joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108842ba
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x108842a4

Function at 0x108c1e59
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
pushfd
jmp 0x108c1e83
lea esp, [esp + 8]
lea ecx, [ecx + eax*4]
jmp 0x108c1e8f
mov edi, ebx
mov ecx, dword [esi + 0x1c]
btc di, ax
stc
jmp 0x108c1e63
mov eax, dword [ebp + 8]
mov edi, esp
mov edi, dword [eax + ecx]
jmp 0x108c2a50
add edi, eax
call fcn.108c1f21
mov dx, word [esp + 1]
clc
jmp 0x108c2a6f
sub edi, 0xc
rdtsc
lea edx, reloc.KERNEL32.dll_GetCPInfo
mov dh, 0x36
jmp 0x108c2a9b
pushal
cmc
jmp 0x108c2af6
lea eax, [esi*4]
mov ax, si
jmp 0x108c2ad7
mov cl, byte [esp]
jmp 0x108c2b04
mov eax, dword [edi + 0xc]
neg bx
jae 0x108c2ac1
mov cl, byte [esp]
mov dh, ch
bsr dx, sp
jmp 0x108c2b0a
ja 0x108c2aa3
lea eax, [esi*4]
mov ax, si
jmp 0x108c2ad7
mov dh, ch
bsr dx, sp
cpuid
jmp 0x108c2b12
sub esp, 0x14
jle 0x108c2d77
lea esp, [esp + 2]
push ebp
lea esp, [esp + 2]
jmp 0x108c2cf4
mov bl, 0xdd
mov bh, byte [esp]
mov dword [edi + 4], ecx
cmc
jge 0x108c2b70
lea ecx, reloc.KERNEL32.dll_GetCPInfo
jmp 0x108c2bbd
mov dword [ebp], eax
pop ebp
mov dword [edi + 8], ebx
mov bl, 0x4a
mov bx, 0xa26d
jmp 0x108c2b42
jmp 0x108c2bb6
not ecx
mov ecx, esp
mov ebx, edx
lea edx, reloc.KERNEL32.dll_GetCPInfo
lea esp, [esp + 0x14]
jmp 0x108c2bc3
push ebp
mov ebp, edi
lea ebp, [ebp + 0xc]
jmp 0x108c2b61
popal
jmp 0x108c2c61
lea ecx, reloc.KERNEL32.dll_GetCPInfo
mov ecx, edi
mov dword [ecx], edx
jmp 0x108c2b72
jne 0x108c2ba0
pushal
xchg ebp, edi
mov dx, 0xa5f4
jmp 0x108c2caa
jmp 0x108c2b98
inc ah
and ecx, 0xff0
bsr edx, edx
jge 0x108c2c05
jl 0x108c2c0e
aas
ret
popal
rdtsc
xchg dx, ax
jmp 0x108c2be5
mov eax, dword [esp]
jmp 0x108c2c50
mov eax, dword [esp]
mov dh, 0x98
lea eax, reloc.KERNEL32.dll_GetCPInfo
jmp 0x108c2c59
mov si, 0x1817
mov dword [esp + 0x18], eax
jmp 0x108c2bfd
mov ebx, dword [esp]
mov bl, 0x57
mov ebx, dword [esp]
mov eax, ebp
jmp 0x108c2c7a
mov dh, 0x98
lea eax, reloc.KERNEL32.dll_GetCPInfo
cmp ecx, 0xfe0
jmp 0x108c2c36
mov dx, cx
mov bx, 0x5762
jmp 0x1086ebba
jne 0x108c2ba0
xor byte [edi + 0xc], 0x20
jmp 0x108c2ba0
neg bx
jae 0x108c2c2c
mov si, 0x1817
mov dword [esp + 0x18], eax
popal
rdtsc
xchg dx, ax
jmp 0x108c2be5
lea esp, [esp + 2]
cmp dword [edi + 0xc], 1
stc
jbe 0x108c2be3
ja 0x108c2b98
ret 0x4c7d
lea esp, [esp + 2]
push ebp
jmp 0x108c2cf0

Function at 0x109212e1
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call 0x1091db8b
jmp 0x1092134e
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
jmp 0x10921324
push ebp
jmp 0x10921383
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1092130e
push eax
jmp 0x1091db86
mov ebp, eax
mov eax, dword [ebp]
pop ebp
mov eax, dword [eax + 8]
jmp 0x10921364
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x21497495
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..text
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x21f477c5
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4065c9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42d2c4], 0
jne 0x406604
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4065dd
mov dword [ecx*4 + 0x42d2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x4065d8
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406631
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42d2c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406612
not eax
pop ebp
ret 0xc

Function at 0x100113e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x1001171
add esi, ecx
mov ax, word [esi]
test ax, ax
je 0x1001169
cmp ax, 0x22
jne 0x1001159
cmp word [esi], 0x22
jne 0x1001189
jmp 0x1001187
cmp ax, 0x20
jbe 0x1001189
add esi, ecx
cmp word [esi], 0x20
ja 0x1001177
jmp 0x1001189
cmp ax, 0x20
ja 0x1001191
add esi, ecx
mov ax, word [esi]
test ax, ax
jne 0x1001181
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x10011ab
movzx eax, word [ebp - 0x14]
jmp 0x10011ae
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40e9e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ea40
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00403e30
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret

Function at 0x40eb10
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40eb70
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00403e30
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x40f420
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x40f45b
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, edi
push ebx
push esi
xor ebx, ebx
mov esi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f466
sub ecx, edx
xor eax, eax
sar ecx, 1
cmp ecx, 0x104
ja 0x40f526
cmp ax, word [edi]
je 0x40f524
nop dword [eax]
push 0x5010bc
push esi
call fcn.004bfc5b
mov edi, eax
add esp, 8
test edi, edi
jne 0x40f4b8
push 0x5010dc
push esi
call fcn.004bfc5b
mov edi, eax
add esp, 8
test edi, edi
je 0x40f524
mov esi, edi
sub esi, dword [ebp - 0x214]
sar esi, 1
test esi, esi
jle 0x40f516
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call fcn.004cdf34
add esp, 0x18
lea eax, [ebp - 0x210]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
jne 0x40f516
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f516
mov ebx, 1
lea esi, [edi + 2]
xor eax, eax
cmp ax, word [esi]
jne 0x40f490
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x40fd70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
mov edx, dword [ebp + 8]
push edi
mov edi, ecx
lea ecx, [ebp - 0x4c]
call fcn.0040e7d0
cmp dword [ebp - 0x38], 0x10
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00435410
push eax
lea ecx, [ebp - 0x4c]
call fcn.004031f0
mov edx, dword [ebp - 0x68]
cmp edx, 0x10
jb 0x40fde7
mov ecx, dword [ebp - 0x7c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40fddd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff7d
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 0x38], 0x10
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x64]
cmovae edx, dword [ebp - 0x4c]
call fcn.0040e8d0
cmp dword [esi + 0x14], 8
jb 0x40fe02
mov esi, dword [esi]
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.0040e7d0
lea eax, [ebp - 0x1c]
push eax
mov edx, eax
call fcn.0042f9a0
add esp, 4
lea edx, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x34]
cmovae edx, dword [ebp - 0x1c]
call fcn.0040e8d0
cmp dword [ebp - 0x50], 8
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x34]
cmovae edx, dword [ebp - 0x64]
cmp dword [ebp - 0x20], 8
cmovae ecx, dword [ebp - 0x34]
add eax, eax
push eax
push ecx
push 1
push edx
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, dword [ebp - 0x20]
mov esi, eax
neg esi
sbb esi, esi
cmp edx, 8
jb 0x40fe95
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fe8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff82
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 0x10
jb 0x40fedd
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40fed3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff82
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
cmp edx, 8
jb 0x40ff25
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ff1b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff82
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
cmp edx, 0x10
jb 0x40ff69
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ff5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff82
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
int3
Function at 0x40ffe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 1
push ecx
push eax
push ebx
push edi
mov dword [ebp - 0xc], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4100d9
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4100d9
xor ecx, ecx
lea eax, [eax*2 + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004bdd47
mov esi, eax
add esp, 4
test esi, esi
je 0x4100d9
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx*4 + 2]
push ecx
push 0
push esi
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4100ce
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x410094
mov ecx, dword [ebp - 0x14]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.00403e30
push 2
push esi
call fcn.004bdd39
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 2
push esi
call fcn.004bdd39
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret

Function at 0x4100f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x410102
mov esi, dword [esi]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
pop esi
sbb eax, eax
inc eax
pop ebp
ret
Function at 0x4104e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, 9
push 0
push eax
call fcn.004c05c0
add esp, 0xc
mov dword [ebp - 0x210], 0x103
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4106a9
cmp ax, word [ebp - 0x20c]
je 0x4106a9
push 3
lea eax, [ebp - 0x20c]
push 0x505384
push eax
call fcn.004c83ee
add esp, 0xc
test eax, eax
jne 0x410592
mov esi, 2
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 3
lea eax, [ebp - 0x20c]
push 0x50538c
push eax
call fcn.004c83ee
add esp, 0xc
test eax, eax
jne 0x4105c2
mov esi, 5
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 3
lea eax, [ebp - 0x20c]
push 0x505394
push eax
call fcn.004c83ee
add esp, 0xc
test eax, eax
jne 0x4105f2
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 3
lea eax, [ebp - 0x20c]
push 0x50539c
push eax
call fcn.004c83ee
add esp, 0xc
test eax, eax
jne 0x410622
mov esi, 6
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 3
lea eax, [ebp - 0x20c]
push 0x5053a4
push eax
call fcn.004c83ee
add esp, 0xc
test eax, eax
jne 0x410652
mov esi, 7
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 3
lea eax, [ebp - 0x20c]
push 0x5053ac
push eax
call fcn.004c83ee
add esp, 0xc
test eax, eax
jne 0x410682
mov esi, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
push 3
lea eax, [ebp - 0x20c]
push 0x5053b4
push eax
call fcn.004c83ee
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.VersionNumber
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4106e8
xor ecx, ecx
mov eax, 1
cmp cx, word [ebp - 0x20c]
cmovne esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x410700
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4220
call fcn.004beaf0
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x4000
lea eax, [ebp - 0x4210]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.004c05c0
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41073d
mov eax, dword [esi]
lea ecx, [ebp - 0x4214]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x410833
cmp eax, 0x3fff
ja 0x410833
cmp dword [esi + 0x14], 8
jb 0x410766
mov esi, dword [esi]
lea ecx, [ebp - 0x4210]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x410833
lea eax, [ebp - 0x4218]
push eax
lea eax, [ebp - 0x421c]
push eax
push 0x5010bc
lea eax, [ebp - 0x4210]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x410833
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
mov ecx, dword [ebp - 0x421c]
add esp, 0xc
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x50113c
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.0041fa80
lea edx, [ebp - 0x210]
add esp, 0x1c
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x410800
sub edx, esi
lea eax, [ebp - 0x210]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00403e30
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret

Function at 0x410a70
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5592dc], 0
je 0x410a9c
mov eax, dword [0x5592d8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov dword [0x5592dc], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x410b18
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
test eax, eax
je 0x410b08
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 8], 0
jne 0x410b18
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
mov dword [0x5592d8], 1
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x410b40
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x22c
lea eax, [ebp - 0x248]
mov byte [ebp - 0x24d], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x254], esi
call fcn.004c05c0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x258], eax
push ecx
push eax
mov dword [ebp - 0x248], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x410cc5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.004ce38d
add esp, 8
test eax, eax
jne 0x410caa
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x24c]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x410c30
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call edi
push dword [ebp - 0x24c]
call ebx
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x410c7d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
push esi
push 0x6cd
push str.V3HELPFUNC::Kill
push str.__s__d__TerminateProcess_return_value:__d
call fcn.0041f720
add esp, 0x10
push edi
call ebx
test esi, esi
je 0x410c7d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 0x24d], 1
jmp 0x410ca4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea eax, [ebp - 0x224]
push eax
push 0x6e9
push str.V3HELPFUNC::Kill
push str.__s__d__Kill__s_error_:_d
call fcn.0041f720
add esp, 0x14
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x410bb7
push dword [ebp - 0x258]
call ebx
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x24d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x411480
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x22c
lea eax, [ebp - 0x230]
mov ebx, ecx
push 0
push eax
call fcn.004c05c0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x411502
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004ce38d
add esp, 8
test eax, eax
je 0x41151c
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x4114e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret