joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1f4
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1040
call fcn.0040f4d0
push ebx
push esi
mov esi, dword [esp + 0x1050]
xor ebx, ebx
cmp word [esi], bx
je 0x40e41b
push esi
call fcn.00414965
pop ecx
cmp eax, 0x7f6
jae 0x40e41b
push ebp
push edi
push 0x3c
pop edi
push edi
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.00410480
movzx ecx, word [esi]
lea edx, [esi + 2]
add esp, 0xc
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0x1c0
push 0x22
pop ebp
cmp cx, bp
je 0x40e254
mov edx, esi
mov dword [esp + 0x24], edx
mov eax, ebx
test cx, cx
je 0x40e29d
push 0x20
mov ecx, esi
pop edi
cmp word [ecx], bp
jne 0x40e27e
jmp 0x40e271
cmp word [esi + eax*2], bp
je 0x40e27a
inc eax
cmp word [esi + eax*2], bx
jne 0x40e26b
jmp 0x40e27e
mov word [esi + eax*2], di
cmp word [esi + eax*2], di
je 0x40e3f2
cmp word [esi + eax*2 + 2], 0x2f
je 0x40e3ec
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40e264
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40e2aa
cmp word [eax], bx
jne 0x40e2c4
cmp byte [esp + 0x105c], bl
jne 0x40e2c4
cmp word [0x4491fa], bx
je 0x40e2c4
mov dword [esp + 0x28], 0x4491fa
push edx
mov dword [esp + 0x34], 1
call fcn.00403288
mov esi, eax
test esi, esi
je 0x40e2ef
push str..inf
push esi
call fcn.00405641
test eax, eax
jne 0x40e2ef
mov dword [esp + 0x20], 0x4233bc
push dword [esp + 0x24]
call fcn.00402569
test al, al
je 0x40e317
push 0x800
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x2c]
call fcn.00403011
lea eax, [esp + 0x50]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e419
mov edi, dword [esp + 0x1054]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4481f0], bl
jne 0x40e350
cmp byte [esp + 0x105c], bl
jne 0x40e350
cmp byte [0x4548e2], bl
je 0x40e3af
test edi, edi
je 0x40e365
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e365
push ebx
push edi
call ebp
mov bl, 1
push 0x7d0
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [esp + 0x4c]
call fcn.0040e674
cmp byte [0x4548e2], 0
je 0x40e3af
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e3af
mov eax, dword [esp + 0x10]
add eax, 0x3e8
cmp eax, dword [0x4548e4]
jbe 0x40e3af
mov dword [0x4548e4], eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40e3cc
push str..exe
push esi
call fcn.00405641
test eax, eax
je 0x40e405
cmp byte [0x4481f0], 0
mov al, byte [esp + 0x105c]
je 0x40e40c
test al, al
jne 0x40e40c
mov dword [0x4548e8], 0x1b58
jmp 0x40e40c
cmp word [esi + eax*2], di
jne 0x40e3f8
xor ecx, ecx
mov word [esi + eax*2], cx
inc eax
lea eax, [esi + eax*2]
mov dword [esp + 0x28], eax
jmp 0x40e2a1
mov al, byte [esp + 0x105c]
test bl, bl
je 0x40e419
test al, al
je 0x40e419
push 1
push edi
call ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x1040
ret 0xc
Function at 0x40e426
Capabilities:
Hide graphical window

Disassembly:
and dword [0x4411b8], 0
push 1
push dword [esp + 8]
mov byte [0x4481c2], 1
mov byte [0x4481c3], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.0040136d
cmp dword [0x4481c4], 0
jne 0x40e466
cmp byte [0x4481e8], 0
je 0x40e46f
cmp dword [0x4481e0], 0
jne 0x40e482
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x40e555
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040f4d0
cmp byte [0x4481f8], 0
je 0x40e5df
cmp word [0x4548f0], 0
je 0x40e5df
push esi
lea eax, [ebp - 0x1008]
push eax
push 0x4548f0
call fcn.0040d256
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e5de
push dword [ebp + 8]
call fcn.00414965
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40e5e5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040f4d0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040437f
mov esi, eax
test esi, esi
je 0x40e63d
movzx ecx, word [esi]
push ecx
jmp 0x40e628
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00404476
test al, al
jne 0x40e621
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4037d9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
push edi
xor edi, edi
cmp edx, dword [ebp + 0xc]
cmova esi, eax
test esi, esi
je 0x403809
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x4037f4
jmp 0x40380b
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4056ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4056d0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040578c
jmp 0x405787
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x4056f1
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4056f3
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40577b
jg 0x405706
test esi, esi
je 0x40577b
test ecx, ecx
jl 0x405748
jg 0x405710
test eax, eax
je 0x405748
cmp ebx, ecx
jg 0x405722
jl 0x40571a
cmp esi, eax
jae 0x405722
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0043a0b0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40574e
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40577b
jg 0x405758
test esi, esi
je 0x40577b
cmp dword [edi + 0x4c], 0
je 0x40577b
mov ecx, edi
call fcn.004040db
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0043dbb3
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc
Function at 0x407fff
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x408157
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x408155
cmp eax, edi
jne 0x408040
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x408155
cmp eax, edi
jne 0x408040
test dword [esi + 0x50], edx
je 0x408163
cmp eax, 0x2e
jne 0x40805b
push 5
lea ecx, [esi + 0x24]
call fcn.00409af8
mov ecx, esi
call fcn.00409b36
jmp 0x408140
cmp eax, 0x5c
jne 0x4080ad
mov ecx, esi
call fcn.00409b36
test byte [esi + 0x50], 0x80
je 0x4080a1
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x40808a
push 4
lea ecx, [esi + 0x24]
call fcn.00409af8
mov ecx, esi
call fcn.00409b36
jmp 0x408147
cmp al, 0x42
jne 0x4080a1
push 4
lea ecx, [esi + 0x24]
call fcn.00409af8
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x40807e
mov ecx, esi
call fcn.0040816d
jmp 0x408140
cmp eax, 0x5b
jne 0x4080cd
mov ecx, esi
call fcn.00409b36
mov ecx, esi
call fcn.004086c7
cmp dword [esi + 0x4c], 0x5d
je 0x40804f
push 4
jmp 0x408165
cmp eax, 0x28
jne 0x4080e9
mov ecx, esi
call fcn.00409b36
mov ecx, esi
call fcn.0040a02e
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x408163
jmp 0x408135
cmp eax, 0x5e
jne 0x4080f2
push 2
jmp 0x408076
cmp eax, 0x24
jne 0x4080fe
push 3
jmp 0x408076
cmp eax, 0x2a
je 0x40815f
cmp eax, 0x2b
je 0x40815f
cmp eax, 0x3f
je 0x40815f
cmp eax, 0x7b
je 0x40815f
cmp eax, 0x7d
jne 0x40811c
test dword [esi + 0x50], edx
je 0x40815b
cmp eax, 0x5d
jne 0x408126
test dword [esi + 0x50], edx
je 0x4080c6
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0040798b
mov bl, 1
mov ecx, esi
call fcn.00409b36
test bl, bl
je 0x408147
mov ecx, esi
call fcn.00409b64
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x408015
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x408165
push 0xa
jmp 0x408165
push 5
mov ecx, esi
call fcn.00409384
int3

Function at 0x40f8fa
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x475114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00414c17
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40f921
mov eax, dword [eax]
push ebx
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.0040425b
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004218c2
leave
ret
Function at 0x410115
Capabilities:
Create directory

