joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc2be
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x51c91c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], vtable.ILayerWindow.0
mov dword [edi], vtable.CLayerWindowBase_class_CInputWnd__class_ATL::CWinTraits__2046689280__0__.0
mov dword [edi + 0x24], vtable.CLayerWindowBase_class_CInputWnd__class_ATL::CWinTraits__2046689280__0__.1.0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 1
mov dword [edi + 0x3c], 0xff
mov ecx, esi
mov dword [edi + 0x40], 1
mov dword [edi + 0x44], 0
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00412310
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 0x50], 0
call fcn.00404320
mov ecx, eax
test ecx, ecx
je 0x410048
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x54], eax
push 0xa4
mov byte [ebp - 4], 4
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
call fcn.0041f6e0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x40ff94
mov ecx, eax
call fcn.00448f80
test eax, eax
jne 0x40ff96
xor eax, eax
mov dword [edi + 0x44], eax
lea esi, [edi + 0x78]
mov dword [edi], vtable.CInputWnd.0
mov dword [edi + 0x24], vtable.CInputWnd.1.0
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
lea ebx, [esi + 0x24]
mov byte [ebp - 4], 7
mov dword [esi], vtable.CEditExImpl_class_CEditEx__class_WTL::CEditT_class_ATL::CWindow___class_ATL::CWinTraits_1442840576__0__.0
mov dword [ebp - 0x18], ebx
call fcn.00404320
mov ecx, eax
test ecx, ecx
je 0x410052
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x4eab1c
mov byte [ebp - 4], 8
mov ecx, ebx
test eax, 0xffff0000
jne 0x410014
movzx eax, ax
push eax
call fcn.004110d0
jmp 0x410020
push 0
push 0x4eab1c
call fcn.00404ae0
mov dword [esi + 0x28], 0
mov eax, edi
mov dword [esi + 0x54], 0
mov dword [esi], vtable.CEditEx.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004036d0
push 0x80004005
call fcn.004036d0
int3
Function at 0x410060
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.00469210
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.00469210
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4100c3
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x4100c8
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x4100e6
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x4100e8
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x4100fc
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x52032c]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004530b8
mov esp, ebp
pop ebp
ret 0x18

Function at 0x410e20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc3cb
mov eax, dword fs:[0]
push eax
mov eax, 0x2008
call fcn.004534e0
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2010]
push 0x2000
push 0
push eax
mov dword [ebp - 0x2014], esi
call fcn.00469210
add esp, 0xc
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x410e94
push 0x1000
lea eax, [ebp - 0x2010]
push eax
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.00404320
mov ecx, eax
test ecx, ecx
je 0x410f10
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x410eca
movzx eax, ax
mov ecx, esi
push eax
call fcn.004110d0
jmp 0x410ef1
lea ecx, [ebp - 0x2010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410ed3
sub ecx, edx
lea eax, [ebp - 0x2010]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404ae0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004036d0
int3
Function at 0x415930
Capabilities:
Create process on windows

Disassembly:
push 4
push 0x4ebae4
push 0
call fcn.0041e0f0
cmp eax, 6
jne 0x41595b
push 1
push 0
push 0
push str.http:__cdn_file.apkevery.com_safebox_install_McSafeBoxSetup_home.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x416010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc996
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x4160bc
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x4160bc
call fcn.00409510
mov edi, eax
jmp 0x4161db
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4160df
call fcn.00409510
jmp 0x4161ce
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4160fd
call fcn.00409510
jmp 0x4161ce
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x41611e
mov edi, 0x8007000e
jmp 0x4161d0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x416214
jb 0x41613c
cmp eax, 0xffffffff
ja 0x416214
cmp eax, 0x400
jbe 0x416151
push eax
lea ecx, [ebp - 0x418]
call fcn.00413d20
jmp 0x416177
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x416177
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x41618e
mov edi, 0x8007000e
jmp 0x4161d0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4161ae
call fcn.00409510
jmp 0x4161ce
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00415e70
mov edi, eax
test esi, esi
je 0x4161db
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4161f4
lea ecx, [ebp - 0x418]
call fcn.00414480
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004036d0
int3
Function at 0x417930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41795c
push edi
