joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9cb1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x34]
push str.Registering_components...
push eax
mov esi, ecx
call fcn.00449e80
push str._changeversionreg
push str.KChangeVersionImpl::_changeTip
push 0x384
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckchangeversion.cpp
push 9
mov dword [ebp - 4], 0
call fcn.00487a00
add esp, 0x20
push 0xf
push ecx
lea edx, [ebp - 0x34]
mov ecx, esp
mov dword [ebp - 0x38], esp
push edx
mov dword [esi + 0x70], 0xf
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, esi
call fcn.00401190
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
push str.office6ksomisc.exe
add esi, 0x38
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040ca60
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov edi, 8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], edi
jae 0x44cf7d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44cf8d
test al, 0x10
je 0x44cfc0
push str.file_ksomisc.exe_not_exist__
push str.KChangeVersionImpl::callAnotherKsomiscToReg
push 0x1cb
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckchangeversion.cpp
push 0
call fcn.00487a00
add esp, 0x14
cmp dword [ebp - 0x18], edi
jb 0x44cfbc
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
jmp 0x44d013
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x18], edi
jae 0x44cfd2
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x30]
push edx
push str._changeversionreg
push eax
call fcn.0044ff30
add esp, 0xc
test eax, eax
jns 0x44cffd
cmp dword [ebp - 0x18], edi
jb 0x44cfbc
mov eax, dword [ebp - 0x2c]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
jmp 0x44d013
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x18], edi
jb 0x44d011
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x44d210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9d38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str.wtoolexwpsupdate.exe
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ca60
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov esi, 8
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], esi
jae 0x44d265
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44d275
test al, 0x10
je 0x44d2a8
push str.file_wpsudpate.exe_not_exist__
push str.KChangeVersionImpl::reCreateUpdateTask
push 0x1f5
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckchangeversion.cpp
push 0
call fcn.00487a00
add esp, 0x14
cmp dword [ebp - 0x18], esi
jb 0x44d2a4
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x44d310
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x44d2b3
lea eax, [ebp - 0x2c]
push 0
push 0x4cf38c
push eax
call fcn.0044ff30
add esp, 0xc
test eax, eax
jns 0x44d2fd
push 0
push eax
push str.Failed_to_execute_file:_0x_08x__existCode:_d
push str.KChangeVersionImpl::reCreateUpdateTask
push 0x1fd
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckchangeversion.cpp
push 0
call fcn.00487a00
add esp, 0x1c
cmp dword [ebp - 0x18], esi
jb 0x44d2a4
mov edx, dword [ebp - 0x2c]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x44d310
cmp dword [ebp - 0x18], esi
jb 0x44d30e
mov eax, dword [ebp - 0x2c]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 4
Function at 0x44d330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9d38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str.wtoolexwpsnotify.exe
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ca60
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov esi, 8
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], esi
jae 0x44d385
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44d395
test al, 0x10
je 0x44d3c8
push str.file_ksomisc.exe_not_exist__
push str.KChangeVersionImpl::reCreateNotifyTask
push 0x20e
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckchangeversion.cpp
push 0
call fcn.00487a00
add esp, 0x14
cmp dword [ebp - 0x18], esi
jb 0x44d3c4
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x44d430
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x44d3d3
lea eax, [ebp - 0x2c]
push 0
push 0x4cf38c
push eax
call fcn.0044ff30
add esp, 0xc
test eax, eax
jns 0x44d41d
push 0
push eax
push str.Failed_to_execute_file:_0x_08x__existCode:_d
push str.KChangeVersionImpl::reCreateNotifyTask
push 0x216
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckchangeversion.cpp
push 0
call fcn.00487a00
add esp, 0x1c
cmp dword [ebp - 0x18], esi
jb 0x44d3c4
mov edx, dword [ebp - 0x2c]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x44d430
cmp dword [ebp - 0x18], esi
jb 0x44d42e
mov eax, dword [ebp - 0x2c]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 4
Function at 0x44fdd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5610c1], 0
jne 0x44fe3d
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov byte [0x5610c1], 1
setae al
mov byte [0x5610c0], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x5610c0]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret

Function at 0x44fe50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5610c3], 0
jne 0x44febd
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov byte [0x5610c3], 1
setbe al
mov byte [0x5610c2], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x5610c2]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x44ff30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x45002b
cmp word [esi], bx
je 0x45002b
push edi
push esi
push str.RunProcess:__s.
push str.KProcessUtils::RunProcess
push 0x19f
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 7
call fcn.00487a00
push 0x38
lea eax, [ebp - 0x38]
push ebx
push eax
mov dword [ebp - 0x3c], 0x3c
call sub.MSVCR100.dll_memset
mov edi, dword [ebp + 0x10]
add esp, 0x24
mov dword [ebp - 0x38], 0x500
cmp edi, ebx
je 0x44ff96
mov dword [ebp - 0x38], 0x540
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x44fffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x44ffd4
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push str.Failed_ShellExecuteEx:_0x_08x.
push str.KProcessUtils::RunProcess
push 0x1b0
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push ebx
call fcn.00487a00
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, ebx
je 0x450022
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.Invalid_Arg.
push str.KProcessUtils::RunProcess
push 0x19b
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push ebx
call fcn.00487a00
add esp, 0x14
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450060
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 0x20
push 2
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4500eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4500ba
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_allocate_sid:_0x_08x.
push str.KProcessUtils::IsUserInGroup
push 0x1c7
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 5
call fcn.00487a00
add esp, 0x18
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x450134
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x450112
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_check_token_group:_0x_08x.
