joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436d60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.0044e270
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x436da9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x436da9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x48abb8
call fcn.0045171b
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.00451396
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x436eab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x436e66
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x436e66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x436e66
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x436e66
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.0044e270
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x436e66
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.0044d859
add esp, 8
test eax, eax
je 0x436eab
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ca30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48ae5c]
jne 0x44ca3a
repz ret
jmp fcn.00452655

Function at 0x460655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48ae5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004542f4
and dword [ebp - 0x14], 0
cmp dword [0x49015c], 0
mov dword [ebp - 0x18], eax
jne 0x460708
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4607b0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4607b0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49015c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x490160], eax
call edi
push eax
call esi
push 0x47ef2c
push ebx
mov dword [0x490164], eax
call edi
push eax
call esi
mov dword [0x49016c], eax
test eax, eax
je 0x460708
push 0x47ef14
push ebx
call edi
push eax
call esi
mov dword [0x490168], eax
mov eax, dword [0x490168]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x460761
cmp dword [0x49016c], ecx
je 0x460761
push eax
call esi
push dword [0x49016c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x460761
test ebx, ebx
je 0x460761
call edi
test eax, eax
je 0x460758
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x460758
test byte [ebp - 8], 1
jne 0x460761
or dword [ebp + 0x10], 0x200000
jmp 0x460794
mov eax, dword [0x490160]
cmp eax, dword [ebp - 0x18]
je 0x460794
push eax
call esi
test eax, eax
je 0x460794
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x460794
mov eax, dword [0x490164]
cmp eax, dword [ebp - 0x18]
je 0x460794
push eax
call esi
test eax, eax
je 0x460794
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49015c]
call esi
test eax, eax
je 0x4607b0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4607b2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ca30
leave
ret
Function at 0x4095c9
Capabilities:
Read file on windows

Disassembly:
push 0x54
mov eax, 0x416a1f
call fcn.00414056
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x50], ecx
jb 0x4095e5
mov eax, dword [ebx]
jmp 0x4095e7
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.msvcr100.dll__stat64i32]
pop ecx
pop ecx
test eax, eax
je 0x409602
xor al, al
call fcn.004140a0
ret 4
cmp dword [ebx + 0x14], 0x10
jb 0x40960c
mov eax, dword [ebx]
jmp 0x40960e
mov eax, ebx
push 0x4198fc
push eax
call dword [sym.imp.msvcr100.dll_fopen]
xor esi, esi
pop ecx
pop ecx
mov dword [ebp - 0x44], eax
cmp eax, esi
je 0x4095f8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
inc eax
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call fcn.00415b32
mov edi, dword [ebp - 0x60]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x48], esi
jbe 0x409674
mov eax, dword [ebp - 0x5c]
sub eax, edi
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
sub eax, esi
push eax
lea eax, [edi + esi]
push 1
push eax
call dword [sym.imp.msvcr100.dll_fread]
add esp, 0x10
test eax, eax
je 0x409696
add esi, eax
cmp esi, dword [ebp - 0x48]
jb 0x409651
push dword [ebp - 0x44]
call dword [sym.imp.msvcr100.dll_fclose]
pop ecx
mov byte [edi + esi], 0
mov eax, edi
mov ecx, dword [ebp - 0x50]
push eax
push ebx
call fcn.0040930e
test eax, eax
jne 0x409684
mov bl, 1
jmp 0x4096d4
push dword [ebp - 0x44]
call dword [sym.imp.msvcr100.dll_ferror]
pop ecx
test eax, eax
je 0x409674
cmp dword [ebx + 0x14], 0x10
jb 0x4096ac
mov ebx, dword [ebx]
call dword [sym.imp.msvcr100.dll__errno]
push dword [eax]
call dword [sym.imp.msvcr100.dll_strerror]
push eax
push ebx
push str.Failed_to_read_file__s:__s_n
call fcn.004115c7
push dword [ebp - 0x44]
call dword [sym.imp.msvcr100.dll_fclose]
add esp, 0x14
xor bl, bl
lea ecx, [ebp - 0x60]
call fcn.00409d10
mov al, bl
jmp 0x4095fa

Function at 0x40a8ce
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x424eb0]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x198]
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call sub.msvcr100.dll_memset
add esp, 0xc
lea edi, [esi + 1]
push edi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
cmp eax, ebx
je 0x40a96e
cmp eax, edi
ja 0x40a96e
push esi
lea eax, [ebp + 0x89]
push ebx
push eax
mov byte [ebp + 0x88], bl
call sub.msvcr100.dll_memset
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push 0x4199fc
lea eax, [ebp + 0x88]
push esi
push eax
call dword [sym.imp.msvcr100.dll__snprintf]
add esp, 0x20
cmp eax, ebx
jle 0x40a96e
mov byte [ebp + eax + 0x88], bl
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x40a970
xor eax, eax
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413fde
add ebp, 0x190
leave
ret
Function at 0x40b6e8
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x416c04
call fcn.00413fed
xor edi, edi
mov dword [ebp - 0x10], edi
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.00415b32
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 4], edi
jb 0x40b720
mov eax, dword [ebx]
jmp 0x40b722
mov eax, ebx
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x20]
push esi
push eax
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
cmp eax, edi
je 0x40b7a0
cmp eax, esi
jae 0x40b7a0
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.00415b32
mov esi, dword [ebp - 0x2c]
sub esi, dword [ebp - 0x30]
mov byte [ebp - 4], 1
push esi
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call dword [sym.imp.kernel32.dll_GetLongPathNameA]
cmp eax, edi
je 0x40b77f
cmp eax, esi
jae 0x40b77f
push dword [ebp - 0x30]
mov ecx, dword [ebp + 8]
call fcn.00404c84
lea ecx, [ebp - 0x30]
call fcn.00409d10
jmp 0x40b7ca
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x40b79b
push eax
push dword [ebp - 0x20]
push str.Unable_to_get_long_path_name_for___s_:_GetLongPathName_failed__error__d__n
call fcn.0041130e
add esp, 0xc
push dword [ebp - 0x20]
jmp 0x40b76d
cmp dword [ebx + 0x14], 0x10
jb 0x40b7aa
mov esi, dword [ebx]
jmp 0x40b7ac
mov esi, ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push 0x41a818
call fcn.0041130e
mov ecx, dword [ebp + 8]
add esp, 0xc
push ebx
call fcn.004080ea
lea ecx, [ebp - 0x20]
call fcn.00409d10
mov eax, dword [ebp + 8]
call fcn.0041408c
ret
Function at 0x40bafa
Capabilities:
Compare security identifiers

Disassembly:
push 0x34
mov eax, 0x416ca2
call fcn.00414056
lea eax, [ebp - 0x24]
push eax
xor ebx, ebx
push ebx
push 8
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40bb4c
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x40bbf7
lea eax, [ebp - 0x24]
push eax
push 8
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40bbf7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x400
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.00415b32
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov byte [ebp - 4], 1
jmp 0x40bb9d
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [ebp - 0x38]
cmp eax, 0x7a
jne 0x40bbe6
push dword [ebp - 0x34]
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00401fa0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.00415b32
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x20]
push ecx
sub eax, esi
push eax
push esi
push 2
push dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
call edi
test eax, eax
je 0x40bb77
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40bbff
lea ecx, [ebp - 0x38]
call fcn.00409d10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b269
xor al, al
call fcn.004140a0
ret
xor edi, edi
mov byte [ebp - 0x19], bl
cmp dword [esi], ebx
jbe 0x40bc28
lea ebx, [esi + 4]
push dword [ebp - 0x3c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40bc24
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x40bc0b
jmp 0x40bc28
mov byte [ebp - 0x19], 1
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
lea ecx, [ebp - 0x38]
call fcn.00409d10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b269
mov al, byte [ebp - 0x19]
jmp 0x40bbf9
Function at 0x40f43b
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424eb0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
imul edi, edi, 0x3e8
mov al, byte [0x4252d0]
test al, al
je 0x40f464
call fcn.00415b32
push edi
push dword [0x4252d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x424e14]
cmp ecx, eax
sbb esi, esi
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x1c]
shr ecx, 0x14
push ecx
shr eax, 0x14
push eax
push str.Memory_status:_total___u_available___u_limit___u_n
push 4
call fcn.00411620
add esp, 0x14
neg esi
je 0x40f4b9
push str.Low_memory_condition___skipping_refresh_operation_n
push 3
call fcn.00411620
pop ecx
pop ecx
jmp 0x40f456
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00413fde
leave
ret

Function at 0x40f5dc
Capabilities:
Get memory capacity

Disassembly:
cmp dword [0x425220], 0
jne 0x40f5f8
cmp dword [0x425218], 0
jne 0x40f5f3
jmp fcn.0040f43b
jmp fcn.0040f371
jmp fcn.0040f4c7

Function at 0x40fdb2
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x1bc
mov eax, 0x417336
call fcn.00414056
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp - 0x1c8], eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040a42d
push 0x41cb30
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00415b32
add esp, 0x18
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00403933
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40fe08
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x1c0]
push ecx
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x1c4], eax
cmp eax, 0xffffffff
je 0x40fed6
cmp byte [ebp + 0xc], bl
je 0x40feaf
test byte [ebp - 0x1c0], 0x10
je 0x40feaf
push 2
mov edi, 0x41cb34
lea esi, [ebp - 0x194]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40feaf
push 3
mov edi, 0x41cb38
lea esi, [ebp - 0x194]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40feaf
push 0x5c
push dword [ebp - 0x1c8]
lea eax, [ebp - 0x80]
push eax
call fcn.0040a42d
lea ecx, [ebp - 0x194]
push ecx
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 3
call fcn.00415b32
push dword [ebp + 0xc]
mov byte [ebp - 4], 4
push eax
call fcn.0040fdb2
add esp, 0x20
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.00403933
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00403933
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp - 0x1c4]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x40fe25
push dword [ebp - 0x1c4]
call dword [sym.imp.kernel32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403933
call fcn.004140a0
ret
Function at 0x412d04
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x424eb0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x412d38
push eax
push str.Unable_to_initialize_socket_library__error__d_n
call fcn.004115c7
pop ecx
pop ecx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00413fde
add esp, 0x194
ret

Function at 0x412f61
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0x28
mov eax, 0x417882
call fcn.00414056
mov esi, ecx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x34], esi
mov dword [esi], vtable.Socket.0
call fcn.00415b32
and dword [ebp - 4], 0
push 6
push 1
push 2
mov byte [esi + 0x14], 0
call dword [sym.imp.ws2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x412fcf
and dword [ebp - 0x20], 0
push 0xf
pop eax
push eax
push str.socket___failed
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x30], 0
call fcn.00404698
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [ebp - 0x14], eax
push 0x421b08
lea eax, [ebp - 0x30]
push eax
call sub.msvcr100.dll__CxxThrowException
mov dword [esi + 8], accept
mov eax, esi
call fcn.004140a0
ret

Function at 0x413a0e
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x41399d
push 0
push 0
call dword [sym.imp.msvcr100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
pop esi
test eax, eax
jne 0x413a54
call dword [sym.imp.msvcr100.dll__errno]
push dword [eax]
call dword [sym.imp.msvcr100.dll_strerror]
push eax
push str.Unable_to_start_thread:__s_n
call fcn.0041130e
add esp, 0xc
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret

Function at 0x413fde
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424eb0]
jne 0x413fe8
repz ret
jmp fcn.00414667
Function at 0x414996
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4149a5
pop dword [ebp - 0x50]
mov eax, 0x50454b21
sub eax, 0x5004017c
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x37e24
push 0
mov eax, 0x9a9d5c49
add eax, 0x65a5f9a3
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4c17
xor edi, edi
add edi, eax
mov edx, 0x43f000
add edx, dword [ebp - 0x50]
mov esi, 0xa0599f67
xor dword [ebp - 0x20], 0x2170baa1
mov ebx, dword [edx]
add ebx, esi
sub dword [ebp - 4], ebx
mov dword [edi], ebx
xor dword [ebp - 0x24], ebx
add edi, 0x54908c50
sub edi, 0x54908c4c
add edx, 0xadcb7d22
add edx, 0x523482e2
loop 0x4149f4
add eax, 0x1232f
xor ebx, ebx
add ebx, eax
add eax, 0x9682c9fd
sub eax, 0x9682c9f8
mov ecx, 0x74d5c6
add ecx, 0xffcb2a3a
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x405f50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494ef1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6a73c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
call fcn.00405b70
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00405b70
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00405b70
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00405b70
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00405b70
mov byte [ebp - 4], 9
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004077b0
lea ecx, [ebp + 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004077b0
lea edx, [ebp + 0x38]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004077b0
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x50]
mov byte [eax + 0x48], cl
lea edx, [ebp + 0x54]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.004077b0
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x6c]
mov byte [eax + 0x49], cl
lea edx, [ebp + 0x70]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.004077b0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x88]
mov dword [eax + 0x7c], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x4a], 0
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.004070e0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x20]
call fcn.004070e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x38]
call fcn.004070e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.004070e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x70]
call fcn.004070e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x84
Function at 0x40b780
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4952fb
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x6a73c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d4], 0
lea ecx, [ebp - 0x2e8]
call fcn.00405dc0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2ec], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2cc], eax
push 0x22c
push 0
lea eax, [ebp - 0x2c0]
push eax
call fcn.0046fbb0
add esp, 0xc
mov dword [ebp - 0x2c0], 0x22c
lea ecx, [ebp - 0x2c0]
push ecx
mov edx, dword [ebp - 0x2cc]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b93e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2d0], eax
lea ecx, [ebp - 0x2c4]
push ecx
mov ecx, dword [ebp - 0x2d0]
call fcn.0040ab80
lea edx, [ebp - 0x2d8]
push edx
mov ecx, dword [ebp - 0x2d0]
call fcn.0040ac10
nop
jmp 0x40b857
lea ecx, [ebp - 0x2c4]
call fcn.00407bd0
nop
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.004079d0
movzx ecx, al
test ecx, ecx
je 0x40b923
lea ecx, [ebp - 0x2c4]
call fcn.00407b70
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2c8]
call fcn.0040d140
mov dword [ebp - 0x2dc], eax
push 0
mov ecx, dword [ebp - 0x2dc]
call fcn.00407a60
push eax
lea edx, [ebp - 0x29c]
push edx
call fcn.0047223b
add esp, 8
test eax, eax
jne 0x40b91e
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x2c8]
push ecx
lea ecx, [ebp - 0x90]
call fcn.00406090
mov byte [ebp - 4], 1
lea edx, [ebp - 0x94]
push edx
lea ecx, [ebp - 0x2e8]
call fcn.0040eb50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.004072b0
nop
mov ecx, dword [ebp - 0x2c8]
call fcn.0040cfd0
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
or ecx, dword [ebp - 0x2e0]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
jmp 0x40b923
jmp 0x40b84b
lea eax, [ebp - 0x2c0]
push eax
mov ecx, dword [ebp - 0x2cc]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b81b
mov edx, dword [ebp - 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2e8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405d60
mov ecx, dword [ebp - 0x2d4]
or ecx, 1
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.00407190
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c80e
mov esp, ebp
pop ebp
ret
Function at 0x40cff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x6a73c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x414], reloc.WS2_32.dll_accept
mov dword [ebp - 0x410], str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov dword [ebp - 0x40c], 0
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0x40c], 0
jne 0x40d07b
push 0x49768c
mov ecx, dword [ebp + 8]
call fcn.00405690
mov eax, dword [ebp - 0x408]
or eax, 1
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 8]
jmp 0x40d126
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x200
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0
push str.ProgId
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x420], eax
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
push 0x4976b0
lea eax, [ebp - 0x404]
push eax
call fcn.00471ce1
add esp, 8
test eax, eax
jne 0x40d105
push str.not_found
mov ecx, dword [ebp + 8]
call fcn.00405690
mov ecx, dword [ebp - 0x408]
or ecx, 1
mov dword [ebp - 0x408], ecx
mov eax, dword [ebp + 8]
jmp 0x40d126
lea edx, [ebp - 0x404]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405690
mov eax, dword [ebp - 0x408]
or eax, 1
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c80e
mov esp, ebp
pop ebp
ret