joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x848], ecx
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x80c], 0
lea eax, [ebp - 0x814]
push eax
push 0xf013f
push 0
push 0x5f6ab4
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x418348
xorps xmm0, xmm0
movlpd qword [ebp - 0x82c], xmm0
lea ecx, [ebp + 8]
call fcn.00404b90
mov eax, dword [ebp - 0x82c]
mov edx, dword [ebp - 0x828]
jmp 0x41850c
push 0
lea ecx, [ebp - 0x810]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push str.DnibSoftInfo
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x4183b0
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movlpd qword [ebp - 0x834], xmm0
lea ecx, [ebp + 8]
call fcn.00404b90
mov eax, dword [ebp - 0x834]
mov edx, dword [ebp - 0x830]
jmp 0x41850c
push 0
lea ecx, [ebp - 0x80c]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.00406b50
push eax
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x418429
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movlpd qword [ebp - 0x83c], xmm0
lea ecx, [ebp + 8]
call fcn.00404b90
mov eax, dword [ebp - 0x83c]
mov edx, dword [ebp - 0x838]
jmp 0x41850c
xor edx, edx
mov word [ebp - 0x804], dx
push 0x7fe
push 0
lea eax, [ebp - 0x802]
push eax
call fcn.004ac380
add esp, 0xc
mov dword [ebp - 0x818], 0x400
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x804]
push edx
push 0
push 0
push str.installtime
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x804]
push ecx
call fcn.004afdb1
add esp, 4
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x4184dc
xorps xmm0, xmm0
movlpd qword [ebp - 0x844], xmm0
lea ecx, [ebp + 8]
call fcn.00404b90
mov eax, dword [ebp - 0x844]
mov edx, dword [ebp - 0x840]
jmp 0x41850c
lea edx, [ebp - 0x804]
push edx
call fcn.004b4a7f
add esp, 4
cdq
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], edx
lea ecx, [ebp + 8]
call fcn.00404b90
mov eax, dword [ebp - 0x824]
mov edx, dword [ebp - 0x820]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4185e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00461380
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41861d
call fcn.00419340
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
call edx
test eax, eax
jne 0x418783
call fcn.0041a960
test eax, eax
je 0x418637
call fcn.0041a960
mov ecx, eax
call fcn.0045b517
mov dword [ebp - 0x10], eax
jmp 0x41863e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
push 0x2800
call fcn.004b4d29
add esp, 4
mov dword [ebp - 8], eax
push 0x2800
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00418a70
push str.__levels
mov edx, dword [ebp + 0xc]
push edx
push str.__was_found_within__
mov eax, dword [ebp + 8]
push eax
push str._with_name_of__
call fcn.00419340
push eax
push str.FindChildByName2_Failed__no_window_of_class
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
cmp dword [ebp - 4], 0
je 0x41870c
push 3
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
call eax
movzx ecx, al
test ecx, ecx
je 0x41870c
mov edx, dword [ebp + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
mov ecx, dword [ebp - 8]
push ecx
push str.soui
push 3
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x34]
call edx
jmp 0x41876b
push 0x5f6f34
push 0x20e
push 0x5f6f30
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
push 0x5f6f2c
push str.SOUI::SWindow::FindChildByName2
push 0x5f6f2c
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b4d24
add esp, 4
xor edx, edx
jne 0x41861d
xor eax, eax
jmp 0x418786
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x41bbc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00461380
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41bbfd
call fcn.0041c6d0
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
call edx
test eax, eax
jne 0x41bd63
call fcn.0041a960
test eax, eax
je 0x41bc17
call fcn.0041a960
mov ecx, eax
call fcn.0045b517
mov dword [ebp - 0x10], eax
jmp 0x41bc1e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
push 0x2800
call fcn.004b4d29
add esp, 4
mov dword [ebp - 8], eax
push 0x2800
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00418a70
push str.__levels
mov edx, dword [ebp + 0xc]
push edx
push str.__was_found_within__
mov eax, dword [ebp + 8]
push eax
push str._with_name_of__
call fcn.0041c6d0
push eax
push str.FindChildByName2_Failed__no_window_of_class
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
cmp dword [ebp - 4], 0
je 0x41bcec
push 3
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
call eax
movzx ecx, al
test ecx, ecx
je 0x41bcec
mov edx, dword [ebp + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
mov ecx, dword [ebp - 8]
push ecx
push str.soui
push 3
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x34]
call edx
jmp 0x41bd4b
push 0x5f6f34
push 0x20e
push 0x5f6f30
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
push 0x5f6f2c
push str.SOUI::SWindow::FindChildByName2
push 0x5f6f2c
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b4d24
add esp, 4
xor edx, edx
jne 0x41bbfd
xor eax, eax
jmp 0x41bd66
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x41bd70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00461380
