joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e6cca
Capabilities:
Create process on windows

Disassembly:
push 0x7d0
mov eax, 0x1014b08d
call fcn.100fb0fb
mov eax, ecx
mov dword [ebp - 0x780], eax
cmp dword [eax + 4], 0xffffffff
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x784], esi
je 0x100e6d02
push 0
call fcn.1005d1ee
test al, al
je 0x100e6e95
lea ecx, [ebp - 0x2c]
call fcn.100049bb
and dword [ebp - 4], 0
cmp dword [esi + 0x10], 0
je 0x100e6d73
cmp dword [ebx + 0x10], 0
je 0x100e6d82
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x100e6d24
mov eax, dword [ebx]
push 0x20
pop ecx
cmp cx, word [eax]
je 0x100e6d73
lea ecx, [ebp - 0x44]
call fcn.100049bb
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.10014b27
push ebx
lea eax, [ebp - 0x44]
mov edx, str._s__s
push eax
lea ecx, [ebp - 0x5c]
call fcn.100e66fb
push eax
lea ecx, [ebp - 0x2c]
call fcn.1005d1ee
lea ecx, [ebp - 0x5c]
call fcn.1005d1ee
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.1005d1ee
jmp 0x100e6d82
cmp dword [ebx + 0x10], 0
je 0x100e6d82
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1005d1ee
push 0x44
pop edi
push edi
lea eax, [ebp - 0x7dc]
push 0
push eax
call fcn.100fd6a1
mov dword [ebp - 0x7dc], edi
xor eax, eax
lea edi, [ebp - 0x794]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x780]
cmp dword [edi + 0x1c], 0
jne 0x100e6dbe
and dword [ebp - 0x780], 0
jmp 0x100e6dd5
lea eax, [edi + 0xc]
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x780], eax
jb 0x100e6dd5
mov eax, dword [eax]
mov dword [ebp - 0x780], eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_GetPriorityClass]
mov edx, eax
or edx, 0x8000000
cmp dword [ebp - 0x1c], 0
jne 0x100e6df4
xor ecx, ecx
jmp 0x100e6dff
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [esi + 0x10], 0
jne 0x100e6e09
xor eax, eax
jmp 0x100e6e13
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100e6e13
mov eax, dword [esi]
lea esi, [ebp - 0x794]
push esi
lea esi, [ebp - 0x7dc]
push esi
push dword [ebp - 0x780]
push 0
push edx
xor edx, edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x100e6e67
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
push ebx
push dword [ebp - 0x784]
push ecx
call esi
push eax
push ecx
lea ecx, [ebp - 0x77c]
call fcn.1005d1ee
push 0x101c8f84
lea eax, [ebp - 0x77c]
jmp 0x100e6ead
mov eax, dword [ebp - 0x794]
push dword [ebp - 0x790]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x103
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.1005d1ee
xor eax, eax
call fcn.100fb0ad
ret 0x14
push ecx
push ecx
lea ecx, [ebp - 0x3ec]
call fcn.100e70d5
push 0x101c8f84
lea eax, [ebp - 0x3ec]
push eax
call fcn.1005d1ee
int3
Function at 0x100e7c9f
Capabilities:
Start service

Disassembly:
push 8
mov eax, 0x10141cb0
call fcn.100fb0c7
mov ebx, ecx
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.advapi32.dll_StartServiceW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x100e7ceb
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp eax, 0x420
jne 0x100e7cf6
push str.OService::StartService___Service_instance_already_running
push ecx
push 0x64
mov edx, 0x7c1
mov ecx, 0x2541043
call fcn.1005d1ee
add esp, 0xc
cmp byte [ebx + 0x14], 0
je 0x100e7d36
mov esi, dword [ebx + 0xc]
jmp 0x100e7d14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
sub esp, 0xc
call fcn.1005d1ee
xor al, al
jmp 0x100e7d38
add esi, 0xffffffe4
mov ecx, esi
call fcn.100e7c9f
mov edi, dword [ebx + 8]
cmp esi, edi
jne 0x100e7d0a
mov esi, dword [ebx + 0xc]
cmp edi, esi
je 0x100e7d33
mov ecx, edi
call fcn.1005d1ee
add edi, 0x1c
cmp edi, esi
jne 0x100e7d22
mov edi, dword [ebx + 8]
mov dword [ebx + 0xc], edi
mov al, 1
call fcn.100fb098
ret

Function at 0x100ed34c
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x101c5a10
call fcn.100fb519
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x100ed3c2
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x100ed3c2
mov esi, dword [edx + ecx + 0xd8]
lea eax, [ecx + esi]
cmp edi, eax
jb 0x100ed3c2
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x100ed3c2
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x100ed3cb
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100ed5b9
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x101d73d4]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x101d73e0]
test edx, edx
jne 0x100ed601
test eax, eax
je 0x100ed614
mov edx, eax
mov dword [0x101d73d4], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x100ed614
cmp ecx, ebx
jb 0x100ed614
cmp ecx, edi
jbe 0x100ed6f8
mov edx, eax
test eax, eax
jmp 0x100ed636
test edx, edx
je 0x100ed631
mov eax, dword [edx + 8]
test eax, eax
je 0x100ed631
cmp eax, ebx
jb 0x100ed631
cmp eax, edi
jbe 0x100ed6f8
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x101d73d4], edx
jne 0x100ed61a
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x100ed678
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
cmp esi, 0x40000000
jae 0x100ed6a0
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
mov edx, esi
mov ecx, ebx
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
mov edx, edi
mov ecx, esi
call fcn.1005d1ee
mov edx, eax
test edx, edx
je 0x100ed71d
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x101d73e0]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x101d73d4], edx
mov dword [0x101d73e0], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x100ed6e8
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x100ed71d
cmp esi, edi
ja 0x100ed71d
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.100fd6a1
add esp, 0xc
mov eax, esi
jmp 0x100ed71f
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x100ed5c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x101d73d4]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x101d73e0]
test edx, edx
jne 0x100ed601
test eax, eax
je 0x100ed614
mov edx, eax
mov dword [0x101d73d4], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x100ed614
cmp ecx, ebx
jb 0x100ed614
cmp ecx, edi
jbe 0x100ed6f8
mov edx, eax
test eax, eax
jmp 0x100ed636
test edx, edx
je 0x100ed631
mov eax, dword [edx + 8]
test eax, eax
je 0x100ed631
cmp eax, ebx
jb 0x100ed631
cmp eax, edi
jbe 0x100ed6f8
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x101d73d4], edx
jne 0x100ed61a
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x100ed678
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
cmp esi, 0x40000000
jae 0x100ed6a0
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
mov edx, esi
mov ecx, ebx
call fcn.1005d1ee
mov edx, eax
test edx, edx
jne 0x100ed6be
mov edx, edi
mov ecx, esi
call fcn.1005d1ee
mov edx, eax
test edx, edx
je 0x100ed71d
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x101d73e0]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x101d73d4], edx
mov dword [0x101d73e0], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x100ed6e8
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x100ed71d
cmp esi, edi
ja 0x100ed71d
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.100fd6a1
add esp, 0xc
mov eax, esi
jmp 0x100ed71f
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x100f0c68
Capabilities:
Get hostname

Disassembly:
push 0x60
mov eax, 0x1014c0f7
call fcn.100fb0fb
mov esi, ecx
mov dword [ebp - 0x68], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 4]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], esi
and dword [ebp - 0x68], 0
push eax
mov dword [esi], 0x101a7f24
call fcn.1005d1ee
and dword [ebp - 4], 0
cmp dword [edi + 0x10], 0
je 0x100f0cad
push edi
lea ecx, [ebp - 0x60]
call fcn.1005d1ee
xor ebx, ebx
inc ebx
jmp 0x100f0cde
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.kernel32.dll_GetComputerNameW]
test eax, eax
lea edx, [ebp - 0x30]
mov ecx, 0x1015d1bc