call fcn.004149c0
mov ecx, eax
call fcn.0040da80
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00469210
add esp, 0xc
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push str.Setup_Path
push str.SOFTWAREMcSafeBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x417b3d
push dword [0x51b2b8]
push str.inst
push eax
call fcn.00414b70
mov ecx, eax
call fcn.00450720
call fcn.004149c0
mov ecx, eax
call fcn.0040d310
push eax
call fcn.00414b70
mov ecx, eax
call fcn.004509b0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00469210
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x51f888]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00414c00
test eax, eax
je 0x417b9e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], eax
call fcn.00414c00
test eax, eax
je 0x417b9e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004036f0
test al, al
jne 0x417a92
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417a70
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x418]
call fcn.00404ae0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00414550
mov edx, dword [ebp - 0x418]
or edi, 0xffffffff
add esp, 8
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417ac8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x41c]
push eax
call fcn.00414b70
mov ecx, eax
call fcn.00450990
push 0
push 0
push 1
push 0
push str.exist
call fcn.00414b70
mov ecx, eax
call fcn.00450780
test esi, esi
je 0x417b0e
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x417b0e
push str.exist
push eax
push esi
call fcn.004848f0
add esp, 0xc
mov edx, dword [ebp - 0x41c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x417b8a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x51f898], 0
jne 0x417b8a
push 0
push edi
push 0
push dword [0x51f888]
mov dword [0x51f898], 1
call main
test esi, esi
je 0x417b8a
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x417b8a
cmp dword [0x51b2b4], 0
jne 0x417b7b
push 0x4ebfe4
jmp 0x417b80
push str.fail
push eax
push esi
call fcn.004848f0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004530b8
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.004036d0
int3
Function at 0x4183f0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcad2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00469210
add esp, 0xc
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Setup_Path
push str.SOFTWAREMcSafeBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4184b3
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4184b3
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [0x51f934]
test ecx, ecx
jne 0x41851d
push 0x51b328
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x51f934], 0
jne 0x41850c
push 0x2c
call fcn.0041f6e0
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4184f7
mov ecx, eax
call fcn.0040cde0
mov ecx, eax
jmp 0x4184f9
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
xchg dword [ebp - 0x21c], eax
mov dword [0x51f934], ecx
push 0x51b328
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x51f934]
call fcn.0040e5d0
test eax, eax
je 0x418583
call fcn.00422730
push 0x208
mov esi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00469210
mov ecx, dword [esi]
lea eax, [ebp - 0x218]
add esp, 0xc
push 0x104
push eax
push esi
call dword [ecx + 0x44]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push 0x4ec120
push 0x4ec124
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x224]
call fcn.00418150
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret
Function at 0x41b5f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push edi
mov edi, ecx
test eax, eax
jne 0x41b66e
call fcn.004149c0
mov ecx, eax
call fcn.0040e5c0
test eax, eax
je 0x41b62c
mov eax, dword [edi + 0x8c]
lea ecx, [edi + 0x8c]
call dword [eax]
mov dword [edi + 0x170], 1
xor eax, eax
pop edi
pop ebp
ret 0x10
mov ecx, dword [edi + 0x74]
test ecx, ecx
je 0x41b65d
cmp dword [edi + 0x78], 0
je 0x41b65d
mov eax, dword [ecx]
push 1
push 0
push ecx
call dword [eax + 0x20]
push 0
lea ecx, [edi + 0xa0]
call fcn.00411b90
mov eax, dword [edi + 0x78]
push 1
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov dword [edi + 0x170], 1
xor eax, eax
pop edi
pop ebp
ret 0x10
cmp eax, 1
jne 0x41b6d2
call fcn.004149c0
mov ecx, eax
call fcn.0040e5c0
test eax, eax
jne 0x41b6b3
mov ecx, dword [edi + 0x74]
test ecx, ecx
je 0x41b6c1
cmp dword [edi + 0x78], eax
je 0x41b6c1
mov eax, dword [ecx]
push 1
push 0
push ecx
call dword [eax + 0x20]
push 0
lea ecx, [edi + 0xa0]
call fcn.00411b90
mov eax, dword [edi + 0x78]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [edi + 0x98]
lea ecx, [edi + 0x98]
call dword [eax]
mov dword [edi + 0x170], 2
xor eax, eax
pop edi
pop ebp
ret 0x10
cmp eax, 2
jne 0x41b74b
push esi
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [edi + 0xa0]
call fcn.00411b90
call fcn.00422730
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
call fcn.00414b70
push 0
push 0
push 1
mov edx, str.inst_suc
test esi, esi
mov ecx, str.inst_cover_suc
cmove ecx, edx
push 0
push ecx
mov ecx, eax
call fcn.00450780
call fcn.0045a5f0
pop esi
test eax, eax
je 0x41b744
push 0
push 0
push 1
push 0
push str.inst_asv
call fcn.00414b70
mov ecx, eax
call fcn.00450780
mov ecx, edi
call fcn.0041bd20
xor eax, eax
pop edi
pop ebp
ret 0x10

Function at 0x41bd20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi + 0xa0]
call fcn.00411b90
mov ecx, 0x51f8d8
call fcn.004065f0
push str.quit
call fcn.00419570
add esp, 4
lea ecx, [esi + 0x88]
call fcn.00418c80
test eax, eax
jne 0x41bd77
push eax
push eax
push 1
push eax
push str.install_r_fail
call fcn.00414b70
mov ecx, eax
call fcn.00450780
xor esi, esi
call fcn.004149c0
mov ecx, eax
call fcn.0040e4d0
test eax, eax
mov ecx, 1
cmovne esi, ecx
call fcn.00422730
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
call fcn.00422730
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret
Function at 0x420eb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x420f8b
test ecx, ecx
je 0x420f8b
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x420f8b
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x420f8b
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x420f76
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
call fcn.00487daa
add esp, 0xc
test eax, eax
je 0x420f9e
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x420f20
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x4c0]
call fcn.00421b50
xor ecx, ecx
test edi, edi
je 0x420fbc
cmp edi, 0x7fffffff
jbe 0x420fc1
mov ecx, 0x80070057
test ecx, ecx
js 0x420ff7
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x420fdf
cmp word [eax], 0
je 0x420fdf
add eax, 2
sub esi, 1
jne 0x420fd1
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x420ff9
xor esi, esi
test ecx, ecx
js 0x42104a
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x42103d
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7fffffff
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x42103d
movzx eax, word [edi + ecx]
test ax, ax
je 0x42103d
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x421024
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004530b8
mov esp, ebp
pop ebp
ret
Function at 0x421060
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4210d8
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret

Function at 0x421190
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004534e0
mov eax, dword [0x51c91c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x4212ca
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jl 0x4212ca
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4212ca
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00469210
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x42129f
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00469210
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.0046a652
add esp, 0x14
test eax, eax
je 0x421264
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x421264
mov ecx, 1
jmp 0x421266
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
lea eax, [ebp - 0x804]
cmovne eax, edx
push eax
push edi
push ebx
call fcn.00421b50
mov edi, dword [ebp - 0x1008]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x42127f
push edi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00420eb0
add esp, 0xc
mov edi, eax
jmp 0x421285
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004530b8
mov esp, ebp
pop ebp
ret
Function at 0x4217c0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x50d870
push 0x46acc0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a14
call fcn.004534e0
mov eax, dword [0x51c91c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
test esi, esi
je 0x421994
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421816
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x421994
mov dword [ebp - 4], 0
call fcn.00421060
mov dword [ebp - 4], 0xfffffffe
jmp 0x42185c
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.00469210
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.00469210
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x421994
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.004852cb
lea eax, [ebp - 0x224]
push eax
call fcn.00485ce0
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x421994
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
call fcn.00421190
add esp, 0xc
test eax, eax
je 0x421987
lea eax, [ebp - 0xa24]
push eax
call fcn.00485ce0
add esp, 4
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421948
test dx, dx
je 0x421944
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421948
add eax, 4
add ecx, 4
test dx, dx
jne 0x421922
xor eax, eax
jmp 0x42194d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x421987
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x421973
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa24]
push eax
push 0x4f0710
call fcn.00423b70
add esp, 8
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x4218e4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004530b8
mov esp, ebp
pop ebp
ret 4