joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4134e1
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0041351c
test al, al
jne 0x413518
cmp byte [esp + 0xc], 0
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
je 0x413504
mov ecx, esi
call fcn.00413537
jmp 0x413518
xor eax, eax
push eax
push eax
push esi
push 0x4139fb
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret 8

Function at 0x413afd
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a1e24
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
xor ebp, ebp
push ecx
mov ebx, ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebx
call fcn.00413d63
mov dword [esp + 0xe0], ebp
lea ecx, [esp + 0x18]
call fcn.00426068
call fcn.00413c5d
test eax, eax
je 0x413b6e
push 9
push str.LBBrowser
lea ecx, [esp + 0x20]
call fcn.004130ec
lea ecx, [esp + 0x18]
call fcn.00426068
push 0xa
push 0x4b4a8c
lea ecx, [esp + 0x20]
call fcn.004130ec
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebp
call fcn.004271ab
pop ecx
test eax, eax
jne 0x413c2f
cmp dword [0x4d8dfc], 1
jg 0x413bfb
push 1
push 0x28
push str.LiebaoOperator.cpp
lea ecx, [esp + 0x30]
call fcn.00437390
mov edi, eax
mov byte [esp + 0xe0], 1
xor ebx, ebx
inc ebx
mov dword [esp + 0x1c], ebx
mov esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [edi + 8]
mov edx, str.Launch_Error__path_:
call fcn.00410491
mov edx, esi
mov ecx, eax
call fcn.00437a80
mov edx, str.__CreateProcessAsActivedUser_err___d
mov ecx, eax
call fcn.00410491
pop ecx
mov ecx, eax
call fcn.0040ec68
mov dword [esp + 0xe0], ebp
test bl, 1
je 0x413c17
and ebx, 0xfffffffe
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.004373e0
push 5
push ebp
push str.__restore_last_session
push dword [esp + 0x24]
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [esp + 0xe0], 0xffffffff
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.00411bb2
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd0
ret
Function at 0x4143ad
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a1f34
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x4d8f40]
xor ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
inc ebp
xor esi, esi
test al, 1
jne 0x414436
or eax, ebp
mov dword [0x4d8f40], eax
mov dword [esp + 0x230], esi
push 0x4b679c
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov ecx, eax
mov dword [0x4d8f3c], ecx
or dword [esp + 0x230], 0xffffffff
mov eax, dword [0x4d8f40]
jmp 0x41443c
mov ecx, dword [0x4d8f3c]
test al, 2
jne 0x414477
or eax, 2
mov dword [0x4d8f40], eax
mov dword [esp + 0x230], ebp
push 0x4b67d8
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call edi
mov dword [0x4d8f44], eax
or dword [esp + 0x230], 0xffffffff
mov ecx, dword [0x4d8f3c]
jmp 0x41447c
mov eax, dword [0x4d8f44]
test ecx, ecx
je 0x4144c8
test eax, eax
je 0x4144c8
call ecx
cmp eax, 0xffffffff
je 0x4144c8
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
push ecx
push eax
mov dword [esp + 0x20], esi
call dword [0x4d8f44]
test eax, eax
je 0x4144c8
lea eax, [esp + 0x18]
push eax
push ebp
push ebp
push esi
push 0x2000000
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [esp + 0x14]
test eax, eax
jne 0x4144f2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0047aabf
add esp, 0x220
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x414556
xor eax, eax
push 0x206
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push esi
push eax
call fcn.00482250
add esp, 0xc
lea eax, [esp + 0x1c]
push esi
push 0x1c
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [esp + 0x1c]
push eax
call fcn.00402919
pop ecx
push eax
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.00403190
mov esi, ebp
push dword [esp + 0x14]
call edi
mov eax, esi
jmp 0x4144ca

Function at 0x414604
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00482250
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00402919
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00403190
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x414679
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
xor ebx, ebx
cmp dword [ecx + 0x14], 8
push edi
mov edi, edx
mov ebp, ebx
jb 0x41468c
mov ecx, dword [ecx]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x4146ac
xor al, al
jmp 0x414709
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4146fc
push ebx
push esi
mov ecx, edi
call fcn.00415d3c
cmp dword [edi + 0x14], 0x10
jb 0x4146cd
mov edi, dword [edi]
test esi, esi
je 0x4146fa
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
mov eax, esi
sub eax, ebp
push eax
lea eax, [edi + ebp]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4146fa
add ebp, dword [esp + 0x10]
cmp ebp, esi
jb 0x4146d1
mov bl, 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4152b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp + 8], 0
push ebx
push edi
mov ebx, edx
mov edi, ecx
jle 0x415317
push ebp
mov ebp, dword [esp + 0x10]
sub ebx, ebp
push esi
inc byte [edi + 0x100]
movzx esi, byte [edi + 0x100]
mov al, byte [esi + edi]
add byte [edi + 0x101], al
movzx edx, byte [edi + 0x101]
mov cl, byte [esi + edi]
mov al, byte [edx + edi]
mov byte [esi + edi], al
mov byte [edx + edi], cl
movzx eax, byte [edi + 0x101]
movzx ecx, byte [edi + 0x100]
mov al, byte [eax + edi]
add al, byte [ecx + edi]
movzx eax, al
mov al, byte [eax + edi]
xor al, byte [ebx + ebp]
mov byte [ebp], al
inc ebp
dec dword [esp + 0x18]
jne 0x4152c5
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x417c6d
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
mov edi, ecx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00482250
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0047ca1d
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x68], eax
test eax, eax
je 0x417dd0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b6900
push eax
call esi
push 0x4b690c
push dword [edi + 0x68]
mov dword [edi + 4], eax
call esi
push 0x4b691c
push dword [edi + 0x68]
mov dword [edi + 8], eax
call esi
push str.WinHttpAddRequestHeaders
push dword [edi + 0x68]
mov dword [edi + 0xc], eax
call esi
push 0x4b694c
push dword [edi + 0x68]
mov dword [edi + 0x10], eax
call esi
push 0x4b6960
push dword [edi + 0x68]
mov dword [edi + 0x14], eax
call esi
push str.WinHttpQueryHeaders
push dword [edi + 0x68]
mov dword [edi + 0x18], eax
call esi
push 0x4b698c
push dword [edi + 0x68]
mov dword [edi + 0x1c], eax
call esi
push 0x4b699c
push dword [edi + 0x68]
mov dword [edi + 0x20], eax
call esi
push str.WinHttpCrackUrl
push dword [edi + 0x68]
mov dword [edi + 0x24], eax
call esi
push str.WinHttpSetOption
push dword [edi + 0x68]
mov dword [edi + 0x28], eax
call esi
push 0x4b69d4
push dword [edi + 0x68]
mov dword [edi + 0x2c], eax
call esi
push str.WinHttpSetTimeouts
push dword [edi + 0x68]
mov dword [edi + 0x34], eax
call esi
mov dword [edi + 0x30], eax
cmp dword [edi + 4], ebx
je 0x417dce
cmp dword [edi + 0x10], ebx
je 0x417dce
cmp dword [edi + 0x24], ebx
je 0x417dce
cmp dword [edi + 8], ebx
je 0x417dce
cmp dword [edi + 0xc], ebx
je 0x417dce
cmp dword [edi + 0x1c], ebx
je 0x417dce
cmp dword [edi + 0x20], ebx
je 0x417dce
cmp dword [edi + 0x18], ebx
je 0x417dce
cmp dword [edi + 0x14], ebx
je 0x417dce
cmp dword [edi + 0x28], ebx
je 0x417dce
cmp dword [edi + 0x2c], ebx
je 0x417dce
test eax, eax
je 0x417dce
inc ebx
mov dword [edi], ebx
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x417de3
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
mov edi, ecx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00482250
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.wininet.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0047ca1d
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x6c], eax
test eax, eax
je 0x417f24
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push eax
call esi
push str.InternetConnectW
push dword [edi + 0x6c]
mov dword [edi + 0x3c], eax
call esi
push str.HttpOpenRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x40], eax
call esi
push str.HttpAddRequestHeadersW
push dword [edi + 0x6c]
mov dword [edi + 0x44], eax
call esi
push str.HttpSendRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x48], eax
call esi
push str.HttpQueryInfoW
push dword [edi + 0x6c]
mov dword [edi + 0x4c], eax
call esi
push str.InternetReadFile
push dword [edi + 0x6c]
mov dword [edi + 0x50], eax
call esi
push str.InternetCloseHandle
push dword [edi + 0x6c]
mov dword [edi + 0x54], eax
call esi
push str.InternetCrackUrlW
push dword [edi + 0x6c]
mov dword [edi + 0x58], eax
call esi
push str.InternetSetOptionW
push dword [edi + 0x6c]
mov dword [edi + 0x5c], eax
call esi
push str.InternetQueryDataAvailable
push dword [edi + 0x6c]
mov dword [edi + 0x60], eax
call esi