cmove edx, ecx
lea ecx, [ebp - 0x48]
push edx
call fcn.1005d1ee
push 6
lea eax, [ebp - 0x48]
pop ebx
push eax
lea ecx, [esi + 0x1c]
call fcn.1005d1ee
test bl, 2
je 0x100f0cf7
lea ecx, [ebp - 0x48]
and ebx, 0xfffffffd
call fcn.1005d1ee
test bl, 1
je 0x100f0d04
lea ecx, [ebp - 0x60]
call fcn.1005d1ee
mov eax, esi
call fcn.100fb0ad
ret 8
Function at 0x4041bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
call fcn.00402286
lea ecx, [ebp - 8]
call fcn.00402286
xor ebx, ebx
inc ebx
cmp dword [esi + 8], 3
jne 0x4041fe
lea eax, [ebp + 0xc]
push eax
call fcn.0040b486
push eax
lea ecx, [ebp - 4]
call fcn.0040222d
lea ecx, [ebp + 0xc]
call fcn.0040223f
mov eax, str._uninstall__SessionType_URS
jmp 0x404234
cmp dword [esi + 8], ebx
je 0x404215
cmp dword [esi + 8], 2
je 0x404215
mov eax, dword [ebp + 0xc]
xor bl, bl
mov esi, str.Invalid_type_received__d
jmp 0x40426b
lea eax, [ebp + 0xc]
push eax
call fcn.0040b4ef
push eax
lea ecx, [ebp - 4]
call fcn.0040222d
lea ecx, [ebp + 0xc]
call fcn.0040223f
mov eax, str._uninstall__SessionType_ASSIST
push eax
lea ecx, [ebp - 8]
call fcn.0040221b
push ebx
lea ecx, [ebp + 8]
mov esi, str.Uninstall_service_called__d
call fcn.00402642
push eax
lea ecx, [ebp - 8]
call fcn.00402642
push eax
lea ecx, [ebp - 4]
call fcn.00402642
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push esi
call fcn.0041c596
pop ecx
pop ecx
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp - 4]
call fcn.0040223f
lea ecx, [ebp + 8]
call fcn.0040223f
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x404294
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
lea ecx, [esp + 8]
call fcn.00402642
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4042b0
xor esi, esi
jmp 0x4042b3
and esi, 0x10
lea ecx, [esp + 8]
call fcn.0040223f
mov eax, esi
pop esi
ret
Function at 0x4045df
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0xf
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x264], 0x22c
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40471a
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.00405473
lea ecx, [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00405489
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x4046f8
lea ecx, [ebp - 0xc]
call fcn.00402642
push eax
lea ecx, [ebp - 0x34]
call fcn.0040569e
lea ecx, [ebp - 0x34]
call fcn.00405606
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00463964
pop ecx
pop ecx
test eax, eax
jne 0x40468f
lea eax, [ebp - 0x14]
or ebx, 1
push eax
call fcn.0040b504
mov ecx, eax
call fcn.00402642
push eax
lea ecx, [ebp - 0x34]
call fcn.004055d8
mov byte [ebp - 5], 1
test eax, eax
jne 0x404693
mov byte [ebp - 5], 0
test bl, 1
je 0x4046a3
lea ecx, [ebp - 0x14]
and ebx, 0xfffffffe
call fcn.0040223f
cmp byte [ebp - 5], 0
je 0x4046e8
push dword [ebp - 0x25c]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4046e8
lea eax, [ebp - 0x240]
push eax
push str.AppInstaller::killApplicationProcess
push str._s:_Killing_process_with_name:__s
call fcn.0041c6f8
add esp, 0xc
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x34]
call fcn.0040563f
lea ecx, [ebp - 0xc]
call fcn.00405440
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
call fcn.00405432
test al, al
jne 0x40463f
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404618
test esi, esi
je 0x40472d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.0040553f
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40477e
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp + 8]
push ebx
push esi
xor ebx, ebx
inc ebx
push ebx
push eax
call fcn.004057bc
lea ecx, [ebp + 8]
call fcn.0040229a
mov esi, 0x49a000
test al, al
jne 0x4047e1
lea ecx, [ebp - 4]
call fcn.0040229a
test al, al
jne 0x4047e1
lea edx, [ebp - 4]
call fcn.004056e3
test al, al
je 0x4047e1
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00405731
add esp, 0xc
lea ecx, [ebp + 8]
push eax
call fcn.0040222d
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp + 8]
call fcn.0040229a
test al, al
jne 0x404827
lea ecx, [ebp - 4]
call fcn.0040229a
test al, al
jne 0x404827
lea edx, [ebp - 4]
call fcn.004056e3
test al, al
je 0x404827
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00405731
add esp, 0xc
lea ecx, [ebp + 8]
push eax
call fcn.0040222d
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp - 8]
call fcn.00402286
lea ecx, [ebp + 0xc]
call fcn.00405606
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.0040289a
add esp, 0x10
lea ecx, [ebp - 8]
call fcn.00402642
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404896
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x404896
lea ecx, [ebp + 0xc]
call fcn.00405606
push eax
push str.file_deleting_failed__s
call fcn.0041c596
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UNINSTALL::_Deleting_failed_for_error_code__d
call fcn.0041c596
pop ecx
pop ecx
xor bl, bl
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp - 4]
call fcn.0040223f
lea ecx, [ebp + 8]
call fcn.0040223f
lea ecx, [ebp + 0xc]
call fcn.0040563f
pop esi
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x404cf6
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
push esi
push edi
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del___s_
lea ecx, [ebp - 4]
call fcn.00402244
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0045b550
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 4]
call fcn.0040590f
push eax
lea eax, [ebp - 0x678]
push 0x208
push eax
call fcn.0040316b
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
lea eax, [ebp - 0x678]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
lea ecx, [ebp - 4]
call fcn.0040223f
pop edi
pop esi
leave
ret
Function at 0x40b858
Capabilities:
Get hostname

Disassembly:
mov eax, 0x4833d1
call fcn.00482d18
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x18], esi
mov ax, word [0x497a60]
mov word [ebp - 0x220], ax
push 0x206
push esi
lea eax, [ebp - 0x21e]
push eax
call fcn.0045b550
add esp, 0xc
mov dword [ebp - 0x14], 0x208
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x40b911
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov esi, 0x208
push esi
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.0045b550
add esp, 0xc
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x40b911
push 0x497a60
mov ecx, edi
call fcn.0040221b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x40b91f
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.0040221b
or dword [ebp - 4], 0xffffffff
jmp 0x40b93d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b9a1
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x4833db
call fcn.00482d18
sub esp, 0x24c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov edi, esi
mov dword [ebp - 0x24], edi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x14], eax
mov ebx, 0x22c
push ebx
push esi
lea eax, [ebp - 0x258]
push eax
call fcn.0045b550
add esp, 0xc
mov dword [ebp - 0x258], ebx
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40ba48
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00402274
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402244
push eax
call fcn.0040bca8
pop ecx
pop ecx
mov bl, al
lea ecx, [ebp - 0x1c]
call fcn.0040223f
lea ecx, [ebp - 0x20]
call fcn.0040223f
test bl, bl
jne 0x40ba4e
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40b9fe
jmp 0x40ba57
mov edi, dword [ebp - 0x250]
mov dword [ebp - 0x24], edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40ba76
push edi
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x18], esi
or dword [ebp - 4], 0xffffffff
jmp 0x40ba9a
test esi, esi
je 0x40bab5
push dword [ebp + 8]
push str.GetProcessHandleByName
push str._s::Handle_for_process__s_aquired_successfully
call fcn.0041c68c
add esp, 0xc
jmp 0x40bad1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str.GetProcessHandleByName
push str._s::Failed_to_aquire_handle_for_process__s_:_error_d
call fcn.0041c68c
add esp, 0x10
lea ecx, [ebp + 8]
call fcn.0040223f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e1b2
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x270
push ebx
push ebp
push esi
push edi
mov ebx, 0x11c
lea eax, [esp + 0x18]
push ebx
xor ebp, ebp
push ebp
push eax
call fcn.0045b550
add esp, 0xc
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [esp + 0x14]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebp
call fcn.0040e174
push 3
pop ebx
test al, al
je 0x40e20f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x40e26f
cmp dword [esp + 0x1c], 6
jne 0x40e26f
cmp dword [esp + 0x20], 2
jne 0x40e26f
push 1
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0x11c
mov edi, eax
mov esi, edx
lea eax, [esp + 0x164]
push ebp
push eax
call fcn.0045b550
add esp, 0xc
mov dword [esp + 0x160], 0x11c
lea eax, [esp + 0x160]
mov dword [esp + 0x168], ebx
push esi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x40e26f
mov dword [esp + 0x20], ebx
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40e28f
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 0x13c]
push ecx
call eax
mov eax, dword [esp + 0x1c]
mov cx, word [esp + 0x13c]
cmp eax, 0xa
jne 0x40e2bf
xor ebx, ebx
cmp byte [esp + 0x132], 1
setne bl
add ebx, 0xd
jmp 0x40e358
cmp eax, 6
jne 0x40e321
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x40e2de
xor ebx, ebx
cmp byte [esp + 0x132], 1
setne bl
add ebx, 0xb
jmp 0x40e358
cmp eax, 2
jne 0x40e2f5
xor ebx, ebx
cmp byte [esp + 0x132], 1
setne bl
add ebx, 9
jmp 0x40e358
cmp eax, 1
jne 0x40e30b
xor ebx, ebx
cmp byte [esp + 0x132], al
setne bl
add ebx, 7
jmp 0x40e358
test eax, eax
jne 0x40e356
xor ebx, ebx
cmp byte [esp + 0x132], 1
setne bl
add ebx, 5
jmp 0x40e358
cmp eax, 5
jne 0x40e356
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x40e343
cmp byte [esp + 0x132], 1
jne 0x40e358
cmp cx, 9
jne 0x40e358
push 4
jmp 0x40e34a
cmp eax, 1
jne 0x40e34d
push 2
pop ebx
jmp 0x40e358
test eax, eax
jne 0x40e356
xor ebx, ebx
inc ebx
jmp 0x40e358
mov ebx, ebp
pop edi
pop esi
movzx ecx, cx
xor eax, eax
pop ebp
mov dword [0x4c2dfc], ebx
inc eax
mov dword [0x4bdf20], ecx
mov byte [0x4c2fe6], 1
pop ebx
add esp, 0x270
ret
Function at 0x40e5e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbcc
mov ax, word [0x497a60]
push ebx
push esi
push edi
push 0xbb6
mov word [ebp - 0xbc8], ax
xor ebx, ebx
lea eax, [ebp - 0xbc6]
mov dword [ebp - 0xc], 1
push ebx
push eax
mov edi, ecx
mov dword [ebp - 8], 0x3ffe
call fcn.0045b550
mov esi, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 4], ebx
test esi, esi
jne 0x40e631
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [edi + 4]
call fcn.00402642
lea ecx, [ebp - 4]
push ecx
cmp dword [edi + 0x10], ebx
je 0x40e649
push 0xf013f
jmp 0x40e64e
push 0xf003f
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e6e2
push ebx
push str.writeValue:__Key_found_..._:__d
call fcn.0041c596
push str.writeValue:__After_addRegistryKey_method_in_writeValue_method__
call fcn.0041c596
add esp, 0xc
lea eax, [ebp - 8]
lea ecx, [ebp + 8]
push eax
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.00402642
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e6d2
push str.value_is_found
call fcn.0041c596
pop ecx
lea eax, [ebp - 0xbc8]
push eax
push 0x49b884
push dword [ebp + 0x10]
call fcn.0040289a
add esp, 0xc
cmp dword [ebp - 4], ebx
je 0x40e6cd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
inc ebx
jmp 0x40e6ef
cmp dword [ebp - 4], ebx
je 0x40e6ef
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40e6ef
push eax
push str.writeValue:__Key_open_failure___d
call fcn.0041c596
pop ecx
pop ecx
lea ecx, [ebp + 8]
call fcn.0040223f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x10