joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb8
xor eax, eax
push ebp
push 0x452c82
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
xor edx, edx
mov eax, 2
call fcn.004527d0
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004527f0
mov ebx, eax
jmp 0x452c4e
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404d78
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004094b8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408ba0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408ba0
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404f14
je 0x452c25
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404d78
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408ba0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408ba0
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404f14
jne 0x452c3f
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00452810
mov ebx, eax
test ebx, ebx
jne 0x452b80
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c89
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404b2c
lea eax, [ebp - 4]
call fcn.00404b08
ret

Function at 0x452fa8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffca0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fb8
xor eax, eax
push ebp
push 0x453080
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x209]
mov edx, dword [ebp - 4]
call fcn.0040968c
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402c88
lea eax, [ebp - 0x309]
mov edx, dword [ebp - 8]
call fcn.0040968c
lea eax, [ebp - 0x350]
xor ecx, ecx
mov edx, 0x44
call fcn.0040346c
mov dword [ebp - 0x350], 0x44
mov dword [ebp - 0x324], 1
mov word [ebp - 0x320], bx
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x350]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x209]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x453057
or esi, 0xffffffff
jmp 0x453065
push 0xffffffffffffffff
mov eax, dword [ebp - 0x360]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453087
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b2c
ret
Function at 0x453a2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453d86
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402f2c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409484
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x453d9c
call fcn.00404e14
mov eax, 0x453db8
call fcn.004539b4
test al, al
je 0x453b72
mov eax, dword [0x455ea0]
mov edx, 0x453dd4
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
mov eax, dword [0x455ea0]
mov edx, 0x453e08
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
mov eax, dword [0x455ea0]
mov edx, 0x453e34
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
mov edx, 0x453db8
mov eax, dword [0x4528a0]
call fcn.004529ac
push 0x12c
call sub.kernel32.dll_Sleep
mov eax, dword [0x455ea0]
mov edx, 0x453e4c
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
mov eax, dword [ebp - 8]
call fcn.00404fc8
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x453b72
mov eax, dword [ebp - 8]
call fcn.004093ec
test al, al
je 0x453b72
cmp dword [ebp - 4], 1
jne 0x453b3b
mov eax, dword [0x455ea0]
mov edx, 0x453e78
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
jmp 0x453b54
mov eax, dword [0x455ea0]
mov edx, 0x453ec8
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
cmp dword [ebp - 4], 1
jne 0x453d6b
mov eax, dword [0x455fe0]
call fcn.0040362c
call fcn.00402c14
jmp 0x453d6b
mov eax, dword [0x455ea0]
mov edx, 0x453f08
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
mov eax, 0x457c50
mov edx, 0x453f28
call fcn.00404b5c
push 0x453f34
lea eax, [ebp - 0x14]
mov ecx, dword [0x457c50]
mov edx, 0x453f44
call fcn.00404e14
mov eax, dword [ebp - 0x14]
call fcn.00404fc8
push eax
mov ecx, dword [0x457668]
mov dl, 1
mov eax, dword [0x416fac]
call fcn.0041b0cc
mov dword [0x457c4c], eax
xor eax, eax
push ebp
push 0x453c56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x457c4c]
mov edx, dword [eax]
call dword [edx]
call fcn.00402a88
mov dword [0x457c44], eax
mov eax, dword [0x457c4c]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [0x457c44]
mov eax, dword [0x457c4c]
call fcn.0041a9f8
mov edx, dword [ebp - 8]
mov eax, dword [0x457c4c]
call fcn.0041aec8
mov eax, dword [0x455ea0]
mov edx, 0x453f58
call fcn.004051b8
call fcn.00403844
call fcn.00402c14
mov eax, dword [0x457c44]
call fcn.00402ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453c5d
mov eax, dword [0x457c4c]
call fcn.00403d94
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453d8d
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404b2c
ret
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], str.j_bj_bj
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x41b81b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x4a3ca8]
push edi
mov edi, eax
mov eax, dword [ebp + 8]
mov ebx, ecx
cmp eax, 3
jb 0x41b88d
push 3
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x12
movzx ecx, byte [eax + ebx]
mov edx, dword [ebp - 4]
shl edx, 8
or ecx, edx
inc eax
mov dword [ebp - 4], ecx
cmp eax, 3
jl 0x41b84c
xor edx, edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub dword [ebp - 8], 6
shr eax, cl
and eax, 0x3f
mov al, byte [eax + esi]
mov byte [edx + edi], al
inc edx
cmp edx, 4
jl 0x41b863
sub dword [ebp + 8], 3
add ebx, 3
add edi, 4
dec dword [ebp - 0xc]
jne 0x41b840
mov eax, dword [ebp + 8]
dec eax
je 0x41b8cc
dec eax
jne 0x41b8eb
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + esi]
mov byte [edi], al
movzx eax, byte [ebx]
movzx ecx, byte [ebx + 1]
and eax, 3
shl eax, 4
shr ecx, 4
or eax, ecx
mov al, byte [eax + esi]
mov byte [edi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [esi + eax*4]
mov byte [edi + 2], al
mov byte [edi + 3], 0x3d
jmp 0x41b8eb
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + esi]
mov byte [edi], al
movzx eax, byte [ebx]
and eax, 3
add eax, eax
mov al, byte [esi + eax*8]
mov byte [edi + 1], al
mov word [edi + 2], 0x3d3d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x423f92
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push 8
mov eax, 0x4740bb
call fcn.0043cb85
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp esi, dword [ebp + 0xc]
je 0x423fe5
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.0041ed0a
add dword [ebp + 0x10], 0x40
add esp, 0xc
add esi, 0x40
jmp 0x423fab
mov eax, dword [ebp + 0x10]
call fcn.0043cc2a
ret

Function at 0x425474
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push 0x94
mov eax, 0x47433f
call fcn.0043cb52
mov edi, ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0041d810
mov esi, eax
cmp esi, dword [edi + 4]
je 0x42549c
mov eax, dword [ebx]
cmp eax, dword [esi + 0xc]
jge 0x4254eb
lea ecx, [ebp - 0xa0]
call fcn.0041d944
mov ecx, dword [ebx]
and dword [ebp - 4], 0
mov dword [ebp - 0x58], ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.0041dfb1
lea eax, [ebp - 0x58]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00423e18
push eax
push esi
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00424fe8
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x54]
call fcn.0044bc1e
lea ecx, [ebp - 0xa0]
call fcn.0044bc1e
lea eax, [esi + 0x10]
call fcn.0043cc2a
ret 4
Function at 0x436639
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x437700], 0x20
push esi
push edi
mov esi, ecx
je 0x43667a
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x42da68
push dword [0x43770c]
push dword [0x437708]
call fcn.00439380
push 0x1c135e
call fcn.00430cef
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x4366c2
cmp ecx, edi
je 0x4366f2
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x4366c2
cmp ecx, dword [ebp - 0x10]
jne 0x4366c2
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x43b459
Capabilities:
Encode data using xor

Disassembly:
push esi
lea esi, [ecx + 0x10]
mov edx, dword [esi]
mov eax, edx
mov ecx, edx
and eax, 0xffffc000
add eax, 0x4000
xor eax, edx
and eax, 0xfffc000
xor edx, eax
mov eax, ecx
lock cmpxchg dword [esi], edx
mov edx, eax
cmp edx, ecx
jne 0x43b45f
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1770d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x1770da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x1770d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x1770d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x1770dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x1770db5
pop edi
not eax
pop esi
ret 0xc
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0x41f31dd0
add eax, 0xbe4d0abe
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xbfdab021
sub dword [ebp - 0x1c], 0x71886ad6
mov dword [ebp - 0x18], 0xa1c080c7
sub dword [ebp - 0x18], 0x6f8d3482
mov dword [ebp - 0x14], 0x879f74cb
sub dword [ebp - 0x14], 0x3b53309d
mov dword [ebp - 0x10], 0x3be568e7
add dword [ebp - 0x10], 0xc41a9719
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb9b6e57
sub eax, 0xb5aedcb
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x92c5df60
add dword [ebp - 0x1c], 0xe1ac89f6
mov dword [ebp - 0x18], 0x89b137e3
sub dword [ebp - 0x18], 0x4844d66e
mov dword [ebp - 0x14], 0x5d582887
add dword [ebp - 0x14], 0x61743e5
mov dword [ebp - 0x10], 0x843ef98b
sub dword [ebp - 0x10], 0x843ef98b
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xe4ab4cd3
add eax, 0x1b953401
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3738e
push 0
call eax
mov ecx, 0x4a81
mov edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0xc]
mov ebx, 0x630b1c
mov edi, dword [esi]
sub dword [ebp - 8], edi
add edi, ebx
sub dword [ebp - 8], 0xbd9bc7da
mov dword [edx], edi
xor dword [ebp - 4], edx
add edx, 0xb680c58a
add edx, 0x497f3a7a
add esi, 0x6e69cfc4
add esi, 0x91963040
loop 0x40299e
add eax, 0x11cd7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4032e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x414320]
push 0
push 0x403320
push 0
push 0x65
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 1
push eax
mov dword [0x414308], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x414308]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x414308]
ret

Function at 0x403720
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40f2b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x19c
push ebx
push esi
lea ecx, [esp + 0xc]
call fcn.00401ca0
xor ebx, ebx
lea ecx, [esp + 8]
mov dword [esp + 0x1ac], ebx
call fcn.00401ca0
lea ecx, [esp + 0x10]
mov byte [esp + 0x1ac], 1
call fcn.00401ca0
mov eax, dword [esp + 0x1c0]
lea ecx, [esp + 0x20]
push eax
push str.SKU_d
push ecx
mov byte [esp + 0x1b8], 2
call fcn.004072fa
mov ecx, dword [esp + 0x1c8]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00401550
test al, al
je 0x403909
lea ecx, [esp + 0x10]
push ecx
push 0x4130b8
push ebx
lea ecx, [esp + 0x18]
call fcn.004021a0
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
mov esi, eax
call fcn.00401d70
push esi
push ebx
lea ecx, [esp + 0x10]
call fcn.00401da0
lea ecx, [esp + 8]
call fcn.00401f90
cmp byte [eax], 0x20
jne 0x403800
push 1
push ebx
lea ecx, [esp + 0x10]
call fcn.00401da0
lea ecx, [esp + 8]
call fcn.00401f90
cmp byte [eax], 0x20
je 0x4037e6
lea eax, [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push 0x20019
push ebx
call fcn.00401f90
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x403909
lea ecx, [esp + 0x14]
lea edx, [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.InstallPath
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x403909
cmp dword [esp + 0x18], 1
jne 0x403909
lea edx, [esp + 0xa0]
push 0x5c
push edx
lea esi, [esp + 0xa8]
call fcn.00406610
add esp, 8
cmp eax, ebx
je 0x403895
lea esi, [eax + 1]
push 0x5c
push esi
call fcn.00406610
add esp, 8
cmp eax, ebx
jne 0x403883
cmp esi, ebx
je 0x40389b
mov byte [esi], bl
mov eax, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1b4]
lea ecx, [esp + 0xa0]
push eax
push ecx
push edx
call fcn.00406d10
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x1ac], 1
call fcn.00401cd0
lea ecx, [esp + 8]
mov byte [esp + 0x1ac], bl
call fcn.00401cd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1ac], 0xffffffff
call fcn.00401cd0
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
add esp, 0x1a8
ret
lea ecx, [esp + 0x10]
mov byte [esp + 0x1ac], 1
call fcn.00401cd0
lea ecx, [esp + 8]
mov byte [esp + 0x1ac], bl
call fcn.00401cd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1ac], 0xffffffff
call fcn.00401cd0
mov ecx, dword [esp + 0x1a4]
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a8
ret
Function at 0x404ea0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0xb0
lea eax, [esp]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x404f37
lea ecx, [esp + 0x34]
push 0x80
push ecx
push 6
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
lea edx, [esp + 0x38]
push 0x4130e8
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0040710a
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call esi
test eax, eax
je 0x404f7d
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
call ebx
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
call esi
test eax, eax
jne 0x404f5c
pop edi
pop ebx
pop esi
add esp, 0xb0
ret

Function at 0x405250
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x358
push ebx
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
mov ebx, dword [esp + 0x36c]
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea edi, [ebx + 0x100]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x20], 0x44
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x64]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0x200]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x68]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x405326
push eax
lea eax, [esp + 0x26c]
push 0x100
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x300], ecx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ebx + 0x304], edx
mov dword [ebx + 0x308], eax
mov dword [ebx + 0x30c], ecx
pop ebp
mov al, 1
pop ebx
add esp, 0x358
ret