joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf59f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xf6e9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xf5a002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00f5ddff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xf5a002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00f556e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00f5e20b
push 0x10
call fcn.00f5e1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xf59fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00f4a1c0
jmp 0xf59fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00f59b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xf59ff0
mov ecx, edi
call fcn.00f4a2c0
push edi
call fcn.00f5e1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xf5a021
inc ebx
cmp ebx, 0x20
jb 0xf59f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xf5b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf6f808
push 0xf5f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xf5b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xf5b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00f5e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xf5b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xf5b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xf5b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00f5b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf5bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf5bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xf5bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf5bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xf5bd94
push eax
push esi
call fcn.00f5e20b
add esp, 8
pop esi
ret 0x10

Function at 0xf5bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf5be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xf5be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xf74320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f5ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xf5bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xf5be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf5bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xf5beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xf74320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f5ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xf5beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xf5be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xf5c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xf5c131
push esi
call fcn.00f5f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00f4e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xf5c131
push 0
push ebp
call fcn.00f4e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00f4e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xf5c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00f4e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xf5c121
push 0xf74918
push edi
call fcn.00f5d3f0
push eax
push ebx
push esi
call fcn.00f5bf60
push 0xf748f8
push edi
call fcn.00f5d3f0
push eax
push ebx
push esi
call fcn.00f5bf60
push 0xf748d8
push edi
call fcn.00f5d3f0
push eax
push ebx
push esi
call fcn.00f5bf60
push 0xf748c0
push edi
call fcn.00f5d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00f5bf60
push 0xf748a0
push edi
call fcn.00f5d3f0
push eax
push ebx
push esi
call fcn.00f5bf60
push 0xf74888
push edi
call fcn.00f5d3f0
push eax
push ebx
push esi
call fcn.00f5bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xf5d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f5d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f5d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f5d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f5d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf5dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf5dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf6f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf5dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf5dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x421100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, edx
mov ebx, ecx
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42112a
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x421142
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x421137
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x421173
cmp esi, ecx
jae 0x421137
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x421161
cmp esi, ecx
jae 0x421137
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4211bd
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4211d5
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4211ca
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x421206
cmp esi, ecx
jae 0x4211ca
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4211f4
cmp esi, ecx
jae 0x4211ca
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421980
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xca
push eax
lea edi, [ecx + 8]
mov dword [ebp - 8], 0xca
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
xor esi, esi
call fcn.0042d290
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0xd], 0
jne 0x4219c7
cmp dword [eax + 0x10], 0xca
ja 0x4219c7
cmp eax, dword [edi]
je 0x4219c3
mov esi, dword [eax + 0x14]
test esi, esi
jne 0x4219ee
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [ebp - 4]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
test esi, esi
je 0x4219f0
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00429e20
mov dword [eax], esi
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x421ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639ca6
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
xor esi, esi
mov edi, 7
mov dword [ebp - 0x230], ebx
xor eax, eax
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x230], ax
push 0x1fe
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
call fcn.0060a8e0
add esp, 0xc
mov dword [ebp - 0x260], esi
xor eax, eax
mov dword [ebp - 0x250], esi
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], edi
mov word [ebp - 0x260], ax
push 0x35
push str.SOFTWAREMicrosoftWindowsCurrentVersionSetupState
call fcn.0042e850
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
push 0xa
xor eax, eax
mov dword [ebp - 0x248], esi
push str.ImageState
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x248], ax
call fcn.0042e850
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
push ecx
cmovae eax, dword [ebp - 0x260]
push 0x2001f
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x26c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421d41
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x26c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x270]
push ecx
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push esi
push eax
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x218], si
je 0x421d35
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421d07
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.0042e850
mov edi, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x220]
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 8
lea eax, [ebp - 0x230]
mov edx, 0x26
mov ecx, esi
cmovae eax, dword [ebp - 0x230]
cmp esi, edx
cmova ecx, edx
push ecx
push str.IMAGE_STATE_GENERALIZE_RESEAL_TO_AUDIT
push eax
mov dword [ebp - 0x264], ecx
call fcn.0042b370
add esp, 0xc
test eax, eax
jne 0x421d7d
cmp esi, 0x26
jb 0x421d7d
jbe 0x421dac
push dword [ebp - 0x264]
cmp edi, 8
lea eax, [ebp - 0x230]
push str.IMAGE_STATE_SPECIALIZE_RESEAL_TO_AUDIT
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.0042b370
add esp, 0xc
test eax, eax
jne 0x421db1
cmp esi, 0x26
jb 0x421db1
ja 0x421db1
mov ebx, 1
lea ecx, [ebp - 0x248]
call fcn.0042f900
lea ecx, [ebp - 0x260]
call fcn.0042f900
lea ecx, [ebp - 0x230]
call fcn.0042f900
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
Function at 0x424dd0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x424e5d
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x424e5d
push SysReAllocStringLen
push 1
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
je 0x424e5d
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
Function at 0x428dd0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x8a0
mov eax, dword [0x6d3438]
xor eax, esp
mov dword [esp + 0x89c], eax
push 0x208
lea eax, [esp + 0x7c]
push eax
push str.WINDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x428ef8
cmp word [0x6e2fe0], 0
je 0x428eb6
push 0x6e2fe0
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x490]
push str.__s_notepad.exe____s_
push eax
call fcn.0042c250
add esp, 0x10
mov dword [esp + 0xc], 0
lea eax, [esp + 0x50]
mov dword [esp + 8], 0x44
xorps xmm0, xmm0
mov dword [esp + 0x10], str.winsta0default
movlpd qword [esp + 0x14], xmm0
push eax
lea eax, [esp + 0xc]
movlpd qword [esp + 0x20], xmm0
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [esp + 0x4a8]
movlpd qword [esp + 0x44], xmm0
push eax
push 0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movaps xmmword [esp + 0x78], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x89c]
xor ecx, esp
call fcn.00608185
mov esp, ebp
pop ebp
ret
push dword [0x6e368c]
mov edx, dword [0x6e3838]
lea ecx, [esp + 0x64]
push 0x44c
call fcn.00432160
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x428edb
mov eax, dword [eax]
push 0x10
push 0x6e3770
push eax
push dword [0x6e36a4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x60]
call fcn.0042f900
mov ecx, dword [esp + 0x89c]
xor ecx, esp
call fcn.00608185
mov esp, ebp
pop ebp
ret

Function at 0x42b9b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a320
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0060862c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.005f3b84
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431d40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a9a0
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x45c]
mov dword [0x6e3a50], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMcAfeeExMOCP
xorps xmm0, xmm0
mov dword [0x6e3a54], 0
push reloc.OLEAUT32.dll_SysReAllocString
movups xmmword [0x6e3a40], xmm0
mov dword [ebp - 0x45c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x464]
mov dword [ebp - 0x464], 0x105
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push str.InstallDir
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x431e28
sub esp, 0x18
lea ecx, [ebp - 0x21c]
mov edx, esp
lea esi, [ecx + 2]
mov dword [edx], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], 7
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431e00
sub ecx, esi
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0042e850
call fcn.00431fd0
jmp 0x431f9d
push 0x104
lea eax, [ebp - 0x428]
push eax
push str._PROGRAMFILES_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x431f9d
xor eax, eax
mov dword [ebp - 0x440], 0
mov word [ebp - 0x440], ax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x430], 0
lea edx, [eax + 2]
mov dword [ebp - 0x42c], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431e77
sub eax, edx
lea ecx, [ebp - 0x440]
sar eax, 1
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0042e850
mov dword [ebp - 4], 0
mov eax, accept
mov ecx, dword [ebp - 0x430]
sub eax, ecx
cmp eax, 0x13
jb 0x431fbd
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
push 0x13
cmovae eax, dword [ebp - 0x440]
push str.McAfeeExMOCPcore
push ecx
push eax
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x460]
lea ecx, [ebp - 0x458]
call fcn.0042cf70
lea ecx, [ebp - 0x440]
call fcn.0042f900
movups xmm0, xmmword [ebp - 0x458]
xor eax, eax
lea ecx, [ebp - 0x458]
mov word [ebp - 0x458], ax
movups xmmword [ebp - 0x474], xmm0
movups xmmword [ebp - 0x440], xmm0
movq xmm0, qword [ebp - 0x448]
movq qword [ebp - 0x430], xmm0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 7
call fcn.0042f900
cmp dword [ebp - 0x42c], 8
lea edx, [ebp - 0x440]
cmovae edx, dword [ebp - 0x474]
sub esp, 0x18
mov esi, esp
mov ecx, edx
mov dword [esi], 0
lea edi, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431f75
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0042e850
call fcn.00431fd0
lea ecx, [ebp - 0x440]
call fcn.0042f900
mov eax, 0x6e3a40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
call fcn.0042f3b0
int3
Function at 0x431fd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a9e5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [0x6e3a40], 0
je 0x432011
mov bl, 1
jmp 0x4320c8
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042a5f0
push 0x14
push str.mcinstallerutil.dll
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0042a330
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6e3a40], eax
test eax, eax
je 0x4320be
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsAuthenticationRequired
push eax
call esi
mov dword [0x6e3a48], eax
test eax, eax
je 0x4320be
push str.IsValidPassword
push dword [0x6e3a40]
call esi
mov dword [0x6e3a4c], eax
test eax, eax
je 0x4320be
push str.IsInterfaceCompatibleWithVersion
push dword [0x6e3a40]
call esi
mov dword [0x6e3a44], eax
test eax, eax
je 0x4320be
push str.SendUninstallNotificationEmail
push dword [0x6e3a40]
call esi
mov dword [0x6e3a54], eax
test eax, eax
je 0x4320be
push str.Triggerforgotpassword
push dword [0x6e3a40]
call esi
mov dword [0x6e3a50], eax
test eax, eax
je 0x4320be
mov bl, 1
jmp 0x4320c0
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.0042f900
lea ecx, [ebp + 8]
call fcn.0042f900
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret 0x18

Function at 0x432ba0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00434550