joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409090
Capabilities:
Check if file exists
Delete file
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20f]
mov byte [ebp - 0x210], 0
push 0
push eax
call fcn.00434f70
add esp, 0xc
push 0
push 0
push 0x1004
push dword [0x464fc4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x777
push eax
push 0
call fcn.00408c50
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4091ea
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0x210]
push str.Dasm.txt
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, 0x58
lea ecx, [ebp - 0x26c]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec edx
jne 0x409117
lea eax, [ebp - 0x210]
mov dword [ebp - 0x26c], 0x58
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x260], str.Text_file
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x24c], 0x209
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
je 0x4091e0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40919f
push 0x44
push str.Confirmation
push str.File_exist__Replace_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x4091e0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4091df
push 0
lea eax, [ebp - 0x214]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call fcn.00435a6a
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x412d60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push str._r_nModule_list:_names__addresses__sizes__time_stamps_and_file_times:_r_n
push dword [ebp + 8]
call fcn.00413130
add esp, 8
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x40]
xor edx, edx
mov eax, 0x40000000
xor esi, esi
div edi
xor ebx, ebx
shl eax, 2
mov dword [ebp - 4], eax
test eax, eax
je 0x412df1
lea ecx, [ecx]
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov eax, esi
imul eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x412de3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x412de3
div edi
add esi, eax
cmp dword [ebp - 0x10], 0x1000
jne 0x412dec
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jbe 0x412dec
push eax
push dword [ebp + 8]
mov ebx, eax
call fcn.00412fb0
add esp, 8
jmp 0x412dec
mov eax, 0x10000
div edi
add esi, eax
cmp esi, dword [ebp - 4]
jb 0x412da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412e00
Capabilities:
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x25c]
lea eax, [ebp - 0x68]
push dword [ebp - 0x260]
push eax
call fcn.004127a0
lea eax, [ebp - 0x68]
push eax
push str.Error_occurred_at__s._r_n
push esi
call fcn.00413130
add esp, 0x18
lea eax, [ebp - 0x234]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x412e75
push str.Unknown
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0xc8
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x412ea9
push str.Unknown
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x234]
push eax
push str._s__run_by__s._r_n
push esi
call fcn.00413130
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, eax
cmp edx, 0x80000000
jae 0x412ef8
mov ecx, edx
movzx eax, dl
shr ecx, 0x10
push ecx
mov ecx, edx
shr ecx, 8
movzx ecx, cl
push ecx
push eax
push str.Microsoft_Windows_NT_2000_XP__u._u__Build:__u__r_n
push esi
call fcn.00413130
add esp, 0x14
jmp 0x412f3e
mov eax, edx
cmp dl, 4
jae 0x412f25
shr eax, 0x10
and eax, 0xffff7fff
push eax
mov eax, edx
shr eax, 8
movzx eax, al
push eax
movzx eax, dl
push eax
push str.Microsoft_Win32s__u._u__Build:__u__r_n
push esi
call fcn.00413130
add esp, 0x14
jmp 0x412f3e
shr eax, 8
movzx eax, al
push eax
movzx eax, dl
push eax
push str.Microsoft_Windows_9x__u._u_r_n
push esi
call fcn.00413130
add esp, 0x10
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x26c]
push dword [ebp - 0x270]
push str._d_processor_s___type__d._r_n
push esi
call fcn.00413130
add esp, 0x10
mov dword [ebp - 0x254], 0x20
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24c]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory._r_n
push esi
call fcn.00413130
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x412fb0
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x458c60
push 0x4356d0
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x4630b0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x188], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x184]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x413106
mov eax, 0x5a4d
cmp ax, word [esi]
jne 0x413106
mov edi, dword [esi + 0x3c]
cmp dword [edi + esi], 0x4550
jne 0x413106
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov byte [ebp - 0x80], 0
push 0x63
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.00434f70
add esp, 0xc
xor eax, eax
cmp ebx, 0xffffffff
je 0x4130d7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x194]
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4130ca
push str.___file_date_is
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push dword [ebp - 0x190]
push dword [ebp - 0x194]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x80]
push eax
call fcn.004127a0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x80]
push ecx
push dword [edi + esi + 8]
push eax
push esi
lea eax, [ebp - 0x184]
push eax
push str._s__loaded_at_0x_0.8X____d_bytes____0.8X_s_r_n
push dword [ebp - 0x188]
call fcn.00413130
add esp, 0x1c
jmp 0x413106
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x419070
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x30], eax
xor eax, eax
movlpd qword [ebp - 0x38], xmm0
cmp dword [eax + 0x44eb7c], edx
je 0x4190f2
add eax, 0x1c
inc ecx
cmp eax, 0x444
jb 0x419095
mov ecx, dword [ebp - 0x38]
cmp dword [0x465a24], 0
xorps xmm0, xmm0
mov eax, dword [0x465a20]
push esi
push edi
mov dword [ebp - 0x2c], 0
movdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 8], 0
movdqu xmmword [ebp - 0x18], xmm0
je 0x419132
sub ecx, dword [eax + 0x30]
push ecx
push dword [0x465a1c]
mov ecx, 0x465a18
push eax
call fcn.00423c70
mov edi, 8
jmp 0x41914a
lea eax, [ecx*8]
sub eax, ecx
cmp dword [0x465a24], 0
je 0x419119
mov eax, dword [eax*4 + 0x44eb8c]
test eax, eax
je 0x4190a8
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x34], eax
jmp 0x4190ab
mov ecx, dword [eax*4 + 0x44eb84]
test ecx, ecx
je 0x4190a8
mov ecx, dword [ecx]
mov dword [ebp - 0x34], 0
jmp 0x4190ab
sub ecx, dword [eax + 0x34]
push ecx
push dword [0x465a1c]
push eax
call fcn.00423cb0
add esp, 0xc
mov edi, 4
push 0
push dword [0x465a38]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
cmp esi, ecx
jbe 0x419186
mov eax, dword [ebp - 0x30]
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Invalid_entry_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
lea eax, [edi + esi]
xor edx, edx
cmp eax, ecx
cmova edi, edx
test esi, esi
jne 0x4191bd
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Cant_find_offset_
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
mov ecx, 0x465a18
mov dword [ebp - 0x2c], 0x148
call fcn.00423850
push 0
push dword [0x465a38]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
mov eax, dword [0x465a30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
lea eax, [esi - 1]
add eax, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.HEdit.dll_HESetInternalOptions]
call dword [sym.imp.HEdit.dll_HEShowWindow]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x41a4c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push ebx
lea eax, [edi + 0x18]
mov dword [edi + 8], esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80000a7
push 3
push 0
push 1
test esi, esi
je 0x41a553
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
je 0x41a54a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x14], eax
test eax, eax
je 0x41a54a
push 0
push eax
push 0
push 2
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 0x10], eax
cmp eax, 0xffffffff
je 0x41a54a
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 4], eax
test eax, eax
jne 0x41a5ba
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
je 0x41a54a
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0x900c4
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x14], eax
test eax, eax
je 0x41a54a
push 0
push eax
push 0
push 4
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 0x10], eax
cmp eax, 0xffffffff
je 0x41a54a
push 0
push 0
push 0
push 2
jmp 0x41a533
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8

Function at 0x41c950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push str.exefile_shellBreak__Enter__PE_Tools_command
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41ca09
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call fcn.00434f70
mov eax, dword [0x468b04]
lea edx, [ebp - 0x20c]
add esp, 0xc
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x41c9b0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.__BREAKENTER___1_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x41d630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x228], 0
xor esi, esi
movdqu xmmword [ebp - 0x224], xmm0
movq qword [ebp - 0x214], xmm0
jmp 0x41d670
lea edi, [ebp - 0x228]
add edi, esi
push edi
push dword [esi + 0x462dfc]
push 0x80000000
call ebx
test eax, eax
jne 0x41d72a
push 0x103
push eax
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x20b]
push eax
call fcn.00434f70
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00434f70
add esp, 0x18
lea eax, [ebp - 0x20c]
push dword [0x468b04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.__PESNIFFER___1_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
add esi, 4
cmp esi, 0x1c
jb 0x41d670
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004344b4
mov esp, ebp
pop ebp
ret

Function at 0x41d740
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
push edi
xor esi, esi
jmp 0x41d750
push dword [esi + 0x462dfc]
push 0x80000000
call ebx
push dword [esi + 0x462e18]
mov edi, eax
push 0x80000000
call ebx
test edi, edi
je 0x41d774
test eax, eax
jne 0x41d77c
add esi, 4
cmp esi, 0x1c
jb 0x41d750
pop edi
pop esi
pop ebx
ret

Function at 0x41d800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x228], 0
xor esi, esi
movdqu xmmword [ebp - 0x224], xmm0
movq qword [ebp - 0x214], xmm0
jmp 0x41d840
lea edi, [ebp - 0x228]
add edi, esi
push edi
push dword [esi + 0x462e34]
push 0x80000000
call ebx
test eax, eax
jne 0x41d8fa
push 0x103
push eax
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x20b]
push eax
call fcn.00434f70
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00434f70
add esp, 0x18
lea eax, [ebp - 0x20c]
push dword [0x468b04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.__REBUILDPE___1_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
add esi, 4
cmp esi, 0x1c
jb 0x41d840
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x41d910
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
push edi
xor esi, esi
jmp 0x41d920
push dword [esi + 0x462e34]
push 0x80000000
call ebx
push dword [esi + 0x462e50]
mov edi, eax
push 0x80000000
call ebx
test edi, edi
je 0x41d944
test eax, eax
jne 0x41d94c
add esi, 4
cmp esi, 0x1c
jb 0x41d920
pop edi
pop esi
pop ebx
ret

Function at 0x41d950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x228], 0
xor esi, esi
movdqu xmmword [ebp - 0x224], xmm0
movq qword [ebp - 0x214], xmm0
jmp 0x41d990
lea edi, [ebp - 0x228]
add edi, esi
push edi
push dword [esi + 0x462dc4]
push 0x80000000
call ebx
test eax, eax
jne 0x41da4a
push 0x103
push eax
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x20b]
push eax
call fcn.00434f70
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00434f70
add esp, 0x18
lea eax, [ebp - 0x20c]
push dword [0x468b04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.__PEEDITOR___1_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
add esi, 4
cmp esi, 0x1c
jb 0x41d990
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004344b4
mov esp, ebp
pop ebp
ret

Function at 0x41da60
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
push edi
xor esi, esi
jmp 0x41da70
push dword [esi + 0x462dc4]
push 0x80000000
call ebx
push dword [esi + 0x462de0]
mov edi, eax
push 0x80000000
call ebx
test edi, edi
je 0x41da94
test eax, eax
jne 0x41da9c
add esi, 4
cmp esi, 0x1c
jb 0x41da70
pop edi
pop esi
pop ebx
ret
Function at 0x41e050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x34
push str.PE_Tools_v1.9.762.2018_build
push str.WARNING:_Debugging_this_process_may_result_in_loss_of_data._nAre_you_sure_you_wish_to_attach_the_debugger_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x41e110
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [0x467bb0]
push str._s__p__ld
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x40
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x260], 0x44
push 0
push eax
call fcn.00434f70
add esp, 0x1c
lea eax, [ebp - 0x21c]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x21c], xmm0
push eax
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41e121
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41e137
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.Unable_to_Attach_Debugger_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004344b4
mov esp, ebp
pop ebp
ret
Function at 0x41e1d0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x117]
push 0x103
push 0
push eax
mov byte [ebp - 0x118], 0
call fcn.00434f70
push 0x15c
lea eax, [ebp - 0x274]
mov dword [ebp - 0x278], 0
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x14], xmm0
call fcn.00434f70
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x18
mov dword [0x467b30], 0
push 0xffffffffffffffff
push 0
push 1
push 0x1002
push dword [0x467b44]
call esi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
push 0
push 0
push 0x1009
push dword [0x467b44]
call esi
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x2b4], 2
push eax
push dword [0x467b34]
mov dword [ebp - 0x2a4], 9
push 0x102d
push dword [0x467b40]
mov dword [ebp - 0x2a8], 0x465444
call esi
push 0x465444
call fcn.00415680
mov ebx, eax
push ebx
mov dword [ebp - 0x27c], ebx
call fcn.00428bd0
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.00428750
add esp, 0x10
test eax, eax
je 0x41e40a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebx, [ebx]
push 0x160
lea eax, [ebp - 0x278]
push 0
push eax
call fcn.00434f70
push dword [ebp - 0x280]
push dword [0x467b30]
push str.Building_module_list..._d_of__d
push 0x467800
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0x467800
push 0
push 0x401
push dword [0x467ba0]
call esi
test edi, edi
je 0x41e33b
push 0x467800
push 0x472
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0xc], 0
lea eax, [ebp - 0x118]
push eax
push 0x467908
je 0x41e356
call ebx
mov eax, dword [0x467b38]
jmp 0x41e3a1
call ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x467908
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push 0x4101
push 0x160
lea eax, [ebp - 0x278]
push eax
push 0x80
push 0x467908
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp - 0x278]
test eax, eax
cmove eax, dword [0x467b38]
push eax
push 0xffffffffffffffff
push dword [0x467bac]
mov dword [0x467b3c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [0x467b3c]
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push 0x467908
push dword [0x467b44]
call fcn.0041de80
inc dword [0x467b30]
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x27c]
call fcn.00428ad0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x28
test eax, eax
jne 0x41e2e0
call fcn.00428c50
push eax
push str.Processes_loaded:__d
push 0x467800
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x467800
push 0
push 0x401
push dword [0x467ba0]
call esi
test edi, edi
je 0x41e44c
push 0x467800
push 0x472
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004344b4
mov esp, ebp
pop ebp
ret