mov dword [edi + 0x64], eax
cmp dword [edi + 0x3c], ebx
je 0x417f21
cmp dword [edi + 0x40], ebx
je 0x417f21
cmp dword [edi + 0x44], ebx
je 0x417f21
cmp dword [edi + 0x48], ebx
je 0x417f21
cmp dword [edi + 0x4c], ebx
je 0x417f21
cmp dword [edi + 0x50], ebx
je 0x417f21
cmp dword [edi + 0x54], ebx
je 0x417f21
cmp dword [edi + 0x58], ebx
je 0x417f21
cmp dword [edi + 0x5c], ebx
je 0x417f21
cmp dword [edi + 0x60], ebx
je 0x417f21
inc ebx
mov dword [edi + 0x38], ebx
mov eax, dword [edi + 0x38]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x4190e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a2b7c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.00418f9e
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x38]
mov dword [ebx], vtable.ATL::CDacl::CAccessObjectAce.0
mov dword [ebx + 0x74], ebp
mov dword [ebx + 0x78], ebp
test esi, esi
je 0x41916b
push 0x4d6656
push 0x10
call fcn.0047c1fb
pop ecx
pop ecx
test eax, eax
je 0x419158
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x41915a
mov eax, ebp
mov dword [ebx + 0x74], eax
test eax, eax
jne 0x41916b
push 0x8007000e
call fcn.004046a6
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4191a4
push 0x4d6656
push 0x10
call fcn.0047c1fb
pop ecx
pop ecx
test eax, eax
je 0x41918d
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x41918f
mov eax, ebp
mov dword [ebx + 0x78], eax
test eax, eax
jne 0x4191a4
push dword [ebx + 0x74]
call fcn.0047b56e
pop ecx
mov dword [ebx + 0x74], ebp
jmp 0x419161
or dword [esp + 0x20], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18

Function at 0x419522
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
mov ebx, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x224]
push edi
mov edi, ecx
lea edx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, bp
jne 0x41954a
sub edi, edx
lea eax, [esp + 0x14]
sar edi, 1
lea edx, [esp + 0x10]
mov esi, 0x104
mov dword [esp + 0x10], edi
cmp edi, esi
mov dword [esp + 0x14], esi
cmovbe eax, edx
push dword [eax]
push ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x419588
xor eax, eax
jmp 0x419615
push ebp
push dword [esp + 0x230]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x419581
push ecx
lea ecx, [esp + 0x1c]
call fcn.0041941a
lea esi, [esp + 0x18]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bp
jne 0x4195b1
sub esi, ecx
mov ecx, ebx
sar esi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x4195c5
sub ecx, edx
sar ecx, 1
mov edx, ecx
sub edx, edi
lea eax, [ecx + esi]
lea ebp, [edx + esi]
cmp eax, edi
jbe 0x419581
lea eax, [ebp + 1]
cmp eax, 0x104
jae 0x419581
lea eax, [edx + edx]
add esi, esi
push eax
lea eax, [ebx + edi*2]
push eax
lea eax, [esi + ebx]
push eax
call fcn.0047aad0
push esi
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00481c00
xor eax, eax
add esp, 0x18
mov word [ebx + ebp*2], ax
inc eax
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047aabf
add esp, 0x214
ret
Function at 0x419d4e
Capabilities:
Enumerate process modules

Disassembly:
push 0x1c
mov eax, 0x4a2c7c
call fcn.0048373d
mov edi, ecx
xor esi, esi
mov dword [edi + 0x10], esi
call fcn.0040251e
lea ecx, [ebp - 0x28]
call fcn.0041a8b2
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x28]
call fcn.0041a931
push ecx
call fcn.0041a812
mov eax, 0xc8
push ecx
lea ebx, [eax + 0x14]
mov ecx, edi
push ebx
call fcn.0041a3f7
movzx eax, al
test eax, eax
je 0x419df2
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x10]
push ecx
shl eax, 2
push eax
push dword [edi]
mov dword [ebp - 0x10], esi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x419dc6
mov eax, dword [ebp - 0x10]
shr eax, 2
cmp ebx, eax
jb 0x419d84
push ecx
push eax
mov ecx, edi
call fcn.0041a3f7
jmp 0x419dfe
mov ecx, edi
call fcn.0040251e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x419deb
call esi
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x419dfe
mov esi, 0x80004005
jmp 0x419dfe
mov ecx, edi
call fcn.0040251e
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041a8e4
mov eax, esi
call fcn.0048370b
ret

Function at 0x41a2af
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4a2dab
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call fcn.0041a8b2
xor ebx, ebx
mov dword [esp + 0x3c], ebx
lea ecx, [esp + 0x18]
call fcn.0041a931
push ecx
call fcn.0041a812