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41bdad
call fcn.0041c6e0
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
call edx
test eax, eax
jne 0x41bf13
call fcn.0041a960
test eax, eax
je 0x41bdc7
call fcn.0041a960
mov ecx, eax
call fcn.0045b517
mov dword [ebp - 0x10], eax
jmp 0x41bdce
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
push 0x2800
call fcn.004b4d29
add esp, 4
mov dword [ebp - 8], eax
push 0x2800
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00418a70
push str.__levels
mov edx, dword [ebp + 0xc]
push edx
push str.__was_found_within__
mov eax, dword [ebp + 8]
push eax
push str._with_name_of__
call fcn.0041c6e0
push eax
push str.FindChildByName2_Failed__no_window_of_class
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
cmp dword [ebp - 4], 0
je 0x41be9c
push 3
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
call eax
movzx ecx, al
test ecx, ecx
je 0x41be9c
mov edx, dword [ebp + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
mov ecx, dword [ebp - 8]
push ecx
push str.soui
push 3
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x34]
call edx
jmp 0x41befb
push 0x5f6f34
push 0x20e
push 0x5f6f30
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
push 0x5f6f2c
push str.SOUI::SWindow::FindChildByName2
push 0x5f6f2c
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b4d24
add esp, 4
xor edx, edx
jne 0x41bdad
xor eax, eax
jmp 0x41bf16
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x41bf20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00461380
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41bf5d
call fcn.0041c6f0
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
call edx
test eax, eax
jne 0x41c0c3
call fcn.0041a960
test eax, eax
je 0x41bf77
call fcn.0041a960
mov ecx, eax
call fcn.0045b517
mov dword [ebp - 0x10], eax
jmp 0x41bf7e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
push 0x2800
call fcn.004b4d29
add esp, 4
mov dword [ebp - 8], eax
push 0x2800
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00418a70
push str.__levels
mov edx, dword [ebp + 0xc]
push edx
push str.__was_found_within__
mov eax, dword [ebp + 8]
push eax
push str._with_name_of__
call fcn.0041c6f0
push eax
push str.FindChildByName2_Failed__no_window_of_class
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c80
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
cmp dword [ebp - 4], 0
je 0x41c04c
push 3
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
call eax
movzx ecx, al
test ecx, ecx
je 0x41c04c
mov edx, dword [ebp + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x20e
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
mov ecx, dword [ebp - 8]
push ecx
push str.soui
push 3
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x34]
call edx
jmp 0x41c0ab
push 0x5f6f34
push 0x20e
push 0x5f6f30
push str.d:_temp_aaaaaaa_thirdparty_soui_souiincludecoreSWnd.h
push 0x5f6f2c
push str.SOUI::SWindow::FindChildByName2
push 0x5f6f2c
lea ecx, [ebp - 0x24]
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c60
mov ecx, eax
call fcn.00418c40
mov ecx, eax
call fcn.00418c60
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b4d24
add esp, 4
xor edx, edx
jne 0x41bf5d
xor eax, eax
jmp 0x41c0c6
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x41de20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4299
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.0041e570
mov dword [ebp - 0x280], eax
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004ac380
add esp, 0xc
push 0x5f7590
lea ecx, [ebp - 0x248]
call fcn.00404a20
mov dword [ebp - 4], 0
push str.UnKonw
lea eax, [ebp - 0x218]
push eax
call fcn.004afd5e
add esp, 8
cmp dword [ebp - 0x280], 0
jbe 0x41dfcc
mov ecx, dword [ebp - 0x280]
push ecx
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp - 0x27c]
call fcn.0041e1e0
mov byte [ebp - 4], 1
push 0x5f75b0
lea eax, [ebp - 0x230]
push eax
call fcn.00403e30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41df31
mov edx, dword [ebp - 0x280]
push edx
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x27c]
call fcn.0041e2d0
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00404da0
lea ecx, [ebp - 0x260]
call fcn.00404b90
lea ecx, [ebp - 0x230]
call fcn.00406b50
push eax
lea edx, [ebp - 0x278]
push edx
call fcn.00440ff2
add esp, 8
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
call fcn.00406b50
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004afd5e
add esp, 8
lea ecx, [ebp - 0x278]
call fcn.00404b90
lea ecx, [ebp - 0x230]
call fcn.00406b50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41dfbd
lea ecx, [ebp - 0x248]
push ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x28c], esp
lea edx, [ebp - 0x230]
push edx
call fcn.00404990
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x27c]
call fcn.0041e030
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00404b90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00404f00
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00404e90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00404b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41e1e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ac380
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x41e294
lea eax, [ebp - 0x220]
push eax
push 4
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41e287
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404a20
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 8
Function at 0x41e2d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4307
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x484], ecx
mov dword [ebp - 0x47c], 0
push 0x5f7538
lea ecx, [ebp - 0x230]
call fcn.00404a20
mov dword [ebp - 4], 0
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x474], 0
push 0x228
push 0
lea eax, [ebp - 0x470]
push eax
call fcn.004ac380
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
jne 0x41e3a4
push 0x5f753c
mov ecx, dword [ebp + 8]
call fcn.00404a20
mov ecx, dword [ebp - 0x47c]
or ecx, 1
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00404b90
mov eax, dword [ebp + 8]
jmp 0x41e549
mov dword [ebp - 0x474], 0x22c
lea edx, [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x478]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41e509
lea ecx, [ebp - 0x450]
push ecx
lea ecx, [ebp - 0x248]
call fcn.00404a20
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x46c]
cmp edx, dword [ebp + 0xc]
jne 0x41e4df
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004ac380
add esp, 0xc
mov edx, dword [ebp - 0x46c]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x41e4c1
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp - 0x480]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x230]
call fcn.00404f00
push 0x5f7540
lea eax, [ebp - 0x230]
push eax
call fcn.00403e30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41e4c1
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x484]
call fcn.0041e600
push 0x5f7544
lea ecx, [ebp - 0x230]
push ecx
call fcn.00403e30
add esp, 8
movzx edx, al
test edx, edx
je 0x41e4c1
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.00404f00
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.00404b90
jmp 0x41e509
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.00404b90
lea edx, [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x478]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41e3c9
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404910
mov eax, dword [ebp - 0x47c]
or eax, 1
mov dword [ebp - 0x47c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00404b90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret 8
Function at 0x428250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x184
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4284d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x188], eax
mov esp, ebp
pop ebp
ret
Function at 0x429ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4ee6
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x66a344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x184], 0
jne 0x429aec
jmp 0x429ca5
mov dword [ebp - 0x48], 1
push 0
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0x184]
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x184]
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x58]
call fcn.00404f60
push eax
lea ecx, [ebp - 0x28]
call fcn.00404a20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.00418ac0
lea ecx, [ebp - 0x28]
call fcn.00406b50
push eax
call fcn.004afdb1
add esp, 4
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jg 0x429b62
mov dword [ebp - 0x48], 0
jmp 0x429b94
push 3
push 0
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x28]
call fcn.004135c0
lea ecx, [ebp - 0x40]
call fcn.00406b50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429b8c
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.00404b90
cmp dword [ebp - 0x48], 0
je 0x429bae
lea ecx, [ebp - 0x28]
call fcn.00406b50
push eax
call fcn.0044a2f5
add esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x429bf2
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x17c], 0
je 0x429bdc
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx + 0x17c]
call fcn.004612d8
push 0
mov ecx, dword [ebp - 0x44]
call fcn.00462581
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404b90
jmp 0x429ca5
mov edx, dword [ebp - 0x44]
cmp dword [edx + 0x17c], 0
je 0x429c1a
push 0
push 1
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x17c]
call fcn.004612d8
push 0
mov ecx, dword [ebp - 0x44]
call fcn.00462581
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x170
call fcn.0041a830
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 0x170
call fcn.00412a10
jmp 0x429c4f
lea ecx, [ebp - 0x4c]
call fcn.00418d30
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041c460
movzx ecx, al
test ecx, ecx
je 0x429c96
lea ecx, [ebp - 0x4c]
call fcn.00404f70
cmp dword [eax], 0
jne 0x429c71
jmp 0x429c47
lea ecx, [ebp - 0x4c]
call fcn.00404f70
mov edx, dword [eax]
mov dword [ebp - 0x50], edx
lea ecx, [ebp - 0x28]
call fcn.00406b50
push eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 8]
call eax
jmp 0x429c47
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c1bd
mov esp, ebp
pop ebp
ret