joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10461d3
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10461d3
mov eax, 0x80070057
jmp 0x10461f9
and dword [ebp + 8], 0
push edi
lea ecx, [ebp + 8]
call fcn.010251b6
push eax
call fcn.01045e24
mov edi, eax
test edi, edi
jge 0x10461fe
mov esi, edi
push dword [ebp + 8]
call fcn.01067da0
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x1046212
push ecx
call fcn.01067da0
mov eax, 0x80004003
jmp 0x10461f8
call fcn.0105a29e
mov dword [esi], eax
test eax, eax
jne 0x10461ec
mov esi, 0x80004003
jmp 0x10461ee

Function at 0x1046ac8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea esi, [ecx + 4]
push 0x178c
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
mov dword [ebp - 4], eax
call ebx
test eax, eax
je 0x1046acb
push 0x7f04
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x1046acb
push eax
lea ecx, [ebp - 4]
call fcn.01046a47
push 7
push dword [esi]
call edi
mov edi, eax
push edi
call ebx
test eax, eax
je 0x1046acb
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
mov ecx, esi
call fcn.0102687f
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x1049871
Capabilities:
Get disk information

Disassembly:
push 8
mov eax, 0x10729cf
call fcn.0100dba4
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x10498b6
mov dword [esi + 4], 0x1004760
mov dword [esi + 0x28], 0x1006c50
mov dword [esi + 0xc], 0x1004758
mov dword [esi + 0x5c], 0x1007004
mov dword [esi + 0x48], 0x1002eb8
push ebx
lea ecx, [esi + 0x58]
mov dword [ebp - 4], ebx
mov dword [esi + 0x50], 0x100439c
call fcn.0104889c
mov dword [ebp - 0x10], 3
push ebx
mov ecx, esi
call fcn.010488ee
lea edi, [esi + 8]
push ebx
mov ecx, edi
call fcn.010496f6
mov eax, dword [esi + 4]
mov dword [esi], 0x1004744
mov dword [edi], 0x1004730
mov eax, dword [eax + 4]
mov dword [eax + esi + 4], 0x1004720
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov dword [eax + esi + 4], 0x1004710
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 4], 0x1004700
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x44]
mov dword [eax + esi], ecx
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
lea ecx, [eax - 0x4c]
mov dword [eax + esi], ecx
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
lea ecx, [eax - 0x54]
mov dword [eax + esi], ecx
mov dword [esi + 0x40], ebx
mov eax, esi
call fcn.0100dc90
ret 4
Function at 0x1051da0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0104a139
xor eax, eax
mov dword [esi], 0x1005054
lea ecx, [esi + 0x90]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x28], eax
lea ecx, [esi + 0xbc]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0xe4]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x10c]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x134]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x15c]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x184]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x1ac]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x28], eax
lea ecx, [esi + 0x1d8]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x200]
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x24], eax
lea ecx, [esi + 0x228]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x28], eax
lea ecx, [esi + 0x254]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x28], eax
mov dword [esi + 0x280], eax
mov dword [esi + 0x284], eax
mov dword [esi + 0x288], eax
push 3
pop eax
mov dword [esi + 0x28c], eax
mov dword [esi + 0x290], eax
xor eax, eax
inc eax
push 2
pop ecx
mov dword [esi + 0x294], eax
mov dword [esi + 0x298], eax
mov dword [esi + 0x2a4], eax
mov dword [esi + 0x2a8], eax
mov dword [esi + 0x2ac], eax
mov dword [esi + 0x2b0], eax
mov dword [esi + 0x29c], ecx
mov dword [esi + 0x2a0], ecx
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10532dd
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10532e5
mov ecx, 0x12c
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
xor eax, eax
pop ebp
ret 0x10

Function at 0x1053749
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov ebx, 0x1109
mov esi, ecx
push ebx
push dword [esi + 0x2c]
call edi
push 0
push 2
push ebx
push dword [esi + 0x2c]
call edi
mov eax, dword [esi + 0x54]
test eax, eax
je 0x1053751
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
and dword [esi + 0x54], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x10555d5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x107d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.010554e8
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.01055b42
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x105561a
cmp dword [ebp - 0x94], 5
jb 0x105563b
jmp 0x1055637
cmp dword [ebp - 0x88], 1
jne 0x105563b
cmp dword [ebp - 0x94], 4
ja 0x1055637
jne 0x105563b
cmp dword [ebp - 0x90], 0
jbe 0x105563b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1005cf0
call fcn.0100e5e9
test eax, eax
jge 0x105565c
mov byte [0x10801ac], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100db8f
leave
ret

Function at 0x105605b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x102
test eax, eax
je 0x1056069
cmp eax, ecx
je 0x1056069
mov edx, 0x80070006
cmp eax, 0xffffffff
jne 0x105603b
call fcn.01056967
mov edx, eax
mov ecx, dword [0x107d1a4]
cmp ecx, 0x107d1a4
je 0x1056065
test byte [ecx + 0x1c], 1
je 0x1056065
push edx
push dword [ebp + 0xc]
push 0x1005ea8
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01055ea7
xor al, al
jmp 0x1056072
xor edx, edx
cmp eax, ecx
sete dl
mov al, dl
pop ebp
ret 8

Function at 0x10561a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
movzx eax, byte [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x105618a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
jmp 0x10561c3
push esi
call fcn.01056967
mov esi, eax
mov eax, 0x800703f0
cmp esi, eax
je 0x10561c2
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x10561c0
test byte [eax + 0x1c], 1
je 0x10561c0
push esi
push 0x1005ea8
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x105639d
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x1056346
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1056336
test byte [eax + 0x1c], 4
je 0x1056336
push 0x1005ea8
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x1056342
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
jmp 0x10563a7
push esi
mov esi, 0x80004005
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
sub eax, 0xb
je 0x1056372
dec eax
je 0x1056364
dec eax
je 0x105636b
sub eax, 9
jne 0x1056377
mov esi, 0x8007000e
jmp 0x1056377
mov esi, 0x80070005
jmp 0x1056377
mov esi, 0x8007009b
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x105639c
test byte [eax + 0x1c], 1
je 0x105639c
push esi
push 0x1005ea8
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
test esi, esi
jge 0x10563a4
mov eax, esi
jmp 0x10563a6
xor eax, eax
pop esi
leave
ret 0x1c
Function at 0x1057882
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x107d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x1c]
lea edx, [ebp - 0x108]
push edx
lea edx, [ebp - 0x110]
push edx
push esi
push ecx
push eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x110], 0x104
call fcn.0105765f
mov ecx, eax
mov eax, dword [ebp + 0x10]
push ecx
push dword [esi]
call fcn.010576ad
test al, al
je 0x105783c
mov eax, 0x8007065d
jmp 0x105793e
test ecx, ecx
jl 0x105786a
mov eax, dword [ebp - 0x110]
mov dword [ebx], eax
cmp dword [ebp + 0x20], eax
jae 0x1057857
mov eax, 0x800700ea
jmp 0x105793e
lea ecx, [ebp - 0x108]
push ecx
push eax
push edi
call fcn.0105686d
jmp 0x105793e
cmp ecx, 0x800700ea
jne 0x1057874
xor ecx, ecx
mov eax, 0x80070002
cmp ecx, eax
je 0x105793e
test ecx, ecx
jge 0x105788c
mov eax, ecx
jmp 0x105793e
and dword [ebp - 0x10c], 0
mov edi, dword [ebp - 0x110]
cmp dword [ebp + 0x20], edi
jb 0x105794f
cmp dword [ebp - 0x10c], 0
je 0x10578be
push dword [ebp - 0x10c]
call fcn.0100d684
and dword [ebp - 0x10c], 0
pop ecx
push edi
lea eax, [ebp - 0x10c]
push eax
call fcn.01056824
mov edi, eax
test edi, edi
jl 0x1057927
push dword [ebp - 0x10c]
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x114]
push dword [ebp - 0x11c]
call fcn.0105765f
mov edi, eax
mov eax, dword [ebp + 0x10]
push edi
push dword [esi]
call fcn.010576ad
test al, al
jne 0x105796f
test edi, edi
jge 0x105798d
cmp edi, 0x800700ea
jne 0x1057913
xor edi, edi
cmp edi, 0x80070002
je 0x10579a7
test edi, edi
jge 0x1057893
cmp dword [ebp - 0x10c], 0
je 0x105793c
push dword [ebp - 0x10c]
call fcn.0100d684
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100db8f
leave
ret 0x1c
cmp dword [ebp - 0x10c], 0
mov dword [ebx], edi
je 0x105784d
push dword [ebp - 0x10c]
call fcn.0100d684
pop ecx
jmp 0x105784d
cmp dword [ebp - 0x10c], 0
je 0x1057832
push dword [ebp - 0x10c]
call fcn.0100d684
pop ecx
jmp 0x1057832
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x118]
mov dword [ebx], eax
mov eax, dword [ebp - 0x10c]
mov dword [ecx], eax
xor eax, eax
jmp 0x105793e
cmp dword [ebp - 0x10c], 0
je 0x10579bc
push dword [ebp - 0x10c]
call fcn.0100d684
pop ecx
mov eax, 0x80070002
jmp 0x105793e
Function at 0x10595ad
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test byte [0x10809b4], 1
push esi
push edi
jne 0x1059546
mov esi, 0x1005c14
mov edi, 0x1080984
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1005c24
mov edi, 0x1080994
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [0x10809b4], 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1005c34
mov edi, 0x10809a4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.01058a72
lea ecx, [ebp - 4]
push ecx
call dword [eax + 0x18]
test eax, eax
jl 0x105958a
cmp dword [ebp - 4], 2
jne 0x1059563
mov eax, 0x80070032
jmp 0x105958a
mov edx, 0x1080984
xor eax, eax
push ebx
mov edi, dword [ebp + 0xc]
push 4
pop ecx
mov esi, edx
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x1059590
add eax, 0x10
add edx, 0x10
cmp eax, 0x30
jb 0x105956b
mov eax, 0x80070057
pop ebx
pop edi
pop esi
leave
ret 8
mov eax, dword [ebp - 4]
sub eax, 4
mov esi, edx
je 0x10595b5
dec eax
je 0x10595a6
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x10595c2
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [eax + 0xf], 0xcc
jmp 0x10595c2
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [eax + 0xf], 0
xor eax, eax
jmp 0x1059589
Function at 0x105cdb6
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x1071c1c
call fcn.0100dba4
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
jne 0x105cd6d
mov eax, 0x80070057
jmp 0x105ce5f
push edi
push edi
push dword [esi + 0x28]
call fcn.0106db6b
cmp eax, edi
jl 0x105ce5f
mov dword [ebp - 0x18], edi
mov dword [ebp + 8], edi
push dword [esi + 0x28]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], edi
call fcn.01057b0a
mov esi, eax
cmp esi, edi
jge 0x105cdaf
cmp dword [ebp + 8], edi
je 0x105cda8
push dword [ebp + 8]
call fcn.0100d695
pop ecx
mov eax, esi
jmp 0x105ce5f
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
push 0x1006558
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.01057e2d
mov esi, eax
cmp esi, edi
jge 0x105cde0
cmp dword [ebp - 0x10], edi
je 0x105cd9a
push dword [ebp - 0x10]
call fcn.0100d695
pop ecx
jmp 0x105cd9a
mov dword [ebp - 0x14], edi
call fcn.01058a72
lea ecx, [ebp - 0x14]
push ecx
call dword [eax + 0x18]
mov esi, eax
cmp esi, edi
jl 0x105cdd0
cmp dword [ebp - 0x14], 1
mov eax, str.mpas_fe.exe
je 0x105ce05
mov eax, str.mpam_fe.exe
push dword [ebp - 0x10]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x105ce41
mov eax, dword [0x107d1a4]
mov esi, 0x8050a004
cmp eax, 0x107d1a4
je 0x105cdd0
test byte [eax + 0x1c], 1
je 0x105cdd0
push esi
push 0x10064bc
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
jmp 0x105cdd0
cmp dword [ebp - 0x10], edi
je 0x105ce4f
push dword [ebp - 0x10]
call fcn.0100d695
pop ecx
cmp dword [ebp + 8], edi
je 0x105ce5d
push dword [ebp + 8]
call fcn.0100d695
pop ecx
xor eax, eax
call fcn.0100dc90
ret 4

Function at 0x106d67b
Capabilities:
Create thread

Disassembly:
push 0x18
mov eax, 0x1072ff8
call fcn.0100dba4
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x106d5ea
mov dword [esi], 0x1007960
mov dword [esi + 0x1c], 0x1002eb8
mov dword [ebp - 0x10], 1
push ebx
mov ecx, esi
call fcn.010245d2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x1007954
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x1c]
mov dword [eax + esi - 4], ecx
lea edi, [esi + 0xc]
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [ebp - 4], 1
mov dword [edi + 4], ebx
push ebx
push 1
push 1
mov dword [esi + 0x14], ebx
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov ecx, edi
call fcn.0106d595
mov eax, dword [edi]
test eax, eax
jne 0x106d691
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x106d66a
test byte [eax + 0x1c], 1
je 0x106d66a
push esi
push 0x1007940
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
cmp esi, ebx
jle 0x106d67a
and esi, 0xffff
or esi, 0x80070000
push esi
lea ecx, [ebp - 0x24]
call fcn.01058334
push 0x1077684
lea eax, [ebp - 0x24]
push eax
call fcn.0100db78
mov eax, esi
call fcn.0100dc90
ret 4
Function at 0x4023a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4213d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40247b
jmp 0x4023f0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402400
mov edi, dword [ebx + 0x10]
sub eax, edx
mov ecx, edi
sar eax, 1
cmp ecx, edi
jae 0x402418
mov esi, edi
cmp edi, eax
jb 0x402420
mov esi, eax
cmp dword [ebx + 0x14], 8
jb 0x40242a
mov edx, dword [ebx]
jmp 0x40242c
mov edx, ebx
lea ecx, [ebp - 0x20c]
test esi, esi
je 0x40244a
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x402495
add edx, 2
add ecx, 2
dec esi
jne 0x402436
mov ebx, dword [ebp + 8]
cmp edi, eax
jb 0x402459
xor ecx, ecx
cmp edi, eax
setne cl
test ecx, ecx
je 0x4024a2
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4023f0
mov esi, dword [ebp - 0x234]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004097da
mov esp, ebp
pop ebp
ret
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
je 0x402447
mov ebx, dword [ebp + 8]
jmp 0x402455
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004097da
mov esp, ebp
pop ebp
ret

Function at 0x4024c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
mov esi, eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jb 0x4024e9
mov esi, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402511
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0xc]
push ecx
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402530
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
mov esi, eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
xor ecx, ecx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], cx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jb 0x402566
mov esi, dword [esi]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40258e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0xc]
push eax
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4025c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push 1
mov ecx, eax
push ecx
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [ebp - 8]
push 0
push 0
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x402601
lea eax, [ebp + 8]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x402624
mov edx, dword [ebp + 8]
push edx
call fcn.00409f88
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4213d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x50]
push 1
mov ecx, eax
xor ebx, ebx
push ecx
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [ebp - 0x38]
push ebx
push ebx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.AVUninstallEvent
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
cmp edi, ebx
je 0x403c2f
push esi
xor ecx, ecx
push 0x15
mov eax, str.AVTray.exe__uninstall
lea esi, [ebp - 0x20]
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], ebx
mov word [ebp - 0x20], cx
call fcn.00405150
lea edx, [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
cmp dword [ebp - 0xc], 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
jae 0x403bd1
mov eax, esi
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x94]
push edx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x403bf9
xor al, al
jmp 0x403c07
mov eax, dword [ebp - 0x30]
push eax
call esi
mov ecx, dword [ebp - 0x2c]
push ecx
call esi
mov al, 1
test al, al
sete bl
cmp dword [ebp - 0xc], 8
jb 0x403c1e
mov edx, dword [ebp - 0x20]
push edx
call fcn.00409f88
add esp, 4
test bl, bl
jne 0x403c2b
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004097da
mov esp, ebp
pop ebp
ret
Function at 0x406170
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419e4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4213d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004092d4
push 4
mov dword [ebp - 4], 0
call fcn.0040a088
mov edi, eax
add esp, 4
test edi, edi
je 0x4061ec
call fcn.004090cf
mov dword [edi], eax
call fcn.00408e8e
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00409295
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4061e2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004092bd
jmp 0x4061ee
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4097da
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4213d4]
jne 0x4097e4
repz ret
jmp fcn.0040d315