Disassembly:
push 0x140
mov eax, 0x459c3c
call fcn.0042193e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x90]
mov esi, dword [ebp + 0xc]
push edi
push eax
call fcn.0040fba2
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x90], ebx
jne 0x41024e
lea ecx, [ebp - 0x88]
call fcn.0040f01d
test al, al
je 0x410160
mov bl, 1
jmp 0x41024e
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00414a96
pop ecx
pop ecx
cmp dword [ebp - 0x30], 0
mov byte [ebp - 4], 1
je 0x41023e
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00410115
pop ecx
pop ecx
test al, al
je 0x41023e
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.00414c17
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4101a2
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x4101c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 0x149], bl
cmp eax, 0xb7
jne 0x4101c9
mov byte [ebp - 0x149], 1
lea ecx, [ebp - 0x58]
call fcn.0040425b
cmp byte [ebp - 0x149], 0
je 0x4101df
xor eax, eax
inc eax
jmp 0x41023c
call fcn.00403542
push 2
push eax
lea ecx, [ebp - 0x148]
call fcn.004026ca
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 2
push str.Failed_to_create_directory_at_
push eax
call fcn.00401478
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._due_to
push edi
push esi
call fcn.004012c4
pop ecx
pop ecx
push eax
call fcn.00401478
pop ecx
pop ecx
mov ecx, eax
call fcn.0040dca3
lea ecx, [ebp - 0x148]
call fcn.00402c8a
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00404235
lea ecx, [ebp - 0x40]
call fcn.00404235
lea ecx, [ebp - 0x80]
call fcn.00404235
mov al, bl
call fcn.004218e8
ret
Function at 0x410309
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x475114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], eax
call fcn.0040f044
test al, al
jne 0x41035f
xor ebx, ebx
mov dword [esi], 2
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x1c], bl
push eax
lea ecx, [esi + 4]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], ebx
call fcn.0040235d
lea ecx, [ebp - 0x1c]
jmp 0x410459
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00414c17
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x410376
mov eax, dword [eax]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call fcn.0040425b
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x4103a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x41033e
mov eax, dword [ebp - 0x38]
cdq
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push edi
push eax
mov dword [ebp - 0x44], edx
call fcn.0040f542
pop ecx
pop ecx
push ebx
mov edi, dword [eax]
lea ecx, [ebp - 0x34]
push edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
call fcn.0040be08
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x40]
push ebx
push ecx
push edi
mov edi, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x38]
cmp eax, 1
jne 0x410421
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x40], eax
jne 0x41042f
lea eax, [ebp - 0x34]
mov dword [esi], ebx
push eax
lea ecx, [esi + 4]
call fcn.0040235d
jmp 0x410456
test eax, eax
jne 0x41042f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x410435
mov dword [esi], 0x26
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [esi + 4]
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], bl
call fcn.0040235d
lea ecx, [ebp - 0x1c]
call fcn.00404235
lea ecx, [ebp - 0x34]
call fcn.00404235
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218c2
leave
ret

Function at 0x4104e2
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x475114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push eax
call fcn.0040f7ca
mov edi, eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00414c17
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x410518
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.0040425b
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218c2
leave
ret
Function at 0x412756
Capabilities:
Enumerate processes

Disassembly:
push 0x2a0
mov eax, 0x45a252
call fcn.0042193e
mov dword [ebp - 0x298], ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a0], edi
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4127c0
lea eax, [ebp - 0x294]
mov ecx, edi
push eax
call fcn.00410ed6
lea ecx, [ebp - 0x294]
call fcn.00413c51
mov eax, edi
jmp 0x412955
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4127e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4127a0
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x298]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x288]
push eax
call fcn.00410d97
test ebx, ebx
jle 0x412831
cmp dword [ebp - 0x288], ebx
jne 0x4128e1
mov eax, dword [ebp - 0x26c]
and dword [ebp - 0x18], 0
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x288]
mov ecx, edi
call fcn.004126a1
test al, al
jne 0x4128b8
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x260]
push eax
call fcn.0040ddf3
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00414b84
pop ecx
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402f0a
lea ecx, [ebp - 0x58]
call fcn.00404235
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040425b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x294]
call fcn.00410d5e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00404235
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x412803
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x298]
lea esi, [ebx + 4]
push esi
call fcn.00403fca
pop ecx
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebx + 0x34]
call fcn.00413ccc
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x294]
push eax
call fcn.00410ed6
push esi
mov byte [ebp - 4], 4
call fcn.00403fe9
pop ecx
lea ecx, [ebp - 0x2ac]
call fcn.004041bb
lea ecx, [ebp - 0x294]
call fcn.00413c51
mov eax, dword [ebp - 0x2a0]
call fcn.004218e8
ret 8
Function at 0x413094
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x475114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4130f5
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cmp eax, 1
pop ebx
sete al
xor ecx, ebp
call fcn.004218c2
leave
ret
Function at 0x414037
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x475114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov dword [esi + 0x10], ecx
lea edi, [esi + 0x1c]
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
mov dword [esi + 0x18], ecx
push ebx
push eax
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
call fcn.00414b84
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.00402f0a
lea ecx, [ebp - 0x1c]
call fcn.00404235
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0
je 0x4140f5
and dword [ebp - 0x20], 0
mov ecx, ebx
cmp dword [ebx + 0x14], 8
jb 0x4140a4
mov ecx, dword [ebx]
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [esi + 0x18]
push eax
push 0
push ecx
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x4140c6
cmp dword [ebp - 0x20], 0
je 0x4140f5
push edi
push dword [ebp - 0x20]
mov ecx, edi
call fcn.00410b7a
cmp dword [ebx + 0x14], 8
jb 0x4140d9
mov ebx, dword [ebx]
lea eax, [ebp - 0x20]
push eax
push dword [edi]
lea eax, [esi + 0x18]
push eax
mov eax, dword [ebp - 0x24]
push 0
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41410e
xor ecx, ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
mov dword [esi + 0x18], ecx
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218c2
leave
ret 8
Function at 0x4142c5
Capabilities:
Set registry value