push str.KProcessUtils::IsUserInGroup
push 0x1cd
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 5
call fcn.00487a00
add esp, 0x18
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x10], ebx
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x450160
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 1
push esi
mov dword [ebp - 4], 0
call ebx
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b0bb6
add esp, 4
mov edi, eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push edi
push 1
push esi
call ebx
test eax, eax
jne 0x4501d8
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4501c3
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.KProcessUtils::IsSameUser
push 0x210
jmp 0x4502f5
mov eax, dword [edi]
mov dword [ebp - 8], eax
test eax, eax
je 0x4502c8
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4502c8
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 1
push edx
mov dword [ebp - 4], 0
call ebx
mov eax, dword [ebp - 4]
push eax
call fcn.004b0bb6
mov edx, dword [ebp - 4]
add esp, 4
lea ecx, [ebp - 4]
push ecx
push edx
mov esi, eax
mov eax, dword [ebp + 0xc]
push esi
push 1
push eax
call ebx
test eax, eax
jne 0x450260
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x45024b
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.KProcessUtils::IsSameUser
push 0x223
jmp 0x4502f5
mov ebx, dword [esi]
test ebx, ebx
je 0x450299
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x450299
mov ecx, dword [ebp - 8]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
push edi
setne bl
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4502b6
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.KProcessUtils::IsSameUser
push 0x22a
jmp 0x4502f5
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4502e5
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.KProcessUtils::IsSameUser
push 0x217
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 0
call fcn.00487a00
add esp, 0x18
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450cc0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 4
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x450dc7
mov esi, ebx
cmp ebx, 0xffffffff
je 0x450dc7
cmp dword [edi + 0x14], 8
jb 0x450cff
mov edi, dword [edi]
push 0x24
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x450dc7
cmp edi, 0xffffffff
je 0x450dc7
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x450dbb
cmp eax, 3
je 0x450dbb
lea ecx, [ebp - 0x20]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x450dbb
xor esi, esi
nop
lea edx, [ebp - 0x20]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x450d9c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x14
jl 0x450d50
mov esi, dword [ebp - 0x1c]
dec esi
neg esi
sbb esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and esi, 0x80004005
call edi
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
je 0x450dc7
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x450ddb
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test esi, esi
je 0x450ded
cmp esi, 0xffffffff
je 0x450ded
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x451130
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x234], edi
test esi, esi
je 0x451291
cmp word [esi], 0
je 0x451291
test edi, edi
je 0x451291
push ebx
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4511e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4511b0
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.KProcessUtils::GetProcessPid
push 0xce
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 0
call fcn.00487a00
add esp, 0x18
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x230]
push ecx
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x45123c
mov edi, dword [sym.imp.MSVCR100.dll__wcsicmp]
lea esp, [esp]
lea edx, [ebp - 0x20c]
push esi
push edx
call edi
add esp, 8
test eax, eax
jne 0x451223
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x228]
push eax
call fcn.004510c0
lea ecx, [ebp - 0x230]
push ecx
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x451200
mov edi, dword [ebp - 0x234]
jmp 0x45126f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x451250
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.KProcessUtils::GetProcessPid
push 0xdb
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 0
call fcn.00487a00
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [edi]
xor eax, eax
cmp edx, dword [edi + 4]
pop ebx
pop edi
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
push str.Invalid_Args.
push str.KProcessUtils::GetProcessPid
push 0xc5
push str.D:_rc_v11_personal_20200207_branchCoding_supportksomisckprocessutils.cpp
push 0
call fcn.00487a00
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x451580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, ecx
push esi
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], dx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4515b0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.00405660
mov eax, dword [ebp - 0x20]
mov esi, 8
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0xc], esi
jae 0x4515e0
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x24]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x451606
cmp dword [ebp - 0xc], esi
jb 0x45165b
mov edx, dword [ebp - 0x20]
push edx
jmp 0x451653
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
push ebx
push eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x24]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x451649
cmp dword [ebp - 0xc], 8
jb 0x45165b
mov edx, dword [ebp - 0x20]
push edx
jmp 0x451653
cmp dword [ebp - 0xc], 8
jb 0x45165b
mov eax, dword [ebp - 0x20]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x451920
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.004b14f0
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
push 0xffc
lea ecx, [ebp - 0x1000]
push edi
push ecx
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1004], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1024]
push edx
push 0x400
lea eax, [ebp - 0x1004]
push eax
mov dword [ebp - 0x1024], edi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x451a59
mov eax, dword [ebp - 0x1024]
shr eax, 2
mov dword [ebp - 0x1028], eax
cmp eax, edi
jbe 0x451a45
push ebx
push esi
lea ecx, [ecx]
cmp edi, 0x400
jae 0x451a43
mov ecx, dword [ebp + edi*4 - 0x1004]
push ecx
lea edx, [ebp - 0x1020]
push edx
call fcn.004516c0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x4519cd
mov esi, dword [eax]
jmp 0x4519cf
mov esi, eax
mov ecx, dword [ebp - 0x102c]
call fcn.004042c0
push eax
push esi
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
sete bl
cmp dword [ebp - 0x100c], 8
jb 0x451a02
mov eax, dword [ebp - 0x1020]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
je 0x451a36
mov eax, dword [ebp + edi*4 - 0x1004]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x451a36
cmp esi, 0xffffffff
je 0x451a36
push 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 0x1028]
jb 0x4519a0
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x451a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba482
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x220], esi
mov word [esi], ax
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 1
mov word [ebp - 0x218], cx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x451b1d
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451b10
jmp 0x451b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x451b7e
push 0x208
lea edx, [ebp - 0x218]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x451b7e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451b60
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, esi
call fcn.00405660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret