joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x402d23
cmp byte [esi + 0x3d], 0
je 0x402d23
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x402cd8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x402cea
sub eax, 1
je 0x402cee
sub eax, 2
je 0x402d23
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402d0c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402cd8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0046dda6
mov esp, ebp
pop ebp
ret

Function at 0x4037e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403839
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403839
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403828
cmp esi, edx
jae 0x403839
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403816
cmp esi, edx
jae 0x403839
cmp word [esi], 0
je 0x403839
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x40acb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470e78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x488924
call fcn.0045d100
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.repairAttemptFailedOutlook_KB_11382_ShellExecute
call fcn.0045d100
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push 0
push 0
push str.stop_sppsvc
push str.net.exe
push str.runas
push 0
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
call esi
push 0
push 0
push str.config_sppsvc_startauto
push str.sc.exe
push str.runas
push 0
call esi
push 0
push 0
push str.start_sppsvc
push str.net.exe
push str.runas
push 0
call esi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Necessary_changes_have_been_done.
call fcn.0045d100
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.0045fd10
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471058
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
push 0
push 0
push str.__resetnavpane
push str.outlook.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x488924
call fcn.0045d100
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.OutlookInvalidXmlError_KB_11361_ShellExecute_to_open_outlook_in__resetnavpane
call fcn.0045d100
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
or ecx, 0xffffffff
call fcn.0045f800
add esp, 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Necessary_changes_have_been_done.
call fcn.0045d100
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.0045fd10
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c3f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471458
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x488924
call fcn.0045d100
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.OpenOutlookInSafeMode_KB_11363_ShellExecute_to_open_outlook_in_safe_mode
call fcn.0045d100
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push 0
push 0
push str.__safe
push str.outlook.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Necessary_changes_have_been_done.
call fcn.0045d100
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.0045fd10
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4191c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472f40
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push ecx
mov esi, esp
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x41939e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov ecx, esi
push 0x488924
call fcn.00402f20
test al, al
jne 0x41922e
push 0x488924
mov ecx, esi
call fcn.0045d070
mov dword [ebp - 4], 1
push ecx
mov esi, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x18], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x4193a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov ecx, esi
push str.interactiveServiceDet_KB_11377_ShellExecute
call fcn.00402f20
test al, al
jne 0x419277
push str.interactiveServiceDet_KB_11377_ShellExecute
mov ecx, esi
call fcn.0045d070
mov byte [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push 0
push 0
push str.config_UI0Detect_startdisabled
push str.sc.exe
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov esi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x4193b2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 4
mov ecx, esi
push 0x48780e
call fcn.00402f20
test al, al
jne 0x4192ed
push 0x48780e
mov ecx, esi
call fcn.0045d070
mov dword [ebp - 4], 5
push ecx
mov esi, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x4193bc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 6
mov ecx, esi
push str.System_restart_is_needed_to_fix_the_issue_completely.
call fcn.00402f20
test al, al
jne 0x419336
push str.System_restart_is_needed_to_fix_the_issue_completely.
mov ecx, esi
call fcn.0045d070
mov byte [ebp - 4], 7
push ecx
mov esi, esp
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x4193c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 8
mov ecx, esi
push str.Success
call fcn.00402f20
test al, al
jne 0x419378
push str.Success
mov ecx, esi
call fcn.0045d070
mov byte [ebp - 4], 9
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.0045fd10
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
push 0x80004005
call fcn.00403850
int3
Function at 0x45d910
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test edx, edx
je 0x45d952
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45d923
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push str.ProxyOverride
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0x10
push 0x80004005
call fcn.00403850
int3
Function at 0x45f2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48375d
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x224], esi
push 0x104
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x45f39f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00402f20
test al, al
jne 0x45f372
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45f354
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004030c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
int3

Function at 0x45f3b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4837b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x45f48e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
lea edx, [ebp - 0x14]
lea ecx, [ebp + 8]
call fcn.00462620
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
push ecx
push 0xf003f
push 0
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [ebp - 0x14]
mov edi, eax
test edi, edi
jne 0x45f435
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45f45c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x45f47b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
int3
Function at 0x4617d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483e10
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov bl, cl
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push 0x3c
push 0
lea eax, [ebp - 0x58]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0x494894
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test bl, bl
je 0x46186f
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461898
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x461940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483e6d
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 1
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x461a3d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4619fe
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4619e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004030c0
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x461a20
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
int3
Function at 0x463c80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48454c
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x228], ebx
mov eax, ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x463d05
lea eax, [ebp - 0x230]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x463d23
cmp eax, 2
jne 0x463d0f
push str.Key_not_found._n
call fcn.0046da10
add esp, 4
mov eax, 1
jmp 0x463ef9
push str.Error_opening_key._n
call fcn.0046da10
add esp, 4
xor eax, eax
jmp 0x463ef9
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2]
mov dword [ebp - 0x224], ebx
cmp word [ebx - 2], 0x5c
je 0x463d50
mov eax, 0x5c
mov word [ebx], ax
add ebx, 2
mov dword [ebp - 0x224], ebx
xor eax, eax
mov word [ebx], ax
mov dword [ebp - 0x22c], 0x104
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x463e6b
nop dword [eax + eax]
mov ecx, 0x7ffffffe
mov dword [ebp - 0x244], ecx
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x23c], edi
mov edx, 0x208
mov dword [ebp - 0x240], edx
mov eax, ebx
mov dword [ebp - 0x234], eax
xor esi, esi
mov dword [ebp - 0x238], esi
test edx, edx
je 0x463df8
test ecx, ecx
je 0x463e08
movzx ebx, word [edi]
test bx, bx
je 0x463e08
mov word [eax], bx
add eax, 2
mov dword [ebp - 0x234], eax
add edi, 2
mov dword [ebp - 0x23c], edi
dec edx
mov dword [ebp - 0x240], edx
dec ecx
mov dword [ebp - 0x244], ecx
inc esi
jmp 0x463dbc
sub eax, 2
mov dword [ebp - 0x234], eax
dec esi
mov dword [ebp - 0x238], esi
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x220]
call fcn.00463c80
test eax, eax
je 0x463e65
mov dword [ebp - 0x22c], 0x104
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
mov ebx, dword [ebp - 0x224]
je 0x463d90
jmp 0x463e6b
mov ebx, dword [ebp - 0x224]
sub ebx, 2
mov dword [ebp - 0x224], ebx
xor eax, eax
mov word [ebx], ax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x228]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x463d1c
mov eax, 1
jmp 0x463ef9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
Function at 0x464350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4846c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x4643d4
mov dword [ebp - 4], 2
mov dword [ebp - 4], esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4643c0
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4643fd
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464dd0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484850
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
wait
mov dword [ebp - 0x54], 0x40
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x464e5f
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
call fcn.0046f200
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [0x497f2c]
cvtss2sd xmm0, xmm0
movsd qword [ebp - 0x5c], xmm0
fld qword [ebp - 0x5c]
sub esp, 8
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp qword [ebp - 0x5c]
movsd xmm0, qword [ebp - 0x5c]
cvtpd2ps xmm0, xmm0
cvttss2si eax, xmm0
wait
jmp 0x464eb1
mov eax, 4
wait
jmp 0x464eb1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret

Function at 0x4652a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4849b4
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.00402820
mov byte [ebp - 4], 2
mov dword [ebp - 0x224], 0x101
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004026c0
mov dword [ebp - 0x228], 1
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x21c]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x46535b
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, esi
jmp 0x4653b2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
Function at 0x465420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484a4d
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x248], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
push 0x22c
push 0
lea eax, [ebp - 0x240]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
or esi, 0xffffffff
test eax, eax
je 0x465551
nop dword [eax]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x244]
call fcn.004026c0
mov byte [ebp - 4], 2
lea edx, [ebp + 8]
lea ecx, [ebp - 0x244]
call fcn.0045d240
test al, al
jne 0x465520
cmp edi, 0xffffffff
je 0x4654e7
mov eax, dword [ebp - 0x238]
cmp edi, eax
je 0x465526
mov byte [ebp - 4], 4
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46550c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
lea eax, [ebp - 0x240]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4654b0
jmp 0x465551
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x465551
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x248], 0
je 0x46558e
mov dword [ebp - 4], 5
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x465587
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov al, 1
jmp 0x46562d
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4655b4
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
xor al, al
jmp 0x46562d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret