joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a000
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411af0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41a014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0xffffffff
je 0x40a048
cmp dword [ebp + 0x10], 0
je 0x40a048
cmp dword [ebp + 0x14], 0
jne 0x40a057
mov dword [ebp - 0x18], 0x57
mov eax, dword [ebp - 0x18]
jmp 0x40a0ed
mov byte [ebp - 0x11], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jle 0x40a0ca
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40a0ae
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x11], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
push 0x418038
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
jmp 0x40a0b6
cmp dword [ebp - 0x1c], 0
jne 0x40a0b6
jmp 0x40a0ca
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x1c]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
jmp 0x40a068
jmp 0x40a0d2
mov dword [ebp - 4], 0xffffffff
jmp 0x40a0e2
mov edx, dword [ebp + 0x14]
mov al, byte [ebp - 0x11]
mov byte [edx], al
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a110
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411b10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41a014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0xffffffff
je 0x40a152
cmp dword [ebp + 0x14], 0
jne 0x40a161
mov dword [ebp - 0x18], 0x57
mov eax, dword [ebp - 0x18]
jmp 0x40a1f7
mov byte [ebp - 0x11], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jle 0x40a1d4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40a1b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x11], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
push 0x418038
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
jmp 0x40a1c0
cmp dword [ebp - 0x1c], 0
jne 0x40a1c0
jmp 0x40a1d4
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x1c]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
jmp 0x40a172
jmp 0x40a1dc
mov dword [ebp - 4], 0xffffffff
jmp 0x40a1ec
mov edx, dword [ebp + 0x14]
mov al, byte [ebp - 0x11]
mov byte [edx], al
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b340
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40b382
push str.OpenProcessToken_fail
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
xor eax, eax
jmp 0x40b407
lea ecx, [ebp - 0x20]
push ecx
push 0x415964
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40b3a9
push str.LookupPrivilegeValue_fail
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
xor eax, eax
jmp 0x40b407
mov dword [ebp - 0x14], 1
mov edx, 0xc
imul eax, edx, 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp + eax - 0x10], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp + eax - 0xc], edx
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 8], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40b402
push str.AdjustTokenPrivileges_fail
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
xor eax, eax
jmp 0x40b407
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret

Function at 0x40c150
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.mfc140u.dll_AfxWinInit]
test eax, eax
jne 0x40c17e
push 0x4159cc
call fcn.0040c1c0
add esp, 4
call fcn.0040c060
xor eax, eax
pop ebp
ret
Function at 0x40c2a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
popal
cmp dword [ebp - 8], 5
jne 0x40c315
cmp dword [ebp - 0xc], 0
jne 0x40c315
push 0x415e4c
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 0
jmp 0x40c3fb
cmp dword [ebp - 8], 5
jne 0x40c33a
cmp dword [ebp - 0xc], 1
jne 0x40c33a
push 0x415e68
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 1
jmp 0x40c3fb
cmp dword [ebp - 8], 5
jne 0x40c35f
cmp dword [ebp - 0xc], 2
jne 0x40c35f
push 0x415e80
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 2
jmp 0x40c3fb
cmp dword [ebp - 8], 6
jne 0x40c381
cmp dword [ebp - 0xc], 0
jne 0x40c381
push 0x415ea0
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 3
jmp 0x40c3fb
cmp dword [ebp - 8], 6
jne 0x40c3a3
cmp dword [ebp - 0xc], 1
jne 0x40c3a3
push 0x415ebc
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 4
jmp 0x40c3fb
cmp dword [ebp - 8], 6
jne 0x40c3c5
cmp dword [ebp - 0xc], 2
jne 0x40c3c5
push 0x415ed0
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 5
jmp 0x40c3fb
cmp dword [ebp - 8], 0xa
jne 0x40c3e7
cmp dword [ebp - 0xc], 0
jne 0x40c3e7
push 0x415ee4
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 6
jmp 0x40c3fb
push 0x415ef8
call fcn.00406d00
add esp, 4
mov dword [ebp - 4], 7
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c410
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x3ac], ecx
mov byte [ebp - 0x104], 0
push 0xfe
push 0
lea eax, [ebp - 0x103]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [ebp - 0x395], 1
push 0xff
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0xffffffff
jne 0x40c495
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Get_chicken_hostName_failed___Error_Code:_d_n
call fcn.00406d00
add esp, 8
mov byte [ebp - 0x395], 0
jmp 0x40c5a6
mov ecx, 0x3f
lea esi, [ebp - 0x104]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jne 0x40c4dd
push str.Yow__Bad_host_lookup.
call fcn.00406d00
add esp, 4
mov byte [ebp - 0x395], 0
jmp 0x40c59b
xor eax, eax
mov word [ebp - 0x394], ax
push 0x18e
push 0
lea ecx, [ebp - 0x392]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [ebp - 0x204], 0
push 0xfe
push 0
lea edx, [ebp - 0x203]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x3a0], 0
lea eax, [ebp - 0x394]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40c59b
push 0xff
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x40c595
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0
je 0x40c595
mov eax, dword [ebp - 0x39c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 0x3a0], eax
mov ecx, 8
mov esi, dword [ebp - 0x3a0]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 0x395]
mov byte [ecx], dl
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c810
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], 0
mov eax, 0x42
mov word [ebp - 0x10], ax
jmp 0x40c841
mov cx, word [ebp - 0x10]
add cx, 1
mov word [ebp - 0x10], cx
movzx edx, word [ebp - 0x10]
cmp edx, 0x5a
jg 0x40c93f
xorps xmm0, xmm0
movlpd qword [ebp - 0x44], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov ax, word [ebp - 0x10]
mov word [ebp - 0xc], ax
mov ecx, 0x3a
mov word [ebp - 0xa], cx
xor edx, edx
mov word [ebp - 8], dx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 3
je 0x40c89b
jmp 0x40c935
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40c909
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
call fcn.00411590
divsd xmm0, qword [0x416c50]
divsd xmm0, qword [0x416c50]
divsd xmm0, qword [0x416c50]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cvtsi2sd xmm1, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
shr ecx, 0x1f
addsd xmm1, qword [ecx*8 + 0x416c60]
addsd xmm1, xmm0
movsd xmm0, xmm1
call fcn.00411461
mov dword [ebp - 0x14], eax
jmp 0x40c933
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
cvtsi2sd xmm0, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x416c60]
addsd xmm0, qword [0x416c30]
call fcn.00411461
mov dword [ebp - 0x14], eax
jmp 0x40c93a
jmp 0x40c835
jmp 0x40c835
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret
Function at 0x40cec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411cf0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41a014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x40cf0d
cmp dword [ebp + 8], 0
je 0x40cf83
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40cf4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x11], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
push 0x418038
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
jmp 0x40cf81
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40cf77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
push 0x418038
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cf87
mov byte [ebp - 0x11], 0
jmp 0x40cf8f
mov dword [ebp - 4], 0xffffffff
jmp 0x40cf9f
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp - 0x11]
mov byte [ecx], dl
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d2a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x220]
call fcn.0040d3e0
movzx ecx, al
test ecx, ecx
je 0x40d3a6
cmp dword [ebp - 0x214], 0
jne 0x40d308
jmp 0x40d3a6
xor edx, edx
mov word [ebp - 0x210], dx
push 0x208
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x224]
push ecx
push 4
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x40d35e
jmp 0x40d3a6
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x40d384
jmp 0x40d3a6
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov dword [ebp - 0x21c], 1
xor edx, edx
jne 0x40d2fa
cmp dword [ebp - 0x214], 0
je 0x40d3c6
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 8

Function at 0x40d3e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40d40e
xor al, al
jmp 0x40d488
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40d431
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40d488
mov dword [ebp - 0x14], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x20]
mov dword [ebp + ecx - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + ecx - 0xc], eax
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 8], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40d486
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40d488
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret
Function at 0x40ef00
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40ef37
push str.OpenProcessToken_Error._n
call fcn.00406d00
add esp, 4
mov ecx, 0xc
imul edx, ecx, 0
lea eax, [ebp + edx - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x14], 1
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 8], 2
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40ef95
push str.AdjustTokenPrivileges_Error._n
call fcn.00406d00
add esp, 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x40efb2
push str.Shutdown_Error__n
call fcn.00406d00
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 4
Function at 0x40f7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411f70
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x630
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x640], ecx
mov dword [ebp - 0x624], 0
cmp dword [ebp + 0xc], 0
jne 0x40f84d
mov dword [ebp - 0x624], 0x57
mov eax, dword [ebp - 0x624]
jmp 0x40f99e
mov byte [ebp - 0x61d], 1
mov ecx, 0x15
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersion
lea edi, [ebp - 0x61c]
rep movsd dword es:[edi], dword [esi]
push 0x3ac
push 0
lea eax, [ebp - 0x5c8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x62c], 0x104
mov dword [ebp - 0x630], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x634]
push ecx
push 1
push 0
lea edx, [ebp - 0x61c]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x40f951
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x630]
push edx
push 0
push str.ProgramFilesDir
mov eax, dword [ebp - 0x634]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x628], eax
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [ebp - 0x628]
je 0x40f936
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x624], edx
mov byte [ebp - 0x61d], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x638], eax
push 0x418038
lea ecx, [ebp - 0x638]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
jmp 0x40f94f
lea edx, [ebp - 0x21c]
push edx
push 0x4166b4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
add esp, 0xc
jmp 0x40f975
mov byte [ebp - 0x61d], 0
mov ecx, dword [ebp - 0x624]
mov dword [ebp - 0x63c], ecx
push 0x418038
lea edx, [ebp - 0x63c]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
jmp 0x40f97d
mov dword [ebp - 4], 0xffffffff
jmp 0x40f98d
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 0x61d]
mov byte [eax], cl
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 8
Function at 0x40f9c0
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40f9f4
cmp dword [ebp - 0x18], 1
je 0x40fa31
cmp dword [ebp - 0x18], 2
je 0x40fa75
jmp 0x40fab7
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40fa06
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
jmp 0x40fa2c
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_ClipCursor]
jmp 0x40fab7
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40fa57
push 0
push 0x4166bc
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40fa73
push 0
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x20], eax
push 5
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40fab7
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40fa9b
push 0
push 0x416644
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40fab7
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x28], eax
push 5
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102f6
mov esp, ebp
pop ebp
ret 8
Function at 0x40602b
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x406049
mov ecx, dword [ebp - 8]
call fcn.0040f806
jmp 0x40605c
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4e0
jb 0x40605c
mov ecx, dword [ebp - 8]
call fcn.0040f687
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x12
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret