joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d37ac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4d37f0
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.00409e8c
add esp, 0x200
pop ebx
ret

Function at 0x4e1c00
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4e1c2e
mov eax, ebx
call fcn.004e26b4
cmp dword [ebx + 0x40], 0
je 0x4e1c27
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4e1c9f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4e1c91
cmp dword [ebx + 8], 0
je 0x4e1c50
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4e1c62
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e1c91
cmp dword [ebx + 8], 0
je 0x4e1c43
cmp eax, 3
je 0x4e1c75
dec eax
jne 0x4e1c43
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e1c43
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4e1c43
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4e1cbd
cmp dword [ebx + 0x14], 0xcc
je 0x4e1cbd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e1cc8
pop ebx
ret

Function at 0x4f2500
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4f2525
cmp dword [esp + 4], 5
jb 0x4f2525
mov al, 1
jmp 0x4f2527
xor eax, eax
add esp, 0x94
ret
Function at 0x5197fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51986d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x598020]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x519857
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005197ec
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5195f4]
call fcn.00519894
mov dword [0x598084], eax
mov eax, dword [ebp - 4]
call fcn.0051979c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519874
lea eax, [ebp - 8]
call fcn.0040649c
ret

Function at 0x51b454
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x51b50e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cd4
mov eax, dword [0x598cc8]
cmp dword [eax], 2
jne 0x51b4c3
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405044
mov eax, dword [ebx]
call fcn.00404e70
push eax
mov eax, dword [ebx]
call fcn.00404e60
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404e70
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405044
jmp 0x51b4f5
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409e8c
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b515
lea eax, [ebp - 0x3f0]
call fcn.004045c8
ret
Function at 0x53e22c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0053e218
test eax, eax
jne 0x53e24d
mov eax, esi
call fcn.004045c8
jmp 0x53e2de
mov eax, ebx
call fcn.0053e374
test al, al
je 0x53e293
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004046b8
test edi, edi
je 0x53e28a
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x53e2de
mov eax, esi
call fcn.004045c8
jmp 0x53e2de
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x53e2d7
mov eax, dword [ebp + 0x208]
call fcn.0041ef64
test eax, eax
jle 0x53e2c5
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.0044819c
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.0040461c
jmp 0x53e2de
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x210]
call fcn.0040461c
jmp 0x53e2de
mov eax, esi
call fcn.004045c8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x554f80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x555133
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042fbb0
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00472fdc
call fcn.00540970
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x555004
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.0042a0c0
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042fbb0
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042a0c8
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00429fa8
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00409d1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042fbb0
call fcn.0042aef0
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a01c
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a058
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a058
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a058
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042a0c0
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042fbb0
mov eax, dword [eax + 0xc]
pop edx
call fcn.00429f54
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042fbb0
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x23
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*4 + 0xc]
call fcn.00429d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55513a
lea eax, [ebp - 4]
call fcn.004045c8
ret
Function at 0x56b21c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x56b234
mov eax, ebx
call fcn.0056ab30
cmp dword [ebx + 0x68], 0
jne 0x56b241
mov eax, ebx
call fcn.0056aac0
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.0056a940
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0056bb74
cmp eax, dword [esp]
je 0x56b2af
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0056bb88
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x56b28b
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.0056bb74
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x56b2a4
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x56b2ca
push 3
mov eax, dword [esi + 0xc]
call fcn.00467160
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x56b2d7
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.0045ff74
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0045ff98
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0045ffc0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0045ffe4
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0041cb74
mov eax, ebp
mov edx, dword [0x5984b4]
mov byte [edx + 2], al
mov eax, dword [0x5984b4]
mov byte [eax], 0
mov eax, dword [0x5984b4]
mov byte [eax + 1], 0
mov eax, dword [0x5984b4]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00467160
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00467160
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00467160
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x5984b4]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042fbb0
call fcn.0042aef0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00467160
push eax
mov eax, dword [0x598460]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00467160
push eax
call sub.user32.dll_ShowWindow
push 0
push esi
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56c47c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409878
test al, al
je 0x56c503
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403068
or esi, 0x100
test esi, esi
jns 0x56c4b7
call fcn.00403678
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404a88
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x56c503
mov dl, 1
mov eax, dword [0x428f30]
call fcn.004311d4
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.004315a4
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x56c503
mov eax, esp
call fcn.0040f0d4
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x5768dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x59a210
test esi, esi
jne 0x5768f6
xor eax, eax
jmp 0x5769f8
cmp dword [ebp], 0
jne 0x576901
call fcn.0057686c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5769d1
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x57690d
test edi, edi
jbe 0x5769f3
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5769d5
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x588b84
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
push 0
push 0
push 0
push 0
push 0x588c58
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x588c50
xor ecx, ecx
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, 0x100000
call fcn.004027ec
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x588c40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, ebx
call fcn.00404a88
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
test ebx, ebx
je 0x588c2a
lea eax, [ebp - 8]
push eax
push 0x100000
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 8], 0
jbe 0x588c1e
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, esi
call fcn.00420ae4
cmp dword [ebp - 8], 0
jne 0x588bf8
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588c47
mov eax, dword [ebp - 0xc]
call fcn.0040280c
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405d00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494981
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x75a440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
call fcn.00405a50
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00405a50
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00405a50
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00405a50
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00405a50
mov byte [ebp - 4], 9
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00407560
lea ecx, [ebp + 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00407560
lea edx, [ebp + 0x38]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00407560
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x50]
mov byte [eax + 0x48], cl
lea edx, [ebp + 0x54]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00407560
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x6c]
mov byte [eax + 0x49], cl
lea edx, [ebp + 0x70]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00407560
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x88]
mov dword [eax + 0x7c], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x4a], 0
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.00406e90
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x20]
call fcn.00406e90
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x38]
call fcn.00406e90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00406e90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x70]
call fcn.00406e90
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x84
Function at 0x40b5c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494daf
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x75a440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2d0], 0
mov ecx, dword [ebp + 8]
call fcn.00405c40
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2d0]
or eax, 1
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2e8], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2cc], eax
push 0x22c
push 0
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.0046f640
add esp, 0xc
mov dword [ebp - 0x2c0], 0x22c
lea edx, [ebp - 0x2c0]
push edx
mov eax, dword [ebp - 0x2cc]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b797
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2d4], ecx
lea edx, [ebp - 0x2c4]
push edx
mov ecx, dword [ebp - 0x2d4]
call fcn.0040a980
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x2d4]
call fcn.0040aa10
nop
jmp 0x40b6b0
lea ecx, [ebp - 0x2c4]
call fcn.00407940
nop
lea ecx, [ebp - 0x2d8]
push ecx
lea ecx, [ebp - 0x2c4]
call fcn.004076a0
movzx edx, al
test edx, edx
jne 0x40b77c
lea ecx, [ebp - 0x2c4]
call fcn.004078e0
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2c8]
call fcn.0040d080
mov dword [ebp - 0x2dc], eax
push 0
mov ecx, dword [ebp - 0x2dc]
call fcn.004077d0
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00471ccb
add esp, 8
test eax, eax
jne 0x40b777
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0x2c8]
push edx
lea ecx, [ebp - 0x90]
call fcn.00405e40
mov dword [ebp - 4], 1
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040ec30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00407060
nop
mov ecx, dword [ebp - 0x2c8]
call fcn.0040cf00
mov dword [ebp - 0x2e0], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
or edx, dword [ebp - 0x2e0]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
jmp 0x40b77c
jmp 0x40b6a4
lea ecx, [ebp - 0x2c0]
push ecx
mov edx, dword [ebp - 0x2cc]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b674
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40cf30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x75a440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x414], reloc.WS2_32.dll_accept
mov dword [ebp - 0x410], str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov dword [ebp - 0x40c], 0
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0x40c], 0
jne 0x40cfbb
push 0x49768c
mov ecx, dword [ebp + 8]
call fcn.00405570
mov eax, dword [ebp - 0x408]
or eax, 1
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 8]
jmp 0x40d066
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x200
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0
push str.ProgId
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x420], eax
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
push 0x4976b0
lea eax, [ebp - 0x404]
push eax
call fcn.00471771
add esp, 8
test eax, eax
jne 0x40d045
push str.not_found
mov ecx, dword [ebp + 8]
call fcn.00405570
mov ecx, dword [ebp - 0x408]
or ecx, 1
mov dword [ebp - 0x408], ecx
mov eax, dword [ebp + 8]
jmp 0x40d066
lea edx, [ebp - 0x404]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405570
mov eax, dword [ebp - 0x408]
or eax, 1
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40d200
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494fc4
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x75a440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 8]
call fcn.00405cc0
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a4]
or eax, 1
mov dword [ebp - 0x1a4], eax
push 0x497e54
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.00401c40
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040b500
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
je 0x40d33f
mov ecx, dword [ebp - 0x198]
and ecx, 0x10
je 0x40d315
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x28]
call fcn.004051a0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x10]
call fcn.00407ce0
mov byte [ebp - 0x199], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00406e70
movzx ecx, byte [ebp - 0x199]
test ecx, ecx
je 0x40d315
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x40]
call fcn.004051a0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040ec70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00406e70
nop
lea ecx, [ebp - 0x198]
push ecx
mov edx, dword [ebp - 0x1a0]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d2a2
mov eax, dword [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00406e70
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00406f00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40dca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x75a440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004717b1
add esp, 8
push 0x497968
lea edx, [ebp - 0x204]
push edx
call fcn.00471740
add esp, 8
mov eax, dword [str.fgimllnamdeacpaddbdafchhcmapebgj]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.00471740
add esp, 8
mov dword [ebp - 0x408], 0
push 0
lea edx, [ebp - 0x408]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40dd2e
mov eax, 2
jmp 0x40dde2
mov dword [ebp - 0x40c], 0
push str.https:__clients2.google.com_service_update2_crx
lea edx, [ebp - 0x404]
push edx
call fcn.004717b1
add esp, 8
lea eax, [ebp - 0x404]
push eax
call fcn.004718f5
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x40c], ecx
mov edx, dword [ebp - 0x40c]
shl edx, 1
mov dword [ebp - 0x410], edx
cmp dword [ebp - 0x410], 0x200
jae 0x40dd81
jmp 0x40dd87
call fcn.0046c1cb
nop
xor eax, eax
mov ecx, dword [ebp - 0x410]
mov word [ebp + ecx - 0x404], ax
mov edx, dword [ebp - 0x40c]
push edx
lea eax, [ebp - 0x404]
push eax
push 1
push 0
push str.update_url
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40ddd3
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x40dde2
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret