joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ab0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac80a
mov eax, dword fs:[0]
push eax
sub esp, 0x868
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 3
xor ebx, ebx
lea eax, [ebp - 0x834]
push ebx
push eax
mov dword [ebp - 0x83c], ebx
call fcn.0040b9c0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x818]
cmp dword [ebp - 0x820], 8
lea eax, [ebp - 0x834]
push ebx
cmovae eax, dword [ebp - 0x834]
push ebx
push ecx
push eax
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x409cf6
xor eax, eax
mov dword [ebp - 0x81c], 1
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.0047aa40
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x409b63
mov eax, dword [esi]
jmp 0x409b65
mov eax, esi
push 0x400
lea ecx, [ebp - 0x810]
push ecx
lea ecx, [ebp - 0x81c]
push ecx
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x409c03
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x870]
call fcn.00405330
push 5
push 0x4cea44
mov byte [ebp - 4], 1
mov ebx, 1
push dword [eax + 0x10]
mov dword [ebp - 0x83c], ebx
push ecx
mov ecx, eax
call fcn.00404530
test eax, eax
je 0x409c03
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x858]
call fcn.00405330
push 4
push str.NTFS
mov dword [ebp - 4], 2
mov ebx, 3
push dword [eax + 0x10]
mov dword [ebp - 0x83c], ebx
push ecx
mov ecx, eax
call fcn.00404530
mov byte [ebp - 0x835], 1
test eax, eax
jne 0x409c0a
mov byte [ebp - 0x835], 0
test bl, 2
je 0x409c46
and ebx, 0xfffffffd
cmp dword [ebp - 0x844], 8
jb 0x409c29
push dword [ebp - 0x858]
call fcn.004781a0
add esp, 4
xor eax, eax
mov dword [ebp - 0x844], 7
mov dword [ebp - 0x848], 0
mov word [ebp - 0x858], ax
mov dword [ebp - 4], 0
test bl, 1
je 0x409c69
cmp dword [ebp - 0x85c], 8
jb 0x409c69
push dword [ebp - 0x870]
call fcn.004781a0
add esp, 4
cmp byte [ebp - 0x835], 0
jne 0x409cf6
mov edx, dword [ebp - 0x814]
mov ecx, dword [ebp - 0x818]
call fcn.0047c01e
mulsd xmm0, qword [0x4cfd18]
lea eax, [ebp - 0x870]
push 2
push 0
push eax
mov ecx, esi
movsd qword [ebp - 0x840], xmm0
call fcn.0040b9c0
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x409cb5
mov eax, dword [eax]
mov ecx, eax
call fcn.00409990
cmp dword [ebp - 0x85c], 8
mov bl, al
jb 0x409cd5
push dword [ebp - 0x870]
call fcn.004781a0
add esp, 4
movsd xmm0, qword [ebp - 0x840]
test bl, bl
je 0x409d01
cvttsd2si eax, xmm0
cmp eax, 0x6000
jle 0x409d01
mulsd xmm0, qword [0x4cfd20]
jmp 0x409cf9
xorps xmm0, xmm0
movsd qword [ebp - 0x840], xmm0
cmp dword [ebp - 0x820], 8
jb 0x409d20
push dword [ebp - 0x834]
call fcn.004781a0
movsd xmm0, qword [ebp - 0x840]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret
Function at 0x40aa90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x25c], esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
mov dword [ebp - 0x260], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40ac6c
push esi
call fcn.0041afe0
add esp, 4
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40ac6c
jmp 0x40ab20
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x234], ax
je 0x40ab55
lea eax, [ebp - 0x234]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ab46
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405200
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0041afe0
mov ebx, dword [esi + 0x10]
lea edx, [ebp - 0x28]
add esp, 4
cmp dword [ebp - 0x14], 8
cmovae edx, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x40ab90
mov ecx, dword [esi]
jmp 0x40ab92
mov ecx, esi
mov edi, dword [ebp - 0x18]
cmp ebx, edi
mov esi, edi
cmovb esi, ebx
test esi, esi
jne 0x40abb0
xor eax, eax
test eax, eax
jne 0x40abd8
cmp ebx, edi
jae 0x40abcf
or eax, 0xffffffff
jmp 0x40abd6
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x40abc1
add ecx, 2
add edx, 2
dec esi
jmp 0x40ab9e
movzx eax, word [ecx]
cmp ax, word [edx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x40aba2
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
sete al
test al, al
je 0x40ac33
push dword [ebp - 0x250]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40ac23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x25c]
mov ecx, esi
push eax
call fcn.00405390
push eax
push str.open_progress_error__s____d
push 0x4dc
push str.killProgressByHandle
call fcn.00411450
add esp, 0x14
jmp 0x40ac39
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x40ac51
push dword [ebp - 0x28]
call fcn.004781a0
add esp, 4
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40ab20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret
Function at 0x40b590
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acae8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x4ce89c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00405200
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x20]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00406830
push 9
push str.bdrox.exe
lea ecx, [ebp - 0x28]
call fcn.00406750
push 9
push str.__autorun
lea ecx, [ebp - 0x28]
call fcn.00406750
lea eax, [ebp - 0x2c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40b65d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4ce860
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
jb 0x40b66e
push dword [ebp - 0x28]
call fcn.004781a0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret

Function at 0x40d970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4acd48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4de310]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4ca850
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00405200
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 8]
push eax
push dword [esi + 0x10]
call fcn.0040b470
cmp dword [esp + 0x20], 8
jb 0x40d9ed
push dword [esp + 0xc]
call fcn.004781a0
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40da00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4acd48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4de310]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4ca850
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00405200
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 4]
push eax
push 0x50
call fcn.0040b470
cmp dword [esp + 0x20], 8
jb 0x40da7c
push dword [esp + 0xc]
call fcn.004781a0
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40da90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4acd48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4de310]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4ca850
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00405200
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 4]
push eax
push 0x5a
call fcn.0040b470
cmp dword [esp + 0x20], 8
jb 0x40db0c
push dword [esp + 0xc]
call fcn.004781a0
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40db20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4acd48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4de310]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x20], 7
push eax
push 0x4ca850
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.00405200
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 4]
push eax
push 0x64
call fcn.0040b470
cmp dword [esp + 0x20], 8
jb 0x40db9c
push dword [esp + 0xc]
call fcn.004781a0
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40e599
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40e5d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40e5d0
lea ebx, [ebx]
cmp esi, edx
jae 0x40e5d4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40e5c0
cmp esi, edx
jb 0x40e5db
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.00405390
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41546b
mov al, 1
jmp 0x41549a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405390
push eax
push str.removeFile_file_from____s___error___d.
push 0x174
push str.utility::ufile::removeFile
call fcn.00411450
add esp, 0x14
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4154a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0047aa40
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00405330
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00405190
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
lea ecx, [ebp - 0x228]
call fcn.00405bb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret

Function at 0x41a3b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0047aa40
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41a415
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x41a422
mov al, 1
jmp 0x41a424
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret

Function at 0x41a440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0047aa40
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], 0x4cb034
mov ecx, dword [ebp + 8]
call fcn.00405390
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41a4b1
push 5
push 0
mov ecx, dword [ebp + 8]
call fcn.00405390
push eax
push str.iexplore.exe
push 0x4cb128
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x41d2e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x41d2f4
xor al, al
jmp 0x41d338
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x41d3e0
push 0
push 0
call fcn.0047d352
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x41d340
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x41d395
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x41d37e
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x41d3b6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [eax]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x41d3d6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x41d640
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adb18
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00405390
push eax
mov ecx, dword [ebp + 8]
call fcn.00405390
push eax
push str.createProcess_filename____s___param____s___show___d
push 0xed
push 0x4cc8b8
call fcn.00411450
add esp, 0x18
mov ecx, dword [ebp + 8]
push ecx
push 0x4cc8d8
lea edx, [ebp - 0x58]
push edx
call fcn.0041e0e0
add esp, 0xc
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0
push 0x4cc8d4
mov ecx, dword [ebp - 0x64]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040d140
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00405bb0
mov ecx, dword [ebp + 0xc]
call fcn.004035c0
movzx eax, al
test eax, eax
jne 0x41d728
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4cc8dc
lea edx, [ebp - 0x40]
push edx
call fcn.0041e0e0
add esp, 0xc
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004072e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00405bb0
mov dword [ebp - 0xc8], 0
push 0x40
push 0
lea edx, [ebp - 0xc4]
push edx
call fcn.0047aa40
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x9c], 1
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41d788
mov dword [ebp - 0x5c], 5
jmp 0x41d78f
mov dword [ebp - 0x5c], 0
mov cx, word [ebp - 0x5c]
mov word [ebp - 0x98], cx
xor edx, edx
mov word [ebp - 0x96], dx
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0xc8]
push edx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00405390
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41d824
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4cc8e0
push 0x100
push str.utility::process::create
call fcn.00411450
add esp, 0x10
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405bb0
mov eax, dword [ebp - 0x60]
jmp 0x41d85a
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x41d83c
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x74]
mov dword [ecx], edx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405bb0
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret
Function at 0x41d880
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adb48
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41d8f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
push eax
push str.create_tool_help_snapshot_failed__err___d
push 0x1d9
push 0x4ccfd8
call fcn.00411450
add esp, 0x10
jmp 0x41d9b5
mov dword [ebp - 0x258], 0x22c
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41d94e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
push eax
push str.process32First_failed__err___d
push 0x1e6
push str.utility::process::enumProcess
call fcn.00411450
add esp, 0x10
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41d9b5
lea ecx, [ebp - 0x2c]
call fcn.0041d9d0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00403570
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041dc40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041d9f0
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41d94e
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret
Function at 0x41e6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adc2b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x4de310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x430], ecx
mov eax, dword [ebp - 0x430]
cmp dword [eax], 0
jne 0x41e742
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x428]
push edx
call fcn.0041af50
add esp, 8
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x434], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x434]
call fcn.00405390
push eax
push 0x4cd410
push 0x3e
push 0x4cd450
call fcn.00411450
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.00405bb0
or eax, 0xffffffff
jmp 0x41e7c4
mov ecx, dword [ebp + 8]
call fcn.004195b0
mov dword [ebp - 0x43c], 0x400
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.0041a390
push eax
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x41e7a3
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040b770
jmp 0x41e7be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4cd46c
push 0x51
push str.utility::RegKey::RegRead
call fcn.00411450
add esp, 0x10
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478043
mov esp, ebp
pop ebp
ret 8

Function at 0x426820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x4e7e60], ecx
inc eax
cmp eax, 0x100
jb 0x426823
cmp eax, 0x800
jae 0x4268f3
nop
mov edx, dword [eax*4 + 0x4e7a60]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4e7e60]
mov dword [eax*4 + 0x4e7e60], edx
inc eax
cmp eax, 0x800
jb 0x4268d0
mov dword [0x4e9e60], 0x428460
mov dword [0x4e7e4c], 0x428460
mov dword [0x4e9e64], 0x428500
call fcn.00428710
mov ecx, dword [0x4e7e4c]
test eax, eax
mov edx, 0x428500
cmove ecx, edx
mov dword [0x4e7e4c], ecx
pop ecx
ret