joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3d4370
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x3d450e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x3d450e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x3d450e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x3d450e
mov eax, dword [0x3de0a8]
test eax, eax
jne 0x3d43db
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0x2fc76848
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3de0a8], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x3d4505
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x3de2b4]
test eax, eax
jne 0x3d443b
mov ecx, 0xe4dda7c2
call fcn.003d3f40
mov edx, 0x2bab1175
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3de2b4], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x3d44be
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x3de2b4]
test eax, eax
jne 0x3d44a6
mov ecx, 0xe4dda7c2
call fcn.003d3f40
mov edx, 0x2bab1175
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3de2b4], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x3d4465
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.003d4640
mov edx, edi
mov ecx, ebx
call fcn.003d4550
pop esi
test eax, eax
jne 0x3d4505
mov eax, dword [0x3de134]
test eax, eax
jne 0x3d44f9
mov ecx, 0xb98d61a4
call fcn.003d3f40
mov edx, 0xece41155
mov ecx, eax
call fcn.003d3ea0
mov dword [0x3de134], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219
Function at 0x403e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 4
jne 0x403e35
mov dword [ebp - 0x214], 4
jmp 0x403e3f
mov dword [ebp - 0x214], 0x104
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x220], eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004df856
add esp, 0x10
push 0x2f
lea eax, [ebp - 0x20c]
push eax
call fcn.00424300
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x403e98
mov ecx, 0x5c
mov edx, dword [ebp - 0x218]
mov word [edx], cx
jmp 0x403e68
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x403efb
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x403f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x228], 0x104
push 0x104
mov eax, dword [ebp + 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004df856
add esp, 0x10
push 0x2f
lea edx, [ebp - 0x20c]
push edx
call fcn.00424300
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x403f84
mov eax, 0x5c
mov ecx, dword [ebp - 0x238]
mov word [ecx], ax
jmp 0x403f54
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x4040b8
lea edx, [ebp - 0x228]
push edx
push 0
lea eax, [ebp - 0x23c]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x228]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c8cbc
add esp, 4
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x228]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x22c]
push edx
call fcn.00424f20
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x23c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x230], eax
mov edx, dword [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x224]
call fcn.00415150
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00418640
lea ecx, [ebp - 0x224]
call fcn.00417930
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x248], ecx
push 2
mov edx, dword [ebp - 0x248]
push edx
call fcn.004c8cae
add esp, 8
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x4057e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513f65
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.004147c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00420200
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004e1c68
add esp, 4
test eax, eax
je 0x405844
call fcn.004df68e
cmp dword [eax], 0x11
jne 0x405861
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00417910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00417910
jmp 0x4058be
push 0x5c
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00423cf0
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40587e
mov eax, dword [ebp - 0x30]
mov byte [eax], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00414970
call fcn.004057e0
add esp, 0x18
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004e1c68
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00417910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00417910
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret

Function at 0x4058e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513fa1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00414f80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00420220
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004e0834
add esp, 4
test eax, eax
je 0x405944
call fcn.004df68e
cmp dword [eax], 0x11
jne 0x405961
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00417930
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00417930
jmp 0x4059c0
push 0x5c
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00424320
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x405980
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov word [ecx], ax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00415150
call fcn.004058e0
add esp, 0x18
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004e0834
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00417930
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00417930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x405f90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5c
mov eax, 2
shl eax, 0
add eax, dword [ebp + 8]
push eax
call fcn.00424300
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x405fe2
push 0x5c
mov ecx, dword [ebp - 0x41c]
add ecx, 2
push ecx
call fcn.00424300
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x405ff5
mov eax, 0x80004005
jmp 0x406157
mov edx, dword [ebp - 0x41c]
mov ax, word [edx]
mov word [ebp - 0x420], ax
xor ecx, ecx
mov edx, dword [ebp - 0x41c]
mov word [edx], cx
mov eax, dword [0x5284a8]
mov dword [ebp - 0x20c], eax
mov cx, word [0x5284ac]
mov word [ebp - 0x208], cx
push 0x202
push 0
lea edx, [ebp - 0x206]
push edx
call fcn.004ca660
add esp, 0xc
mov eax, 0x41
mov word [ebp - 0x418], ax
jmp 0x40605f
mov cx, word [ebp - 0x418]
add cx, 1
mov word [ebp - 0x418], cx
movzx edx, word [ebp - 0x418]
cmp edx, 0x5a
jge 0x406142
mov eax, 2
imul ecx, eax, 0
mov dx, word [ebp - 0x418]
mov word [ebp + ecx - 0x20c], dx
mov eax, 2
imul ecx, eax, 0
mov dword [ebp - 0x424], ecx
cmp dword [ebp - 0x424], 0x208
jae 0x4060a2
jmp 0x4060a7
call fcn.004c904b
xor edx, edx
mov eax, dword [ebp - 0x424]
mov word [ebp + eax - 0x414], dx
push 0x104
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40613d
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.004dfd17
add esp, 8
test eax, eax
jne 0x40613d
push 0x5284b0
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004df719
add esp, 0xc
mov eax, dword [ebp - 0x41c]
add eax, 2
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004df719
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004df724
add esp, 0xc
xor eax, eax
jmp 0x406157
jmp 0x40604d
mov edx, dword [ebp - 0x41c]
mov ax, word [ebp - 0x420]
mov word [edx], ax
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x406170
Capabilities:
Enumerate processes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], 0xffffffff
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x4061c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x244], eax
push str.hProcessSnap__INVALID_HANDLE_VALUE___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4062d4
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x406206
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x528574
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x4062d4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004dfd17
add esp, 8
test eax, eax
jne 0x4062a6
mov edx, dword [ebp - 0x228]
mov dword [0x57bb64], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
cmp eax, dword [0x57bb64]
jne 0x406249
jmp 0x4062a6
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x406287
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 5
jne 0x406285
xor eax, eax
jmp 0x4062d4
jmp 0x4062a4
cmp dword [ebp + 0xc], 0
je 0x4062a4
push 0x104
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp - 0x238]
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
jmp 0x4062c1
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x406206
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x406490
Capabilities:
Get common file path
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5140ab
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x264], 0
call fcn.00405f10
test eax, eax
je 0x406689
cmp dword [0x57bb60], 0
je 0x406505
mov eax, dword [0x57bb60]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x26c]
mov dword [ebp - 0x264], eax
jmp 0x406687
mov cx, word [0x528534]
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004ca660
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00415150
mov dword [ebp - 4], 0
push 0x528538
push 0x528554
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x260]
push eax
call fcn.0040ea40
add esp, 0xc
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x274], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x274]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.0040e970
add esp, 0xc
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x27c], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x27c]
call fcn.00420220
push eax
call fcn.0041b330
add esp, 4
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00417930
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.00417930
cmp dword [ebp - 0x268], 0
je 0x40664b
push str.QueryFullProcessImageNameW
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x57bb60], eax
cmp dword [0x57bb60], 0
je 0x40663c
mov eax, dword [0x57bb60]
mov dword [ebp - 0x280], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x280]
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x406675
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
mov dword [ebp - 0x264], eax
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call fcn.00405f90
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00417930
jmp 0x4066b3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
mov dword [ebp - 0x264], eax
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call fcn.00405f90
add esp, 8
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x406850
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x406885
xor eax, eax
jmp 0x40691e
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4068b7
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40691e
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
jne 0x4068f5
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
push 0
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4068b7
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret

Function at 0x406930
Capabilities:
Enumerate processes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x23c], 0
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x406979
xor eax, eax
jmp 0x406a62
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4069b9
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._Process32First_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x406a62
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004dfd17
add esp, 8
test eax, eax
jne 0x406a34
mov edx, dword [ebp - 0x228]
mov dword [0x57bb64], edx
mov eax, dword [ebp - 0x228]
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x406a16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 5
jne 0x406a16
jmp 0x406a4f
lea ecx, [ebp - 0x238]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00422e90
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4069b9
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x407e30
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51429b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
push 0x529194
lea ecx, [ebp - 0x28]
call fcn.00415150
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [ebp - 0x2c], ax
movzx eax, word [ebp - 0x2c]
cmp eax, 0xc07
je 0x407eb7
movzx ecx, word [ebp - 0x2c]
cmp ecx, 0x407
je 0x407eb7
movzx edx, word [ebp - 0x2c]
cmp edx, 0x1407
je 0x407eb7
movzx eax, word [ebp - 0x2c]
cmp eax, 0x1007
je 0x407eb7
movzx ecx, word [ebp - 0x2c]
cmp ecx, 0x807
jne 0x407ec9
push 0x52919c
lea ecx, [ebp - 0x28]
call fcn.00418730
jmp 0x407f4e
movzx edx, word [ebp - 0x2c]
cmp edx, 0x40b
je 0x407f1b
movzx eax, word [ebp - 0x2c]
cmp eax, 0x80c
je 0x407f1b
movzx ecx, word [ebp - 0x2c]
cmp ecx, 0xc0c
je 0x407f1b
movzx edx, word [ebp - 0x2c]
cmp edx, 0x40c
je 0x407f1b
movzx eax, word [ebp - 0x2c]
cmp eax, 0x140c
je 0x407f1b
movzx ecx, word [ebp - 0x2c]
cmp ecx, 0x180c
je 0x407f1b
movzx edx, word [ebp - 0x2c]
cmp edx, 0x100c
jne 0x407f2a
push 0x5291a4
lea ecx, [ebp - 0x28]
call fcn.00418730
jmp 0x407f4e
movzx eax, word [ebp - 0x2c]
cmp eax, 0x416
je 0x407f41
movzx ecx, word [ebp - 0x2c]
cmp ecx, 0x816
jne 0x407f4e
push 0x5291ac
lea ecx, [ebp - 0x28]
call fcn.00418730
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00414f10
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00417930
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret
Function at 0x409e30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5146b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00414f80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00420220
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004e0834
add esp, 4
test eax, eax
je 0x409e90
call fcn.004df68e
cmp dword [eax], 0x11
jne 0x409ea1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00417930
jmp 0x409f03
push 0x5c
mov edx, dword [ebp - 0x44]
push edx
call fcn.00424320
add esp, 8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x409ec0
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], ax
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x40]
call fcn.00415150
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00409e30
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00417930
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004e0834
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00417930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret