joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406be9
Capabilities:
Delete file
Get disk size
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28bc
call fcn.0041e970
push edi
mov byte [ebp - 0x28a8], 0
mov byte [ebp - 0x28b0], 0
mov byte [ebp - 0x28a0], 0
mov ecx, 0xa27
xor eax, eax
lea edi, [ebp - 0x289f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x429878], 0xffffffff
jne 0x406c95
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [0x429870], cl
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..A:
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x429878], eax
mov edx, dword [ebp + 8]
mov al, byte [edx]
mov byte [0x429874], al
lea ecx, [ebp - 0x28ac]
push ecx
lea edx, [ebp - 0x28a4]
push edx
lea eax, [ebp - 0x28b4]
push eax
lea ecx, [ebp - 0x28bc]
push ecx
push 0x429874
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edx, dword [ebp - 0x28b4]
imul edx, dword [ebp - 0x28bc]
mov dword [0x42cd14], edx
push 0
push 0
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28b8], eax
cmp dword [ebp - 0x28b8], 0xffffffff
jne 0x406cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406bb9
add esp, 4
mov al, 1
jmp 0x406d9d
lea ecx, [ebp - 0x28b0]
push ecx
lea edx, [ebp - 0x28a8]
push edx
mov eax, dword [ebp - 0x28b8]
push eax
mov ecx, dword [0x42cd14]
push ecx
mov edx, dword [0x429878]
push edx
call fcn.00406766
add esp, 0x14
and eax, 0xff
test eax, eax
jne 0x406d1b
mov eax, dword [ebp - 0x28b8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x406d9d
mov ecx, dword [ebp - 0x28b8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28a8]
and edx, 0xff
test edx, edx
je 0x406d97
lea eax, [ebp - 0x28a0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406a96
add esp, 8
lea edx, [ebp - 0x28a0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x406d80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406bb9
add esp, 4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28a0]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov al, 1
jmp 0x406d9d
mov edx, dword [ebp - 0x28b0]
and edx, 0xff
test edx, edx
jne 0x406d97
mov byte [0x42cd27], 1
mov al, byte [ebp - 0x28a8]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40d550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push edi
call fcn.004011da
mov dword [0x42cc68], eax
mov eax, dword [ebp + 8]
fild dword [eax + 0xc]
fstp dword [0x439ad4]
lea ecx, [ebp - 0x830]
push ecx
call fcn.004177e7
add esp, 4
lea ecx, [ebp - 0x830]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 0x828], 0
mov ecx, 0x207
xor eax, eax
lea edi, [ebp - 0x827]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 8]
add edx, 0x334
push edx
lea eax, [ebp - 0x828]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x828]
push edx
push 0x417bc4
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x439ad4]
push ecx
call fcn.0040470c
add esp, 4
mov dword [ebp - 0x82c], 0
jmp 0x40d61d
mov edx, dword [ebp - 0x82c]
add edx, 1
mov dword [ebp - 0x82c], edx
cmp dword [ebp - 0x82c], 0x14
jge 0x40d649
push ecx
mov ecx, esp
mov dword [ebp - 0x834], esp
push str.reg.exe
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x838], eax
call fcn.00402ca9
add esp, 4
jmp 0x40d60e
push 0x439a48
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x439a60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x42d030
call fcn.004129a9
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x42d030
call fcn.00412e90
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41df4b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420dbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov dword [ebp - 0x68], ecx
mov dword [ebp - 4], 1
push 0x44
push 0
lea eax, [ebp - 0x64]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x64], 0x44
mov word [ebp - 0x34], 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x64]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.00405eb0
push eax
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea ecx, [ebp + 8]
call fcn.00405eb0
push eax
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x41dff1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
jmp 0x41e00c
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x41ea80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4220c0
push 0x41ec36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5139f0], 0xffffffff
mov dword [0x5139f4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5139e4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5139e0]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5139ec], ecx
call fcn.0041ec80
mov eax, dword [0x42a9d0]
test eax, eax
jne 0x41eb11
push 0x41ec70
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.0041ec50
push 0x426070
push 0x42606c
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5139dc]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5139d8]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x426068
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x41ec1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x41eb85
cmp al, 0x22
jne 0x41eb77
cmp byte [esi], 0x22
jne 0x41eb8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x41eb9e
cmp al, 0x20
ja 0x41eb9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x41eb8e
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x41ebbf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x41ebc4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x41ec04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x41eb8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x41ec1f
Function at 0x402691
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5345d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push 0x4d
lea eax, [ebp - 0x57]
push ebx
push eax
mov byte [ebp - 0x58], bl
call fcn.004b53e0
add esp, 0xc
cmp esi, ebx
jne 0x4026c3
or eax, 0xffffffff
jmp 0x402777
lea eax, [ebp - 0x58]
push eax
mov edx, str.____This_is_the_beginning_of_a_PAULA_Arkive_self_extracting_compilation.____
call fcn.0047e900
push esi
call fcn.004b4b02
push esi
mov dword [ebp - 0x5c], ebx
call fcn.004b4b5e
add esp, 0xc
cmp eax, 0xffffffff
je 0x40270a
push 1
push eax
lea eax, [ebp - 0x5c]
lea ebx, [ebp - 0x58]
call fcn.00421998
test eax, eax
pop ecx
pop ecx
jne 0x402770
push esi
call fcn.004b4b5e
cmp eax, 0xffffffff
pop ecx
jne 0x4026e8
xor ebx, ebx
push 2
push ebx
push esi
call fcn.004b48ff
add esp, 0xc
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004b4450
pop ecx
push eax
lea eax, [ebp - 0x58]
push 1
push eax
call fcn.004b43ca
mov edi, eax
lea eax, [ebp - 0x58]
push eax
call fcn.004b4450
add esp, 0x14
cmp edi, eax
je 0x40274e
push str.:7:TagSelfExtractingExe___FAILED:_fwrite___failed_to_write_the_tag_
call fcn.004178df
or eax, 0xffffffff
jmp 0x402776
push esi
call fcn.004b4b02
push 2
push 0xffffffffffffffff
push esi
call fcn.004b48ff
push esi
call fcn.004b4b5e
push 2
push ebx
push esi
call fcn.004b48ff
add esp, 0x20
push esi
call fcn.004b4673
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004b4c95
leave
ret
Function at 0x40382c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004c6510
push ebx
push esi
xor ebx, ebx
push 0xffc
lea eax, [ebp - 0x1004]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x1008], ebx
call fcn.004b53e0
add esp, 0xc
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jne 0x403869
xor eax, eax
jmp 0x4038f2
shr esi, 2
mov eax, 0x40000
cmp esi, eax
mov dword [ebp - 4], esi
jbe 0x40387b
mov dword [ebp - 4], eax
shr dword [ebp - 4], 2
push edi
mov edi, 0x400
cmp dword [ebp - 4], edi
jbe 0x40389c
push 4
push dword [ebp - 4]
call fcn.004b422c
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x4038a5
mov dword [ebp - 4], edi
lea esi, [ebp - 0x1008]
xor edi, edi
push dword [ebp + 8]
push dword [ebp - 4]
push 4
push esi
call fcn.004b56f6
add esp, 0x10
test eax, eax
mov dword [ebp - 8], eax
jbe 0x4038d1
xor ebx, ebx
test eax, eax
jbe 0x4038cd
add edi, dword [esi + ebx*4]
inc ebx
cmp ebx, eax
jb 0x4038c5
add edi, eax
jmp 0x4038a7
test edi, edi
jne 0x4038da
test ebx, ebx
je 0x4038da
inc edi
test esi, esi
je 0x4038ef
lea eax, [ebp - 0x1008]
cmp esi, eax
je 0x4038ef
push esi
call fcn.004b4080
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409fd3
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push edi
call fcn.0040a371
call fcn.0040a185
xor ebx, ebx
mov dword [esp + 0xc], eax
mov dword [0x54787c], 1
call fcn.0040d36d
call fcn.00433839
test eax, eax
jne 0x40a010
push str.:5:InitConsole___encountered_a_problem:_EnableNumLock___FAILED_
call fcn.00417db7
pop ecx
call fcn.0040a328
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
xor ebx, ebx
test eax, eax
je 0x40a076
push str.PAULA_Initialization...
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
test eax, eax
mov edi, str._GetLastError_
jne 0x40a043
push edi
push str.:4:InitConsole___encountered_a_problem:_SetConsoleTitle___FAILED:__s
call fcn.00417db7
pop ecx
pop ecx
push 0x243
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040a328
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x40a06a
push edi
push str.:2:InitConsole___encountered_a_problem:_SetWindowPos___FAILED:__s
call fcn.00417db7
pop ecx
pop ecx
call fcn.0040a328
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0040a316
push eax
call fcn.00413d94
cmp dword [ebp + 8], ebx
pop ecx
je 0x40a0b5
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edi, eax
call fcn.00414cd3
cmp edi, ebx
je 0x40a0b0
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffaffff
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.00414cd3
call fcn.00414db7
call fcn.00414edd
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str.DoNotScrmbErLg.txt
push ebx
call fcn.0045e70f
pop ecx
pop ecx
mov edi, eax
call fcn.0041b048
test eax, eax
je 0x40a0e7
push ebx
call fcn.0041729b
pop ecx
mov eax, dword [esp + 0xc]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a185
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x5345d0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.004b53e0
add esp, 0xc
call fcn.0040a0f1
xor edi, edi
inc edi
call fcn.0040c039
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
mov esi, str._GetLastError_
jne 0x40a1e6
push esi
push str.:7:InitConsole___FAILED:_AllocConsole___FAILED:__s
xor edi, edi
call fcn.004178df
pop ecx
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push 0xfffffffffffffff6
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
jne 0x40a20c
push esi
push str.:7:InitConsole___FAILED:_SetConsoleMode_STD_INPUT_HANDLE__FAILED:__s
xor edi, edi
call fcn.004178df
pop ecx
pop ecx
push 3
push 0xfffffffffffffff5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
jne 0x40a22c
push esi
push str.:7:InitConsole___FAILED:_SetConsoleMode_STD_OUTPUT_HANDLE__FAILED:__s
xor edi, edi
call fcn.004178df
pop ecx
pop ecx
push 1
push 0x40a344
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x40a24c
push esi
push str.:7:InitConsole___FAILED:_SetConsoleCtrlHandler___FAILED:__s
xor edi, edi
call fcn.004178df
pop ecx
pop ecx
mov ebx, 0x35c
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
test eax, eax
jne 0x40a26b
push ebx
push str.:9:InitConsole___FAILED:_SetConsoleOutputCP___FAILED:_could_not_set_code_page__d___
xor edi, edi
call fcn.004178df
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ebx, ebx
cmp eax, ebx
mov dword [0x547860], eax
jne 0x40a28b
push esi
push str.:7:InitConsole___FAILED:_GetConsoleWindow___FAILED:__s
xor edi, edi
call fcn.004178df
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jbe 0x40a2ca
lea edx, [esp + 0x10]
call fcn.0047cea7
mov eax, edx
push eax
mov esi, 0x4d3dec
call fcn.0047c537
test eax, eax
pop ecx
jne 0x40a2ca
push ebx
push ebx
call fcn.0045e70f
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.Sounds_
push ebx
call fcn.0045e70f
pop ecx
pop ecx
mov ebx, eax
call fcn.00479402
call fcn.004a4ba8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004b5860
pop ecx
call fcn.004b586d
call fcn.004b586d
call fcn.004b586d
mov ecx, dword [esp + 0x11c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b4c95
mov esp, ebp
pop ebp
ret
Function at 0x40aacf
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test esi, esi
push ebx
mov ebx, eax
jne 0x40aadf
xor eax, eax
jmp 0x40ab54
test ebx, ebx
jne 0x40aae8
mov byte [esi], 0
jmp 0x40aadb
jge 0x40ab0e
push edi
call fcn.0040bf5d
mov edi, eax
sub edi, dword [ebp + 8]
push ebx
call fcn.004b7159
cmp edi, eax
pop ecx
jge 0x40ab04
mov ebx, edi
jmp 0x40ab0d
push ebx
call fcn.004b7159
pop ecx
mov ebx, eax
pop edi
mov ax, word [ebp + 8]
mov word [ebp - 8], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 6], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
push esi
call fcn.0040bff5
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x40ab44
cmp eax, ebx
jg 0x40aae3
mov byte [eax + esi], 0
jmp 0x40aadb
cmp eax, ebx
jg 0x40ab4e
mov byte [eax + esi], 0
jmp 0x40ab51
mov byte [esi], 0
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x40abda
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5345d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x130]
push ebx
push eax
mov dword [ebp - 0x134], ebx
call fcn.004b53e0
add esp, 0xc
cmp esi, ebx
je 0x40ac3f
cmp byte [esi], bl
je 0x40ac3f
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x13c], edi
jne 0x40ac50
push str._GetLastError_
push dword [ebp + 8]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED:__s
call fcn.004178df
add esp, 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop ebx
call fcn.004b4c95
leave
ret
lea eax, [ebp - 0x134]
push eax
push edi
mov dword [ebp - 0x134], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40ac88
push str._GetLastError_
push dword [ebp + 8]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_Process32First___FAILED:__s
call fcn.004178df
add esp, 0x10
call fcn.0041d762
jmp 0x40ac3f
or dword [ebp - 0x138], 0xffffffff
cmp dword [ebp + 8], ebx
push esi
lea eax, [ebp - 0x110]
push eax
je 0x40aca9
call fcn.004b519f
test eax, eax
pop ecx
pop ecx
je 0x40acb4
jmp 0x40acfa
call fcn.0047d058
test eax, eax
pop ecx
pop ecx
je 0x40acfa
push dword [ebp - 0x12c]
mov dword [ebp - 0x138], ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x40acfa
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40acf5
push str._GetLastError_
lea eax, [ebp - 0x110]
push eax
push str.:1:TerminateProcessByName___encountered_a_problem:_TerminateProcess___FAILED_to_terminate__s:__s:_trying_once_more_with_higher_privilege...
call fcn.00417db7
add esp, 0xc
call fcn.0041d762
mov edi, dword [ebp - 0x13c]
lea eax, [ebp - 0x134]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40ac8f
call fcn.0041d762
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x138]
jmp 0x40ac42
Function at 0x40ad2d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5345d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x130]
push ebx
push eax
mov dword [ebp - 0x134], ebx
call fcn.004b53e0
add esp, 0xc
cmp esi, ebx
je 0x40ae19
cmp byte [esi], bl
je 0x40ae19
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ad97
push dword [ebp + 8]
push esi
push str.CountProcesses__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.004178df
add esp, 0xc
or eax, 0xffffffff
jmp 0x40ae1b
lea eax, [ebp - 0x134]
push eax
push edi
mov dword [ebp - 0x134], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40adca
push dword [ebp + 8]
push esi
push str.CountProcesses__s___d__FAILED:_Process32First___FAILED_
call fcn.004178df
add esp, 0xc
call fcn.0041d762
jmp 0x40ad8f
mov dword [ebp - 0x138], ebx
cmp dword [ebp + 8], ebx
push esi
lea eax, [ebp - 0x110]
push eax
je 0x40adea
call fcn.004b519f
test eax, eax
pop ecx
pop ecx
je 0x40adf5
jmp 0x40adfb
call fcn.0047d058
test eax, eax
pop ecx
pop ecx
je 0x40adfb
inc dword [ebp - 0x138]
lea eax, [ebp - 0x134]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40add0
call fcn.0041d762
mov eax, dword [ebp - 0x138]
jmp 0x40ae1b
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop ebx
call fcn.004b4c95
leave
ret
Function at 0x40b4fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x5345d0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1a4]
mov esi, 0x207
xor ebx, ebx
push esi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.004b53e0
add esp, 0xc
cmp dword [ebp + 0x1a8], ebx
mov dword [ebp - 0x7c], ebx
jge 0x40b554
mov dword [ebp + 0x1a8], esi
push 0x208
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.004b53e0
mov eax, dword [ebp - 0x78]
add esp, 0xc
call fcn.0047c34d
mov edx, edi
call fcn.0047c3ca
test eax, eax
je 0x40b57d
xor eax, eax
jmp 0x40b5cb
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
je 0x40b5b7
push esi
push str._GetLastError_
push edi
push str.:4:GetRegString___s___FAILED:_RegQueryValueEx___FAILED:__s_ld
call fcn.00417db7
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40b579
mov ecx, dword [ebp + 0x1a8]
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x78]
dec ecx
call fcn.0047c3fc
pop ecx
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b4c95
add ebp, 0x198
leave
ret

Function at 0x40b5e2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
jne 0x40b5f0
xor eax, eax
jmp 0x40b631
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x40b62e
push esi
push str._GetLastError_
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.:4:SetRegDword___s____ld__FAILED:_RegSetValueEx___FAILED:__s_ld
call fcn.00417db7
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40b5ec
xor eax, eax
inc eax
pop esi
pop ebp
ret