joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4246c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x46b3db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4871a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0044db68
push 4
mov dword [esp + 0x20], 0
call fcn.0044ff4d
mov edi, eax
add esp, 4
test edi, edi
je 0x42473e
call fcn.0044d6f3
mov dword [edi], eax
call fcn.0044d521
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0044d445
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x424733
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0044d46d
jmp 0x424740
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x425b30
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46f516
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
push edi
mov eax, dword [0x4871a0]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
push 0x100
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0x80
call fcn.00453e20
mov ebx, dword [0x48b9d0]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x4791c8
shr ecx, 0x10
add esp, 0xc
mov dword [esp + 0x18], ebx
test ecx, ecx
jne 0x425ca2
mov edx, 0x4791c8
movzx ecx, dx
lea edx, [esp + 0x18]
call fcn.0040d380
mov ebx, dword [esp + 0x18]
mov edx, 0x477c20
mov dword [esp + 0x138], 0
mov esi, dword [0x48b9d0]
shr edx, 0x10
mov dword [esp + 0x14], esi
test edx, edx
jne 0x425cec
mov eax, 0x477c20
movzx ecx, ax
lea edx, [esp + 0x14]
call fcn.0040d380
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
push ebx
push 0x80000002
mov byte [esp + 0x150], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esp + 0x24], 1
jne 0x425d4a
cmp word [esp + 0x2c], 0
je 0x425d4a
cmp dword [esp + 0x1c], 0
jbe 0x425d4a
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x425d36
lea eax, [esp + 0x28]
push eax
lea edi, [esp + 0x24]
lea ebx, [esp + 0x30]
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
call fcn.00405e30
add esp, 4
cmp dword [esp + 0x20], 0
je 0x425d36
lea esi, [esp + 0x14]
call fcn.0040e0c0
lea esi, [esp + 0x18]
call fcn.0040e0c0
mov eax, 1
jmp 0x425d8e
push 0x4791c8
call edi
mov esi, eax
test esi, esi
je 0x425bc3
mov ecx, esi
lea edx, [esp + 0x18]
call fcn.0040e0f0
test eax, eax
je 0x425bbf
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x425bbf
mov ebx, dword [esp + 0x18]
push eax
push 0x4791c8
push ebx
call fcn.00454ea0
add esp, 0xc
jmp 0x425bc3
push 0x477c20
call edi
mov edi, eax
test edi, edi
je 0x425bfd
mov ecx, edi
lea edx, [esp + 0x14]
call fcn.0040e0f0
test eax, eax
je 0x425bf9
lea eax, [edi + edi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x425bf9
mov esi, dword [esp + 0x14]
push eax
push 0x477c20
push esi
call fcn.00454ea0
add esp, 0xc
jmp 0x425bfd
lea esi, [esp + 0x14]
call fcn.0040e0c0
lea esi, [esp + 0x18]
call fcn.0040e0c0
jmp 0x425d8c
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [esi - 0xc]
cmp ecx, 0x48b9c0
je 0x425d6e
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x425d6e
push esi
call fcn.004501ef
add esp, 4
lea edx, [ebx - 0xc]
cmp edx, 0x48b9c0
je 0x425d8c
lea esi, [ebx - 0xc]
push esi
call edi
test eax, eax
jg 0x425d8c
push esi
call fcn.004501ef
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0044fcda
add esp, 0x12c
ret
Function at 0x425f40
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry value

Disassembly:
sub esp, 0x82c
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
push edi
xor edi, edi
mov dword [esp + 0x20], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se.exe
mov dword [esp + 0x24], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
mov dword [esp + 0x28], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_5.exe
mov dword [esp + 0x2c], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
xor esi, esi
push 0x800
lea eax, [esp + 0x34]
push edi
mov ebx, 1
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0x400
call fcn.00453e20
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + esi*4 + 0x24]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x24]
push eax
push 0x477c20
push ecx
push 0x80000002
call ebp
test eax, eax
jne 0x426012
cmp dword [esp + 0x1c], ebx
jne 0x426012
cmp word [esp + 0x30], di
je 0x426012
cmp dword [esp + 0x18], edi
jbe 0x426012
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426012
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
push eax
lea edi, [esp + 0x18]
lea ebx, [esp + 0x34]
call fcn.00405e30
add esp, 4
cmp dword [esp + 0x14], 0
jne 0x42604d
xor edi, edi
inc esi
cmp esi, 4
jb 0x425f82
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360se6
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426054
mov edx, dword [esp + 0x10]
push edx
lea esi, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x426056
mov eax, 1
jmp 0x426056
xor eax, eax
mov ecx, dword [esp + 0x834]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044fcda
add esp, 0x82c
ret

Function at 0x426cd0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x46cb61
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4871a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
mov dword [edi], vtable.CCommandParser.0
mov eax, dword [0x48b9d0]
mov dword [edi + 4], eax
mov dword [esp + 0x1c], 0
mov ecx, dword [0x48b9d0]
mov dword [edi + 8], ecx
mov edx, dword [0x48b9d0]
lea esi, [edi + 0xc]
mov dword [esi], edx
mov byte [esp + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
test ebp, ebp
je 0x426d3a
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
mov ebx, eax
call fcn.0040e190
push edi
call fcn.00426e10
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4270a0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x3a8
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x3a4], eax
mov eax, dword [esp + 0x3b0]
push ebp
mov ebp, dword [esp + 0x3b0]
xor ecx, ecx
push 0x18e
push ecx
lea edx, [esp + 0x222]
push edx
mov dword [esp + 0x10], eax
mov word [esp + 0x224], cx
call fcn.00453e20
add esp, 0xc
lea eax, [esp + 0x218]
push eax
push 0xc7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x427114
pop ebp
mov ecx, dword [esp + 0x3a4]
xor ecx, esp
call fcn.0044fcda
add esp, 0x3a8
ret
push ebx
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x22]
push edx
mov word [esp + 0x24], cx
call fcn.00453e20
mov eax, dword [0x4799cc]
mov cx, word [0x4799d0]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
add esp, 0xc
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
lea edi, [esp + 0x220]
push esi
mov dx, word [edi]
push 0x104
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + 0x20], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4271b0
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
jmp 0x427180
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427180
sub eax, edx
sar eax, 1
mov esi, eax
mov edx, 0x5c
mov word [esp + esi*2 + 0x1c], dx
inc esi
push esi
lea ecx, [esp + 0x20]
push ecx
xor eax, eax
push ebp
mov word [esp + esi*2 + 0x28], ax
call ebx
test eax, eax
je 0x4271db
mov dx, word [edi]
add edi, 2
test dx, dx
jne 0x4271b0
cmp word [edi], dx
jne 0x427153
xor eax, eax
mov ecx, dword [esp + 0x3b4]
pop esi
pop edi
pop ebx
pop ebp
xor ecx, esp
call fcn.0044fcda
add esp, 0x3a8
ret
mov ebx, dword [esp + 0x10]
lea eax, [ebp + esi*2]
push eax
lea ecx, [esp + 0x18]
push ecx
push str._s_s
mov ecx, 0x104
call fcn.004101d0
add esp, 0xc
mov eax, 1
jmp 0x4271c2

Function at 0x427210
Capabilities:
Get disk size

Disassembly:
sub esp, 0x238
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
xor ebx, ebx
xor eax, eax
cmp esi, ebx
je 0x4272b5
push 0x208
lea ecx, [esp + 0x26]
push ebx
push ecx
mov word [esp + 0x2c], ax
call fcn.00453e20
push ebx
push ebx
push ebx
lea edx, [esp + 0x38]
push edx
push esi
call fcn.00453468
add esp, 0x20
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4272b3
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [edi], ecx
mov dword [edi + 4], edx
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0044fcda
add esp, 0x238
ret
xor eax, eax
mov ecx, dword [esp + 0x234]
pop ebx
xor ecx, esp
call fcn.0044fcda
add esp, 0x238
ret
Function at 0x427980
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x42799f
test byte [esp], 7
je 0x42799f
mov eax, 1
pop ecx
ret
call fcn.004278e0
pop ecx
ret

Function at 0x427a80
Capabilities:
Get file version info

Disassembly:
mov eax, 0x2010
call fcn.00456af0
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x200c], eax
test esi, esi
je 0x427b63
test edi, edi
je 0x427b63
push 0x2000
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.00453e20
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x427b63
cmp eax, 0x1fff
ja 0x427b63
lea edx, [esp + 0xc]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x427b63
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0x478028
lea edx, [esp + 0x18]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x427b63
push 0x104
push 0
push edi
call fcn.00453e20
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push str._d._d._d._d
push 0x104
push edi
call fcn.00428ce0
add esp, 0x28
mov eax, 1
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0044fcda
add esp, 0x2010
ret
mov ecx, dword [esp + 0x200c]
xor ecx, esp
xor eax, eax
call fcn.0044fcda
add esp, 0x2010
ret

Function at 0x427d40
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push esi
push edi
push 0xff
lea eax, [esp + 0x11]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x18], 0
call fcn.00453e20
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
test eax, eax
je 0x427d9d
test byte [esp + 0x1e], 0x80
jne 0x427d9d
push esi
push 1
push esi
push 0x12
call ebx
mov esi, 1
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, eax
test esi, esi
je 0x427db4
push 0
push 3
push 0
push 0x12
call ebx
mov ecx, dword [esp + 0x10c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044fcda
add esp, 0x104
ret
push esi
mov esi, eax
call fcn.00427dd0
test eax, eax
jne 0x427f14
mov ecx, esi
pop esi
jmp 0x427d40
pop esi
ret
Function at 0x427dd0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
test eax, eax
jne 0x427de8
add esp, 8
ret
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
jne 0x427e02
mov eax, 1
add esp, 8
ret
push ebx
push edi
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
cmp edi, ebx
je 0x427ee3
push ebp
push 1
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
test eax, eax
je 0x427e5e
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
push edx
call fcn.00427d00
add esp, 4
test eax, eax
je 0x427ec6
push esi
call ebp
test eax, eax
je 0x427ea3
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
test eax, eax
je 0x427eab
push esi
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
add esp, 8
ret
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
add esp, 8
ret
push 0
push edi
push ebx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
add esp, 8
ret
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 8]
pop edi
pop ebx
add esp, 8
ret

Function at 0x427f00
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push esi
push edi
push 0xff
lea eax, [esp + 0x11]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x18], 0
call fcn.00453e20
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
test eax, eax
je 0x427d9d
test byte [esp + 0x1e], 0x80
jne 0x427d9d
push esi
push 1
push esi
push 0x12
call ebx
mov esi, 1
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, eax
test esi, esi
je 0x427db4
push 0
push 3
push 0
push 0x12
call ebx
mov ecx, dword [esp + 0x10c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044fcda
add esp, 0x104
ret
push esi
mov esi, eax
call fcn.00427dd0
test eax, eax
jne 0x427f14
mov ecx, esi
pop esi
jmp 0x427d40
pop esi
ret
Function at 0x427f60
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x414
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov eax, ebx
mov esi, ecx
call fcn.00414170
test esi, esi
je 0x428031
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x428031
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.00453e20
add esp, 0xc
push 0x104
lea edx, [esp + 8]
push edx
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x427fe4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0044fcda
add esp, 0x414
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call fcn.00453e20
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004270a0
add esp, 0x14
test eax, eax
je 0x427fcc
push edi
lea edi, [esp + 0x210]
mov eax, ebx
call fcn.0040e210
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebx]
xor eax, eax
cmp dword [ecx - 8], eax
mov ecx, dword [esp + 0x414]
setg al
pop esi
xor ecx, esp
call fcn.0044fcda
add esp, 0x414
ret

Function at 0x428060
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x23c]
mov ebx, ecx
push esi
mov eax, ebx
call fcn.00414170
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4280b1
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0044fcda
add esp, 0x230
ret
push edi
push 0x228
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00453e20
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x22c
xor edi, edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4280fb
nop
cmp dword [esp + 0x18], ebp
je 0x4280f7
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4280e0
jmp 0x4280fb
mov edi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.00427f60
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044fcda
add esp, 0x230
ret

Function at 0x428130
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0xc
lea ecx, [esp]
push ecx
push 0x427050
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 4]
add esp, 0xc
ret
Function at 0x428160
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4281cc
push 0x228
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00453e20
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push esi
mov dword [esp + 0xc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4281c5
cmp dword [esp + 0xc], edi
je 0x4281e5
lea edx, [esp + 4]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4281b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0044fcda
add esp, 0x230
ret
mov ecx, dword [esp + 0x230]
mov eax, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.0044fcda
add esp, 0x230
ret

Function at 0x428aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
push esi
add eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428b0b
mov eax, dword [esp + 8]
cmp eax, 1
je 0x428adc
cmp eax, 2
jne 0x428af7
mov eax, dword [esp]
test esi, esi
je 0x428b05
test eax, eax
je 0x428b00
test al, 1
jne 0x428af7
mov edx, eax
shr edx, 1
cmp word [esi + edx*2 - 2], 0
je 0x428b05
mov eax, 0xd
pop ecx
ret 4
xor ecx, ecx
mov word [esi], cx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 4

Function at 0x428ee0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x428f86
mov eax, dword [edi + 0x20c]
test eax, eax
je 0x428f0f
push eax
call fcn.0044fe27
add esp, 4
push esi
call fcn.00450b92
add esp, 4
mov dword [edi + 0x20c], eax
test eax, eax
je 0x428f86
push eax
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x428f86
mov eax, dword [edi + 0x20c]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x479be0
push eax
mov dword [esp + 0x18], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x428f86
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04x
push 0x208
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x429150
Capabilities:
Delete file

Disassembly:
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42919a
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x429167
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x429174
cmp eax, 1
jne 0x429174
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esi + 0x18]
push eax
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret
Function at 0x429480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx ecx, word [esp + 4]
push esi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x42949a
pop esi
ret 4
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x4294c0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4294c7
pop ebx
xor eax, eax
pop esi
ret 4
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x4294e6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x429507
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
ret 4
push ebx
push esi
push eax
call fcn.00454ea0
add esp, 0xc
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea esi, [esp + 0x10]
xor ebx, ebx
call fcn.0040ec90
push eax
push ebx
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x429548
mov edx, dword [esp + 0x10]
push edx
call fcn.0040ed00
add esp, 4
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42955f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
mov eax, ebx
pop ebx
pop esi
ret 4