joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433744
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x433897
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x47440b1
push ebp
mov eax, edi
call fcn.00403670
mov edx, 3
call fcn.004336fc
pop ecx
mov eax, edi
call fcn.00403670
mov esi, eax
test esi, esi
jle 0x4337c2
mov ebx, 1
push ebp
mov eax, 0x18
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
xor eax, eax
mov al, byte [edi + ebx - 1]
call fcn.004336fc
pop ecx
inc ebx
dec esi
jne 0x4337a3
push ebp
mov eax, dword [ebp - 8]
call fcn.00403670
mov edx, 0xf
call fcn.004336fc
pop ecx
mov eax, dword [ebp - 8]
call fcn.00403670
mov esi, eax
test esi, esi
jle 0x433803
mov ebx, 1
push ebp
mov edx, 0x40
sub edx, ebx
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
call fcn.004336fc
pop ecx
inc ebx
dec esi
jne 0x4337e9
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00402ab4
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10]
call fcn.0040361c
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403670
push eax
mov edx, 0x4338b0
lea eax, [ebp - 0x118]
call fcn.00403590
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 0x10]
call fcn.00403678
mov eax, dword [ebp - 0x118]
mov ecx, 8
pop edx
call fcn.00403874
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
mov edx, 0x4338c0
call fcn.004036bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43389e
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.0040351c
lea eax, [ebp - 0x10]
call fcn.004034fc
ret
Function at 0x433900
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x433a5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004034fc
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.00405d4c
mov eax, dword [ebp - 0x24]
mov edx, 0x433a70
call fcn.00403958
cmp eax, 0x1e
jg 0x43395e
je 0x4339e6
dec eax
je 0x43397e
sub eax, 6
je 0x4339c0
sub eax, 0xb
je 0x4339d3
jmp 0x433a35
sub eax, 0x23
je 0x4339f4
sub eax, 8
je 0x433a05
sub eax, 7
je 0x433a26
jmp 0x433a35
call sub.kernel32.dll_GetVersion
mov esi, eax
lea edx, [ebp - 0x24]
mov eax, esi
and ax, 0xff
movzx eax, ax
call fcn.004329b0
push dword [ebp - 0x24]
push 0x433ab0
lea edx, [ebp - 0x28]
mov eax, esi
shr ax, 8
movzx eax, ax
call fcn.004329b0
push dword [ebp - 0x28]
mov eax, ebx
mov edx, 3
call fcn.00403730
jmp 0x433a3f
mov eax, dword [0x441628]
call fcn.00422e0c
mov edx, ebx
call fcn.004329b0
jmp 0x433a3f
mov eax, dword [0x441628]
call fcn.00422e04
mov edx, ebx
call fcn.004329b0
jmp 0x433a3f
mov eax, ebx
mov edx, 0x433abc
call fcn.00403590
jmp 0x433a3f
mov edx, ebx
mov eax, dword [0x441628]
mov eax, dword [eax + 0x24]
call fcn.004329b0
jmp 0x433a3f
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov edx, ebx
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x433a1c
add eax, 0x3ff
sar eax, 0xa
call fcn.004329b0
jmp 0x433a3f
mov eax, ebx
mov edx, dword [0x440838]
call fcn.00403590
jmp 0x433a3f
mov dword [0x441788], 0xd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433a61
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040351c
ret
Function at 0x433dcc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov ebx, eax
mov edx, 0xfffffffd
mov eax, ebx
call fcn.00433d64
test eax, eax
setg byte [esp + 4]
cmp byte [esp + 4], 0
je 0x433f7a
mov byte [esp + 5], 0
mov eax, dword [esp]
call fcn.00403670
mov esi, eax
test esi, esi
jle 0x433f7a
mov edi, 1
mov eax, dword [0x44191c]
call fcn.0043298c
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
cmp al, 0xfa
jb 0x433e73
sub al, 0xfa
mov byte [esp + 8], al
mov al, byte [esp + 8]
and al, 1
xor al, 1
mov byte [esp + 5], al
xor eax, eax
mov al, byte [esp + 8]
shr eax, 1
mov bl, byte [eax + 0x440850]
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov ebp, eax
push 0
xor eax, eax
mov al, byte [esp + 9]
mov eax, dword [eax*4 + 0x440854]
push eax
mov eax, ebp
push eax
push ebx
call sub.user32.dll_keybd_event
jmp 0x433f72
xor edx, edx
cmp al, 0xf0
jb 0x433e86
and eax, 0xff
mov bl, byte [eax + 0x440754]
jmp 0x433ea3
cmp al, 0xe4
jb 0x433e91
mov ebx, eax
sub bl, 0x74
jmp 0x433ea3
cmp al, 0x20
jae 0x433e99
mov ebx, eax
jmp 0x433ea3
push eax
call sub.user32.dll_VkKeyScanA
mov edx, eax
mov ebx, edx
mov eax, edx
call fcn.004055f8
mov byte [esp + 8], al
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov ebp, eax
cmp byte [esp + 5], 0
jne 0x433f12
cmp byte [esp + 8], 0
jbe 0x433f12
cmp byte [esp + 8], 6
jne 0x433eef
push 0
push 0
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
mov word [esp + 6], 0x12
jmp 0x433ef6
mov word [esp + 6], 0x10
push 0
push 0
push 0
movzx eax, word [esp + 0x12]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
mov al, byte [esp + 0x12]
push eax
call sub.user32.dll_keybd_event
push 0
push 0
mov eax, ebp
push eax
push ebx
call sub.user32.dll_keybd_event
push 0
push 2
mov eax, ebp
push eax
push ebx
call sub.user32.dll_keybd_event
cmp byte [esp + 5], 0
jne 0x433f72
cmp byte [esp + 8], 0
jbe 0x433f72
push 0
push 2
push 0
movzx eax, word [esp + 0x12]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
mov al, byte [esp + 0x12]
push eax
call sub.user32.dll_keybd_event
cmp byte [esp + 8], 6
jne 0x433f72
push 0
push 2
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
inc edi
dec esi
jne 0x433e12
mov al, byte [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x435de8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x435efd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00405d4c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00403590
test esi, esi
jle 0x435ee2
mov ebx, 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov al, byte [eax + ebx - 1]
sub al, 0x43
je 0x435e70
sub al, 6
je 0x435e90
sub al, 5
jne 0x435eaa
push 0
push 0
push 0xe
push esi
call sub.user32.dll_SendMessageA
mov edi, eax
inc edi
lea eax, [ebp - 4]
mov edx, edi
call fcn.004039a0
test edi, edi
jle 0x435eaa
mov eax, dword [ebp - 4]
call fcn.00403834
push eax
push edi
push 0xd
push esi
call sub.user32.dll_SendMessageA
jmp 0x435eaa
lea eax, [ebp - 4]
mov edx, 0x80
call fcn.004039a0
push 0x7f
mov eax, dword [ebp - 4]
call fcn.00403834
push eax
push esi
call sub.user32.dll_GetClassNameA
jmp 0x435eaa
lea edx, [ebp - 8]
mov eax, esi
call fcn.004329b0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x435f14
call fcn.004036bc
mov eax, dword [ebp - 4]
call fcn.00403834
call fcn.00406554
mov edx, eax
lea eax, [ebp - 4]
call fcn.004039a0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00434e20
pop ecx
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00403670
cmp ebx, eax
jle 0x435e29
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435f04
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040351c
ret
Function at 0x438b14
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x438c35
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
call fcn.004382f4
pop ecx
mov edx, 0x438c4c
mov eax, dword [ebp - 0xc]
call fcn.00405df4
test eax, eax
jne 0x438b5c
mov bl, 1
jmp 0x438b8c
mov byte [ebp - 5], 1
call sub.kernel32.dll_GetTickCount
mov edi, eax
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00402ac0
mov esi, eax
cmp dword [ebp - 4], 0
jg 0x438b7f
cmp esi, 1
jge 0x438b84
mov esi, 1
imul eax, esi, 0x3e8
mov esi, eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
call fcn.004382f4
pop ecx
mov eax, dword [ebp - 0xc]
call fcn.00403670
test eax, eax
jne 0x438b47
mov eax, dword [0x441918]
push eax
call sub.kernel32.dll_Sleep
mov eax, dword [0x441624]
call fcn.00424110
cmp byte [ebp - 5], 0
je 0x438bcd
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp esi, eax
setle byte [ebp - 6]
test bl, bl
je 0x438bdf
mov eax, dword [0x441778]
call fcn.00403670
test eax, eax
jg 0x438bee
cmp byte [ebp - 6], 0
jne 0x438bee
cmp byte [0x441795], 0
je 0x438ba5
cmp byte [0x441795], 0
je 0x438bfd
dec dword [0x441784]
test byte [ebp - 6], bl
je 0x438c1f
mov eax, dword [0x441778]
call fcn.00403670
test eax, eax
jne 0x438c1f
mov eax, 0x441778
mov edx, 0x438c5c
call fcn.0040354c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438c3c
lea eax, [ebp - 0xc]
call fcn.004034fc
ret
Function at 0x43a260
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [0x441914]
mov dword [eax - 8], edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov edx, dword [0x441914]
call fcn.004039a0
test bl, bl
je 0x43a2b4
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403834
push eax
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
jmp 0x43a2d3
mov eax, dword [0x441914]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403834
push eax
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyA
pop esi
pop ebx
pop ebp
ret
Function at 0x43b4d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
lea ebx, [ebp - 0x10]
xor eax, eax
push ebp
push 0x43be8e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x441788], eax
mov byte [0x441799], 0
mov byte [0x441795], 0
mov byte [ebp - 0x35], 0
Function at 0x40a8e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a904
xor eax, eax
jmp 0x40a984
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a91b
xor eax, eax
jmp 0x40a984
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x40a967
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x40a967
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40a93e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x40a973
xor eax, eax
jmp 0x40a984
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x40a981
xor eax, eax
jmp 0x40a984
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40ff60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov byte [ebp - 0x130], 0
push 0x12b
lea eax, [ebp - 0x12f]
push 0
push eax
mov dword [esi], vtable.core_log::log_device_file.0
call sub.MSVCR120.dll_memset
add esp, 0xc
call fcn.00406f20
push eax
lea ecx, [ebp - 0x144]
call fcn.00406850
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x496ccc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ffcb
test al, 0x10
jne 0x40ffd8
push 0
push 0x496ccc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebp - 0x13a]
push eax
movzx eax, word [ebp - 0x13e]
push eax
movzx eax, word [ebp - 0x140]
push eax
push str.c:MyLogMyLog__d__02d__02d.log
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x12c
push eax
call dword [sym.imp.MSVCR120.dll__snprintf_s]
push 0x496d00
lea eax, [ebp - 0x130]
push eax
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.MSVCR120.dll_fopen_s]
add esp, 0x28
lea ecx, [ebp - 0x144]
call fcn.00406040
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048079e
mov esp, ebp
pop ebp
ret

Function at 0x410080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x4100ba
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fwrite]
push dword [edi + 4]
push 2
push 1
push 0x496d04
call dword [sym.imp.MSVCR120.dll_fwrite]
push dword [edi + 4]
call dword [sym.imp.MSVCR120.dll_fflush]
add esp, 0x24
pop edi
pop ebp
ret 8

Function at 0x4101a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMyLogLog
push reloc.OLEAUT32.dll_SysReAllocString
mov word [0x4b254c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41024f
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0
push str.EnableLogToView
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, 1
test eax, eax
jne 0x410215
movzx eax, byte [0x4b254c]
cmp dword [ebp - 4], edi
cmove eax, edi
mov byte [0x4b254c], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push str.EnableLogToFile
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410245
movzx eax, byte [0x4b254d]
cmp dword [ebp - 4], edi
cmove eax, edi
mov byte [0x4b254d], al
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4178f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417906
test al, 0x10
jne 0x417906
mov eax, 1
ret
xor eax, eax
ret
Function at 0x417f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48616e
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x4b2578]
mov dword [ebp - 0x21c], 0
test al, 1
jne 0x417f7e
or eax, 1
mov dword [0x4b2578], eax
mov ecx, 0x4b2560
mov dword [ebp - 4], 0
call fcn.00403390
push 0x48b0e0
call fcn.004808e3
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x4b2560
call fcn.004034a0
test al, al
je 0x417ff3
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
mov ecx, 0x4b2560
push eax
call fcn.00403460
mov edx, 0x4b2560
lea ecx, [ebp - 0x234]
call fcn.00417c40
push eax
mov ecx, 0x4b2560
call fcn.0040f770
lea ecx, [ebp - 0x234]
call fcn.004033c0
push 0x4b2560
mov ecx, esi
call fcn.00403330
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048079e
mov esp, ebp
pop ebp
ret

Function at 0x418020
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], edx
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4180a9
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ecx], ebx
cmp ebx, 0xffffffff
je 0x4180a1
xor ecx, ecx
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x4180a1
push 0
push dword [ebp - 4]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov eax, dword [ecx]
mov byte [esi + eax], 0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421cb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x288
mov eax, dword [0x4ad0cc]
xor eax, esp
mov dword [esp + 0x284], eax
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x421e6a
cmp word [ecx], 0
je 0x421e6a
push ecx
lea ecx, [esp + 0x6c]
call fcn.00405950
xor eax, eax
push 0x206
push eax
mov word [esp + 0x88], ax
lea eax, [esp + 0x8a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [esp + 0x80]
test edi, edi
mov esi, 0x496c80
mov eax, ecx
mov edx, 0x104
cmovne esi, edi
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x421d42
movzx eax, word [esi + ecx]
test ax, ax
je 0x421d42
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x421d24
jmp 0x421d46
test edx, edx
jne 0x421d49
sub ecx, 2
xor eax, eax
push 0x44
push eax
mov word [ecx], ax
lea eax, [esp + 0x28]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x20], 0x44
xorps xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
push 0x20081
push 0
push 0
push 0x497524
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x421daf
lea ecx, [esp + 0x68]
mov edi, 0x80070005
call fcn.004033c0
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
lea eax, [esp + 0x10]
cmp word [esp + 0x80], cx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x88]
cmove eax, ecx
push eax
push ecx
push 0x1000400
push ecx
push ecx
push ecx
lea ecx, [esp + 0x88]
call fcn.00403480
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x421e35
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x421e1e
push eax
call edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x421e31
push eax
call edi
mov dword [esp + 0x14], 0
xor edi, edi
jmp 0x421e3a
mov edi, 0x80004005
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [esp + 0x68]
call fcn.004033c0
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x28c]
mov eax, 0x80070057
pop edi
pop esi
xor ecx, esp
call fcn.0048079e
mov esp, ebp
pop ebp
ret
Function at 0x421e90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4ad0cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x234], ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x421f2b
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x421f2b
mov esi, dword [sym.imp.MSVCR120.dll__wcsicmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call esi
add esp, 8
test eax, eax
je 0x421f43
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x421f01
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048079e
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x228]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov esi, 1
jmp 0x421f2d

Function at 0x422a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422ae1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x422aaf
cmp eax, 2
jne 0x422acb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x422adb
test ecx, ecx
je 0x422ad6
test cl, 1
jne 0x422acb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x422adb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x422af0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x422b05
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x422b10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422b10
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc