joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1811d905
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov edi, dword [esi + 0x9c]
cmp edi, 0xffffffff
je 0x1811d988
cmp edi, 0x40
jbe 0x1811d93a
lea edx, [esi + 0x40]
mov ecx, esi
call fcn.1811deb3
push 0x14
pop edi
mov dword [esi + 0x9c], edi
push ebx
xor ebx, ebx
cmp edi, 0x40
jae 0x1811d955
push 0x40
pop eax
sub eax, edi
push eax
lea eax, [edi + esi]
push ebx
push eax
call fcn.181237a0
add esp, 0xc
xor dword [esi + ebx*4], 0x36363636
inc ebx
cmp ebx, 0x10
jb 0x1811d955
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.1811de17
push edi
push 0x40
pop edx
mov ecx, esi
call fcn.1811de42
or dword [esi + 0x9c], 0xffffffff
mov eax, dword [ebp - 4]
pop ecx
mov ecx, dword [ebp - 8]
pop ebx
jmp 0x1811d98b
lea edi, [esi + 0x40]
test eax, eax
je 0x1811d998
push edi
mov edx, eax
call fcn.1811de42
pop ecx
pop edi
pop esi
leave
ret

Function at 0x1811d99c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 0x1c], ecx
cmp dword [esi + 0x9c], 0xffffffff
je 0x1811d9ca
push esi
xor edx, edx
xor ecx, ecx
call fcn.1811d905
pop ecx
push edi
lea edi, [esi + 0x40]
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.1811deb3
xor eax, eax
xor dword [esi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x1811d9da
mov ecx, edi
call fcn.1811de17
push edi
push 0x40
pop edx
mov ecx, esi
call fcn.1811de42
push edi
push 0x14
pop edx
lea ecx, [ebp - 0x18]
call fcn.1811de42
pop ecx
pop ecx
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.1811deb3
pop edi
test ebx, ebx
je 0x1811da26
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call fcn.18124020
add esp, 0xc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret
Function at 0x1811da34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xa0
mov dword [ebp - 0x21c], eax
mov esi, edx
lea eax, [ebp - 0xcc]
mov edi, ecx
push 0
push eax
call fcn.181237a0
lea eax, [ebp - 0xcc]
mov edx, esi
push eax
mov ecx, edi
call fcn.1811d89a
push 0xa0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.18124020
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call fcn.1811d905
mov eax, dword [ebp + 0x18]
add esp, 0x20
dec eax
xor edx, edx
push 0x14
pop esi
div esi
add eax, 1
mov dword [ebp - 0x220], eax
je 0x1811dbd3
xor edi, edi
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x210], edi
inc ebx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ebx
push esi
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.181237a0
push 0xa0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.18124020
mov eax, ebx
mov byte [ebp - 0x15], bl
shr eax, 0x18
add esp, 0x18
mov byte [ebp - 0x18], al
mov edi, 0x3e8
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x17], al
mov eax, ebx
shr eax, 8
push 4
mov byte [ebp - 0x16], al
pop esi
lea eax, [ebp - 0x16c]
mov edx, esi
push eax
lea ecx, [ebp - 0x18]
call fcn.1811d905
lea eax, [ebp - 0x16c]
push eax
push 0x14
pop edx
lea ecx, [ebp - 0x18]
call fcn.1811d99c
pop ecx
pop ecx
xor esi, esi
mov al, byte [ebp + esi - 0x18]
xor byte [ebp + esi - 0x2c], al
inc esi
cmp esi, 0x14
jb 0x1811db4e
push 0xa0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.18124020
add esp, 0xc
sub edi, 1
jne 0x1811db27
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov esi, dword [ebp - 0x218]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp - 0x21c]
cmp ecx, edi
jae 0x1811dba4
mov al, byte [esi + ecx]
inc edx
mov byte [ecx + ebx], al
inc ecx
cmp edx, 0x14
jb 0x1811db93
mov ebx, dword [ebp - 0x214]
sub esi, 0x14
add dword [ebp - 0x210], 0x14
inc ebx
push 0x14
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], ebx
lea eax, [ebx - 1]
pop esi
cmp eax, dword [ebp - 0x220]
jb 0x1811dadd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret
Function at 0x1811dbe2
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
mov dword [ebp - 0x154], edi
lea esi, [edi + 0x1c]
mov ecx, dword [esi]
mov eax, ecx
ror eax, 8
lea esi, [esi + 4]
rol ecx, 8
and eax, 0xff00ff00
and ecx, 0xff00ff
or eax, ecx
mov dword [ebp + edx*4 - 0x144], eax
inc edx
cmp edx, 0x10
jb 0x1811dc05
push 0x40
lea ecx, [ebp - 0x13c]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x1811dc35
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
mov edx, dword [edi + 0x18]
mov esi, dword [edi + 8]
mov ebx, dword [edi + 0x10]
xor edi, edi
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x158], 0x14
jmp 0x1811dc82
mov ecx, dword [ebp - 0x150]
not ecx
mov edx, esi
and ecx, eax
rol esi, 5
mov eax, ebx
and eax, dword [ebp - 0x150]
xor ecx, eax
mov eax, dword [ebp - 0x14c]
add esi, ecx
add eax, 0x5a827999
add esi, dword [ebp + edi*4 - 0x144]
add esi, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, ebx
mov ebx, dword [ebp - 0x150]
ror ebx, 2
inc edi
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x150], edx
cmp edi, 0x14
jb 0x1811dc7c
mov dword [ebp - 0x15c], 0x28
xor eax, ebx
mov ecx, esi
xor eax, edx
rol esi, 5
add esi, eax
mov eax, dword [ebp - 0x158]
add esi, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x14c]
add eax, 0x6ed9eba1
add esi, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, ebx
mov ebx, edx
mov dword [ebp - 0x148], eax
mov edx, ecx
ror ebx, 2
mov ecx, dword [ebp - 0x158]
inc ecx
mov dword [ebp - 0x158], ecx
cmp ecx, 0x28
jb 0x1811dcde
mov dword [ebp - 0x150], edx
mov edi, edx
mov ecx, ebx
mov edx, esi
xor ecx, edi
rol esi, 5
add esi, dword [ebp - 0x14c]
and ecx, eax
mov eax, ebx
and eax, edi
xor ecx, eax
mov eax, dword [ebp - 0x15c]
add ecx, 0x8f1bbcdc
push 0x3c
add ecx, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x148]
add esi, ecx
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x14c], eax
mov eax, ebx
mov ebx, edi
mov dword [ebp - 0x148], eax
ror ebx, 2
mov edi, edx
inc ecx
pop edx
mov dword [ebp - 0x15c], ecx
cmp ecx, edx
jb 0x1811dd38
mov dword [ebp - 0x150], edi
mov edi, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x150]
xor eax, ebx
mov dword [ebp - 0x154], esi
xor eax, ecx
rol esi, 5
add esi, dword [ebp - 0x14c]
add eax, 0xca62c1d6
add eax, dword [ebp + edx*4 - 0x144]
add esi, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, ebx
mov ebx, ecx
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x154]
ror ebx, 2
inc edx
cmp edx, 0x50
jb 0x1811dda5
add dword [edi + 8], esi
mov eax, ecx
add dword [edi + 0xc], eax
mov eax, dword [ebp - 0x148]
add dword [edi + 0x14], eax
add dword [edi + 0x10], ebx
mov eax, dword [ebp - 0x14c]
add dword [edi + 0x18], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret
Function at 0x1811de17
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 4], 0
and dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
ret

Function at 0x1811e9c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push eax
xor edi, edi
mov ebx, ecx
push edi
push edi
push ebx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x1811ea23
push edi
push 0x989680
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.181435b0
sub eax, 0xb6109100
push ebx
sbb edx, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x1811ea14
inc edi
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1811ea45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1811e989
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1811ea40
mov dword [ecx + 4], eax
mov dword [ecx], 5
or eax, 0xffffffff
jmp 0x1811eaa7
push esi
call sym.goopdate_unsigned.dll_zip_stat_init
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov edx, dword [esi + 4]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
pop ecx
mov ecx, dword [esi]
mov eax, ecx
or eax, 0x10
mov dword [esi + 4], edx
mov dword [esi], eax
mov dword [ebp - 8], edx
mov edx, dword [ebx + 0x70]
mov eax, edx
mov ebx, dword [ebx + 0x74]
or eax, ebx
je 0x1811ea8a
mov eax, dword [ebp + 8]
sub edx, dword [eax + 0x68]
sbb ebx, dword [eax + 0x6c]
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ebx
jmp 0x1811ea9a
test edi, edi
je 0x1811eaa5
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 8]
or ecx, 0x14
mov dword [esi + 4], eax
mov dword [esi], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x181398f9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.181395b9

Function at 0x18149350
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.181491cf
Function at 0x401000
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x180], edx
mov edx, dword [0x46ccf8]
push esi
push edi
mov esi, dword [ebx]
add esi, 8
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
push dword [ebx]
push dword [ebx + 4]
push dword [edi + 4]
call fcn.00423850
mov ecx, dword [ebx]
add esp, 0xc
mov eax, dword [edi + 4]
mov edx, dword [str._old]
mov esi, dword [0x4640e8]
mov dword [ecx + eax], edx
lea edx, [ebp - 0x17c]
mov dword [ecx + eax + 4], esi
mov ecx, dword [edi + 4]
call fcn.00411040
test eax, eax
jns 0x401092
jmp 0x401080
cmp eax, 0xc0000043
je 0x401092
cmp eax, 0xc0000022
jne 0x40116c
push dword [ebp + 8]
mov edx, dword [ebp - 0x180]
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x154], 3
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0x6a09e667
mov dword [ebp - 0x144], 0xbb67ae85
mov dword [ebp - 0x140], 0x3c6ef372
mov dword [ebp - 0x13c], 0xa54ff53a
mov dword [ebp - 0x138], 0x510e527f
mov dword [ebp - 0x134], 0x9b05688c
mov dword [ebp - 0x130], 0x1f83d9ab
mov dword [ebp - 0x12c], 0x5be0cd19
call fcn.00412ce0
sub esp, 8
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x154]
call fcn.00412d80
test al, al
je 0x40116c
lea edx, [ebp - 0x48]
mov ecx, edi
call fcn.00405780
test al, al
je 0x40116c
lea edx, [ebp - 0x28]
mov esi, 0x1c
lea eax, [ebp - 0x48]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x40116c
add edx, 4
add eax, 4
sub esi, 4
jae 0x401142
mov edx, dword ds:[ebx + 4]
mov ecx, dword [edi + 4]
push 1
call fcn.004118e0
test eax, eax
setns bl
jmp 0x40116e
xor bl, bl
lea ecx, [edi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x401185
lea esp, [esp]
call fcn.004061c0
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420701
mov esp, ebp
pop ebp
ret 4
Function at 0x4011a0
Capabilities:
Delete file
Hash data using sha256
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x154], eax
mov edi, ecx
mov dword [ebp - 0x150], 3
mov edx, eax
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0x6a09e667
mov dword [ebp - 0x140], 0xbb67ae85
mov dword [ebp - 0x13c], 0x3c6ef372
mov dword [ebp - 0x138], 0xa54ff53a
mov dword [ebp - 0x134], 0x510e527f
mov dword [ebp - 0x130], 0x9b05688c
mov dword [ebp - 0x12c], 0x1f83d9ab
mov dword [ebp - 0x128], 0x5be0cd19
call fcn.00412ce0
mov eax, dword [ebp - 0x150]
cmp eax, 3
ja case.default.0x401254
jmp dword [eax*4 + 0x4013b8]
lea ecx, [ebp - 0x14c]
call fcn.0041dbd0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x18], eax
jmp 0x4012b5
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14c]
call fcn.0041f3a0
jmp 0x4012b5
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x24], eax
jmp 0x4012b5
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14c]
call fcn.0041d960
lea edx, [ebp - 0x44]
mov ecx, ebx
call fcn.00405780
nop
test al, al
jne 0x4012cb
xor bl, bl
jmp 0x401397
lea ecx, [ebp - 0x24]
mov esi, 0x1c
lea edx, [ebp - 0x44]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4012ee
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4012d6
mov bl, 1
jmp 0x401397
mov edx, dword [0x46ccf8]
mov byte [edi + 0x6c], 1
mov esi, dword [ebx]
add esi, 8
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], esi
mov dword [edi + 4], eax
mov word [eax + esi], cx
push dword [ebx]
push dword [ebx + 4]
push dword [edi + 4]
call fcn.00423850
mov ecx, dword [edi + 4]
add esp, 0xc
mov eax, dword [ebx]
mov edx, dword [str._old]
mov esi, dword [0x4640e8]
mov dword [ecx + eax], edx
mov dword [ecx + eax + 4], esi
mov ecx, dword [edi + 4]
call fcn.00411110
mov edx, dword [edi + 4]
mov ecx, dword [ebx + 4]
push 1
call fcn.004118e0
test eax, eax
jns 0x40135d
xor bl, bl
jmp 0x40137f
push 4
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x154]
mov ecx, ebx
call fcn.00405660
test al, al
setne bl
nop
test edi, edi
je 0x401397
lea ecx, [edi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x401397
call fcn.004061c0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420701
mov esp, ebp
pop ebp
ret 8
push 0xc000000d
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
pop ebx
adc al, byte [eax]
mov word [edx], ss
inc eax
add byte [edx + edx + 0x12a70040], bl
inc eax
add ah, cl
int3
Function at 0x402880
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 8], 0
call fcn.00406260
mov edi, dword [0x46cce4]
test byte [edi], 1
je 0x4028ef
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
lea esp, [esp]
test eax, eax
je 0x4028d1
lock dec dword [esi + 8]
add eax, 8
mov byte [eax + 2], 2
jmp 0x402903
mov eax, dword [esi + 0x10]
add eax, 8
push eax
push 4
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
add eax, 8
mov byte [eax + 2], 2
jmp 0x402903
push 0x78
push 4
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov byte [eax + 2], 0
lock inc dword ds:[edi + 4]
push 0x70
mov dword [eax + 4], 1
lea esi, [eax + 8]
movzx ecx, byte [edi + 2]
push 0
push esi
mov word [eax], cx
call fcn.00422210
mov eax, dword fs:[0x18]
add esp, 0xc
mov eax, dword [eax + 0x30]
push esi
sub esp, 0xc
mov ecx, dword [eax + 0x10]
movzx eax, word [ecx + 0x40]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ecx + 0x44]
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1ec], eax
call fcn.00413060
mov eax, dword [esi + 0x18]
test eax, eax
je 0x402962
cmp dword [eax], 0
jne 0x40296a
call fcn.00403e80
mov dword [esi + 0x18], eax
cmp dword [esi + 0x14], 1
jne 0x402986
push esi
call fcn.004031c0
test eax, eax
js 0x402a74
lfence
jmp 0x402a6d
test byte [esi + 0x10], 2
je 0x402a06
push 0x5c
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x60
push 0
push eax
call fcn.00422210
mov eax, dword [0x46cd00]
add esp, 0xc
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x17c], 8
mov dword [ebp - 0x178], 1
push 0
push 0
push eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x170], 0xfffd
push eax
mov dword [ebp - 0x16c], str.Hey_there__before_we_continue...
mov dword [ebp - 0x168], str.__Process_Hacker_was_renamed_System_Informer._n__Process_Hacker_does_not_support_Windows_10_or_11._n__Process_Hacker_will_not_be_updated._n__Process_Hacker_will_not_be_uninstalled._n_nThis_update_will_now_install_System_Informer._n_nPlease_remember_to_uninstall_Process_Hacker._Thanks__3
mov dword [ebp - 0x12c], 0xc8
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
push 0x60
lea eax, [ebp - 0x1e8]
push 0
push eax
call fcn.00422210
mov eax, dword [0x46ccfc]
add esp, 0xc
mov dword [ebp - 0x1e0], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x1e8], 0x60
mov dword [ebp - 0x1dc], 0x8008
push eax
push 0
push 0
lea eax, [ebp - 0x1e8]
mov dword [ebp - 0x1c8], str.Initializing...
push eax
mov dword [ebp - 0x194], 0x402660
mov dword [ebp - 0x190], esi
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp dword [ebp - 8], 0
je 0x402a74
mov ecx, esi
call fcn.00404e40
lea ecx, [ebp - 0x128]
call fcn.00406320
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00420701
mov esp, ebp
pop ebp
ret
Function at 0x403080
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x46b040]
xor eax, esp
mov dword [esp + 0x60], eax
mov edx, dword [ebp + 8]
push esi
call fcn.0040eae0
lea ecx, [ecx]
test eax, eax
js 0x40318e
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40318e
mov eax, dword fs:[0x18]
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 1
mov edx, 2
mov dword [esp + 0x40], 0x1c
mov dword [esp + 0x44], str.SiSetupMutant_
mov eax, dword [eax + 0x20]
push 0x10
mov dword [esp + 0x4c], 8
mov dword [esp + 0x5c], eax
call fcn.00407ce0
mov esi, eax
movzx ecx, word [esi]
mov word [esp + 0x28], cx
movzx ecx, word [esi]
add cx, 2
mov word [esp + 0x2a], cx
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], 0x18
call fcn.00413320
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 1
push eax
push 1
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x40
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.ntdll.dll_NtCreateMutant]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x403170
call fcn.004061c0
call fcn.00413e40
call fcn.00402880
xor eax, eax
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00420701
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x64]
mov eax, 1
pop esi
xor ecx, esp
call fcn.00420701
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403c40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub esp, 0xc
mov esi, ecx
push 0x46bad8
push ecx
lea ecx, [ebp - 0x10]
call fcn.00410c20
mov edi, eax
test edi, edi
js 0x403e51
mov ecx, dword [esi + 0x18]
mov edx, str._systeminformer.exe_0
call fcn.004055a0
mov dword ds:[ebp - 0x18], 0x180016
mov dword [ebp - 0x14], str.DisplayIcon
mov ecx, dword [eax]
add ecx, 2
push ecx
push dword [eax + 4]
lea eax, [ebp - 0x18]
push 1
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x20
push str.System_Informer
push 1
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x180016
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], str.DisplayName
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 8
push 0x464ca0
push 1
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x1e001c
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], str.DisplayVersion
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x4e
push str.https:__systeminformer.sourceforge.io_
push 1
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x120010
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], str.HelpLink
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov ecx, dword [esi + 0x18]
mov edx, 0x4640bc
call fcn.004055a0
mov dword [ebp - 0x18], 0x20001e
mov dword [ebp - 0x14], str.InstallLocation
mov ecx, dword [eax]
add ecx, 2
push ecx
push dword [eax + 4]
lea eax, [ebp - 0x18]
push 1
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x20
push str.System_Informer
push 1
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x140012
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], str.Publisher
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov ecx, dword ds:[esi + 0x18]
mov edx, str._systeminformer_setup.exe
call fcn.004055a0
mov ebx, eax
test ebx, ebx
je 0x403db2
push dword [ebx + 4]
push str.__s___uninstall
call fcn.00407290
mov esi, eax
lea ecx, [ebx - 8]
add esp, 8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x403dc3
call fcn.004061c0
jmp 0x403dc3
push 0
push str.__s___uninstall
call fcn.00407290
add esp, 8
mov esi, eax
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], 0x20001e
push ecx
push dword [esi + 4]
mov dword [ebp - 0x14], str.UninstallString
push 1
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x120010
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], str.NoModify
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 4
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x120010
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], str.NoRepair
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420701
mov esp, ebp
pop ebp
ret