joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [esp + 0x18], eax
xor edi, edi
mov al, 1
mov dword [esp + 0x14], ecx
mov byte [esp + 0x13], al
cmp dword [ebp + 0x10], edi
jbe 0x4060cd
mov eax, dword [ecx + edi*4]
mov ebx, dword [0x635a54]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x18
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
push eax
push 0x100
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], 0
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.ntdll.dll_NtOpenProcess]
mov esi, eax
cmp esi, 0xc0000022
jne 0x405fd7
cmp ebx, 5
jne 0x405fa7
lea eax, ds:[esp + 0x1c]
mov edx, 0x100
push eax
lea ecx, [esp + 0x40]
call fcn.005248c0
mov esi, eax
cmp esi, 0xc0000022
jne 0x405fd7
cmp dword [0x635a54], 5
jne 0x40606a
mov eax, dword [esp + 0x14]
mov eax, dword [eax + edi*4]
push dword [eax + 0x10]
lea eax, [esp + 0x40]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
mov esi, eax
test esi, esi
js 0x40606a
mov ebx, dword [esp + 0x3c]
lea eax, [esp + 0x40]
push 0x38
xorps xmm0, xmm0
mov dword [esp + 0x4c], 0xffffffff
push eax
push 1
push ebx
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
mov dword [esp + 0x5c], 0xffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov esi, eax
cmp esi, 0xc0000022
jne 0x406057
cmp dword [0x635a54], 5
nop
jne 0x406057
push 0x38
lea eax, [esp + 0x44]
mov edx, 0xc
push eax
mov ecx, ebx
call fcn.00525280
mov esi, eax
push dword ds:[esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x4060e3
mov eax, dword ds:[esp + 0x14]
xor bl, bl
mov byte [esp + 0x13], bl
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x10], 0
lfence
jl 0x40609f
push dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push str.reduce_the_working_set_of
push str.Unable_to__s__s__PID__lu_
call fcn.004019c0
add esp, 0x10
jmp 0x4060b7
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push str.reduce_the_working_set_of
push str.Unable_to__s__s
call fcn.004019c0
add esp, 0xc
mov eax, dword [eax + 4]
push 0
push esi
push eax
push dword [esp + 0x24]
call sym.SystemInformer.exe_Ordinal_1696
test al, al
jne 0x4060e7
mov al, bl
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc
mov bl, byte [esp + 0x13]
inc edi
cmp edi, dword [ebp + 0x10]
jae 0x4060cb
mov ecx, dword [esp + 0x14]
jmp 0x405f16
Function at 0x412880
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
cmp dword [eax], esi
jne 0x4128b8
cmp dword [eax + 8], 0xffffff65
jne 0x4128b8
movzx eax, word [eax + 0xc]
sub eax, 0x41
je 0x4128b8
nop
sub eax, 2
jne 0x4128b8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4128b8
push esi
call sym.SystemInformer.exe_Ordinal_1004
pop esi
ret 8

Function at 0x4128c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
cmp dword [eax], esi
jne 0x412928
cmp dword [eax + 8], 0xffffff65
jne 0x412928
movzx eax, word ds:[eax + 0xc]
sub eax, 0x41
je 0x41290a
sub eax, 2
jne 0x412928
test byte [esp + 0x14], 1
je 0x412928
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x412928
push esi
call sym.SystemInformer.exe_Ordinal_1004
pop esi
pop ecx
ret 0xc
test byte [esp + 0x14], 2
je 0x412928
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x412928
push 2
push 2
push esi
call sym.SystemInformer.exe_Ordinal_1822
pop esi
pop ecx
ret 0xc

Function at 0x413500
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
sub esp, 0x10
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, edx
mov esi, ecx
xor bl, bl
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov bh, byte [eax + 1]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov byte [eax + 1], bl
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x60
push 0
push 0
push 0
push edi
push esi
call sym.SystemInformer.exe_Ordinal_1606
test eax, eax
js 0x4135cf
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push 4
push eax
push 0x1e
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x4135c6
push 0
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 1
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtSetInformationDebugObject]
test eax, eax
js 0x4135b7
push dword [esp + 0x10]
push esi
call dword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
push dword ds:[esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
push esi
mov bl, 1
call dword [sym.imp.ntdll.dll_NtClose]
test bh, bh
je 0x413606
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov byte [ecx + 1], bh
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x1c]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov ecx, dword [esp + 0x18]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x10
ret
Function at 0x414da0
Capabilities:
Delete registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push edi
push 0
push str.RegEdit_RegEdit
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
jne 0x414dfb
push dword ds:[esp + 0x10]
push esi
call sym.SystemInformer.exe_Ordinal_1142
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1518
test byte [eax + 4], 1
jne 0x414e2d
push 0
push 0
push esi
call sym.SystemInformer.exe_Ordinal_1184
test al, al
jne 0x414e2d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 0x62de04
push 0xfffffffffffffff7
push 0x20006
lea eax, [esp + 0x4c]
push eax
call sym.SystemInformer.exe_Ordinal_1470
test eax, eax
js 0x414f30
movups xmm0, xmmword [str.A_SystemInformer]
push 0x11
lea eax, [esp + 0x5c]
movups xmmword [esp + 0x3c], xmm0
push eax
movups xmm0, xmmword [0x5fbed8]
movups xmmword [esp + 0x50], xmm0
call sym.SystemInformer.exe_Ordinal_1633
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x40
call fcn.004fa660
mov esi, eax
mov dword [esp + 0x10], 0x420040
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], ecx
mov eax, dword [esi]
add eax, 2
push eax
push dword [esi + 4]
lea eax, [esp + 0x18]
push 1
push 0
push eax
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x414ecf
call fcn.004fe1e0
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1518
lea edx, [esp + 0x18]
mov ecx, edi
mov al, byte [eax + 4]
not al
and al, 1
movzx eax, al
push eax
call fcn.00414840
mov edx, dword [esp + 0x18]
mov bl, al
mov word [esp + 0x10], dx
lea ecx, [edx + 2]
mov word [esp + 0x12], cx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
cmp edx, 0xfffe
ja 0x414f26
lea eax, ds:[esp + 0x10]
push eax
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1518
test byte ds:[eax + 4], 1
jne 0x414f47
call sym.SystemInformer.exe_Ordinal_1190
mov ecx, dword [esp + 0x84]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
Function at 0x418c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov ebx, dword [esp + 0x5c]
lea eax, [edx - 2]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, dword [esp + 0x6c]
cmp eax, 0x17
ja case.0x418ca0.7
movzx eax, byte [eax + 0x418ddc]
nop dword [eax]
jmp dword [eax*4 + 0x418dc4]
mov eax, dword [esi + 8]
cmp eax, dword [edi + 4]
jb case.0x418ca0.5
lea edx, ds:[esp + 0x34]
push edx
push eax
push 0x407
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x418ca0.5
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x14]
jmp 0x418cff
mov ecx, dword [esi + 4]
jmp 0x418cf0
mov eax, dword [esi + 4]
cmp eax, dword [edi + 4]
jb case.0x418ca0.5
mov ecx, dword [esi + 8]
jmp 0x418cff
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 4]
jb case.0x418ca0.5
mov ecx, dword [ecx + 8]
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x10]
add eax, 0x78
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
call sym.SystemInformer.exe_Ordinal_1410
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x50
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je case.0x418ca0.5
xor ebx, ebx
cmp dword [eax], ebx
jbe case.0x418ca0.5
xor ebp, ebp
nop word [eax + eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + ebp]
mov dword [esp + 0x1c], ecx
add eax, 0x78
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call sym.SystemInformer.exe_Ordinal_1410
mov eax, dword [edi + 0x18]
lea ebp, [ebp + 4]
mov ecx, dword [esp + 0x10]
inc ebx
mov edx, dword [esp + 0x14]
cmp ebx, dword [eax]
jb 0x418d60
mov ecx, dword [esp + 0x5c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x50
ret 0xc
Function at 0x41a560
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x48c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
mov ebx, dword [esp + 0x494]
lea eax, [esp + 0x7c]
push esi
mov dword [esp + 0x1c], eax
mov esi, ecx
push edi
lea eax, [esp + 0x28c]
mov dword [esp + 0xc], 0xd
mov dword [esp + 0x5c], eax
mov edi, edx
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0
push 0x104b
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x34], 0x208
mov dword [esp + 0x58], 0xd
mov dword [esp + 0x68], 0xffffffff
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0
mov dword [esp + 0x70], 0x208
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41a639
lea eax, [esp + 0x48]
push eax
push 0
push 0x104b
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41a639
lea eax, [esp + 0xc]
mov dword [esp + 0x10], ebx
push eax
push 0
push 0x104c
push esi
mov dword [esp + 0x5c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x48]
push eax
push 0
push 0x104c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x494]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x48c
ret 4
Function at 0x439e00
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x130
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x128], eax
test byte [0x62e3b8], 1
push esi
jne 0x439ec5
mov esi, 0x62e3b8
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x439e3b
mov al, 1
jmp 0x439e4f
test byte [0x62e3b8], 1
jne 0x439e4d
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_Ordinal_1388
xor al, al
test al, al
je 0x439ec5
push 0x120
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005861d0
add esp, 0xc
mov dword [esp + 4], 0x120
lea eax, [esp + 4]
push eax
push 0x120
lea eax, [esp + 0x10]
push eax
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
je 0x439eb6
cmp eax, 0xc0000004
jne 0x439eb6
cmp dword [esp + 8], 1
jb 0x439eb6
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439ea0
sub ecx, edx
lea eax, [esp + 0x28]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1315
jmp 0x439eb8
xor eax, eax
mov ecx, esi
mov dword [0x633d94], eax
call sym.SystemInformer.exe_Ordinal_1358
mov eax, dword [0x633d94]
test eax, eax
je 0x439eec
lock inc dword ds:[eax - 4]
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00583f9f
add esp, 0x130
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00583f9f
add esp, 0x130
ret
Function at 0x43aec0
Capabilities:
Get number of processors

Disassembly:
sub esp, 0x64
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword fs:[0x18]
push ebx
push ebp
push esi
mov eax, dword [eax + 0x30]
mov ebx, ecx
push edi
push 0
push 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], 0
movzx edi, word [eax + 0x40]
mov esi, dword [eax + 0x44]
mov eax, dword [ebx]
add eax, edi
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
push eax
call sym.SystemInformer.exe_Ordinal_1331
mov ebp, eax
push edi
push esi
push dword [ebp + 4]
call fcn.00586330
mov eax, dword ss:[ebp + 4]
add esp, 0xc
add eax, edi
push dword [ebx]
push dword [ebx + 4]
push eax
call fcn.00586330
add esp, 0xc
mov dword [esp + 0x10], 0x48
xorps xmm0, xmm0
movlpd qword [esp + 0x14], xmm0
movlpd qword [esp + 0x1c], xmm0
push 0x20
push 4
push dword [0x633a54]
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp dword [0x62db64], 0x71
xorps xmm0, xmm0
mov dword [esp + 0x58], 0x111000
mov edx, 0x20007
mov dword [esp + 0x5c], 0x10000101
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [eax + 4], 1
mov dword [esp + 0x54], eax
jb 0x43afbe
mov dword [esp + 0x60], 0x1110
lea ecx, [esp + 0x58]
mov dword [esp + 0x64], 0
push 0x10
jmp 0x43afc4
push 8
lea ecx, [esp + 0x5c]
push ecx
mov ecx, eax
call fcn.004fd8b0
test eax, eax
jns 0x43afe9
lfence
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x64
ret
push 0
push 0
push 0
push 0
push 0x180
lea eax, [esp + 0x24]
push eax
push 0
push 0
push dword [ebp + 4]
push 0
call sym.SystemInformer.exe_Ordinal_1606
mov esi, eax
test esi, esi
js 0x43b017
push 0
call dword [sym.imp.ntdll.dll_RtlExitUserProcess]
lfence
mov eax, dword [esp + 0x54]
test eax, eax
je 0x43b033
push eax
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
lea ecx, ss:[ebp - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43b048
call fcn.004fe1e0
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x64
ret
Function at 0x43f160
Capabilities:
Hash data using murmur3

Disassembly:
add eax, dword [0x636f71]
dec ebx
neg edi
rol ebx, 0x14
xor dword [0x636e13], 0x85620f23
xchg ecx, esi
xor edi, edx
sub dword [0x636db4], edi
call fcn.004d0e88
call fcn.0042d238
xor dword [0x636e24], esi
xor edi, edx
xchg ecx, esi
mov dword [0x636cf9], 0xb46cb10e
ror ebx, 0x14
neg edi
inc ebx
xor ebx, edi
dec eax
dec edx
sub esi, esp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, dword [0x636f44]
xor ebx, 0x29dd4cfe
call fcn.004b05a6
xchg esi, eax
dec ebx
rol edx, 0x15
add ebx, dword [0x636f03]
xchg eax, esi
ror edi, 1
xor ecx, 0xe92362fa
not esi
call fcn.0057806d
call fcn.0045c61b
not esi
xor ecx, 0xe92362fa
rol edi, 1
xchg eax, esi
ror edx, 0x15
inc ebx
xchg esi, eax
call fcn.0053a1cc
xor ebx, 0x29dd4cfe
add esp, 0x14
inc ebx
xor edi, esp
dec esi
or edi, dword [0x636e7f]
sub eax, dword [0x636e76]
mov dword [0x636e1b], edi
ror ebx, 0x15
dec ebx
add edx, ecx
sal dword [ecx], 1
or eax, 0x636dc0
Function at 0x4595c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [0x6340a0]
push esi
push edi
mov edi, ecx
cmp edi, ebx
je 0x4596af
mov dword [0x6340a0], edi
test ebx, ebx
je 0x459618
mov esi, dword ds:[ebx + 0xc]
mov ecx, esi
push 0
push edi
push 3
push ebx
call dword [0x5a9914]
call esi
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x459618
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [edi + 0x34], 0
jne 0x45967f
mov esi, dword ds:[edi + 0xc]
lea eax, [esp + 0xc]
push 0
push eax
push 5
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
push edi
mov ecx, esi
movups xmmword [esp + 0x1c], xmm0
call dword [0x5a9914]
call esi
test al, al
je 0x45967f
cmp byte [esp + 0xc], 0
jne 0x45967f
push dword [esp + 0x1c]
mov ecx, dword [0x633fcc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0050b260
movzx ecx, byte [0x6330dd]
push ecx
push eax
mov dword [edi + 0x34], eax
call sym.SystemInformer.exe_Ordinal_1833
mov eax, dword [edi + 0x34]
test eax, eax
je 0x45968f
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.00459740
call fcn.00459820
mov esi, dword [edi + 0xc]
mov ecx, esi
push 0
push 0
push 2
push edi
call dword [0x5a9914]
call esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x18
ret
Function at 0x47fba0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x62db64], 0xffffffff
push ebx
push esi
mov esi, dword [0x636a00]
mov ebx, edx
push edi
mov edi, ecx
jae 0x47fbcd
cmp esi, 0x40
jae 0x47fbcd
lfence
mov eax, dword fs:[0x18]
mov eax, dword [eax + esi*4 + 0xe10]
jmp 0x47fbd4
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov esi, dword [ecx + 0x1c]
add edx, esi
add eax, edx
cmp eax, edx
jb 0x47fbff
cmp edx, esi
jb 0x47fbff
cmp eax, dword [ecx + 0x20]
ja 0x47fbff
lea ecx, [ebx - 1]
test edx, ecx
jne 0x47fbff
pop edi
pop esi
lfence
mov eax, edx
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4baae0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x14
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
mov eax, ecx
push edi
mov dword [esp + 0x10], eax
call fcn.004baa40
push dword [0x633a3c]
push 0xc
call sym.SystemInformer.exe_Ordinal_1240
push 0x28
mov esi, eax
push 4
push dword [0x633a54]
mov dword [esi], 0
mov dword [esi + 4], 0xa
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov dword [esp + 0x14], esi
call fcn.0050dd60
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x4baa00
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopsW]
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp dword [eax], ebp
jbe 0x4babc9
xor edi, edi
xor ebx, ebx
nop
mov eax, dword [eax + 8]
mov eax, dword [edi + eax]
test eax, eax
je 0x4bab6f
mov eax, dword [eax + 4]
jmp 0x4bab71
xor eax, eax
push eax
push 0
push 0x143
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4babba
push 4
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [esp + 0x14]
push eax
push esi
push 0x151
mov ecx, dword [ecx + 8]
push dword [esp + 0x1c]
mov ecx, dword [ebx + ecx]
mov dword [eax], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
inc ebp
add edi, 4
add ebx, 4
cmp ebp, dword [eax]
jb 0x4bab60
or esi, 0xffffffff
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4babde
call fcn.004fe1e0
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4babf2
call fcn.004fe1e0
mov ecx, dword ds:[esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x14
ret
Function at 0x4c7de0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x3c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
mov ebx, ecx
push ebp
push esi
push edi
test byte [ebx + 0xbc], 4
jne 0x4c7f38
mov eax, dword [ebx + 0x48]
push dword [eax + 8]
lea eax, [esp + 0x28]
push 1
push eax
call sym.SystemInformer.exe_Ordinal_1937
nop dword [eax + eax]
test eax, eax
js 0x4c7f31
mov ebp, dword [esp + 0x24]
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x30]
mov dword [esp + 0x20], ebp
push eax
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
push 0
push ebp
movups xmmword [esp + 0x3c], xmm0
movq qword [esp + 0x4c], xmm0
call dword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [eax + eax]
cmp eax, 0x80000005
jne 0x4c7e79
mov esi, dword [esp + 0x28]
mov eax, esi
mov ecx, dword [esp + 0x2c]
or eax, ecx
jne 0x4c7f1b
mov esi, 0x100
mov dword [esp + 0x1c], 0x10
push esi
push 4
push dword [0x633a54]
mov dword [esp + 0x20], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
nop dword [eax + eax]
lea eax, [esp + 0x14]
push eax
push esi
push edi
push 0
push ebp
call dword [sym.imp.ntdll.dll_NtQueryKey]
mov esi, eax
test esi, esi
jns 0x4c7ef9
push edi
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp esi, 0x80000005
jne 0x4c7f27
push dword ds:[esp + 0x14]
mov ebp, dword [0x633a54]
push 4
push ebp
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub dword [esp + 0x1c], 1
mov edi, eax
je 0x4c7eff
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
jmp 0x4c7ea0
mov ebp, dword [0x633a54]
nop
test esi, esi
js 0x4c7f27
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
push 0
push ebp
mov dword [esp + 0x24], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0xa8], esi
mov dword [ebx + 0xac], ecx
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebx + 0xbc], 4
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x3c
ret