0x418a62
push 1
push 0x14
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [0x49ceec]
cmp eax, esi
je 0x418a58
cmp eax, 0xffffffff
jne 0x418a7d
mov eax, dword [ebp + 8]
mov ecx, dword [0x49cee8]
mov dword [eax], ecx
xor eax, eax
pop esi
leave
ret 4
Function at 0x43dbb5
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x43dcd5
push ebx
push edi
mov eax, dword [ecx + 4]
movzx edx, byte [ecx]
test eax, 0x200
jne 0x43dcd3
cmp edx, 0x25
je 0x43dc88
cmp edx, 0x9c
je 0x43dc88
cmp edx, 0x5e
je 0x43dcbb
mov edi, 0x9d
cmp edx, edi
jne 0x43dc0d
cmp byte [ecx + 0x26], 0x5e
je 0x43dcbb
cmp edx, 0x9a
je 0x43dc26
cmp edx, 0x98
je 0x43dc26
cmp edx, edi
je 0x43dc26
cmp edx, 0x3d
jne 0x43dc2c
cmp dword [ecx + 0x2c], 0
jne 0x43dc95
mov edi, pe_nt_image_headers32
test edi, eax
je 0x43dcd3
mov edx, dword [ecx + 0xc]
test edx, edx
je 0x43dc49
test dword [edx + 4], edi
je 0x43dc49
mov ecx, edx
jmp 0x43dc8b
mov esi, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x43dc81
test eax, 0x800
jne 0x43dc81
mov eax, dword [ecx]
xor edx, edx
test eax, eax
jle 0x43dc81
lea edi, [ecx + 8]
mov ebx, dword [edi]
test dword [ebx + 4], 0x100
jne 0x43dc7a
inc edx
add edi, 0x18
cmp edx, eax
jl 0x43dc65
jmp 0x43dc81
imul edx, edx, 0x18
mov esi, dword [edx + ecx + 8]
mov ecx, esi
mov esi, dword [ebp + 8]
jmp 0x43dc8b
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x43dbcb
jmp 0x43dcd3
movsx edx, word [ecx + 0x20]
test edx, edx
jl 0x43dcd3
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 4]
shl edx, 4
mov edx, dword [eax + edx + 8]
mov eax, dword [esi]
movzx ecx, byte [eax + 0x42]
push 0
push edx
push ecx
call fcn.0042d068
jmp 0x43dccd
mov eax, dword [esi]
movzx eax, byte [eax + 0x42]
push dword [ecx + 8]
push eax
push esi
xor eax, eax
call fcn.004341b0
mov dword [ebp - 4], eax
add esp, 0xc
pop edi
pop ebx
mov eax, dword [ebp - 4]
call fcn.00434234
pop esi
test eax, eax
je 0x43dce6
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4676a4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0xffffffffffffffff
push 0x800
push eax
mov byte [ebp - 0x804], 0
call fcn.00471c72
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x14
lea eax, [ebp - 0x804]
push eax
call esi
push 0x48cf54
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046c1d2
leave
ret

Function at 0x4676ff
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.0046e3e0
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x467751
cmp dword [ebp - 0x9c], 6
jb 0x467751
xor eax, eax
inc eax
jmp 0x467753
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c1d2
leave
ret

Function at 0x46775f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x49a6d4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x467789
xor eax, eax
leave
ret
cmp dword [ebp - 4], 0
je 0x467785
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.AllowMultipleTSSessions
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x4677c8
cmp dword [ebp - 0xc], 4
jne 0x467785
xor eax, eax
inc eax
leave
ret