joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402080
Capabilities:
Lock the desktop

Disassembly:
push ecx
push esi
call dword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x402093
mov al, 1
pop esi
pop ecx
ret 4
cmp dword [0x62db64], 0xffffffff
jae 0x4020a7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
jmp 0x4020ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4020b9
push eax
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x4020bf
push eax
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x402103
push dword ds:[esi + 4]
push 0x5d369c
push str.Unable_to_lock_the_computer.
push 0xfffe
push 0x20
push dword [esp + 0x20]
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40211b
call fcn.004fe0c0
xor al, al
pop esi
pop ecx
ret 4
push str.Unable_to_lock_the_computer.
push 0x5d369c
push 0x10
push dword [esp + 0x18]
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
xor al, al
pop esi
pop ecx
ret 4

Function at 0x402140
Capabilities:
Shutdown system

Disassembly:
push ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x402157
mov al, 1
pop esi
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax]
test eax, eax
jne 0x40216c
push eax
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x402172
push eax
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x4021b2
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_log_off_the_computer.
push 0xfffe
push 0x20
push dword [esp + 0x20]
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4021ca
call fcn.004fe0c0
xor al, al
pop esi
pop ecx
ret 4
push str.Unable_to_log_off_the_computer.
push 0x5d369c
push 0x10
push dword [esp + 0x18]
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
xor al, al
pop esi
pop ecx
ret 4
Function at 0x4029e0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0xc
dec eax
push esi
cmp eax, 5
ja case.0x4029f3.4
jmp dword [eax*4 + 0x402b98]
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
mov esi, dword [ebp + 8]
test eax, eax
je 0x402a33
push 0
push 0
push str.the_computer
push str.shut_down
push esi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.0x4029f3.4
mov ecx, dword [ebp + 0x10]
or ecx, 2
call fcn.0050cf40
nop
test eax, eax
je 0x402b8e
push eax
push 0
push str.Unable_to_shut_down_the_computer.
push esi
call sym.SystemInformer.exe_Ordinal_1701
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.shut_down
push str.preforms_a_hard
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004019c0
mov esi, dword [ebp + 8]
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.shut_down
push esi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.0x4029f3.4
push 2
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
nop word [eax + eax]
test eax, eax
jns 0x402b8e
push 0
push eax
push str.Unable_to_shut_down_the_computer.
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1701
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.shut_down
push str.forces_a_critical
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004019c0
mov esi, dword [ebp + 8]
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.shut_down
push esi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.0x4029f3.4
push 0x80000000
push 6
push 6
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x402b8e
push 0
push eax
push str.Unable_to_shut_down_the_computer.
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1701
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
mov esi, dword [ebp + 8]
test eax, eax
je 0x402b6d
push 0
push 0
push str.the_computer
push str.update_and_shutdown
push esi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.0x4029f3.4
push 0x80000000
push 0x49
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
jne 0x402a48
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402bc0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edx
push eax
mov edi, ecx
mov dword [esp + 0x1c], 0x1c
mov esi, 0xc0000001
mov dword [esp + 0x20], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x402c0d
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je 0x402db4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x34
push eax
mov dword [esp + 0x20], str.EnableBootObjectsEnumerate
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x18], 0x48
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], str.EnableUpdateDefaultFirmwareBootEntry
push eax
setne bl
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov cl, bl
setne bh
call fcn.0051f940
mov ebp, eax
test ebp, ebp
je 0x402d1e
mov edx, dword [esp + 0x14]
cmp edx, dword [ebp]
jae 0x402c87
lfence
mov eax, dword [ebp + 8]
sub esp, 0x10
mov cl, bh
mov edx, dword [eax + edx*4]
mov eax, esp
movups xmm0, xmmword [edx]
movups xmmword [eax], xmm0
call fcn.0051f280
mov esi, eax
mov ecx, ebp
mov ebx, esi
call fcn.0051fae0
test esi, esi
js 0x402cfa
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402db4
push eax
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x402d9f
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402db4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.004fe0c0
mov esi, ebx
cmp ebx, 0xc0000022
je 0x402d10
cmp esi, 0xc0000005
jne 0x402d1e
mov esi, ebx
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x402d41
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x402d31
movzx eax, si
jmp 0x402d41
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x402d50
mov eax, esi
test eax, eax
je 0x402d50
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
jmp 0x402d59
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
mov esi, eax
test esi, esi
je 0x402d9f
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402db4
lfence
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.004fe0c0
push str.Unable_to_configure_the_boot_application.
push 0x5d369c
push 0x10
push edi
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x405ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [esp + 0x18], eax
xor edi, edi
mov al, 1
mov dword [esp + 0x14], ecx
mov byte [esp + 0x13], al
cmp dword [ebp + 0x10], edi
jbe 0x4060cd
mov eax, dword [ecx + edi*4]
mov ebx, dword [0x635a90]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x18
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
push eax
push 0x100
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], 0
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.ntdll.dll_NtOpenProcess]
mov esi, eax
cmp esi, 0xc0000022
jne 0x405fd7
cmp ebx, 5
jne 0x405fa7
lea eax, ds:[esp + 0x1c]
mov edx, 0x100
push eax
lea ecx, [esp + 0x40]
call fcn.00524800
mov esi, eax
cmp esi, 0xc0000022
jne 0x405fd7
cmp dword [0x635a90], 5
jne 0x40606a
mov eax, dword [esp + 0x14]
mov eax, dword [eax + edi*4]
push dword [eax + 0x10]
lea eax, [esp + 0x40]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
mov esi, eax
test esi, esi
js 0x40606a
mov ebx, dword [esp + 0x3c]
lea eax, [esp + 0x40]
push 0x38
xorps xmm0, xmm0
mov dword [esp + 0x4c], 0xffffffff
push eax
push 1
push ebx
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
mov dword [esp + 0x5c], 0xffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov esi, eax
cmp esi, 0xc0000022
jne 0x406057
cmp dword [0x635a90], 5
nop
jne 0x406057
push 0x38
lea eax, [esp + 0x44]
mov edx, 0xc
push eax
mov ecx, ebx
call fcn.005251c0
mov esi, eax
push dword ds:[esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x4060e3
mov eax, dword ds:[esp + 0x14]
xor bl, bl
mov byte [esp + 0x13], bl
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x10], 0
lfence
jl 0x40609f
push dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push str.reduce_the_working_set_of
push str.Unable_to__s__s__PID__lu_
call fcn.004019c0
add esp, 0x10
jmp 0x4060b7
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push str.reduce_the_working_set_of
push str.Unable_to__s__s
call fcn.004019c0
add esp, 0xc
mov eax, dword [eax + 4]
push 0
push esi
push eax
push dword [esp + 0x24]
call sym.SystemInformer.exe_Ordinal_1696
test al, al
jne 0x4060e7
mov al, bl
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 0xc
mov bl, byte [esp + 0x13]
inc edi
cmp edi, dword [ebp + 0x10]
jae 0x4060cb
mov ecx, dword [esp + 0x14]
jmp 0x405f16
Function at 0x412880
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
cmp dword [eax], esi
jne 0x4128b8
cmp dword [eax + 8], 0xffffff65
jne 0x4128b8
movzx eax, word [eax + 0xc]
sub eax, 0x41
je 0x4128b8
nop
sub eax, 2
jne 0x4128b8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4128b8
push esi
call sym.SystemInformer.exe_Ordinal_1004
pop esi
ret 8

Function at 0x4128c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
cmp dword [eax], esi
jne 0x412928
cmp dword [eax + 8], 0xffffff65
jne 0x412928
movzx eax, word ds:[eax + 0xc]
sub eax, 0x41
je 0x41290a
sub eax, 2
jne 0x412928
test byte [esp + 0x14], 1
je 0x412928
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x412928
push esi
call sym.SystemInformer.exe_Ordinal_1004
pop esi
pop ecx
ret 0xc
test byte [esp + 0x14], 2
je 0x412928
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x412928
push 2
push 2
push esi
call sym.SystemInformer.exe_Ordinal_1822
pop esi
pop ecx
ret 0xc

Function at 0x413500
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
sub esp, 0x10
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, edx
mov esi, ecx
xor bl, bl
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov bh, byte [eax + 1]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov byte [eax + 1], bl
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x60
push 0
push 0
push 0
push edi
push esi
call sym.SystemInformer.exe_Ordinal_1606
test eax, eax
js 0x4135cf
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push 4
push eax
push 0x1e
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x4135c6
push 0
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 1
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtSetInformationDebugObject]
test eax, eax
js 0x4135b7
push dword [esp + 0x10]
push esi
call dword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
push dword ds:[esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
push esi
mov bl, 1
call dword [sym.imp.ntdll.dll_NtClose]
test bh, bh
je 0x413606
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov byte [ecx + 1], bh
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x1c]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov ecx, dword [esp + 0x18]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x10
ret
Function at 0x414da0
Capabilities:
Delete registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push edi
push 0
push str.RegEdit_RegEdit
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
jne 0x414dfb
push dword ds:[esp + 0x10]
push esi
call sym.SystemInformer.exe_Ordinal_1142
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1518
test byte [eax + 4], 1
jne 0x414e2d
push 0
push 0
push esi
call sym.SystemInformer.exe_Ordinal_1184
test al, al
jne 0x414e2d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 0x62de04
push 0xfffffffffffffff7
push 0x20006
lea eax, [esp + 0x4c]
push eax
call sym.SystemInformer.exe_Ordinal_1470
test eax, eax
js 0x414f30
movups xmm0, xmmword [str.A_SystemInformer]
push 0x11
lea eax, [esp + 0x5c]
movups xmmword [esp + 0x3c], xmm0
push eax
movups xmm0, xmmword [0x5fbed8]
movups xmmword [esp + 0x50], xmm0
call sym.SystemInformer.exe_Ordinal_1633
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x40
call fcn.004fa560
mov esi, eax
mov dword [esp + 0x10], 0x420040
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], ecx
mov eax, dword [esi]
add eax, 2
push eax
push dword [esi + 4]
lea eax, [esp + 0x18]
push 1
push 0
push eax
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x414ecf
call fcn.004fe0c0
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1518
lea edx, [esp + 0x18]
mov ecx, edi
mov al, byte [eax + 4]
not al
and al, 1
movzx eax, al
push eax
call fcn.00414840
mov edx, dword [esp + 0x18]
mov bl, al
mov word [esp + 0x10], dx
lea ecx, [edx + 2]
mov word [esp + 0x12], cx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
cmp edx, 0xfffe
ja 0x414f26
lea eax, ds:[esp + 0x10]
push eax
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1518
test byte ds:[eax + 4], 1
jne 0x414f47
call sym.SystemInformer.exe_Ordinal_1190
mov ecx, dword [esp + 0x84]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 8
Function at 0x418c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov ebx, dword [esp + 0x5c]
lea eax, [edx - 2]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, dword [esp + 0x6c]
cmp eax, 0x17
ja case.0x418ca0.7
movzx eax, byte [eax + 0x418ddc]
nop dword [eax]
jmp dword [eax*4 + 0x418dc4]
mov eax, dword [esi + 8]
cmp eax, dword [edi + 4]
jb case.0x418ca0.5
lea edx, ds:[esp + 0x34]
push edx
push eax
push 0x407
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x418ca0.5
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x14]
jmp 0x418cff
mov ecx, dword [esi + 4]
jmp 0x418cf0
mov eax, dword [esi + 4]
cmp eax, dword [edi + 4]
jb case.0x418ca0.5
mov ecx, dword [esi + 8]
jmp 0x418cff
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 4]
jb case.0x418ca0.5
mov ecx, dword [ecx + 8]
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x10]
add eax, 0x78
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
call sym.SystemInformer.exe_Ordinal_1410
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00583f7f
add esp, 0x50
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je case.0x418ca0.5
xor ebx, ebx
cmp dword [eax], ebx
jbe case.0x418ca0.5
xor ebp, ebp
nop word [eax + eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + ebp]
mov dword [esp + 0x1c], ecx
add eax, 0x78
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call sym.SystemInformer.exe_Ordinal_1410
mov eax, dword [edi + 0x18]
lea ebp, [ebp + 4]
mov ecx, dword [esp + 0x10]
inc ebx
mov edx, dword [esp + 0x14]
cmp ebx, dword [eax]
jb 0x418d60
mov ecx, dword [esp + 0x5c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x50
ret 0xc
Function at 0x41a560
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x48c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
mov ebx, dword [esp + 0x494]
lea eax, [esp + 0x7c]
push esi
mov dword [esp + 0x1c], eax
mov esi, ecx
push edi
lea eax, [esp + 0x28c]
mov dword [esp + 0xc], 0xd
mov dword [esp + 0x5c], eax
mov edi, edx
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0
push 0x104b
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x34], 0x208
mov dword [esp + 0x58], 0xd
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0
mov dword [esp + 0x70], 0x208
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41a639
lea eax, [esp + 0x48]
push eax
push 0
push 0x104b
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41a639
lea eax, [esp + 0xc]
mov dword [esp + 0x10], ebx
push eax
push 0
push 0x104c
push esi
mov dword [esp + 0x5c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x48]
push eax
push 0
push 0x104c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x494]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x48c
ret 4
Function at 0x41e820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x14
push esi
push edi
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0x14
xor ecx, ecx
mov dword [esp + 0x14], 0x5fd29c
call fcn.00528da0
mov esi, eax
test esi, esi
je 0x41e871
push 0
mov edx, 0x5fd2b4
mov ecx, esi
call fcn.00528e80
push 0
mov edx, 0x5fd2c4
mov dword [0x633cb4], eax
mov ecx, esi
call fcn.00528e80
mov dword [0x633ca8], eax
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0x16
xor ecx, ecx
mov dword [esp + 0x14], str.uxtheme.dll
call fcn.00528da0
test eax, eax
je 0x41e8a3
push 0
mov edx, str.DrawThemeBackground
mov ecx, eax
call fcn.00528e80
mov dword [0x633ca0], eax
cmp dword [0x635f50], 0
je 0x41e8bf
mov esi, 0xc0000476
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x41ea18
mov eax, dword fs:[0x18]
mov edx, 0x635f50
mov ecx, dword [eax + 0x24]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41e8ea
mov esi, 0xc0000476
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x41ea18
mov edi, dword [0x635f5c]
mov dword [0x635f64], 0
mov dword [0x635f60], 0
mov dword [0x635f58], 0
test edi, edi
je 0x41e94c
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x40
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x10000
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov esi, eax
test esi, esi
js 0x41e94e
mov edi, dword [edi + 4]
test edi, edi
jne 0x41e912
xor esi, esi
mov dword [0x635f4c], esi
test esi, esi
js 0x41e9c8
cmp byte [0x6330fd], 0
nop
jne 0x41e96b
cmp byte [0x6330fe], 0
je 0x41e99c
sub esp, 0xc
mov edx, 0x41e5e0
mov ecx, 0x633ca0
call fcn.00536620
mov esi, eax
test esi, esi
js 0x41e9c8
sub esp, 0xc
mov edx, 0x41e780
mov ecx, 0x633ca8
call fcn.00536620
mov esi, eax
test esi, esi
js 0x41e9c8
sub esp, 0xc
mov edx, 0x41e6e0
mov ecx, 0x633cb4
call fcn.00536620
mov esi, eax
test esi, esi
js 0x41e9c8
call fcn.00536340
mov esi, eax
nop dword [eax + eax]
test esi, esi
jns 0x41ea73
cmp esi, 0xc0000022
je 0x41e9f5
cmp esi, 0xc0000005
je 0x41e9f5
mov eax, esi
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x41e9ec
movzx eax, si
jmp 0x41e9ff
cmp eax, 0xb
jne 0x41ea04
mov eax, esi
jmp 0x41e9ff
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x41ea0f
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x41ea18
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x41ea5d
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_commit_detours_transaction.
push 0xfffe
push 0x20
push 0
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x41ea73
lfence
pop edi
pop esi
add esp, 0x14
jmp fcn.004fe0c0
push str.Unable_to_commit_detours_transaction.
push 0x5d369c
push 0x10
push 0
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
pop edi
pop esi
add esp, 0x14
ret
Function at 0x439d20
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x130
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x128], eax
test byte [0x62e3b8], 1
push esi
jne 0x439de5
mov esi, 0x62e3b8
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x439d5b
mov al, 1
jmp 0x439d6f
test byte [0x62e3b8], 1
jne 0x439d6d
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_Ordinal_1388
xor al, al
test al, al
je 0x439de5
push 0x120
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005861b0
add esp, 0xc
mov dword [esp + 4], 0x120
lea eax, [esp + 4]
push eax
push 0x120
lea eax, [esp + 0x10]
push eax
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
je 0x439dd6
cmp eax, 0xc0000004
jne 0x439dd6
cmp dword [esp + 8], 1
jb 0x439dd6
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439dc0
sub ecx, edx
lea eax, [esp + 0x28]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1315
jmp 0x439dd8
xor eax, eax
mov ecx, esi
mov dword [0x633db4], eax
call sym.SystemInformer.exe_Ordinal_1358
mov eax, dword [0x633db4]
test eax, eax
je 0x439e0c
lock inc dword ds:[eax - 4]
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00583f7f
add esp, 0x130
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00583f7f
add esp, 0x130
ret