Disassembly:
push 0x4c
mov eax, 0x45a6ca
call fcn.0042193e
mov ebx, ecx
mov dword [ebp - 0x58], ebx
cmp dword [ebx], 0
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jne 0x4142e8
xor al, al
jmp 0x4143b2
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x4142fb
cmp byte [ebp + 0x10], al
jne 0x4142fb
mov al, 1
jmp 0x4143b2
xor ecx, ecx
inc ecx
test byte [ebx + 0x20], 2
mov dword [ebp - 0x54], ecx
jne 0x414382
push esi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.00414037
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 1
jne 0x414342
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x38]
call fcn.00414408
push edi
mov ecx, eax
call fcn.0041449c
lea ecx, [ebp - 0x50]
mov bl, al
call fcn.0040425b
test bl, bl
jne 0x414357
mov ebx, dword [ebp - 0x58]
mov eax, dword [ebx + 0x20]
mov ecx, ebx
or eax, 2
push eax
call fcn.00414276
test al, al
jne 0x41436c
mov byte [ebp - 0x54], al
lea ecx, [ebp - 0x1c]
call fcn.00409e6e
lea ecx, [ebp - 0x38]
call fcn.00404235
mov al, byte [ebp - 0x54]
jmp 0x4143b2
lea ecx, [ebp - 0x1c]
call fcn.00409e6e
lea ecx, [ebp - 0x38]
call fcn.00404235
mov eax, dword [edi + 0x10]
xor ecx, ecx
inc ecx
cmp dword [esi + 0x10], 0
jne 0x41438c
xor esi, esi
jmp 0x414394
cmp dword [esi + 0x14], 8
jb 0x414394
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41439c
mov edi, dword [edi]
add eax, eax
push eax
push edi
push ecx
push 0
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
inc al
call fcn.004218e8
ret 0xc

Function at 0x41efaf
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x475114]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41efc5
sub ecx, edx
lea eax, [ecx*2 + 2]
call fcn.00422400
mov eax, esp
lea ecx, [ebp - 5]
push dword [ebp + 8]
push eax
call fcn.0041ef2c
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41f01f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41f017
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41f01f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41f024
mov eax, dword [0x45e9f8]
lea esp, [ebp - 0xc]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004218c2
leave
ret

Function at 0x424c6c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x443e2e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x443e6d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x443e6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x443e6d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x443e6d
cmp dword [ecx + 0x74], 0xe
jbe 0x443e6d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x447a02
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x465cc8
push 0x465cc0
push 0x45fc60
push 0x1f
call fcn.0044786d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x447a36
push dword [ebp + 8]
mov ecx, esi
call dword [0x45c2cc]
call esi
jmp 0x447a3c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x447a80
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x465cd8
push 0x465cd0
push str.FlsGetValue
push 0x21
call fcn.0044786d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x447ab7
push dword [ebp + 8]
mov ecx, esi
call dword [0x45c2cc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x447abf
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x465ce0
push 0x465cd8
push str.FlsSetValue
push 0x22
call fcn.0044786d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x447af9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x45c2cc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]