joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc34
mov eax, dword [0x4ae7ec]
xor eax, esp
mov dword [esp + 0xc30], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov byte [esp + 0x428], 0
test eax, eax
jne 0x40d8b1
lea eax, [esp + 0x428]
push eax
push 0x401
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x40d8c7
push 0x401
push eax
lea ecx, [esp + 0x430]
push ecx
call sym.SelectBehaviorsExe.exe_TM_CopyStringA
add esp, 0xc
cmp byte [esp + 0x428], 0
je 0x40da82
xor eax, eax
cmp eax, 0x400
jae 0x40d8f2
mov dl, byte [eax + 0x4355b4]
mov byte [esp + eax + 0x20], dl
inc eax
cmp byte [eax + 0x4355b4], 0
jne 0x40d8d7
mov byte [esp + eax + 0x20], 0
lea eax, [esp + 0x428]
push 0x3a
push eax
call fcn.00417dc0
add esp, 8
test eax, eax
je 0x40d98a
xor ecx, ecx
cmp byte [esp + 0x428], cl
je 0x40d93f
cmp ecx, 0x400
jae 0x40d93f
lea edx, [esp + ecx + 0x428]
lea esi, [eax + 1]
cmp edx, esi
je 0x40d93f
mov dl, byte [edx]
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp byte [esp + ecx + 0x428], 0
jne 0x40d918
lea eax, [esp + 0x20]
mov byte [esp + ecx + 0x20], 0
lea edx, [eax + 1]
jmp 0x40d950
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d950
sub eax, edx
cmp eax, 2
jne 0x40d973
mov eax, dword [esp + 0x20]
push eax
call sym.SelectBehaviorsExe.exe_TM_ToUpperA
mov bl, al
add esp, 4
mov byte [esp + 0x20], bl
jmp 0x40d98e
push 0x401
lea ecx, [esp + 0x24]
push 0x4355b4
push ecx
call sym.SelectBehaviorsExe.exe_TM_CopyStringA
add esp, 0xc
mov bl, byte [esp + 0x20]
lea edx, [esp + 0x10]
push edx
call fcn.0041aee7
add esp, 4
xor eax, eax
test bl, bl
je 0x40d9bb
cmp eax, 0x400
jae 0x40d9bb
mov cl, byte [esp + eax + 0x20]
mov byte [esp + eax + 0x830], cl
inc eax
cmp byte [esp + eax + 0x20], 0
jne 0x40d9a1
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + eax + 0x830], 0
lea esp, [esp]
cmp bl, 0x5a
jge 0x40d9f1
lea edx, [esp + 0x20]
inc bl
push edx
mov byte [esp + 0x24], bl
call sym.SelectBehaviorsExe.exe_TM_GetDriveTypeA
add esp, 4
cmp eax, esi
je 0x40da6b
cmp bl, 0x5a
jl 0x40d9d5
cmp dword [ebp + 0x10], 0xffffffff
je 0x40da2c
lea eax, [esp + 0x18]
push eax
call fcn.0041aee7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
add esp, 4
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
call fcn.0041aea4
fild dword [ebp + 0x10]
add esp, 0x10
fcompp
fnstsw ax
test ah, 0x41
jnp 0x40da82
push 0x1f4
call edi
xor eax, eax
cmp byte [esp + 0x830], al
je 0x40da5d
mov edi, edi
cmp eax, 0x400
jae 0x40da5d
mov dl, byte [esp + eax + 0x830]
mov byte [esp + eax + 0x20], dl
inc eax
cmp byte [esp + eax + 0x830], 0
jne 0x40da40
mov byte [esp + eax + 0x20], 0
mov bl, byte [esp + 0x20]
jmp 0x40d9d0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc3c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x40daa0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40db50
xor eax, eax
cmp eax, 0x400
jae 0x40dae1
mov cl, byte [eax + 0x4355b4]
mov byte [ebp + eax - 0x408], cl
inc eax
cmp byte [eax + 0x4355b4], 0
jne 0x40dac3
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov byte [ebp + eax - 0x408], 0
mov esi, 1
push 0x401
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0x408]
push eax
call edi
test eax, eax
je 0x40db3e
lea ecx, [ebp - 0x80c]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40db35
test dl, dl
je 0x40db31
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40db35
add eax, 2
add ecx, 2
test dl, dl
jne 0x40db15
xor eax, eax
jmp 0x40db3a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40db63
mov cl, byte [esi + 0x4af610]
inc esi
mov byte [ebp - 0x408], cl
cmp esi, 0x19
jbe 0x40daf4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x408]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004171f3
mov esp, ebp
pop ebp
ret

Function at 0x40db80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00429400
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40dc46
xor eax, eax
cmp eax, 0x400
jae 0x40dbca
mov cx, word [eax*2 + 0x435698]
mov word [ebp + eax*2 - 0x808], cx
inc eax
cmp word [eax*2 + 0x435698], 0
jne 0x40dba7
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor edx, edx
mov word [ebp + eax*2 - 0x808], dx
lea esi, [edx + 2]
lea ecx, [ecx]
push 0x401
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x808]
