joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d080
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x434]
push eax
call fcn.004f91d0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x43c], eax
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x444], 0
cmp dword [ebp - 0x440], 0
je 0x40d16d
lea eax, [ebp - 0x414]
push eax
push 0x529fd4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.004076f0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d140
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x448], eax
lea ecx, [ebp + 8]
call fcn.00406090
mov eax, dword [ebp - 0x448]
jmp 0x40d192
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x444]
add eax, 1
mov dword [ebp - 0x444], eax
jmp 0x40d0e5
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x44c], 0
lea ecx, [ebp + 8]
call fcn.00406090
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret

Function at 0x40d2a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004f91d0
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 4
lea ecx, [ebp - 0x21c]
call fcn.00408cf0
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00405530
mov dword [ebp - 4], 0
push 0x529d84
lea ecx, [ebp - 0x21c]
call fcn.0040c9d0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040c170
mov ecx, dword [ebp - 0x220]
or ecx, 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00406090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x40d390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004f91d0
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 4
lea ecx, [ebp - 0x21c]
call fcn.00408cf0
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00405530
mov dword [ebp - 4], 0
push 0x529d80
lea ecx, [ebp - 0x21c]
call fcn.0040c9d0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040c170
mov ecx, dword [ebp - 0x220]
or ecx, 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00406090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret

Function at 0x40d480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x124], 0
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004f91d0
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edx, [ebp - 0x108]
push edx
lea ecx, [ebp - 0x120]
call fcn.00403270
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 8]
call fcn.004031f0
mov ecx, dword [ebp - 0x124]
or ecx, 1
mov dword [ebp - 0x124], ecx
lea ecx, [ebp - 0x120]
call fcn.00403390
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret

Function at 0x40d8f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0
push 4
lea ecx, [ebp - 0x21c]
call fcn.00408cf0
lea ecx, [ebp - 0x21c]
call fcn.0040c260
mov dword [ebp - 4], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004f91d0
add esp, 0xc
push 0
push 2
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40d993
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00406710
push 0x529d60
lea ecx, [ebp - 0x21c]
call fcn.0040c9d0
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040c170
mov ecx, dword [ebp - 0x220]
or ecx, 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00406090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x40de40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521f30
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004032e0
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp + 0xc]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40debf
jmp 0x40df46
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x40dedf
jmp 0x40df46
mov edx, dword [ebp - 0x3c]
push edx
call fcn.004f4ea6
add esp, 4
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x40defc
jmp 0x40df46
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x40df2c
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x3c]
je 0x40df2e
jmp 0x40df46
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404160
xor edx, edx
jne 0x40de90
cmp dword [ebp - 0x38], 0xffffffff
je 0x40df56
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], 0
je 0x40df8a
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
push edx
call fcn.004f4eaf
add esp, 4
cmp dword [ebp - 0x40], 0
jne 0x40df7d
mov dword [ebp - 0x50], 0
jmp 0x40df8a
mov dword [ebp - 0x34], 0x8123
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004031f0
mov edx, dword [ebp - 0x44]
or edx, 1
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00406090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x40eec0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52202b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
lea ecx, [ebp - 0x14]
call fcn.00408cf0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c170
mov dword [ebp - 4], 0
push 0x5c
push 1
lea ecx, [ebp - 0x278]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040e030
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x274]
push edx
call fcn.0040c640
add esp, 8
mov byte [ebp - 0x269], al
lea ecx, [ebp - 0x278]
call fcn.00406090
movzx eax, byte [ebp - 0x269]
test eax, eax
je 0x40ef56
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0040c9f0
lea ecx, [ebp - 0x268]
push ecx
push 0x529bf0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x280]
push eax
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
lea ecx, [ebp - 0x280]
call fcn.00406090
cmp dword [ebp - 0x270], 0xffffffff
jne 0x40efc8
mov byte [ebp - 0x26a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00406090
mov al, byte [ebp - 0x26a]
jmp 0x40f10e
push 4
lea ecx, [ebp - 0x18]
call fcn.00408cf0
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00405530
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x268]
and edx, 0x10
je 0x40f074
push 0x529bf8
lea eax, [ebp - 0x18]
push eax
call fcn.0040c610
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40f072
push 0x529bfc
lea edx, [ebp - 0x18]
push edx
call fcn.0040c610
add esp, 8
movzx eax, al
test eax, eax
je 0x40f072
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x28c]
push eax
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x288], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x288]
push edx
call fcn.0040eec0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28c]
call fcn.00406090
jmp 0x40f0ae
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x294]
push edx
call fcn.0040c700
add esp, 0xc
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x294]
call fcn.00406090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00406090
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40efc8
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
call fcn.004076f0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 0x26b], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00406090
mov al, byte [ebp - 0x26b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x40f130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52206b
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x818], 0
push 4
lea ecx, [ebp - 0x814]
call fcn.00408cf0
lea ecx, [ebp - 0x814]
call fcn.0040c260
mov dword [ebp - 4], 0
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.004f91d0
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x810]
push ecx
call fcn.004f91d0
add esp, 0xc
push 0
push 0x10
lea edx, [ebp - 0x810]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f1e9
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.00406710
push 0x529d64
lea ecx, [ebp - 0x814]
call fcn.0040c9d0
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040c170
mov edx, dword [ebp - 0x818]
or edx, 1
mov dword [ebp - 0x818], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00406090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret

Function at 0x40f240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52206b
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x818], 0
push 4
lea ecx, [ebp - 0x814]
call fcn.00408cf0
lea ecx, [ebp - 0x814]
call fcn.0040c260
mov dword [ebp - 4], 0
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.004f91d0
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x810]
push ecx
call fcn.004f91d0
add esp, 0xc
push 0
push 0x19
lea edx, [ebp - 0x810]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f2f9
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.00406710
push 0x529d74
lea ecx, [ebp - 0x814]
call fcn.0040c9d0
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040c170
mov edx, dword [ebp - 0x818]
or edx, 1
mov dword [ebp - 0x818], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.00406090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x411690
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x4116c7
xor eax, eax
jmp 0x41176c
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
mov dword [ecx + 4], edx
cmp dword [ebp - 0x19c], 0xffffffff
jne 0x4116f5
xor eax, eax
jmp 0x41176c
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 8], eax
push 1
mov edx, dword [ebp - 0x198]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x544a42
push 0x10f
call fcn.004f59a7
add esp, 8
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1a0]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x198]
cmp dword [edx + 0x10], 0
jne 0x411757
xor eax, eax
jmp 0x41176c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x198]
mov word [ecx + 0xc], ax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x414a50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x22c], 0xffffffff
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414c7c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x414add
mov dword [ebp - 0x210], 0x64
mov dword [ebp - 0x228], 0
jmp 0x414af8
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [ebp - 0x210]
jae 0x414c7c
mov dword [ebp - 0x220], 0
push 0x104
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.004f91d0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0x104
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004f91d0
add esp, 0xc
mov ecx, dword [ebp - 0x228]
push ecx
push str._04u
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.004135d0
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x414ba9
jmp 0x414ae9
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push str.NetCfgInstanceId
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x414be8
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414ae9
lea edx, [ebp - 0x20c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404870
push eax
call fcn.00503a42
add esp, 8
test eax, eax
je 0x414c16
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414ae9
mov dword [ebp - 0x214], 4
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push str.Characteristics
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414c6a
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414c7c
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414ae9
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x415110
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x555b00
push 0x4faaf0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff0
mov eax, dword [0x55e5f4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1d], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1d]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x415193
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret

Function at 0x4151c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 0xc]
push eax
call fcn.004fd222
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
push 0x52b238
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41521d
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fd207
add esp, 4
xor eax, eax
jmp 0x4152d9
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x52b234
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xea
jne 0x415287
mov ecx, dword [ebp - 0xc]
add ecx, 0x100
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00502dca
add esp, 8
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x52b288
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
jmp 0x41523d
cmp dword [ebp - 0x18], 0
jne 0x4152c1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_CharLowerA]
mov dword [ebp - 0x20], eax
push 0x52b28c
mov eax, dword [ebp - 0x20]
push eax
call fcn.00415760
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4152bd
mov eax, 1
jmp 0x4152d9
xor eax, eax
jmp 0x4152d9
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fd207
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x4152f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522528
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x244], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41544f
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x248]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x41544f
push 4
lea ecx, [ebp - 0x18]
call fcn.00408cf0
call fcn.00410680
add eax, 0xc0
mov ecx, eax
call fcn.00404870
push eax
lea ecx, [ebp - 0x18]
call fcn.0040c1b0
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x14]
call fcn.00408cf0
call fcn.00410680
add eax, 0xd8
mov ecx, eax
call fcn.00404870
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c1b0
lea ecx, [ebp - 0x14]
call fcn.004076f0
push eax
lea ecx, [ebp - 0x220]
push ecx
call fcn.005028ad
add esp, 8
test eax, eax
je 0x4153fb
lea ecx, [ebp - 0x18]
call fcn.004076f0
push eax
lea edx, [ebp - 0x220]
push edx
call fcn.005028ad
add esp, 8
test eax, eax
jne 0x415433
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x24c], ecx
lea ecx, [ebp - 0x14]
call fcn.00406090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00406090
mov eax, dword [ebp - 0x24c]
jmp 0x415462
lea ecx, [ebp - 0x14]
call fcn.00406090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00406090
jmp 0x415359
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret
Function at 0x416170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x416183
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4161c6
mov eax, dword [ebp - 0x10]
jmp 0x41622c
cmp dword [ebp - 8], 1
je 0x4161d9
cmp dword [ebp - 8], 2
je 0x4161d9
mov eax, 0xd
jmp 0x41622c
cmp dword [ebp + 0xc], 0
je 0x416220
cmp dword [ebp - 0xc], 0
je 0x41620f
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x416206
mov edx, dword [ebp - 0xc]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x41620d
mov eax, 0xd
jmp 0x41622c
jmp 0x416220
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 0xc]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret 0xc