joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069b8
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.004056e0
test eax, eax
je 0x4069de
test ebx, ebx
je 0x4069de
cmp word [ebx], 0
je 0x4069de
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x4069e6
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x4069f9
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00406d98
xor eax, eax
jmp 0x406a14
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x406a08
cmp eax, 3
jne 0x406a0f
mov eax, 2
jmp 0x406a14
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x406d0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.004056e0
test eax, eax
je 0x406d37
test ebx, ebx
je 0x406d37
cmp word [ebx], 0
je 0x406d37
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x406d6c
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.004056e0
test eax, eax
je 0x406d8e
test ebx, ebx
je 0x406d8e
cmp word [ebx], 0
je 0x406d8e
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x406d98
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.004056e0
test eax, eax
je 0x406dc5
test ebx, ebx
je 0x406dc5
cmp word [ebx], 0
je 0x406dc5
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x406dd4
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x408bcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x41460c
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x408bec
call fcn.00408b94
mov eax, dword [ebp - 4]
jmp 0x408c05
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x408c0d
test al, 7
jne 0x408bf1
cmp esi, 8
jb 0x408c96
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x408c16
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x408cb8
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x408c9d
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40b870
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40b879
mov eax, dword [ebp - 4]
add esp, 0xfffffb30
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x14b4]
lea eax, [ebp - 0x4a0]
call fcn.00406714
lea eax, [ebp - 0x474]
call fcn.00406714
lea eax, [ebp - 0x448]
call fcn.00406714
push 0
lea ecx, [ebp - 0x10b4]
mov edx, ebx
mov eax, esi
call fcn.00405b78
test al, al
jne 0x40b8d6
xor eax, eax
jmp 0x40ba22
cmp byte [ebp - 0x10b4], 0
je 0x40b8e8
cmp byte [ebp - 0x41c], 0
jne 0x40b8ef
xor eax, eax
jmp 0x40ba22
lea eax, [ebp - 0x10b4]
call fcn.00405f94
lea edx, [ebp - 0x41c]
call fcn.00406e90
test eax, eax
je 0x40b91f
mov eax, esi
call fcn.00405f94
lea edx, [ebp - 0x41c]
call fcn.00406e90
test eax, eax
je 0x40b926
xor eax, eax
jmp 0x40ba22
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.00406f34
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00405f94
push eax
call fcn.0040cf98
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00406d0c
test al, al
je 0x40b964
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40b928
mov eax, edi
xor edx, edx
call fcn.00406d0c
test al, al
je 0x40b978
xor eax, eax
jmp 0x40ba22
lea eax, [ebp - 0x18b4]
mov ecx, 0x400
mov edx, esi
call fcn.00406f34
lea eax, [ebp - 0x10b4]
call fcn.00405f94
push eax
lea eax, [ebp - 0x18b4]
call fcn.00405f94
pop edx
call fcn.0040ceac
push edi
lea ecx, [ebp - 0x18b4]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x40b9bc
xor eax, eax
jmp 0x40ba22
lea eax, [ebp - 0x24d4]
call fcn.0040ba2c
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00406d0c
test al, al
jne 0x40b9e7
lea eax, [ebp - 0x24d4]
xor ecx, ecx
mov edx, esi
call fcn.0040bc0c
mov ebx, eax
lea eax, [ebp - 0x18b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40ba0e
lea eax, [ebp - 0x24d4]
call fcn.0040bcdc
lea eax, [ebp - 0x24d4]
call fcn.0040bd60
mov al, 1
push eax
lea eax, [ebp - 0x24d4]
mov edx, 2
call fcn.0040ba7c
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bac0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40bae3
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x40baf4
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x40bb03
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x40bb10
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.004056e0
test eax, eax
je 0x40bb3d
test esi, esi
je 0x40bb3d
cmp word [esi], 0
je 0x40bb3d
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x40bb54
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x40bb6d
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40bb6d
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40bbd7
mov dword [ebx + 4], edi
test esi, esi
je 0x40bba2
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.0040d660
jmp 0x40bbab
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x40bbbe
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040ceac
jmp 0x40bbcd
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.0040d468
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.0040bcbc
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40bd94
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
test esi, esi
je 0x40bebc
cmp dword [edi + 0xc], 0
je 0x40bdd3
mov eax, dword [edi + 0xc]
dec eax
je 0x40bdbd
dec eax
je 0x40bdc9
jmp 0x40bdd3
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40bdd3
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40be26
xor ebx, ebx
cmp esi, ebx
jle 0x40be43
push 0
lea eax, [ebp - 0xc]
push eax
mov edx, esi
sub edx, ebx
cmp edx, 0x4000
jge 0x40bdf7
mov ecx, esi
sub ecx, ebx
jmp 0x40bdfc
mov ecx, 0x4000
push ecx
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 5], dl
test dl, dl
je 0x40be43
add ebx, 0x4000
cmp esi, ebx
jg 0x40bddf
jmp 0x40be43
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
jne 0x40beb8
cmp byte [edi + 0x14], 0
je 0x40beb8
cmp dword [edi + 0xc], 0
jne 0x40beb8
lea edx, [edi + 0x17]
mov eax, 0x414e10
call fcn.00409f88
test al, al
je 0x40bea2
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
jae 0x40bdd3
cmp dword [ebp - 0xc], 0
jbe 0x40bdd3
mov eax, edi
call fcn.0040c0e8
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.0040c030
jmp 0x40bdd3
lea ecx, [edi + 0x17]
mov eax, 0x414e10
xor edx, edx
call fcn.00409f70
jmp 0x40beb8
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bfac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40bfd6
cmp esi, 0x4e20
jle 0x40bfcc
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40c026
mov eax, ebx
call fcn.0040c2f4
test al, al
je 0x40c00d
cmp esi, 0x4e20
jle 0x40c00d
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040bfac
jmp 0x40c029
cmp dword [ebx + 0xc], 1
jne 0x40c021
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40c021
xor eax, eax
jmp 0x40c029
or eax, 0xffffffff
jmp 0x40c029
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40d3f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x41273c], 0
jne 0x40d411
call fcn.0040d03c
mov dword [0x412738], eax
inc byte [0x41273c]
call fcn.0040d03c
sub eax, dword [0x412738]
cmp eax, 0x64
jle 0x40d44d
cmp dword [0x413148], 0
je 0x40d448
mov eax, 0x414e10
mov edx, 0xff
call fcn.0040a11c
mov eax, 0x414e10
mov edx, 0xff
call fcn.0040a114
call fcn.00402c1c
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b649
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
mov esi, dword [esp]
add esp, 4
dec eax
add eax, eax
sub edx, 0x581fed0a
call fcn.0043b695
mov edx, eax
xor dword [ebx], esi
and edx, edx
add eax, 1
inc ebx
add edx, 0x3b7641b9
sub edx, edx
cmp ebx, ecx
jne fcn.0043b649
sub eax, eax
add eax, 0x33f1e89c
and eax, edx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x628e4244
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x46a54df4
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405711
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nsp73C4.tmp
push esi
call fcn.00405b93
push esi
call fcn.004056bc
mov edi, eax
test edi, edi
jne 0x405732
xor eax, eax
jmp 0x405784
push edi
call fcn.00405dfe
test byte [0x42e3b8], 0x80
je 0x40574b
mov al, byte [edi]
test al, al
je 0x40572e
cmp al, 0x5c
je 0x40572e
sub edi, esi
jmp 0x405763
call fcn.00405e97
test eax, eax
je 0x40575d
test byte [eax], 0x10
je 0x40572e
push esi
call fcn.0040566a
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x40574f
call fcn.00405623
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057ff
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40581e
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405824
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405853
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409368]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405898
test edi, edi
jne 0x40585e
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405892
Function at 0x401911
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401948
xor al, al
jmp 0x40197a
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.PagingFiles
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401c12
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
push 0x3c
xor ebx, ebx
lea eax, [esp + 0x18]
push ebx
push eax
mov edi, ecx
call fcn.00482250
add esp, 0xc
mov dword [esp + 0x10], 0x40
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x401ceb
cmp dword [esp + 0x1c], ebx
ja 0x401ceb
jb 0x401c74
cmp dword [esp + 0x18], 0x40000000
ja 0x401ceb
xor eax, eax
push 0x206
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push ebx
push eax
call fcn.00482250
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.00401911
test al, al
je 0x401ceb
lea esi, [esp + 0x50]
cmp word [esp + 0x50], bx
je 0x401cb9
mov ecx, esi
call fcn.004018f8
test al, al
je 0x401cc3
add esi, 2
cmp word [esi], bx
jne 0x401ca6
mov dword [edi], 1
mov al, 1
jmp 0x401ced
call fcn.0042f790
cmp eax, 3
jl 0x401cd3
cmp word [esi], 0x3f
je 0x401ceb
mov edx, dword [esp + 0x18]
mov ecx, esi
call fcn.0040197f
xor ecx, ecx
mov dword [edi], eax
test eax, eax
setne cl
mov al, cl
jmp 0x401ced
xor al, al
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x401d02
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d3a00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00482250
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.00401ae9
test eax, eax
jne 0x401d4a
xor al, al
jmp 0x401dba
lea esi, [ebp - 0x210]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x401d53
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], ebx
push eax
push 2
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
sub esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401db8
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push str.PagingFiles
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047aabf
mov esp, ebp
pop ebp
ret
Function at 0x4025e5
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x24c
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x18], edx
push 0x228
lea eax, [esp + 0x30]
mov dword [esp + 0x20], ecx
push ebx
mov ebp, ebx
mov dword [esp + 0x14], ebx
push eax
mov esi, ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebx
call fcn.00482250
add esp, 0xc
mov dword [esp + 0x10], ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402644
xor eax, eax
jmp 0x40277e
push edi
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402766
test esi, esi
je 0x402670
push esi
call edi
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x402682
push dword [esp + 0x10]
call edi
and dword [esp + 0x10], 0
lea eax, [esp + 0x50]
push 0x4b4a70
push eax
call fcn.0047b6f6
pop ecx
pop ecx
test eax, eax
jne 0x402747
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x402747
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x14], eax
jne 0x402747
push dword [esp + 0x34]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402747
lea eax, [esp + 0x10]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402747
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
and dword [esp + 0x18], 0
and dword [esp + 0x28], 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0040249d
pop ecx
pop ecx
test eax, eax
je 0x402747
mov edx, dword [esp + 0x18]
mov ebp, dword [edx]
test ebp, ebp
je 0x40273a
xor ecx, ecx
mov eax, dword [ebp + ecx*4]
mov edi, 0x4b395c
cmp eax, dword [edi + ecx*4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x40273a
inc ecx
cmp ecx, 3
jne 0x40271b
xor eax, eax
inc eax
jmp 0x40273c
xor eax, eax
push edx
test eax, eax
je 0x402796
call fcn.0047b62c
pop ecx
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402667
mov ebp, dword [esp + 0x24]
test esi, esi
je 0x402766
push esi
call edi
cmp dword [esp + 0x10], 0
je 0x402778
push dword [esp + 0x10]
call edi
and dword [esp + 0x10], 0
push ebx
call edi
mov eax, ebp
pop edi
mov ecx, dword [esp + 0x254]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047aabf
add esp, 0x24c
ret
mov ecx, dword [esp + 0x24]
xor ebp, ebp
mov eax, dword [esp + 0x38]
inc ebp
mov dword [ecx], eax
call fcn.0047b62c
pop ecx
jmp 0x40275f
Function at 0x4028b5
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x4028f4
cmp dword [esi + 4], 0
jl 0x4028f4
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 8]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4028f4
mov al, 1
jmp 0x4028fc
xor eax, eax
mov word [esi + 8], ax
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402c1e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49f3ed
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, ecx
xor eax, eax
mov dword [esp + 0x98], eax
mov esi, str.SoftwareClasses_ls_shellopencommand
push 0x14
pop ecx
lea edi, [esp + 0x3c]
mov dword [esp + 0x14], eax
mov bl, al
mov dword [esp + 0x18], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
inc eax
mov byte [esp + 0x98], al
lea eax, [esp + 0xa0]
cmp dword [esp + 0xb4], 8
cmovae eax, dword [esp + 0xa0]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0042f810
add esp, 0xc
mov byte [esp + 0x98], 2
lea eax, [esp + 0x14]
push eax
mov esi, 0x20019
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x402d04
cmp dword [esp + 0x38], 8
lea eax, [esp + 0x24]
push esi
cmovae eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call fcn.004315e0
test eax, eax
jne 0x402d04
push ebp
push eax
lea ecx, [esp + 0x20]
call fcn.004316d0
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
cmp dword [esp + 0x14], 0
je 0x402d1a
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esp + 0x14], 0
xor eax, eax
inc eax
mov byte [esp + 0x98], al
lea ecx, [esp + 0x24]
push 0
push eax
call fcn.0040314a
mov byte [esp + 0x98], 0
lea ecx, [esp + 0x18]
call fcn.00431540
or dword [esp + 0x98], 0xffffffff
xor eax, eax
push 0
inc eax
lea ecx, [esp + 0xa4]
push eax
call fcn.0040314a
mov al, bl
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0047aabf
add esp, 0x88
ret