push ecx
call edi
test eax, eax
je 0x40dc30
lea ecx, [ebp - 0x100c]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40dc27
test dx, dx
je 0x40dc23
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40dc27
add eax, 4
add ecx, 4
test dx, dx
jne 0x40dc01
xor eax, eax
jmp 0x40dc2c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40dc59
mov dx, word [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZ]
add esi, 2
mov word [ebp - 0x808], dx
cmp esi, 0x32
jbe 0x40dbe0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x808]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x40e0e0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40e16b
cmp byte [esi], 0
je 0x40e16b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e16b
test al, 0x10
je 0x40e16b
test ebx, ebx
je 0x40e154
push 2
push 0x5c
push ebx
call sym.SelectBehaviorsExe.exe_TM_SearchCharA
add esp, 0xc
test eax, eax
jne 0x40e13e
push 1
push 0x3a
push ebx
call sym.SelectBehaviorsExe.exe_TM_SearchCharA
add esp, 0xc
test eax, eax
jne 0x40e13e
mov eax, ebx
jmp 0x40e13f
inc eax
push 0x401
push eax
lea eax, [ebp - 0x408]
push eax
call sym.SelectBehaviorsExe.exe_TM_CopyStringA
add esp, 0xc
push 0x401
lea ecx, [ebp - 0x408]
push ecx
push esi
call sym.SelectBehaviorsExe.exe_TM_AddDirtoPath
add esp, 0xc
jmp 0x40e19d
xor ecx, ecx
test esi, esi
je 0x40e19d
cmp byte [esi], cl
je 0x40e195
push edi
lea edi, [ebp - 0x408]
mov eax, esi
sub edi, esi
cmp ecx, 0x400
jae 0x40e194
mov dl, byte [eax]
mov byte [edi + eax], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x40e180
pop edi
mov byte [ebp + ecx - 0x408], 0
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x40e1c7
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e1c7
and eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
lea edx, [ebp - 0x408]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.004171f3
mov esp, ebp
pop ebp
ret

Function at 0x40e1f0
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x40e250
cmp word [esi], 0
je 0x40e250
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40e250
test al, 0x10
je 0x40e250
push 0x5c
push 0x401
lea eax, [ebp - 0x808]
push eax
push edi
call sym.SelectBehaviorsExe.exe_TM_PickFileNameExW
push 0x401
lea ecx, [ebp - 0x808]
push ecx
push esi
call sym.SelectBehaviorsExe.exe_TM_AddDirtoPathW
add esp, 0x1c
jmp 0x40e288
xor ecx, ecx
test esi, esi
je 0x40e288
cmp word [esi], cx
je 0x40e27e
lea edx, [ebp - 0x808]
mov eax, esi
sub edx, esi
cmp ecx, 0x400
jae 0x40e27e
mov si, word [eax]
mov word [edx + eax], si
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x40e265
xor edx, edx
mov word [ebp + ecx*2 - 0x808], dx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x808]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x40e310
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x40e340
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret
Function at 0x40e720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00429400
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1024], ecx
mov dword [ebp - 0x1020], edi
mov dword [ebp - 0x1018], edx
mov dword [ebp - 0x1014], 0
test eax, eax
je 0x40e769
cmp byte [eax], 0
jne 0x40e77d
mov eax, 0x51
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40e769
push esi
push 0x435300
push eax
call fcn.00418e48
mov esi, eax
add esp, 8
mov dword [ebp - 0x1008], esi
test esi, esi
jne 0x40e7af
lea eax, [esi + 0x18]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, 0x435760
call fcn.0040ec00
mov ebx, eax
test ebx, ebx
jne 0x40e7dd
push esi
call fcn.0041ad3c
add esp, 4
lea eax, [ebx + 0xa]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1018]
mov eax, dword [eax]
test eax, eax
je 0x40e7f5
push 0
push eax
push esi
call fcn.0041aa30
add esp, 0xc
mov ecx, dword [ebp - 0x1008]
push ecx
push 0x1000
lea edx, [ebp - 0x1004]
push 1
xor esi, esi
push edx
mov dword [ebp - 0x100c], esi
call fcn.004190c3
add esp, 0x10
mov dword [ebp - 0x1010], eax
test eax, eax
je 0x40e8f0
jmp 0x40e830
xor ecx, ecx
mov dword [ebp - 0x101c], ecx
test eax, eax
je 0x40e8ba
lea esp, [esp]
mov dl, byte [ebp + ecx - 0x1004]
mov byte [esi + ebx], dl
inc esi
mov dword [ebp - 0x1028], esi
cmp esi, edi
jne 0x40e8a9
mov eax, dword [ebp - 0x1024]
push edi
push eax
push ebx
call sym.SelectBehaviorsExe.exe_TM_CompareBuffer
add esp, 0xc
test eax, eax
jne 0x40e8e6
lea edx, [eax + 1]
cmp edi, edx
ja 0x40e875
mov edx, edi
jmp 0x40e88b
lea ecx, [edi - 1]
lea esi, [ebx + 1]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x1020]
mov esi, dword [ebp - 0x1028]
test edx, edx
je 0x40e89c
lea eax, [edi + ebx - 1]
mov ecx, edx
mov byte [eax], 0x20
dec eax
dec ecx
jne 0x40e895
mov ecx, dword [ebp - 0x101c]
mov eax, dword [ebp - 0x1010]
dec esi
inc dword [ebp - 0x100c]
inc ecx
mov dword [ebp - 0x101c], ecx
cmp ecx, eax
jb 0x40e840
mov ecx, dword [ebp - 0x1008]
push ecx
push 0x1000
lea edx, [ebp - 0x1004]
push 1
push edx
call fcn.004190c3
add esp, 0x10
mov dword [ebp - 0x1010], eax
test eax, eax
je 0x40e8f0
jmp 0x40e830
mov dword [ebp - 0x1014], 1
mov eax, dword [ebp - 0x1008]
push eax
call fcn.0041ad3c
add esp, 4
mov esi, ebx
mov edi, 0x435760
call fcn.0040ec60
cmp dword [ebp - 0x1014], 0
je 0x40e93c
mov eax, dword [ebp - 0x100c]
sub eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x1018]
pop ebx
inc eax
add dword [ecx], eax
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop ebx
pop esi
xor ecx, ebp
mov eax, 1
pop edi
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x40f7b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
test eax, eax
je 0x40f7fc
cmp byte [eax], cl
je 0x40f7f4
lea esi, [ebp - 0x408]
sub esi, eax
lea esp, [esp]
cmp ecx, 0x400
jae 0x40f7f4
mov dl, byte [eax]
mov byte [esi + eax], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x40f7e0
mov byte [ebp + ecx - 0x408], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40f833
cmp byte [esi], 0
je 0x40f833
push 0x401
lea eax, [ebp - 0x408]
push 0x435100
push eax
call sym.SelectBehaviorsExe.exe_TM_AppendStringA
push 0x401
lea ecx, [ebp - 0x408]
push esi
push ecx
call sym.SelectBehaviorsExe.exe_TM_AppendStringA
add esp, 0x18
push 0x44
lea edx, [ebp - 0x45c]
push 0
push edx
call fcn.004219f0
xor eax, eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
add esp, 0xc
lea eax, [ebp - 0x45c]
push eax
mov dword [ebp - 0x45c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x45c]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
test eax, eax
je 0x40f8d5
mov ecx, dword [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x418]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x40f8f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x40f944
cmp word [eax], cx
je 0x40f93a
lea edx, [ebp - 0x808]
sub edx, eax
push edi
mov edi, edi
cmp ecx, 0x801
jae 0x40f939
mov di, word [eax]
mov word [edx + eax], di
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x40f920
pop edi
xor eax, eax
mov word [ebp + ecx*2 - 0x808], ax
test esi, esi
je 0x40f979
cmp word [esi], 0
je 0x40f979
push 0x401
lea ecx, [ebp - 0x808]
push 0x435288
push ecx
call sym.SelectBehaviorsExe.exe_TM_AppendStringW
push 0x401
lea edx, [ebp - 0x808]
push esi
push edx
call sym.SelectBehaviorsExe.exe_TM_AppendStringW
add esp, 0x18
push 0x44
lea eax, [ebp - 0x85c]
push 0
push eax
call fcn.004219f0
xor eax, eax
add esp, 0xc
lea ecx, [ebp - 0x85c]
push ecx
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x85c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x85c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x808]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x40fa1b
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x818]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x818]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x410590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push str.Process
lea ebx, [ebp - 0x90]
mov edi, esi
mov dword [ebp - 0x98], esi
call fcn.00410420
add esp, 4
test eax, eax
jne 0x4107ca
mov eax, dword [ebp - 0x90]
push eax
push 0x435108
lea ecx, [ebp - 0x88]
push 0x80
push ecx
call sym.SelectBehaviorsExe.exe_TM_FormatString
mov edi, 0x2800
add esp, 0x10
mov ebx, str.TM_PERF_DATA_Read
mov dword [ebp - 0x8c], edi
call fcn.0040ec00
mov dword [esi + 0x10], eax
test eax, eax
jne 0x410620
mov eax, 0xa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
lea edx, [ebp - 0x8c]
push edx
push eax
lea ecx, [ebp - 0x9c]
push ecx
push 0
lea edx, [ebp - 0x88]
push edx
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x94], eax
cmp eax, 0xea
jne 0x41074d
mov edi, dword [esi + 0x10]
mov eax, dword [0x4b24c4]
push edi
push eax
push str.TM_PERF_DATA_Read
push str.__s__Ready_to_Free_Memory___ld___lX__n
push str.TM_MemFree
call fcn.0040b1e0
add esp, 0x14
test edi, edi
je 0x4106b1
mov ecx, dword [0x4b24c4]
push edi
push ecx
push str.TM_PERF_DATA_Read
push str.__s__Memory___ld__Free_OK___lX__n
push str.TM_MemFree
call fcn.0040b1e0
add esp, 0x14
push 0x4b24c4
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push edi
call fcn.00417a1f
add esp, 4
jmp 0x4106c8
push str.TM_PERF_DATA_Read
push str.__s__Attempt_to_free_NULL_Memory____n
push str.TM_MemFree
call fcn.0040b140
add esp, 0xc
mov ebx, dword [ebp - 0x8c]
add ebx, 0x400
mov dword [ebp - 0x8c], ebx
jne 0x4106f7
push str.TM_PERF_DATA_Read
push str.__s__Attempt_to_Allocate_Zero_Bytes_Memory_n
push str.TM_MemAlloc
call fcn.0040b140
add esp, 0xc
xor edi, edi
jmp 0x410744
push ebx
call fcn.00417a59
add esp, 4
mov edi, eax
push ebx
test edi, edi
je 0x410792
push 0xcc
push edi
call fcn.004219f0
add esp, 0xc
push 0x4b24c4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [0x4b24c4]
push edi
push ebx
push edx
push str.TM_PERF_DATA_Read
push str.__s__Memory___ld__Allocate__ld_Bytes_OK___lX__n
push str.TM_MemAlloc
call fcn.0040b1e0
add esp, 0x18
mov eax, dword [ebp - 0x94]
mov dword [esi + 0x10], edi
cmp dword [esi + 0x10], 0
je 0x410607
cmp eax, 0xea
je 0x410620
test eax, eax
jne 0x4107ab
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov dword [esi + 0xc], ecx
mov ecx, esi
mov dword [esi + 0x14], eax
call fcn.004104a0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
push str.TM_PERF_DATA_Read
push str.__s__Memory_Allocate__ld_Bytes_Failed_n
push str.TM_MemAlloc
call fcn.0040b140
add esp, 0x10
jmp 0x410744
mov esi, dword [esi + 0x10]
mov edi, str.TM_PERF_DATA_Read
call fcn.0040ec60
mov edx, dword [ebp - 0x98]
mov dword [edx + 0x14], 0
mov eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x4111d0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4ae7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x18]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41124a
lea edx, [ebp - 0x20]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
push edi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x411285
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
test eax, eax
je 0x411281
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
call ebx
jmp 0x411290
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x41126e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Terminate_process__lu_failed___ld__n
push 0x435bbc
call fcn.0040b0a0
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004171f3
mov esp, ebp
pop ebp
ret
Function at 0x411790
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x4ae7ec]
xor eax, esp
mov dword [esp + 0x820], eax
xor edx, edx
lea eax, [esp + 0x10]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
push esi
lea ecx, [esp + 0x419]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
mov byte [esp + 0x41d], dl
mov dword [esp + 0x820], 1
mov dword [esp + 0x824], edx
cmp eax, edx
jne 0x4117f3
mov dword [esp + 0x14], edx
jmp 0x411817
xor ecx, ecx
cmp byte [eax], dl
je 0x411813
lea esi, [esp + 0x1c]
sub esi, eax
nop
cmp ecx, 0x400
jae 0x411813
mov bl, byte [eax]
mov byte [esi + eax], bl
inc eax
inc ecx
cmp byte [eax], dl
jne 0x411800
mov byte [esp + ecx + 0x1c], dl
mov eax, dword [ebp + 0x10]
cmp eax, edx
jne 0x411824
mov dword [esp + 0x18], edx
jmp 0x41184d
xor ecx, ecx
cmp byte [eax], dl
je 0x411846
lea esi, [esp + 0x41d]
sub esi, eax
cmp ecx, 0x400
jae 0x411846
mov bl, byte [eax]
mov byte [esi + eax], bl
inc eax
inc ecx
cmp byte [eax], dl
jne 0x411833
mov byte [esp + ecx + 0x41d], dl
mov eax, dword [ebp + 0x14]
cmp eax, edx
jle 0x41185b
mov dword [esp + 0x820], eax
cmp edi, edx
jne 0x411888
lea edx, [esp + 0x10]
push edx
push 0x411620
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.004171f3
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push 0x411620
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [esp + 0x82c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004171f3
mov esp, ebp
pop ebp
ret