joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4104a0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.Software
push reloc.OLEAUT32.dll_SysReAllocString
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410581
mov ecx, dword [0x568ad4]
push esi
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov esi, 0xb
idiv esi
pop esi
cmp edx, 7
jne 0x41054d
test ecx, ecx
je 0x41054d
lea esp, [esp]
mov eax, ecx
and eax, 0x80000001
jns 0x4104fe
dec eax
or eax, 0xfffffffe
inc eax
jne 0x41050b
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x410512
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x568ad4], ecx
sub edx, 0
je 0x41053c
sub edx, 2
je 0x41053f
dec edx
je 0x410540
jmp 0x410549
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x568ad4], ecx
test ecx, ecx
jne 0x4104f0
push 5
push str.tempo
push 1
push str.Tempo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
jne 0x410578
push str.Tempo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4108b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4108cb
test al, 0x10
je 0x4108cb
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4109c0
Capabilities:
Create directory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004108b0
add esp, 4
test al, al
je 0x4109d9
mov al, 1
pop esi
pop ebp
ret
push ebx
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x410aad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410aad
mov edx, dword [0x568ad4]
mov eax, edx
imul eax, edx
and eax, 0x8000000f
jns 0x410a19
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x410aa7
xor esi, esi
mov ecx, esi
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, esi
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
inc esi
add edx, eax
cmp esi, 0x100
jl 0x410a24
mov dword [0x568ad4], edx
pop ebx
mov al, 1
pop esi
pop ebp
ret
mov al, bl
pop ebx
pop esi
pop ebp
ret
Function at 0x410fd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [0x568ad4]
mov esi, eax
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 2
jne 0x411011
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp esi, 0xffffffff
jne 0x41101b
xor eax, eax
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ebp
ret
Function at 0x411040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50acc6
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5671f0]
mov edi, dword [ebp + 8]
mov ecx, 0x5671f0
mov dword [ebp - 0x224], 0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 4], 0
call fcn.004eaaf0
add esp, 0xc
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x4110fd
add esi, 0xfffffff0
push esi
call fcn.00405030
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411262
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x411262
push str.SHGetFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4111d3
call fcn.00411e60
test al, al
jne 0x4111a9
mov edx, dword [0x568ad4]
xor ebx, ebx
mov ecx, ebx
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, ebx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
inc ebx
add edx, eax
cmp ebx, 0x100
jl 0x411126
mov dword [0x568ad4], edx
add esi, 0xfffffff0
push esi
call fcn.00405030
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jmp 0x411258
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x1c
push 0
call eax
or ebx, 0xffffffff
test eax, eax
js 0x411236
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00401c30
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.004026d0
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411230
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x21c]
add esi, 0xfffffff0
push esi
call fcn.00405030
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x411262
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret
Function at 0x411b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ada8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x567680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push dword [eax]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x411bc4
xor bl, bl
jmp 0x411c29
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], 0
mov ecx, dword [eax - 8]
mov esi, dword [eax - 0xc]
mov edx, 1
sub edx, dword [eax - 4]
or ecx, edx
jge 0x411bfa
push 0
lea ecx, [ebp + 0xc]
call fcn.004084d0
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 8]
push ecx
lea ecx, [esi + esi]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
sete bl
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x411c4d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push dword [eax]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x412029
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
push 0
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], 0
push dword [eax - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412029
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov bl, 1
push edi
mov edi, dword [0x568ad4]
lea ecx, [edi + 2]
lea eax, [edi + 1]
imul eax, ecx
imul eax, edi
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 0xb
jne 0x4120a0
movsd xmm3, qword [0x51a718]
movsd xmm6, qword [0x51a720]
movsd xmm5, qword [0x51a710]
movd xmm4, edi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
lea esp, [esp]
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x41208a
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x412070
pop edi
cmp esi, 0xffffffff
je 0x4120ad
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x412ff0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b016
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x24c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x244], edi
cmp edi, 0xffffffff
jne 0x413044
xor eax, eax
jmp 0x41320d
call fcn.00414790
test al, al
jne 0x41306b
push 4
call fcn.004e8d3a
mov esi, eax
call fcn.004e9fd1
mov dword [esi], eax
push esi
mov dword [0x568ad4], eax
call fcn.004e8c3e
add esp, 8
push 0x22c
xor ebx, ebx
lea eax, [ebp - 0x23c]
push ebx
push eax
call fcn.004eaaf0
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push edi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x413200
call fcn.004147c0
test al, al
jne 0x4130b0
inc dword [0x568eb4]
lea edi, [ebp - 0x218]
shr edi, 0x10
mov dword [ebp - 0x248], edi
nop
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x240], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
test edi, edi
jne 0x413108
movzx edi, ax
push 0
push edi
call fcn.00403090
add esp, 8
test eax, eax
je 0x413138
push edi
push eax
lea ecx, [ebp - 0x240]
call fcn.004082e0
jmp 0x413132
lea edx, [eax + 2]
jmp 0x413110
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413110
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040b9d0
mov esi, dword [ebp - 0x240]
mov edi, dword [esi - 0xc]
mov dword [ebp - 4], 1
test edi, edi
js 0x4131f6
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x41316d
push edi
lea ecx, [ebp - 0x240]
call fcn.004084d0
mov esi, dword [ebp - 0x240]
lea eax, [edi + 1]
push eax
push esi
call fcn.004eb8d7
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4131f6
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [ebp - 0x24c]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x4131af
push esi
push eax
call fcn.004ea1ea
add esp, 8
test eax, eax
je 0x4131af
sub eax, dword [edi]
sar eax, 1
cmovns ebx, dword [ebp - 0x234]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4131d0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x413200
test ebx, ebx
jne 0x413200
mov edi, dword [ebp - 0x248]
jmp 0x4130c0
push 0x80070057
call fcn.00403100
test edi, edi
je 0x41320b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret
Function at 0x414630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41465d
xor al, al
pop esi
pop ebp
ret
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp + 8], 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x568ad4]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 8
jne 0x4146bb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebp
ret

Function at 0x414a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 8], ax
push edi
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0x5f005f
mov dword [ebp - 0x44], 0x520043
mov dword [ebp - 0x40], 0x40005f
mov dword [ebp - 0x3c], 0x410046
mov dword [ebp - 0x38], 0x4c0049
mov dword [ebp - 0x34], 0x440045
mov dword [ebp - 0x30], 0x44005f
mov dword [ebp - 0x2c], 0x57004f
mov dword [ebp - 0x28], 0x4c004e
mov dword [ebp - 0x24], 0x41004f
mov dword [ebp - 0x20], 0x5f0044
mov dword [ebp - 0x1c], 0x450052
mov dword [ebp - 0x18], 0x440041
mov dword [ebp - 0x14], 0x5f0040
mov dword [ebp - 0x10], 0x520043
mov dword [ebp - 0xc], 0x5f005f
call fcn.00401c30
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e9514
mov esp, ebp
pop ebp
ret
Function at 0x41be40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bb08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x41bf71
cmp byte [ebx + 0x46], 0
je 0x41bf71
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
jne 0x41be9f
xor al, al
jmp 0x41bf73
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
cmp ecx, 0x10
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 8
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
nop
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41bf0a
dec eax
je 0x41bf0e
sub eax, 2
je 0x41bf5a
xor bl, bl
jmp 0x41bf5c
mov byte [ebx + 0x46], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edx
sub esi, eax
je 0x41bf40
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [ebp - 0x28]
cmovae eax, edx
push 1
push eax
call fcn.004ec42e
add esp, 0x10
cmp esi, eax
jne 0x41bf06
cmp byte [ebx + 0x46], 0
je 0x41bf5a
test esi, esi
jne 0x41bed0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0041cad0
jmp 0x41bed0
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x41bf6d
push dword [ebp - 0x28]
call fcn.004e8c3e
add esp, 4
mov al, bl
jmp 0x41bf73
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret
Function at 0x420750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bf48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x567680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00420ab0
mov dword [edi], eax
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00420ab0
mov dword [edi + 8], eax
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
call fcn.00420b60
mov eax, dword [edi]
lea ecx, [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
mov eax, dword [edi + 8]
push dword [eax + 4]
call fcn.00420b60
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
mov dword [eax + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4214c0
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c010
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.ProcessKiller
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.00401c30
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00414940
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42152f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x569034], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x24], 0
jne 0x42158f
push 0x51a438
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x421586
push str.OpenProcessToken
push eax
call edi
mov dword [0x569034], eax
jmp 0x42158b
mov eax, dword [0x569034]
test eax, eax
je 0x4215f4
lea eax, [ebp - 0x24]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x569034]
test eax, eax
je 0x4215f4
lea eax, [ebp - 0x30]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4215f4
mov eax, dword [ebp - 0x30]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
push 0
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4215f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x421634
push 0x51b25c
push eax
call edi
push 0x51b33c
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
call edi
push 0x51b34c
push dword [esi + 0x10]
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x14], 0
je 0x421646
cmp dword [esi + 0x18], 0
je 0x421646
cmp dword [esi + 0x1c], 0
jne 0x421690
cmp dword [esi + 0x10], 0
je 0x421690
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xc], eax
test eax, eax
je 0x421690
push str.ZwQuerySystemInformation
push eax
call edi
push 0x51b384
push dword [esi + 0x10]
mov dword [esi + 0x20], eax
call edi
push 0x51b394
push dword [esi + 0x10]
mov dword [esi + 0x24], eax
call edi
push 0x51b3a0
push dword [esi + 0x10]
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret
Function at 0x421850
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call fcn.004217e0
mov esi, eax
test esi, esi
jne 0x421880
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push edi
xor edi, edi
push dword [ebp - 4]
inc edi
push 0x421b20
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4218b0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
jmp 0x4218b5
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 5
jge 0x4218e1
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004217e0
mov esi, eax
test esi, esi
jne 0x421884
xor eax, eax
pop edi
cmp ebx, 1
pop ebx
sete al
pop esi
mov esp, ebp
pop ebp
ret 4