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x41a32e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41a319
call fcn.00404727
mov edi, eax
jmp 0x41a31e
mov edi, 0x80004005
or dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0041a8e4
jmp 0x41a348
mov dword [esi + 0x230], 1
or dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0041a8e4
mov edi, ebx
test edi, edi
js 0x41a39f
mov ebp, 0x22c
lea edi, [esi + 4]
push ebp
push ebx
push edi
call fcn.00482250
add esp, 0xc
mov dword [edi], ebp
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x41a395
mov eax, ebx
cmp dword [esi + 0x230], ebx
je 0x41a379
mov eax, dword [esi + 0xc]
cmp dword [esp + 0x44], eax
je 0x41a3b7
push ebp
push ebx
push edi
call fcn.00482250
add esp, 0xc
mov dword [edi], ebp
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [esi + 0x230], eax
test eax, eax
jne 0x41a36c
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
xor eax, eax
inc eax
jmp 0x41a3a1
Function at 0x41a57c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x41a5a8
xor al, al
jmp 0x41a5c1
push 2
pop eax
push eax
mov dword [ebp - 8], eax
lea ecx, [esi + 4]
lea eax, [ebp - 0x10]
push eax
call fcn.0041ab05
mov byte [esi + 0x38], 1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047aabf
mov esp, ebp
pop ebp
ret 8

Function at 0x41b0bd
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esp + 4]
push edi
mov edi, dword [ebp + 8]
push 0x58
push 0
push eax
call fcn.00482250
push dword [ebp + 0x10]
and dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
and dword [esp + 0x28], 0
mov edx, esi
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0041b13e
add esp, 0x10
lea ecx, [esp + 8]
mov edx, edi
call fcn.0041b1db
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x41bbd6
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x304
mov eax, 0x4a305d
call fcn.00483770
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00482250
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1c
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ecx
push ecx
mov esi, esp
lea eax, [ebp - 0x218]
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
lea ecx, [ebp - 0x248]
mov dword [esi + 4], eax
call fcn.0042ffa0
mov dword [ebp - 4], ebx
mov eax, 0x4b6e18
push ecx
push ecx
mov esi, esp
push eax
mov dword [esi], eax
call fcn.00402919
pop ecx
mov dword [esi + 4], eax
lea ecx, [ebp - 0x248]
lea eax, [ebp - 0x230]
push eax
call fcn.004307e0
inc ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x248]
push eax
call fcn.004300e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.004300b0
push 0x4b6e3c
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x230]
call fcn.00403ecd
mov byte [ebp - 4], 2
sub esp, 0x14
mov esi, esp
mov dword [ebp - 0x30c], esp
push ecx
push ecx
mov ecx, esp
push eax
call fcn.00403d46
mov ecx, esi
call fcn.0042ffa0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.0041bb1b
add esp, 0x18
mov byte [ebp - 4], 0
push 0
push ebx
lea ecx, [ebp - 0x230]
call fcn.0040314a
push str.Defaultiecache
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x230]
call fcn.00403ecd
mov byte [ebp - 4], 4
sub esp, 0x14
mov esi, esp
mov dword [ebp - 0x310], esp
push ecx
push ecx
mov ecx, esp
push eax
call fcn.00403d46
mov ecx, esi
call fcn.0042ffa0
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.0041bb1b
add esp, 0x18
mov byte [ebp - 4], 0
push 0
push ebx
lea ecx, [ebp - 0x230]
call fcn.0040314a
lea ecx, [ebp - 0x308]
call fcn.0041b9d0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x308]
push eax
push ecx
call fcn.00454d43
pop ecx
mov ecx, eax
call fcn.00454d9a
lea eax, [ebp - 0x2c0]
push eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x260]
call fcn.0041c03c
mov byte [ebp - 4], 7
mov edx, eax
lea ecx, [ebp - 0x230]
mov dword [esp], str.iecache
call fcn.00412487
mov byte [ebp - 4], 8
sub esp, 0x14
mov esi, esp
mov dword [ebp - 0x310], esp
push ecx
push ecx
mov ecx, esp
push eax
call fcn.00403d46
mov ecx, esi
call fcn.0042ffa0
mov byte [ebp - 4], 9
mov byte [ebp - 4], 8
call fcn.0041bb1b
add esp, 0x18
mov byte [ebp - 4], 7
push 0
push ebx
lea ecx, [ebp - 0x230]
call fcn.0040314a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x260]
push 0
push ebx
call fcn.0040314a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x308]
call fcn.004558b6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.004300b0
call fcn.0048371f
ret