joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40129e
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x401312
test edi, edi
jle 0x401312
mov eax, edi
shl eax, 2
mov dword [ebp - 4], eax
inc eax
mov ecx, eax
mov dword [ebp - 8], eax
call fcn.00406a21
mov esi, eax
test esi, esi
je 0x401312
push dword [ebp - 8]
mov ecx, esi
call fcn.00406a08
add esp, 4
lea eax, [ebp - 4]
push 0
push 0
push eax
push esi
push 1
push edi
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edi, eax
test edi, edi
je 0x401307
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [ecx + esi], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
jmp 0x40130e
mov ecx, esi
call fcn.00406a47
mov eax, edi
jmp 0x401314
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401385
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edx
push edi
mov edi, edx
test ebx, ebx
je 0x40147b
mov ecx, esi
call fcn.00401365
test eax, eax
je 0x40147b
push 0xf0000000
push 0x18
push edx
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40144c
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40144c
push edi
push dword [esi + 4]
push dword [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40144c
lea eax, [ebp - 0xc]
push eax
push ebx
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
je 0x40144c
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
lea edx, [ecx - 1]
add edx, eax
cmp edx, ecx
jbe 0x401435
mov al, byte [ecx]
xor byte [edx], al
mov al, byte [edx]
xor byte [ecx], al
mov al, byte [ecx]
xor byte [edx], al
inc ecx
dec edx
cmp edx, ecx
ja 0x40141d
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push 0
push 0
push dword [ebp - 0xc]
push eax
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
cmovne edi, ebx
cmp dword [ebp - 0xc], 0
je 0x40145b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 4], 0
je 0x40146a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], 0
je 0x40147b
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401834
Capabilities:
Check mutex on windows

Disassembly:
push esi
call fcn.00401778
mov esi, eax
test esi, esi
jne 0x401842
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
call fcn.00407608
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, esi
mov edi, eax
call fcn.0040756a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401884
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401884
inc eax
jmp 0x40188d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
ret

Function at 0x40199c
Capabilities:
Copy file
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
mov ebx, 0x400
push edi
mov ecx, ebx
call fcn.00407474
mov ecx, 0x800
mov esi, eax
call fcn.00407474
mov ecx, ebx
mov edi, eax
call fcn.00407474
mov ebx, eax
test esi, esi
je 0x401ae5
mov ecx, dword [esi]
dec ecx
push ecx
push dword [esi + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esi + 4], eax
test eax, eax
je 0x401ade
push dword [edi + 8]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
ja 0x401ade
test eax, eax
je 0x401ade
push dword [ebx + 8]
push 0
push 0x4161e4
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x401ade
mov ecx, dword [ebx + 8]
call fcn.0040108e
mov dword [ebx + 4], eax
test eax, eax
je 0x401ade
push 0
push dword [ebx + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esi + 8]
xor edx, edx
call fcn.0040c2c0
test eax, eax
je 0x401ade
mov ecx, edi
call fcn.0040758c
push 1
mov edx, 0x4161e8
mov ecx, edi
call fcn.004076d4
pop ecx
mov edx, ebx
mov ecx, edi
call fcn.0040764c
push 2
mov edx, 0x4161ec
mov ecx, edi
call fcn.004076d4
pop ecx
push 0x22
mov edx, str._DAF8C715436E44649F1312698287E6A5
mov ecx, edi
call fcn.004076d4
pop ecx
mov edx, esi
mov ecx, edi
call fcn.0040764c
push 0x44
pop edx
push edx
lea ecx, [esp + 0x24]
call fcn.00406a08
add esp, 4
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x10]
push 0x10
call fcn.00406a08
add esp, 4
mov eax, ecx
push eax
lea eax, [esp + 0x24]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, esi
call fcn.0040756a
test edi, edi
je 0x401af0
mov ecx, edi
call fcn.0040756a
test ebx, ebx
je 0x401afb
mov ecx, ebx
call fcn.0040756a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b02
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call sub.KERNEL32.dll_GetCommandLineA
mov esi, eax
test esi, esi
je 0x401b54
push edi
mov ecx, esi
call fcn.0040108e
lea ecx, [ebp - 0x18]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00407559
mov esi, eax
lea edi, [ebp - 0xc]
add esp, 4
lea ecx, [ebp - 0xc]
mov edx, str._DAF8C715436E44649F1312698287E6A5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00401caf
mov esi, eax
mov ecx, esi
call fcn.0040756a
xor eax, eax
test esi, esi
pop edi
setne al
jmp 0x401b56
xor eax, eax
pop esi
leave
ret

Function at 0x401b59
Capabilities:
Accept command line arguments
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x41a008]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov esi, eax
test esi, esi
je 0x401c9a
mov ecx, esi
call fcn.0040108e
lea ecx, [esp + 0x20]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00407559
mov esi, eax
lea edi, [esp + 0x18]
add esp, 4
lea ecx, [esp + 0x14]
mov edx, str._DAF8C715436E44649F1312698287E6A5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00401caf
mov esi, eax
push 0x14
pop edi
test esi, esi
je 0x401c60
and dword [esp + 0x10], 0
lea eax, [esp + 0x30]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp edi, 1
jle 0x401bfb
cmp ebx, 0xffffffff
je 0x401bfb
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401bfb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
jmp 0x401c08
mov dword [esp + 0x10], 1
cmp ebx, 0xffffffff
je 0x401c16
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x10], 0
je 0x401bc6
push 4
mov edx, str..._
mov ecx, esi
call fcn.004076d4
push 0x2c
mov edx, str.zopener_8a4800ea0a3f43f4bafd7706c1a4e7ee.log
mov ecx, esi
call fcn.004076d4
pop ecx
pop ecx
lea eax, [esp + 0x30]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c59
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, esi
call fcn.0040756a
mov ecx, 0x400
call fcn.00407474
mov esi, eax
test esi, esi
je 0x401c9a
mov ecx, dword [esi]
dec ecx
push ecx
push dword [esi + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esi + 4], eax
test eax, eax
je 0x401c93
push 4
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, esi
call fcn.0040756a
mov ecx, dword [esp + 0x174]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040dbce
mov esp, ebp
pop ebp
ret
Function at 0x405225
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, edx
test ebx, ebx
je 0x405283
test esi, esi
je 0x405283
push edi
mov ecx, 0x400
call fcn.00407474
mov edi, eax
mov edx, ebx
mov ecx, edi
call fcn.0040764c
push 1
mov edx, 0x416af8
mov ecx, edi
call fcn.004076d4
pop ecx
mov edx, esi
mov ecx, edi
call fcn.00407691
mov ecx, edi
call fcn.00407608
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, edi
mov esi, eax
call fcn.0040756a
pop edi
cmp esi, 0xffffffff
je 0x405283
xor eax, eax
inc eax
jmp 0x405285
xor eax, eax
pop esi
pop ebx
ret

Function at 0x405288
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
je 0x405357
call fcn.00407608
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405357
test al, 0x10
je 0x405357
push ebx
mov ebx, str.Zoom.exe
mov ecx, esi
mov edx, ebx
call fcn.00405225
test eax, eax
je 0x405352
mov edx, str.zChatApp.dll
mov ecx, esi
call fcn.00405225
test eax, eax
je 0x405352
mov edx, str.zVideoApp.dll
mov ecx, esi
call fcn.00405225
test eax, eax
je 0x405352
mov edx, str.Cmmlib.dll
mov ecx, esi
call fcn.00405225
test eax, eax
je 0x405352
mov ecx, esi
call fcn.00407516
mov edi, eax
mov edx, 0x416af8
push 1
mov ecx, edi
call fcn.004076d4
push 8
mov edx, ebx
mov ecx, edi
call fcn.004076d4
pop ecx
pop ecx
mov ecx, 0x400
call fcn.00407474
mov esi, eax
test esi, esi
je 0x40534b
push 0x35
mov edx, str._imp_has_zoom_under_path__found_zoom_binaries_under:
mov ecx, esi
call fcn.004076d4
pop ecx
mov ecx, esi
call fcn.0040bdf2
mov ecx, esi
call fcn.0040756a
mov ecx, edi
call fcn.0040bdf2
mov eax, edi
pop ebx
jmp 0x405359
xor eax, eax
pop edi
pop esi
ret
Function at 0x40535c
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp edi, 0xa
ja 0x40547c
mov ecx, 0x400
call fcn.00407474
mov esi, eax
test esi, esi
je 0x40547c
xor eax, eax
sub edi, eax
je 0x405452
sub edi, 1
je 0x405449
sub edi, 1
je 0x405440
sub edi, 4
je 0x405437
sub edi, 1
jne 0x40546f
mov eax, dword [esi]
dec eax
push eax
push dword [esi + 8]
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x40546f
mov ecx, dword [esi]
dec ecx
cmp eax, ecx
ja 0x40546f
xor edi, edi
xor dl, dl
inc edi
mov ecx, esi
push edi
push edi
push 0
call fcn.004078ea
push edi
mov edx, 0x416af8
mov dword [esi + 4], eax
mov ecx, esi
call fcn.004076d4
add esp, 0x10
mov eax, str.Zoom
cmp dword [ebp + 8], 0
mov edx, str.ZoomVDI
mov ecx, esi
cmove edx, eax
call fcn.00407691
test ebx, ebx
je 0x405425
push 0
mov ecx, esi
call fcn.00407608
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov edx, 0x416af8
mov ecx, esi
call fcn.004076d4
pop ecx
mov eax, esi
jmp 0x40547e
push dword [esi + 8]
push eax
push eax
push 0x2a
jmp 0x405459
push dword [esi + 8]
push eax
push eax
push 0x26
jmp 0x405459
push dword [esi + 8]
push eax
push eax
push 0x1c
jmp 0x405459
push dword [esi + 8]
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor ecx, ecx
test eax, eax
setns cl
test ecx, ecx
jne 0x4053d6
mov ecx, esi
call fcn.0040756a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40592b
Capabilities:
Create directory

Disassembly:
xor edx, edx
xor ecx, ecx
push ebx
push 0
inc edx
call fcn.0040535c
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x405949
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop ebx
ret
push esi
push edi
push 0xc
mov edx, str.ZoomDownload
mov ecx, ebx
call fcn.004076d4
pop ecx
push 0
mov ecx, ebx
call fcn.00407608
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
mov edx, 0x416af8
mov ecx, ebx
mov esi, eax
call fcn.004076d4
mov ecx, 0x800
call fcn.00407474
mov edi, eax
mov edx, str._param_query_local_path__path_is:
push 0x22
mov ecx, edi
call fcn.004076d4
mov edx, ebx
mov ecx, edi
call fcn.0040764c
push 0x17
mov edx, str._dir_create_response_:
mov ecx, edi
call fcn.004076d4
mov edx, esi
mov ecx, edi
call fcn.004077ef
push 0xf
mov edx, str._system_error:
mov ecx, edi
call fcn.004076d4
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, edi
call fcn.004077ef
mov ecx, edi
call fcn.0040bdf2
mov ecx, edi
call fcn.0040756a
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x405b6a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
mov ecx, str.___url
lea eax, [ebp - 0x18]
push eax
push 7
pop edx
call fcn.00407559
mov esi, eax
lea edi, [ebp - 0xc]
add esp, 4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
jne 0x405b9e
xor eax, eax
jmp 0x405bcd
mov ecx, 0x2000
call fcn.00407474
mov esi, eax
mov edx, ebx
mov ecx, esi
call fcn.00407691
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00407a5e
cmp eax, 0xffffffff
jne 0x405bcb
mov ecx, esi
call fcn.0040756a
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40634f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
test esi, esi
je 0x406420
xor edx, edx
mov edi, 0x41ad44
xor eax, eax
lock cmpxchg dword [edi], edx
mov ecx, eax
test ecx, ecx
jne 0x4063ac
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4063a5
push str.RemoveDllDirectory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4063a5
push 2
pop ecx
jmp 0x4063a8
xor ecx, ecx
inc ecx
mov eax, ecx
xchg dword [edi], eax
cmp ecx, 1
jne 0x406410
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00410e50
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x406420
cmp word [ebp - 0x20c], 0
je 0x406420
push ecx
push esi
lea ecx, [ebp - 0x20c]
call fcn.004061fd
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x406420
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, edi
mov esi, eax
call fcn.004061d1
mov eax, esi
jmp 0x406422
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x406422
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040dbce
leave
ret

Function at 0x406430
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, 0x1000
call fcn.00407474
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_GetCommandLineA
mov esi, eax
call fcn.00406d23
mov ebx, eax
call fcn.00406d14
mov ecx, dword [ebp - 4]
mov edx, str.Command_line:
push 0xd
mov edi, eax
call fcn.004076d4
test esi, esi
mov edx, str.NULL
cmovne edx, esi
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.00407691
push 0xa
mov edx, str._Instance:
mov ecx, esi
call fcn.004076d4
mov edx, edi
mov ecx, esi
call fcn.0040776d
push 0xc
mov edx, str._Show_State:
mov ecx, esi
call fcn.004076d4
add esp, 0xc
mov edx, ebx
mov ecx, esi
call fcn.0040785d
mov ecx, esi
call fcn.0040bdf2
mov ecx, esi
call fcn.0040756a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4066cb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov ecx, eax
call fcn.0040108e
mov esi, eax
call sub.KERNEL32.dll_GetCommandLineA
lea ecx, [ebp - 0xc]
mov edx, esi
push ecx
mov ecx, eax
call fcn.00407559
mov esi, eax
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x24]
mov ecx, str._normal.priviledge
push eax
push 0x12
movsd dword es:[edi], dword [esi]
pop edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00407559
mov esi, eax
lea edi, [ebp - 0xc]
add esp, 8
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00407a5e
pop edi
pop esi
cmp eax, 0xffffffff
jne 0x406737
call fcn.0040c660
test eax, eax
je 0x406737
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x40673b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov ecx, eax
call fcn.0040108e
mov esi, eax
call sub.KERNEL32.dll_GetCommandLineA
lea ecx, [ebp - 0x18]
mov edx, esi
push ecx
mov ecx, eax
call fcn.00407559
mov esi, eax
lea edi, [ebp - 0xc]
add esp, 4
mov ecx, 0x800
xor ebx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00407474
mov esi, eax
test esi, esi
je 0x4067d1
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.0040764c
test eax, eax
je 0x4067ca
push 0x13
mov edx, str.__normal.priviledge
mov ecx, esi
call fcn.004076d4
pop ecx
test eax, eax
je 0x4067ca
call fcn.0040cf60
mov edi, eax
test edi, edi
je 0x4067ca
push edi
push ecx
push ecx
mov ecx, esi
call fcn.00407608
mov edx, eax
call fcn.0040cc40
add esp, 0xc
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0040756a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x406d66
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x5c], str.1F1C2DFC_2D24_3E06_BCB8_725134ADF989
push eax
push 0x34
pop edx
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov dword [ebp - 0x58], str.9BE518E6_ECC6_35A9_88E4_87755C07200F
mov dword [ebp - 0x54], str.FF66E9F6_83E7_3A3E_AF14_8DE9A809A6A4
mov dword [ebp - 0x50], str.9A25302D_30C0_39D9_BD6F_21E6EC160475
mov dword [ebp - 0x4c], str.A09D5493_0D9F_3211_B3BF_DD7ABBB318C1
mov dword [ebp - 0x48], str.F2E0402D_AA60_32E3_8480_39AD5CE79DF2
mov dword [ebp - 0x44], str.CC1DB186_550F_3CFE_A2A9_EBA5E5A34BC1
mov dword [ebp - 0x40], str.09298F26_A95C_31E2_9D95_2C60F586F075
mov dword [ebp - 0x3c], str.31B44A9A_7CFE_3039_AEAE_A664F3C5F7BD
mov dword [ebp - 0x38], str.E3F7F270_4ADD_3DA6_8B35_A924C134D49F
mov dword [ebp - 0x34], str.9B775AA1_7B10_379A_9B16_7E373790568C
mov dword [ebp - 0x30], str.DCB46B42_723F_350E_B18A_449BC6C21636
mov dword [ebp - 0x2c], str.09C0A8D5_EEC1_369D_8C7A_2E2DD17DCA5E
mov dword [ebp - 0x28], str.86CE1746_9EFF_3C9C_8755_81EA8903AC34
mov dword [ebp - 0x24], str.CA8A885F_E95B_3FC6_BB91_F4D9377C7686
mov dword [ebp - 0x20], str.820B6609_4C97_3A2B_B644_573B06A0F0CC
mov dword [ebp - 0x1c], str.6AFCA4E1_9B78_3640_8F72_A7BF33448200
mov dword [ebp - 0x18], str.F03CB3EF_DC16_35CE_B3C1_C68EA09E5E97
mov dword [ebp - 0x14], str.402ED4A1_8F5B_387A_8688_997ABF58B8F2
mov dword [ebp - 0x10], str.887868A2_D6DE_3255_AA92_AA0B5A59B874
mov dword [ebp - 0xc], str.527BBE2F_1FED_3D8B_91CB_4DB0F838E69E
mov dword [ebp - 8], str.57660847_B1F7_35BD_9118_F62EB863A598
call fcn.00407559
mov esi, eax
lea edi, [ebp - 0x70]
add esp, 4
mov ecx, 0x200
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00407474
mov ebx, eax
xor edi, edi
test ebx, ebx
jne 0x406e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
jmp 0x406eb3
mov esi, edi
mov ecx, ebx
mov dword [ebp - 0x60], edi
call fcn.0040758c
lea edx, [ebp - 0x70]
mov ecx, ebx
call fcn.0040764c
mov edx, dword [ebp + esi*4 - 0x5c]
mov ecx, ebx
call fcn.00407691
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push 1
push edi
call fcn.00407608
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x60], edi
je 0x406e9b
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x406ea7
inc esi
cmp esi, 0x16
jb 0x406e4e
jmp 0x406eaa
xor edi, edi
inc edi
mov ecx, ebx
call fcn.0040756a
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040dbce
leave
ret
Function at 0x407014
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40707d
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.SecureProtocols
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40707d
cmp dword [ebp - 0xc], 4
jne 0x40707d
mov esi, dword [ebp - 0x10]
mov eax, 0xa00
and esi, eax
sub esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x407083
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], 0
je 0x407092
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x40738b
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
je 0x4073ce
push 0x14
pop ecx
call fcn.00406a21
mov esi, eax
test esi, esi
je 0x4073ce
push 0x14
mov ecx, esi
call fcn.00406a08
push 0
mov edx, edi
mov dword [esi + 0x10], 1
mov ecx, ebx
call fcn.004070e3
mov dword [esi], eax
pop ecx
pop ecx
test eax, eax
jne 0x4073d4
mov ecx, esi
call fcn.00406a47
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x407360
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x4073ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
call fcn.00407145
jmp 0x4073c7
mov dword [esi + 0xc], 0x404810
mov eax, esi
jmp 0x4073d0

Function at 0x40740a
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x40745b
call fcn.00407227
mov edx, eax
mov ecx, esi
call fcn.004071a6
push 0xbb8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407443
cmp eax, 0x102
jne 0x407443
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi]
call fcn.00407145
mov ecx, esi
pop esi
jmp fcn.00406a47
pop esi
ret

Function at 0x407e45
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x407ea2
push dword [esi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x407ea2
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040dbce
leave
ret 0xc