joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ce0
Capabilities:
Print debug messages
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xc
mov dword [ebp - 0x124], ecx
push 1
lea ecx, [ebp - 0x130]
xor edi, edi
push ecx
mov dword [ebp - 0x120], eax
mov esi, edx
mov dword [ebp - 0x130], 0x60001
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], edi
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x416d5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x10c]
push str.RegisterRawInputDevices_failed_with_error__d_n
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x30
lea ecx, [ebp - 0x160]
push edi
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x7f00
push edi
mov dword [ebp - 0x160], 0x30
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x158], 0x4188d0
mov dword [ebp - 0x14c], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
push 4
mov dword [ebp - 0x144], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [ebp - 0x160]
push edx
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x138], 0x480e44
call dword [sym.imp.USER32.dll_RegisterClassExW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x11c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
push 1
mov ebx, eax
call edi
mov edx, dword [ebp - 0x124]
push 0
push esi
push 0
push 0
push eax
push ebx
push 0
push 0
push Ordinal_2
push edx
push 0x480e44
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov eax, dword [ebp - 0x120]
push eax
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.mfc100u.dll_AfxGetModuleState]
mov eax, dword [eax + 8]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_SetClassLongW]
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret 4
Function at 0x41a800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.mfc100u.dll_CDialog::EndDialog]
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc4]
push edi
test ecx, ecx
je 0x41a826
push 0
call ebx
mov dword [esi + 0xc4], 0
mov edi, dword [esi + 0xc8]
test edi, edi
je 0x41a84c
cmp byte [edi + 0x2864], 0
je 0x41a84c
mov ecx, dword [edi]
push 0
mov byte [edi + 0x2864], 0
call ebx
mov dword [edi], 0
movzx eax, word [ebp + 8]
cmp eax, 0x3e9
jg 0x41a944
je 0x41a89f
test eax, eax
jle 0x41a9a2
cmp eax, 2
jle 0x41a881
cmp eax, 0x3e8
jne 0x41a9a2
mov ecx, esi
call fcn.0041a9c0
jmp 0x41a9a2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x41a875
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov edx, dword [esi + 0xc0]
cmp dword [edx + 0x1c], 1
jne 0x41a8f9
call fcn.00426330
mov dword [esi + 0xc8], eax
mov dword [eax + 8], 2
mov eax, dword [eax]
test eax, eax
je 0x41a8cc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x68]
call eax
mov edi, dword [esi + 0xc8]
mov ecx, dword [edi]
mov dword [edi + 4], esi
test ecx, ecx
je 0x41a8e9
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov ebx, edi
call fcn.00426a60
mov ebx, dword [esi + 0xc8]
call fcn.00426a60
jmp 0x41a9a2
call fcn.00426330
mov dword [esi + 0xc8], eax
mov dword [eax + 8], 3
mov eax, dword [eax]
test eax, eax
je 0x41a91a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x68]
call eax
mov edi, dword [esi + 0xc8]
mov ecx, dword [edi]
mov dword [edi + 4], esi
test ecx, ecx
je 0x41a937
mov edx, dword [ecx]
mov eax, dword [edx + 0x68]
call eax
mov ebx, edi
call fcn.00426a60
mov ebx, dword [esi + 0xc8]
call fcn.00426a60
jmp 0x41a9a2
sub eax, 0x3ea
je 0x41a980
sub eax, 8
jne 0x41a9a2
mov ecx, esi
call fcn.0041a9c0
mov eax, dword [esi + 0xd0]
test eax, eax
jne 0x41a96e
push eax
push eax
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41a9a2
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41a9a2
cmp dword [esi + 0xc4], 0
jne 0x41a9a2
mov ecx, dword [esi + 0xc0]
mov edi, dword [esi + 0x20]
push ecx
push esi
call fcn.00420740
add esp, 8
mov dword [esi + 0xc4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, esi
call dword [sym.imp.mfc100u.dll_CDialogEx::OnCommand]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41aa60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x4a12d8]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
mov ecx, 0xc
mov esi, str.Translucent_Window_Class
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
mov dword [esp + 0x10], eax
call esi
lea ecx, [esp + 0x40]
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0
call esi
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push 0
push ebx
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x44]
sub edx, ecx
push edx
push eax
push ecx
push 0x800000
push 0
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
mov esi, eax
push 0xfffffffffffffff0
push esi
call edi
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80080
push eax
push 0xffffffffffffffec
push esi
call edi
push 2
push 0x7f
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esp + 0x74]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x41ace0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x64
push 1
push 0
mov dword [esi + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x20], eax
test eax, eax
je 0x41ad2f
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
push 0
push 0
push esi
push 0x41ad40
push 0
push 0
mov dword [esi], eax
mov dword [esi + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x38], eax
test eax, eax
jne 0x41ad35
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
ret 4
mov eax, 1
pop ebp
ret 4
Function at 0x41b380
Capabilities:
Create thread
Terminate process

Disassembly:
push edi
mov edi, ecx
add dword [edi + 0x50], 1
adc dword [edi + 0x54], 0
cmp eax, dword [edi + 0x44]
jne 0x41b3a8
cmp dword [edi + 0x14], 0
je 0x41b39b
call fcn.0041aee0
cmp dword [edi + 0x1c], 1
jne 0x41b3dc
call fcn.0041afa0
jmp 0x41b3dc
cmp eax, dword [edi + 0x48]
jne 0x41b3dc
cmp dword [edi + 0x34], 0
jne 0x41b3c7
push 0
push 0
push edi
push 0x41ac90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x30]
push 0
push 0x7530
push eax
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [edi + 0x58]
cmp edx, dword [edi + 0x50]
jne 0x41b3fa
mov eax, dword [edi + 0x5c]
cmp eax, dword [edi + 0x54]
jne 0x41b3fa
cmp dword [edi + 0x60], 0
je 0x41b3fa
mov ecx, edi
pop edi
jmp fcn.0041b0a0
pop edi
ret
Function at 0x41ce90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x4a12d8]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebx + 0xdc], eax
mov ecx, 0xc
mov esi, str.Translucent_Window_Class
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], 0x41ce10
call esi
lea ecx, [esp + 0x40]
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
mov ecx, dword [ebx + 0xdc]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0
call esi
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push 0
push 0
sub edx, eax
push edx
mov edx, dword [esp + 0x4c]
sub edx, ecx
push edx
push ecx
push eax
push 0x800000
push 0
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0xfffffffffffffff0
push eax
mov dword [ebx + 0xd4], eax
call esi
mov ecx, dword [ebx + 0xd4]
push 0xffffffffffffffec
push ecx
mov dword [ebx + 0xd8], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [ebx + 0xd4]
or eax, 0x80080
push eax
push 0xffffffffffffffec
push edx
call esi
mov eax, dword [ebx + 0xd4]
push 2
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, dword [ebx + 0xd4]
push ebx
push 0xffffffffffffffeb
push ecx
call esi
mov edx, dword [ebx + 0xd4]
push 0
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0xd4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0xd4]
push 0
push 0xa
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x74]
pop edi
pop esi
xor ecx, esp
call fcn.0043e590
mov esp, ebp
pop ebp
ret 4
Function at 0x420d70
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x420dc9
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x420dd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x420de2
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x420df7
push 0x49bde4
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], esi
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x420e10
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x420ea8
push 0x38
lea ecx, [ebp - 0x244]
push 0
push ecx
mov dword [ebp - 0x248], 0x3c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x22c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x420e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x421130
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x4a12d8]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x42118a
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4211c9
cmp eax, 2
jne 0x4211a4
push str.Key_not_found._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push str.Error_opening_key._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
lea edi, [esi + eax*2]
je 0x4211eb
mov ecx, 0x5c
mov word [edi], cx
add edi, 2
xor edx, edx
mov word [edi], dx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42129e
lea ecx, [ecx]
xor ecx, ecx
mov word [edi], cx
mov eax, 0x208
mov ecx, esi
lea esp, [esp]
cmp word [ecx], 0
je 0x42123e
add ecx, 2
dec eax
jne 0x421230
jmp 0x421262
test eax, eax
je 0x421262
mov ecx, 0x208
sub ecx, eax
lea edx, [esp + 0x20]
mov eax, 0x208
push edx
sub eax, ecx
lea ecx, [esi + ecx*2]
mov edx, Ordinal_2
call fcn.004207f0
push esi
push ebx
call fcn.00421130
add esp, 8
test eax, eax
je 0x42129e
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x421220
xor ecx, ecx
mov word [edi - 2], cx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x22c]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x421360
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00420d70
test eax, eax
jne 0x421381
call fcn.00420e10
push esi
lea eax, [ebp - 0x418]
push eax
push str.LudiumLab_shellopencommand
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
push 0x30
push str.URL:LudiumLab_Protocol
push 1
push 0
push 0x480e44
push Ordinal_2
call esi
push 0
push 0x47fe82
push 1
push str.URL_Protocol
push 0x480e44
push Ordinal_2
call esi
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push str.__s_____1_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421416
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 4]
push edx
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.LudiumLab_shellopencommand
push Ordinal_2
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x421450
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x10], 4
cmp edi, reloc.XINPUT1_3.dll_Ordinal_2
jne 0x4214a7
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4214a7
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4214a7
cmp dword [ebp - 8], 0
mov esi, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
jne 0x4214ac
mov esi, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push esi
push edi
call ebx
cmp eax, 2
je 0x42153e
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x14]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x42152a
call fcn.00420d70
test eax, eax
jne 0x4214fc
call fcn.00420e10
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push esi
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push eax
push ecx
mov dword [ebp - 0xc], 0x2af9
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x421550
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x620]
push eax
push 0x20019
push 0
push 0x480e44
push Ordinal_2
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4215b4
cmp eax, 2
jne 0x4215a9
call fcn.00421360
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov ecx, dword [ebp - 0x620]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
lea edx, [ebp - 0x620]
push edx
push 0x20019
push 0
push str.LudiumLab_shellopencommand
push Ordinal_2
call esi
test eax, eax
je 0x42161b
cmp eax, 2
jne 0x421610
call fcn.00420d70
test eax, eax
jne 0x4215f5
call fcn.00420e10
call fcn.004212e0
call fcn.00421360
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov edx, dword [ebp - 0x620]
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push 0
push edx
mov dword [ebp - 0x624], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
mov eax, dword [ebp - 0x620]
push eax
call edi
test esi, esi
je 0x42168a
cmp esi, 2
jne 0x42167f
call fcn.00420d70
test eax, eax
jne 0x421664
call fcn.00420e10
call fcn.004212e0
call fcn.00421360
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push str.__s_____1_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x61c]
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4216ec
test dx, dx
je 0x4216e8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4216ec
add eax, 4
add ecx, 4
test dx, dx
jne 0x4216c6
xor eax, eax
jmp 0x4216f1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42170d
call fcn.00420d70
test eax, eax
jne 0x421703
call fcn.00420e10
call fcn.004212e0
call fcn.00421360
lea esi, [ebp - 0x20c]
mov eax, esi
lea edx, [eax + 2]
jmp 0x421720
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421720
sub eax, edx
sar eax, 1
dec eax
js 0x421756
mov ecx, 0x5c
jmp 0x421740
cmp word [ebp + eax*2 - 0x20c], cx
je 0x42174f
dec eax
jns 0x421740
jmp 0x421756
lea esi, [ebp + eax*2 - 0x20a]
push esi
mov edi, reloc.XINPUT1_3.dll_Ordinal_2
call fcn.00421450
push esi
mov edi, reloc.EpicWrapperDll.dll_Ordinal_1
call fcn.00421450
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x4217a0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, dword [0x1445a50]
push esi
push edi
mov edi, dword [sym.imp.mfc100u.dll_new]
test eax, eax
jne 0x4217cc
push 4
call edi
add esp, 4
test eax, eax
je 0x4217c5
mov esi, eax
call fcn.004260a0
jmp 0x4217c7
xor eax, eax
mov dword [0x1445a50], eax
mov eax, dword [eax]
imul eax, eax, 0x1bc
mov ecx, dword [eax + 0x4a1810]
mov eax, dword [eax + 0x4a180c]
push 0
push ecx
push eax
xor ecx, ecx
call fcn.0040e130
mov eax, dword [0x1445a50]
add esp, 0xc
test eax, eax
jne 0x421812
push 4
call edi
add esp, 4
test eax, eax
je 0x42180b
mov esi, eax
call fcn.004260a0
jmp 0x42180d
xor eax, eax
mov dword [0x1445a50], eax
mov ecx, dword [eax]
imul ecx, ecx, 0x1bc
mov edx, dword [ecx + 0x4a1824]
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
ret

Function at 0x421a40
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00421550
call fcn.00421850
mov eax, dword [0x1445a50]
test eax, eax
jne 0x421a87
push 4
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
test eax, eax
je 0x421a80
push esi
mov esi, eax
call fcn.004260a0
pop esi
jmp 0x421a82
xor eax, eax
mov dword [0x1445a50], eax
push eax
lea eax, [ebp - 0x204]
call fcn.00426210
push 5
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x421ad0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.d3dcompiler_43.dll
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x104], eax
call ebx
push str.d3d9.dll
mov dword [edi + 0x110], eax
call esi
mov dword [edi + 0x100], eax
call ebx
cmp dword [edi + 0x100], 0
mov dword [edi + 0x110], eax
je 0x421b1a
cmp dword [edi + 0x104], 0
jne 0x421b73
mov eax, dword [0x1445a50]
test eax, eax
jne 0x421b42
push 4
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
test eax, eax
je 0x421b3b
mov esi, eax
call fcn.004260a0
jmp 0x421b3d
xor eax, eax
mov dword [0x1445a50], eax
mov eax, dword [eax]
imul eax, eax, 0x1bc
mov ecx, dword [eax + 0x4a17f8]
mov eax, dword [eax + 0x4a17f4]
push 0
push ecx
push eax
xor ecx, ecx
call fcn.0040e130
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [edi + 0x100]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Direct3DCreate9
push ecx
call esi
mov edx, dword [edi + 0x100]
push str.Direct3DCreate9Ex
push edx
mov dword [edi + 0x108], eax
call esi
pop esi
mov dword [edi + 0x10c], eax
pop ebx
ret