joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43511c
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [eax]
dec dword [ebx]
add byte [eax - 0x74aa6f70], dl
in al, dx
add dword [eax], 0
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
add byte [ebp - 8], dl
mov ebx, eax
xor eax, eax
push ebp
add byte [eax], al
jns 0x43517c
add byte [edi + edi*8 - 0x11], ah
add byte [ecx - 0x5efe4de0], cl
hlt
cld
mov eax, dword [ebp - 0x1e]
add byte [eax], cl
call dword [ecx]
mov edx, dword [ebp - 4]
mov eax, dword [eax]
add al, ch
add dword [0x380000], eax
invalid

Function at 0x457d58
Capabilities:
Encode data using xor

Disassembly:
xor dh, byte [edx + 0x72a43c63]
push esp
mul edi
mov eax, 0xbe532a92
loope 0x457dc7
sbb eax, dword [edx - 0x513c00e9]
sub cl, dh
mov edi, 0xd5f41e57
int3
sub dl, bl
fild word [esi + edi*2 - 0x511bbc43]
inc ebp
outsb dx, byte [esi]
pop edi
aas
adc dword [ebx - 0x45], 0x618cbe3d
push ebx
mov ebx, 0x618cbe3d
popal
mov edi, 0x65fbe429
mov esi, 0x8f9d60df
sbb ah, byte [edi]
add byte [edi + 0x37f8bc54], al
fild qword [esi]
cli
pop ebp
fimul dword [ecx + 0x7b]
lodsb al, byte [esi]
in eax, dx
shr dword [edi - 0x4c9c88ec], cl
nop
sub cl, byte [esi]
mov word [edx], ss
js 0x457e25
adc al, 0x46
loope 0x457dd5
dec esp
cmpsb byte [esi], byte es:[edi]
enter 0xffffffffffffe534, 0x3a
fcomp qword ss:[0xb9b8d27d]
jle 0x457dd2
scasd eax, dword es:[edi]
push edi
or byte [ebp - 0x5c4cc4a], 0xe8
adc bh, ch
test al, 0x85
mov al, 0xd0
stosd dword es:[edi], eax
pop edx
mov dh, 0x3a
rcr byte [edi], 0x96
imul edx, esp, 0xa8930bb3
sbb dword [ebp + 0x69], ebp
dec ebx
push cs
cmpsd dword [esi], dword es:[edi]
ror dword [edx + 0x74], 0xe6
pop esi
daa
inc edi
add al, 0x7f
jne 0x457e97
sub esi, dword [eax]
lds ebp, [edi]
push edx
sub eax, 0x6c9dc6dd
sub al, 0x33
pop ebp
movsb byte es:[edi], byte [esi]
xor dword [ecx], edi
add byte [ecx - 0x6ab2a97d], ah
mov ch, al
jp 0x457e4c
xchg byte [edi - 0xe], bh
and al, 0x20
jmp dword [edi - 0x2cb543ec]
mov ah, byte [eax + 0x59]
salc
into
jge 0x457ef5
invalid
and dword [esi + 0x4cdd4849], eax
nop
mov ch, 0xc2
mov es, word [ebp + ebp*2 - 0x7ff798a1]
sub ecx, dword [esi - 0x14]
mov dword [0x95e0fb48], eax
mov dword [0xfc1a4ddc], eax
mov es, eax
push edx
or eax, 0xad5501f4
adc byte ds:[0xcc0a1274], ch
dec ebp
lodsd eax, dword [esi]
jp 0x457f55
sar byte [ecx], 0x81
mov ebx, 0x3b6ff5e7
clc
xchg edx, eax
or dword [ecx - 0x57], esp
lds ebx, [esi + 0x1e]
xchg dl, ah
sbb ch, al
inc eax
xchg byte [0x6be45316], cl
and byte [eax + 0x43], 0x71
mov byte [ebp + 0x50], cl
out 0x6b, eax
push ss
mov ch, 0x91
dec ebx
mov bh, byte [eax + 0x242d9d90]
invalid
lea eax, [eax - 0x58]
sub al, 0xa0
aam 0xa9
popfd
jnp 0x457f5f
test al, 0x2c
mov al, byte [0x7b9da9d4]
add byte [0xb6e2bdd9], al
add eax, 0xb6e2bdd9
add eax, 0x99acf748
rol edi, 1
cmp ebx, ebp
popal
dec edx
cwde
add dword [ebx], ebp
pop ds
mov ch, 0x45
je 0x457f57
stosb byte es:[edi], al
aaa
adc byte [ecx], bh
push ecx
add bl, al
jne 0x457fb9
daa
xor ch, cl
rol ah, 1
int3
hlt
Function at 0x4808dc
Capabilities:
Encode data using xor

Disassembly:
adc ebx, dword [ebp + 0x7c]
fiadd dword [0xdd16c13]
pushfd
sub ebx, dword [esi]
or dword [ecx + ecx*2 + 0x7c7dcb4e], ecx
push ebx
insd dword es:[edi], dx
fistp qword [esp + esi + 0x64]
and bl, byte [0x371efd54]
aas
xchg edi, eax
sub eax, 0x2a8ca31b
cli
push edx
mov ecx, 0xf63efd18
mov esp, 0x1c3129b5
mov dh, bh
xor al, 0xda
das
pop esp
ffree st(5)
xchg esp, eax
call cs:[edi - 0x53a9e004]
cmp dword cs:[ebp + 4], edi
jl 0x48097a
cmp eax, 0x3f38307c
and byte [ebp + 0x3e17af6c], ah
sbb al, 0x7d
add ecx, ebp
mov ebp, 0x37df4e55
int 0xbd
push ebp
dec esi
fbstp tbyte [edi]
jbe 0x480959
pop edx
or al, 0xae
pop ecx
or al, 0xd
dec ebp
xor al, 0x4a
dec edi
cld
fdivr st(7), st(0)
jle 0x48093e
aam 0x75
aaa
invalid
mov esi, 0x39dd416d
dec dword [ebx]
pop esp
out dx, eax
jl 0x4809a3
mov dword [0xd4b94ef4], eax
mov dword [0x68af5ddd], eax
wait
sub byte [edi - 0x3f], dh
imul ebp, dword [ebx + 0x2f], 0xffffff91
not byte [esi]
in al, 0x28
sbb dh, byte [edi]
xor al, 0x1a
mov esp, 0xe6892a29
or al, 0xd3
cld
mov ch, 0xfc
add byte [esi + 0x3b], bh
jns 0x480932
fisubr word [0x5998f72]
std
dec ebp
mov dh, 0xe7
add ch, ch
lodsd eax, dword [esi]
mov ah, ah
inc esi
pop ebp
out dx, al
and byte [edx - 0x1aa5f448], dh
or ebx, dword [edx - 0x1b]
pop ebp
sbb eax, 0x2bfc6608
dec edi
imul edi, dword [ebp - 0xd], 0xffffffd9
fisubr word [edi + 0x2cd55f32]
or al, 0xdd
adc bl, byte [ebp + 0x6dc5b431]
leave
in al, dx
pmulhw mm4, qword [esi]
mov word [esi], es
loope 0x4809e3
stosd dword es:[edi], eax
sbb al, 0x7a
and al, 0xe8
salc
fstp dword [ebp - 0x27]
insd dword es:[edi], dx
inc ebp
in eax, dx
in al, dx
jae 0x4809e3
scasb al, byte es:[edi]
sub ch, dh
cwde
dec esp
loopne 0x480a2a
pop eax
int 0x8c
sub eax, 0x5a604440
inc eax
inc esp
pushal
pop edx
fcomp qword [ecx - 0x52faf455]
push 0x2dbe1e3f
int3
push ebx
iretd
Function at 0x4854a4
Capabilities:
Encode data using xor

Disassembly:
jl 0x4854e8
jmp 0x485492
cmp dh, al
jns 0x4854f0
ffree st(4)
lea esp, [ecx - 0x65]
fisttp qword [edi - 0xd]
stosd dword es:[edi], eax
xchg esp, eax
jo 0x4854eb
mov bh, byte [esi]
imul ebp, dword cs:[ebp + 0xf], 0x73
mov al, byte [0x7d67f8a6]
int 0xea
xchg esp, eax
std
ret 0x5219
pop es
lodsb al, byte [esi]
push ds
jae 0x4854ed
loop 0x485471
shr dword [edx + 0x28e2e41f], cl
mov al, 0x1f
pushfd
push eax
mov byte [0xa5723592], al
lodsb al, byte [esi]
insd dword es:[edi], dx
xchg edx, eax
xor eax, 0x6daca572
scasb al, byte es:[edi]
jb 0x4854b6
and eax, 0xddc6f4fc
sub word [ebx], ax
push ss
movsd dword es:[edi], dword [esi]
hlt
dec eax
jno 0x485476
stosb byte es:[edi], al
push 0x13
xchg edi, eax
stc
adc edx, dword [edi - 0x1b3bbf07]
sbb esp, edi
cli
mov eax, dword [0xe1acc971]
xchg ebx, eax
and byte [ecx + 0x5a5d4ccf], bh
or edx, dword [esi]
sbb esp, eax
lahf
out dx, al
imul esp, dword [ecx - 0x4b], 0xffffffea
clc
test byte [0xa1b2b1e0], dl
arpl word [esi - 0x4e], di
push cs
shl dword [esi + 0x64], 0xba
loope 0x485566
inc eax
invalid
mov al, byte [0xdcddb743]
cmp eax, 0xbef59dd4
cmc
je 0x485564
cmp bh, byte [ebp + 0x18da330]
mov ebp, 0x18da330
push ebx
add ebp, esp
out dx, al
sub byte [0xb9c95124], dh
push eax
pushal
in eax, dx
dec ebx
insd dword es:[edi], dx
rol dword [eax], 0x3c
dec esp
or al, 0xcd
dec ebp
cmp byte [ebx - 7], al
ja 0x485529
enter 0xffffffffffffbbcb, 0xffffffffffffffea
pop ebp
lcall 0xb9fe, 0x1e4dfd07
cmp byte [edx], dh
inc ebp
inc ebp
adc eax, 0x7405d3b0
mov bh, 0xe
in eax, 0x78
mov byte [0x5c732160], al
and dword [ebx + 0x5c], esi
xchg edi, eax
mov dl, 0x39
mov ch, 0xd2
inc ebx
ror byte [esi + 0x39ea222b], 0x88
xchg esp, eax
adc al, 0x8a
ret
Function at 0x4974f8
Capabilities:
Check for software breakpoints

Disassembly:
push edi
cmp al, 0x27
salc
jge 0x4974fd
call dword [edi + ecx*4 + 0x1fa73cfc]
inc edi
jl 0x49756a
xchg esp, eax
invalid
das
pop edi
pop edi
ljmp 0x820d
and ebx, esp
xor ch, dl
cmp al, byte [edi]
adc edi, dword [eax - 0x53]
sar dword es:[edi - 0x37], 1
lahf
pop ebp
or dh, byte [ebx - 0x7e66c1b0]
not dword [edx]
outsd dx, dword [esi]
lds edi, [ecx - 0x70f98f6d]
xchg dword [esi + 0x3f], ecx
lds eax, [edi - 0x24]
or ebx, dword [edi - 0x2f]
je 0x497599
dec esi
sar ah, 1
mov dh, 0xf8
inc edx
arpl cx, ax
popal
push ecx
lea ebx, [ecx*2 - 0x1c9ec5e5]
push 0xffffffffffffffff
add dword [0xf6cd057b], edx
sti
dec edx
lahf
dec ecx
mov edx, 0xfb5f31d3
add al, 0x53
outsd dx, dword [esi]
sahf
dec edx
adc esi, ebp
fcmovb st(0), st(2)
invalid

Function at 0x49c550
Capabilities:
Check for software breakpoints

Disassembly:
invalid
imul esp, dword [ecx + ebp*4], 0x5cc41c98
mov ch, 0xd9
jne 0x49c5b7
loopne 0x49c4e9
call 0x14d4d534
out 0xd7, eax
mov dword [0xb3a5b294], eax
invalid
invalid

Function at 0x4a521c
Capabilities:
Encode data using xor

Disassembly:
cmp edx, ecx
cmp dword [ebp - 0x4c99653], 0x195eb710
mov dh, 0xe1
dec esp
fsub dword [edi - 0x41]
mov al, 0x41
inc ecx
stosd dword es:[edi], eax
ror byte [ebp + 0x2c013001], 0x23
xchg ebp, eax
int3
lds esp, es:[eax + eax - 0x2f]
push esi
jbe 0x4a525f
enter 0x6a56, 0xfffffffffffffff6
enter 0xfffffffffffff080, 0xffffffffffffffea
out dx, eax
and eax, 0xfeddff
rcr ecx, 1
mov ecx, 0x8484b591
mov gs, esp
lahf
sub al, 0xe1
push ss
out 0x8a, eax
loopne 0x4a51f3
ror byte [esi], 0x32
jo 0x4a524c
or al, 0
aad 0x40
inc eax
mov bl, 0x6d
inc esp
push ss
loop 0x4a5299
cmp eax, 0xcc1f6e0
add al, 0x45
jb 0x4a51e0
add byte [ebp + 0x50ff7711], ch
ja 0x4a5260
call dword [eax - 0x21]
dec eax
out dx, al
push eax
fisttp word [eax - 0x12]
iretd
stosb byte es:[edi], al
jg 0x4a52e0
int3
fisub dword es:[eax - 0xfbc05b6]
pop es
mov cs, word [edx - 0x69a32de0]
or dl, ah
mov eax, 0xffb95205
xchg ecx, eax
cwde
invalid
Function at 0x4a5529
Capabilities:
Encode data using xor

Disassembly:
mov byte [edi - 0x6f], dh
mov bl, 0x27
cvtps2pd xmm4, qword [ebx + ecx*4 - 0x269e5a3f]
pushal
mov al, byte [0xbab736dc]
call [ebx - 0x624fd86e]
mov cl, 0x50
sbb byte [eax - 0xc85b787], bh
out dx, eax
shr dword [ecx - 0x78a3588], cl
mov dh, byte [ecx - 0x42ea551]
cmp byte [edi + ebx*4 - 0x9df46f6], dl
test byte [edx], dl
jge 0x4a555b
aas
push cs
and al, 0x3b
add eax, dword [ecx]
cmp byte [ecx + esi*4 + 0x13cc1b89], dh
std
xchg byte [ebp + edi*8 + 0x58], dh
jecxz 0x4a55ad
pushal
das
popal
adc byte [ecx], 0xf1
lodsb al, byte [esi]
lodsb al, byte [esi]
out dx, eax
and esi, dword [edi]
pop ebp
pop es
dec edx
jne 0x4a5541
lahf
xlatb
in eax, 0xee
std
xchg esi, eax
push 0xad3b5d01
cmp esi, dword [ebp + 0x1d]
jne 0x4a557a
and byte [ebx], dh
jecxz 0x4a54f0
push ebx
add eax, 0xacc469f3
cmp byte [ebp - 0x4b], bh
imul eax, esp, 0xb57d38ac
inc edi
or edx, 0x851b2c57
test dword [eax - 0x6b8594ca], esi
push edi
mov edi, 0x63b9a49a
and dh, byte [esi]
mov edi, 0xe93aecaa
lcall 0xbf36, 0x2263b9a4
stosb byte es:[edi], al
in al, dx
cmp ch, cl
dec edx
mov byte [0xc0bdb473], al
cld
std
lahf
jp 0x4a5564
aad 0x3c
lodsb al, byte [esi]
mov cl, 0x83
insb byte es:[edi], dx
or ebp, edi
add al, 0xc6
lcall 0xcc7a, 0xef2bac5a
add eax, 0x46c06bd9
dec edi
sub byte [ebx - 0x3e], al
invalid
push edx
mov al, 0xbe
not byte [ebx + 0x951e8b8]
outsd dx, dword [esi]
dec dword [edx + 0x3d03fd3b]
invalid

Function at 0x4bf53e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c72f0
cmp edx, dword [eax]
je 0x4bf560
add eax, 8
inc ecx
cmp eax, 0x4c7380
jl 0x4bf551
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c72f0]
jne 0x4bf68e
mov eax, dword [0x4cb9dc]
cmp eax, 1
je 0x4bf668
test eax, eax
jne 0x4bf591
cmp dword [0x4c7234], 1
je 0x4bf668
cmp edx, 0xfc
je 0x4bf68e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf5c8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bfc50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bfe80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bf60b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bfe80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c3b70
push edi
call fcn.004c1650
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bfc50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bfc60
lea eax, [ebp - 0xa0]
push 0x4c3b50
push eax
call fcn.004bfc60
push dword [esi + 0x4c72f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bfc60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c15c4
add esp, 0x2c
pop edi
jmp 0x4bf68e
lea eax, [ebp + 8]
lea esi, [esi + 0x4c72f4]
push 0
push eax
push dword [esi]
call fcn.004bfe80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x58d9626c
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x78354518
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4190b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4190c0
push ebx
push esi
mov eax, 0x418ff8
call fcn.0040642c
xor eax, eax
push ebp
push 0x4192b5
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
push 0x42c260
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x14]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x4192cc
call fcn.004175fc
mov edx, dword [ebp - 0x18]
pop eax
call fcn.004048d4
mov eax, dword [ebp - 0x14]
call fcn.0040b460
test al, al
je 0x419170
push 0
lea eax, [ebp - 0x1c]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x4192cc
call fcn.004175fc
mov edx, dword [ebp - 0x20]
pop eax
call fcn.004048d4
mov eax, dword [ebp - 0x1c]
call fcn.00404acc
push eax
call sub.kernel32.dll_WinExec
call fcn.00417980
jmp 0x41929a
lea eax, [ebp - 0x24]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
call fcn.00417738
lea eax, [ebp - 0x28]
mov edx, 0x4192dc
call fcn.004048d4
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00404a18
je 0x41921b
lea eax, [ebp - 0x2c]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.00417738
lea eax, [ebp - 0x30]
mov edx, 0x4192f0
call fcn.004048d4
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00404a18
je 0x419295
lea eax, [ebp - 0x34]
mov edx, 0x42c260
mov ecx, pe_nt_image_headers32
call fcn.0040487c
mov eax, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
call fcn.00417738
lea eax, [ebp - 0x38]
mov edx, 0x41930c
call fcn.004048d4
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00404a18
je 0x419272
jmp 0x419166
call fcn.00418320
call fcn.00418a04
mov eax, 0x419324
call fcn.00417c74
mov eax, 0x419330
call fcn.00417c74
mov eax, 0x41933c
call fcn.00417c74
mov eax, 0x419324
call fcn.00418cb8
mov eax, 0x419330
call fcn.00418cb8
mov eax, 0x41933c
call fcn.00418cb8
mov edx, 0x419348
mov eax, 0x41935c
call fcn.00417f98
jmp 0x41929a
xor esi, esi
mov ebx, 0x41a404
mov eax, dword [ebx]
call fcn.0041747c
inc esi
add ebx, 4
cmp esi, 0x40
jne 0x419279
push 0x3e7
call sub.kernel32.dll_Sleep_1
jmp 0x419272
call fcn.00418b3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4192bc
lea eax, [ebp - 0x38]
mov edx, 0xa
call fcn.00404630
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4015d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
mov dword [ebp - 0x10c], esi
call fcn.004bda10
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x108]
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401645
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
mov ecx, esi
call fcn.00402e20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bbaec
mov esp, ebp
pop ebp
ret
Function at 0x401670
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e278f
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
push 0x228
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x250]
push edi
push eax
mov dword [ebp - 0x25c], edi
call fcn.004bda10
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x258], eax
cmp eax, 0xffffffff
jne 0x4016e2
xor al, al
jmp 0x401864
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401856
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x28], 0
or edi, 1
push 0x3a8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x25c], edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebp - 0x28]
lea esi, [eax - 1]
push esi
call fcn.00402470
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x230]
push 0
push esi
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x260]
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x40178e
mov ecx, dword [eax]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401801
cmp dword [ebx + 4], 0x15555555
mov eax, dword [ebp - 0x24c]
mov esi, dword [ebx]
mov dword [ebp - 0x264], eax
je 0x401885
mov dword [ebp - 0x26c], ebx
mov byte [ebp - 4], 1
push 0xc
mov dword [ebp - 0x268], 0
call fcn.004bbaae
mov ecx, dword [ebp - 0x264]
add esp, 4
mov dword [ebp - 0x268], 0
mov dword [eax + 8], ecx
inc dword [ebx + 4]
mov ecx, dword [esi + 4]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x40183b
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401831
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401880
push ecx
push edx
call fcn.004bbade
add esp, 8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401702
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bbaec
mov esp, ebp
pop ebp
ret
call fcn.004bff0f
push str.list_too_long
call fcn.0041e704
int3
Function at 0x401de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e285d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x530400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push edx
push dword [ebp + 0x1c]
mov dword [ebp - 0x2c], 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e8d
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], eax
call fcn.00402470
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp + 0x18]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov dword [esi + 0x10], 0
cmovae edx, dword [ebp - 0x28]
mov ecx, edx
mov dword [esi + 0x14], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ec2
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00402e20
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x401f04
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401efa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401f21
push ecx
push edx
call fcn.004bbade
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bbaec
mov esp, ebp
pop ebp
ret
call fcn.004bff0f
int3

Function at 0x401f30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401f7e
mov eax, dword [ebp + 0x14]
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x401f61
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x401ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402015
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x402040
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40206b
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret