joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f7d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x46f842
mov eax, ebx
call fcn.00471c1c
test al, al
jne 0x46f842
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404dd0
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x46f82f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46f84f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d34
jmp 0x46f84f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d34
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x470d40
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x470dae
mov eax, esi
call fcn.00458ff0
test al, al
je 0x470dae
mov eax, dword [ebx + 0x84]
call fcn.00458c50
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x470dae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x470da2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00458c50
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00450ac0
jmp 0x470dae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00470b7c
pop esi
pop ebx
ret

Function at 0x477374
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405170
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x483c9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405160
xor eax, eax
push ebp
push 0x483d05
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebx + 0xc]
call fcn.0043c58c
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], edi
lea eax, [ebx + 0x3c]
mov edx, dword [ebp + 8]
call fcn.00404d34
xor eax, eax
mov dword [ebx + 0x2c], eax
cmp byte [ebx + 0x30], 0
je 0x483cef
mov byte [ebx + 0x30], 0
mov eax, ebx
call fcn.00483e6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483d0c
lea eax, [ebp + 8]
call fcn.00404ce0
ret
Function at 0x48b0a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x4f2da4
test esi, esi
jne 0x48b0ba
xor eax, eax
jmp 0x48b1ab
cmp dword [ebp], 0
jne 0x48b0c5
call fcn.0048b030
xor ebx, 0xffffffff
cmp edi, 8
jb 0x48b185
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x48b0d1
test edi, edi
jbe 0x48b1a6
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x48b189
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48f404
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x48f432
mov eax, ebx
call fcn.0048fea8
cmp dword [ebx + 0x3c], 0
je 0x48f42b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x48f4a3
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x48f495
cmp dword [ebx + 8], 0
je 0x48f454
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x48f466
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48f495
cmp dword [ebx + 8], 0
je 0x48f447
cmp eax, 3
je 0x48f479
dec eax
jne 0x48f447
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48f447
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x48f447
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x48f4c1
cmp dword [ebx + 0x10], 0xcc
je 0x48f4c1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048f4cc
pop ebx
ret
Function at 0x49c4f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49c51e
mov eax, ebx
call fcn.0049cfa4
cmp dword [ebx + 0x40], 0
je 0x49c517
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49c58f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x49c581
cmp dword [ebx + 8], 0
je 0x49c540
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x49c552
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49c581
cmp dword [ebx + 8], 0
je 0x49c533
cmp eax, 3
je 0x49c565
dec eax
jne 0x49c533
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49c533
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49c533
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x49c5ad
cmp dword [ebx + 0x14], 0xcc
je 0x49c5ad
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049c5b8
pop ebx
ret

Function at 0x4be338
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4be42f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x119]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 0x14], 0x105
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x119]
mov ecx, 0x105
call fcn.00404f50
mov eax, dword [ebp - 0x120]
call fcn.00405be4
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetDesktopFolder
call fcn.004bc420
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
mov eax, dword [0x4ed148]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.004bc420
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4ecd0c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
call fcn.004bc420
push esi
mov cl, 1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004be26c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be436
lea eax, [ebp - 0x120]
call fcn.00404ce0
lea eax, [ebp - 8]
mov edx, dword [0x432a30]
mov ecx, 2
call fcn.0040586c
ret
Function at 0x4c6f14
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp byte [esi + 0x1a9], 0
je 0x4c6f3b
mov ecx, esi
mov dl, 1
mov eax, dword [0x4c5078]
call fcn.004c6218
mov dword [esi + 0x20c], eax
jmp 0x4c7025
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
cmp byte [esi + 0x1b3], 0
je 0x4c6f7a
movzx eax, byte [esi + 0x1b2]
movzx edx, al
cmp dx, word [esi + 0x1ae]
jb 0x4c6f6f
mov edx, eax
sub dl, byte [esi + 0x1ae]
mov eax, esi
call fcn.004c66b0
jmp 0x4c6f8e
xor edx, edx
mov eax, esi
call fcn.004c66b0
jmp 0x4c6f8e
movzx edx, byte [esi + 0x1b2]
add dl, byte [esi + 0x1ae]
mov eax, esi
call fcn.004c66b0
cmp byte [esi + 0x1b3], 0
je 0x4c6fa0
cmp byte [esi + 0x1b2], 0
je 0x4c6fb6
cmp byte [esi + 0x1b3], 0
jne 0x4c6fb2
cmp byte [esi + 0x1b2], 0x64
je 0x4c6fb6
xor ebx, ebx
jmp 0x4c6fb8
mov bl, 1
test bl, bl
jne 0x4c6ff5
mov eax, dword [0x4ed148]
mov eax, dword [eax]
call fcn.0046fc8c
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
movzx edx, word [esi + 0x1b0]
cmp eax, edx
ja 0x4c6ff5
cmp byte [esi + 0x1b4], 0
je 0x4c6ff5
cmp byte [esi + 0x1ab], 0
jne 0x4c6ff5
cmp byte [esi + 0x218], 0
je 0x4c6fbc
test bl, bl
jne 0x4c7018
cmp byte [esi + 0x1b4], 0
je 0x4c7018
cmp byte [esi + 0x1ab], 0
jne 0x4c7018
cmp byte [esi + 0x218], 0
je 0x4c6f3b
test bl, bl
je 0x4c7025
mov edx, esi
mov eax, esi
call fcn.004c678c
pop edi
pop esi
pop ebx
ret

Function at 0x4ce53c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
mov eax, dword [ebp - 8]
call fcn.00405160
xor eax, eax
push ebp
push 0x4ce5ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x419b34]
call fcn.0041e4b4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ce5cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004ce5fc
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce5d3
mov eax, dword [ebp - 0xc]
call fcn.00403ddc
cmp byte [ebp - 0xd], 0
jne 0x4ce5cb
mov eax, dword [ebp - 8]
call fcn.00405170
push eax
call sub.kernel32.dll_DeleteFileA
ret
Function at 0x4d6dd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d6f5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [0x439b40]
call fcn.00403f8c
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [esi + 0x30]
call fcn.0041b980
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 4]
call fcn.00450ba0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov eax, dword [eax + 0x190]
call fcn.0042ade8
mov edx, dword [ebx]
mov edx, dword [edx + 0x4c]
sub edx, eax
sar edx, 1
jns 0x4d6e3c
adc edx, 0
mov dword [ebp - 4], edx
mov eax, dword [esi + 4]
mov edx, dword [0x4d48ec]
call fcn.00403f8c
mov eax, dword [eax + 0x36c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x4c]
sub edx, dword [eax + 0x30]
sar edx, 1
jns 0x4d6e62
adc edx, 0
mov dword [ebp - 8], edx
mov eax, dword [ebx + 4]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4d6edd
mov eax, dword [ebp - 8]
push eax
push 1
push 1
mov eax, edi
mov edx, dword [0x439b40]
call fcn.00403f8c
mov eax, dword [eax + 0x190]
push eax
mov eax, dword [esi + 4]
mov edx, dword [0x4d48ec]
call fcn.00403f8c
mov eax, dword [eax + 0x36c]
xor ecx, ecx
pop edx
call fcn.0046066c
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 4]
call fcn.00450ba0
mov eax, dword [ebp - 0x10]
push eax
mov eax, edi
mov edx, dword [0x439b40]
call fcn.00403f8c
mov eax, dword [eax + 0x190]
mov ecx, dword [ebp - 4]
mov edx, 0x14
call fcn.0042ac3c
jmp 0x4d6f44
mov eax, dword [ebp - 8]
push eax
push 0
push 1
mov eax, edi
mov edx, dword [0x439b40]
call fcn.00403f8c
mov eax, dword [eax + 0x190]
push eax
mov eax, dword [esi + 4]
mov edx, dword [0x4d48ec]
call fcn.00403f8c
mov eax, dword [eax + 0x36c]
xor ecx, ecx
pop edx
call fcn.0046066c
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 4]
call fcn.00450ba0
mov eax, dword [ebp - 0x14]
push eax
mov eax, edi
mov edx, dword [0x439b40]
call fcn.00403f8c
mov eax, dword [eax + 0x190]
mov ecx, dword [ebp - 4]
mov edx, 0x14
call fcn.0042ac3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6f66
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404d04
ret
Function at 0x405d00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494981
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x639440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
call fcn.00405a50
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00405a50
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00405a50
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00405a50
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00405a50
mov byte [ebp - 4], 9
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00407560
lea ecx, [ebp + 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00407560
lea edx, [ebp + 0x38]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00407560
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x50]
mov byte [eax + 0x48], cl
lea edx, [ebp + 0x54]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00407560
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x6c]
mov byte [eax + 0x49], cl
lea edx, [ebp + 0x70]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00407560
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x88]
mov dword [eax + 0x7c], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x4a], 0
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.00406e90
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x20]
call fcn.00406e90
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x38]
call fcn.00406e90
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x54]
call fcn.00406e90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x70]
call fcn.00406e90
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x84
Function at 0x40b5c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494daf
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x639440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2d0], 0
mov ecx, dword [ebp + 8]
call fcn.00405c40
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2d0]
or eax, 1
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2e8], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2cc], eax
push 0x22c
push 0
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.0046f640
add esp, 0xc
mov dword [ebp - 0x2c0], 0x22c
lea edx, [ebp - 0x2c0]
push edx
mov eax, dword [ebp - 0x2cc]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b797
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2d4], ecx
lea edx, [ebp - 0x2c4]
push edx
mov ecx, dword [ebp - 0x2d4]
call fcn.0040a980
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x2d4]
call fcn.0040aa10
nop
jmp 0x40b6b0
lea ecx, [ebp - 0x2c4]
call fcn.00407940
nop
lea ecx, [ebp - 0x2d8]
push ecx
lea ecx, [ebp - 0x2c4]
call fcn.004076a0
movzx edx, al
test edx, edx
jne 0x40b77c
lea ecx, [ebp - 0x2c4]
call fcn.004078e0
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2c8]
call fcn.0040d080
mov dword [ebp - 0x2dc], eax
push 0
mov ecx, dword [ebp - 0x2dc]
call fcn.004077d0
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00471ccb
add esp, 8
test eax, eax
jne 0x40b777
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0x2c8]
push edx
lea ecx, [ebp - 0x90]
call fcn.00405e40
mov dword [ebp - 4], 1
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040ec30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00407060
nop
mov ecx, dword [ebp - 0x2c8]
call fcn.0040cf00
mov dword [ebp - 0x2e0], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
or edx, dword [ebp - 0x2e0]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
jmp 0x40b77c
jmp 0x40b6a4
lea ecx, [ebp - 0x2c0]
push ecx
mov edx, dword [ebp - 0x2cc]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b674
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40cf30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x639440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x414], reloc.WS2_32.dll_accept
mov dword [ebp - 0x410], str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov dword [ebp - 0x40c], 0
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0x40c], 0
jne 0x40cfbb
push 0x49768c
mov ecx, dword [ebp + 8]
call fcn.00405570
mov eax, dword [ebp - 0x408]
or eax, 1
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 8]
jmp 0x40d066
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x200
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0
push str.ProgId
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x420], eax
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
push 0x4976b0
lea eax, [ebp - 0x404]
push eax
call fcn.00471771
add esp, 8
test eax, eax
jne 0x40d045
push str.not_found
mov ecx, dword [ebp + 8]
call fcn.00405570
mov ecx, dword [ebp - 0x408]
or ecx, 1
mov dword [ebp - 0x408], ecx
mov eax, dword [ebp + 8]
jmp 0x40d066
lea edx, [ebp - 0x404]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405570
mov eax, dword [ebp - 0x408]
or eax, 1
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40d200
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494fc4
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x639440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 8]
call fcn.00405cc0
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a4]
or eax, 1
mov dword [ebp - 0x1a4], eax
push 0x497e54
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.00401c40
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040b500
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
je 0x40d33f
mov ecx, dword [ebp - 0x198]
and ecx, 0x10
je 0x40d315
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x28]
call fcn.004051a0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x10]
call fcn.00407ce0
mov byte [ebp - 0x199], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00406e70
movzx ecx, byte [ebp - 0x199]
test ecx, ecx
je 0x40d315
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x40]
call fcn.004051a0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040ec70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00406e70
nop
lea ecx, [ebp - 0x198]
push ecx
mov edx, dword [ebp - 0x1a0]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d2a2
mov eax, dword [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00406e70
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00406f00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40dca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x639440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004717b1
add esp, 8
push 0x497968
lea edx, [ebp - 0x204]
push edx
call fcn.00471740
add esp, 8
mov eax, dword [str.fgimllnamdeacpaddbdafchhcmapebgj]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.00471740
add esp, 8
mov dword [ebp - 0x408], 0
push 0
lea edx, [ebp - 0x408]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40dd2e
mov eax, 2
jmp 0x40dde2
mov dword [ebp - 0x40c], 0
push str.https:__clients2.google.com_service_update2_crx
lea edx, [ebp - 0x404]
push edx
call fcn.004717b1
add esp, 8
lea eax, [ebp - 0x404]
push eax
call fcn.004718f5
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x40c], ecx
mov edx, dword [ebp - 0x40c]
shl edx, 1
mov dword [ebp - 0x410], edx
cmp dword [ebp - 0x410], 0x200
jae 0x40dd81
jmp 0x40dd87
call fcn.0046c1cb
nop
xor eax, eax
mov ecx, dword [ebp - 0x410]
mov word [ebp + ecx - 0x404], ax
mov edx, dword [ebp - 0x40c]
push edx
lea eax, [ebp - 0x404]
push eax
push 1
push 0
push str.update_url
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40ddd3
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x40dde2
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret
Function at 0x40f710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495290
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x639440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x138], ecx
push 0
push 0x1c
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
nop
mov dword [ebp - 0x130], 0
jmp 0x40f777
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x138]
add ecx, 4
call fcn.0040fc60
cmp dword [ebp - 0x130], eax
jae 0x40f840
mov ecx, dword [ebp - 0x138]
add ecx, 4
mov dword [ebp - 0x13c], ecx
mov edx, dword [ebp - 0x130]
push edx
mov ecx, dword [ebp - 0x13c]
call fcn.004077f0
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
call fcn.0040b7e0
movzx eax, al
test eax, eax
je 0x40f83b
mov ecx, dword [ebp - 0x134]
call fcn.0040b800
movzx ecx, al
test ecx, ecx
je 0x40f83b
mov ecx, dword [ebp - 0x134]
call fcn.0040d410
movzx edx, al
test edx, edx
je 0x40f83b
mov eax, dword [ebp - 0x134]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0040aff0
add esp, 8
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x12c]
call fcn.004077b0
push eax
lea edx, [ebp - 0x114]
push edx
call fcn.0040ed20
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00406e70
nop
jmp 0x40f768
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret