joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d17b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe68
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x208
mov word [ebp - 0x638], ax
xor edi, edi
lea eax, [ebp - 0x636]
mov dword [ebp - 0xe64], ecx
mov esi, edx
push edi
push eax
mov dword [ebp - 0xe5c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push 0x208
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push 0x208
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xe60], edi
lea eax, [ebp - 0x428]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40d2c1
push 0x4014c8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x403658
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
add eax, esi
push eax
mov dword [ebp - 0xe68], eax
call dword [sym.imp.cmutil.dll_CmMalloc]
mov esi, eax
mov dword [ebp - 0xe60], esi
test esi, esi
je 0x40d2bb
push 0x4014c8
push 0x403658
lea eax, [ebp - 0x428]
push eax
push 0x4015e8
push 0x900
push edi
push edi
push dword [ebp - 0xe68]
push esi
call fcn.00410f98
add esp, 0x24
test eax, eax
js 0x40d2bb
push esi
push ebx
push 0x403868
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x10
mov edx, ebx
xor ecx, ecx
push 1
push esi
call fcn.00407202
push esi
call dword [sym.imp.cmutil.dll_CmFree]
mov esi, dword [ebp - 0xe5c]
push dword [ebp - 0xe64]
xor eax, eax
lea ecx, [ebp - 0x218]
mov edx, 0x105
mov word [ebp - 0x218], ax
call fcn.00406b17
test eax, eax
je 0x40d38f
push esi
lea ecx, [ebp - 0xe58]
call fcn.0040eb66
lea eax, [ebp - 0xa42]
push eax
push eax
lea eax, [ebp - 0x218]
push eax
push 0x403904
push 0x900
push edi
push edi
lea eax, [ebp - 0x638]
push 0x105
push eax
call fcn.00410f98
add esp, 0x24
test eax, eax
js 0x40d38d
push 1
lea eax, [ebp - 0xe60]
xor ecx, ecx
push eax
lea edx, [ebp - 0x218]
call fcn.004068c4
test eax, eax
je 0x40d38d
mov esi, dword [ebp - 0xe60]
mov eax, esi
test esi, esi
jne 0x40d352
mov eax, 0x401a80
push eax
push ebx
push 0x403868
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x10
mov edx, ebx
xor ecx, ecx
push 1
push esi
call fcn.00407202
lea eax, [ebp - 0x638]
mov edx, ebx
push eax
push esi
xor ecx, ecx
call fcn.004079b1
push esi
mov edi, eax
call dword [sym.imp.cmutil.dll_CmFree]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
Function at 0x40d3a7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x43c], edx
push eax
push 0xf003f
push 0
push 0x401588
xor esi, esi
mov ebx, ecx
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4e6
mov eax, 0x104
xor edi, edi
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x438]
push eax
push edi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
jmp 0x40d4c4
cmp dword [ebp - 0x438], 1
jne 0x40d48c
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x428]
call fcn.0040c9db
test eax, eax
je 0x40d48c
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
lea edx, [ebp - 0x218]
call fcn.0040d17b
and esi, eax
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
call fcn.0040cbd3
push dword [ebp - 0x43c]
lea edx, [ebp - 0x218]
mov ecx, ebx
and esi, eax
call fcn.0040ced7
and esi, eax
mov eax, 0x104
inc edi
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40d42d
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d4f8
push 0x40391c
push dword [0x4130e8]
call fcn.0040e818
pop ecx
pop ecx
call fcn.00408277
mov ecx, dword [ebp - 4]
neg esi
pop edi
sbb esi, esi
xor ecx, ebp
and esi, 0x7fffbffb
lea eax, [esi - 0x7fffbffb]
pop esi
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret
Function at 0x40d523
Capabilities:
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x208
mov word [ebp - 0x638], ax
mov esi, ecx
lea eax, [ebp - 0x636]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40d57d
mov eax, 0x80004005
jmp 0x40d768
sub esp, 0xc
lea ecx, [ebp - 0x638]
mov edx, 0x105
push 0x401338
call fcn.00410f31
lea eax, [ebp - 0x63c]
push eax
push 0xf003f
push ebx
push 0x401588
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d708
mov eax, 0x104
mov edi, ebx
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x644], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x648]
push eax
push ebx
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
jmp 0x40d6e6
cmp dword [ebp - 0x648], 1
jne 0x40d6af
lea eax, [ebp - 0x428]
mov ecx, esi
push eax
lea edx, [ebp - 0x218]
call fcn.0040d17b
test eax, eax
jne 0x40d63d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x403960
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x10
lea eax, [ebp - 0x428]
mov ecx, esi
push eax
lea edx, [ebp - 0x218]
call fcn.0040cbd3
test eax, eax
jne 0x40d676
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x403a28
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x10
lea eax, [ebp - 0x638]
mov ecx, esi
push eax
lea edx, [ebp - 0x218]
call fcn.0040ced7
test eax, eax
jne 0x40d6af
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x403b00
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x10
mov eax, 0x104
inc edi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x644], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x648]
push eax
push ebx
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40d5f7
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d71a
push 0x40391c
push dword [0x4130e8]
call fcn.0040e818
pop ecx
pop ecx
call fcn.00408277
lea eax, [ebp - 0x63c]
push eax
push 2
push ebx
push 0x403bc0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jle 0x40d747
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x40d766
push 0x403c20
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret
Function at 0x40d77e
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x401440
push edi
push 0x403c68
and dword [esi + 4], 0
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
xor ebx, ebx
inc ebx
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x40d7bf
xor eax, eax
jmp 0x40d88f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40d7d4
mov dword [esi + 4], ebx
jmp 0x40d88d
push edi
push 0x403cd8
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x40d80f
push edi
push 0x403d38
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
jmp 0x40d7b8
push 0x403da0
push dword [0x4130e8]
call fcn.0040e818
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40d876
cmp eax, 0x80
je 0x40d862
cmp eax, 0x102
je 0x40d85a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x403f38
push dword [0x4130e8]
call fcn.0040e818
add esp, 0x10
jmp 0x40d802
push edi
push 0x403ed8
jmp 0x40d7f4
push edi
push 0x403df8
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
push edi
mov dword [esi + 4], ebx
push 0x403e80
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40d8c9
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ecx
and dword [ebp - 8], edi
mov ebx, edx
push 0x57
pop esi
test ebx, ebx
je 0x40d9ea
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 2
pop edx
test eax, eax
je 0x40d971
push 0x5c
pop ecx
cmp cx, word [ebx + eax*2 - 2]
jne 0x40d971
lea esi, [eax + 1]
cmp esi, eax
jb 0x40d952
mov eax, esi
mul edx
test edx, edx
jne 0x40d952
cmp eax, 0xffffffff
ja 0x40d952
push eax
call dword [sym.imp.cmutil.dll_CmMalloc]
mov edi, eax
test edi, edi
je 0x40d94e
push 0x900
push ecx
push ecx
push ebx
mov edx, esi
mov dword [ebp - 8], 1
mov ecx, edi
call fcn.004064d3
mov esi, eax
and esi, 0xffff
jne 0x40d9ce
jmp 0x40d973
push 8
jmp 0x40d9cd
push 0x80070216
push 0x404088
push dword [0x4130e8]
mov esi, 0x216
call fcn.0040e818
add esp, 0xc
jmp 0x40d9ce
mov edi, ebx
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d9cb
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40d9cb
cmp dword [ebp - 0x10], ebx
jne 0x40d9c7
cmp dword [ebp + 8], ebx
jne 0x40d9bb
cmp dword [ebp - 0x14], ebx
jne 0x40d9c7
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x40d9ce
push 0x50
jmp 0x40d9cd
push 2
pop esi
cmp dword [ebp - 4], 0
je 0x40d9dd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x40d9ea
push edi
call dword [sym.imp.cmutil.dll_CmFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40db05
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
push 0x208
mov word [ebp - 0x210], ax
mov esi, edx
lea eax, [ebp - 0x20e]
mov ebx, ecx
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xd2
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push esi
mov esi, 0x104
lea eax, [ebp - 0x41c]
push esi
push eax
push 0x401068
push 0x402870
push 0x4010d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x41c]
je 0x40dbe2
push esi
lea eax, [ebp - 0x628]
push eax
push 0xca
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x628]
push eax
push 0x900
push edi
push edi
lea eax, [ebp - 0x834]
push 0x105
push eax
call fcn.00410f98
add esp, 0x1c
lea eax, [ebp - 0x210]
push esi
push eax
lea eax, [ebp - 0x834]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edi, [eax - 6]
neg edi
sbb edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret
Function at 0x40dbfa
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, edx
push 0x208
push eax
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
mov ebx, 0x105
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa2c]
call fcn.0040eb66
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x822]
push eax
push 0x401f98
push 0x900
push 0
push 0
push ebx
push edi
call fcn.00410f98
add esp, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x40dc9f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
Function at 0x40e9ad
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x424], ecx
mov edx, ecx
inc esi
xor eax, eax
push edi
mov dword [ebp - 0x420], eax
mov ebx, eax
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x420]
jne 0x40e9dd
sub edx, edi
sar edx, 1
push 0x5c
pop edi
cmp edx, 2
jbe 0x40ea47
movzx eax, word [ecx + 2]
cmp eax, 0x3a
jne 0x40ea0d
xor ebx, ebx
cmp word [ecx + 4], di
sete bl
inc ebx
jmp 0x40ea47
cmp word [ecx], di
jne 0x40ea47
cmp ax, di
jne 0x40ea44
push 2
pop ebx
xor eax, eax
cmp edx, ebx
jbe 0x40ea31
cmp word [ecx + ebx*2], di
jne 0x40ea2c
inc eax
cmp eax, 2
je 0x40ea47
inc ebx
cmp ebx, edx
jb 0x40ea20
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret
xor ebx, ebx
inc ebx
lea eax, [edx - 1]
xor esi, esi
mov dword [ebp - 0x420], eax
cmp ebx, eax
jae 0x40ea5d
inc ebx
cmp word [ecx + ebx*2], di
jne 0x40ea52
xor eax, eax
push 0x208
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40ea31
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edx, 0x105
push 0x900
push ecx
push ecx
push dword [ebp - 0x424]
lea ecx, [ebp - 0x210]
call fcn.00410ebe
test eax, eax
js 0x40ea31
lea eax, [ebx + 1]
cmp eax, 0x105
jae 0x40ea31
lea eax, [ebx*2 + 2]
cmp eax, 0x20a
jae 0x40eb5b
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x40eb32
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x40eb30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ea31
xor esi, esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x424]
cmp ebx, eax
jb 0x40ea56
xor esi, esi
inc esi
jmp 0x40ea31
call fcn.00411ad9
int3
Function at 0x40f129
Capabilities:
Bypass uac via icmluautil

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0
push 0x404664
mov dword [ebp - 8], ecx
mov ebx, 0x80004005
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40f176
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x404678
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
jmp 0x40f1ea
push edi
push 0x4046fc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x40f1a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x404720
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
jmp 0x40f1e2
and dword [ebp - 0xc], 0
mov eax, 0x4136d0
push 0x4136c4
push 0x40354c
push 0x40355c
push eax
push dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 0x18], 0x40143c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call dword [0x414220]
call edi
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.00405c45
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40f465
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0x38
xor ebx, ebx
lea eax, [ebp - 0x38]
push ebx
push eax
mov edi, edx
mov esi, ecx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40f4d0
cmp dword [ebp - 4], ebx
je 0x40f4ee
push 0xea60
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f4ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40f4e7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x40f4ee
mov ebx, 0x8000ffff
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f5be
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call fcn.0040f588
test eax, eax
je 0x40f660
push edi
lea ecx, [ebp - 0xa2c]
call fcn.0040eb66
xor eax, eax
cmp ax, word [ebp - 0x822]
jne 0x40f65d
cmp ax, word [ebp - 0x818]
jne 0x40f65d
cmp ax, word [ebp - 0x616]
je 0x40f65d
cmp ax, word [ebp - 0x414]
je 0x40f65d
lea eax, [ebp - 0x210]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40f660
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x616]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x40376c
push 0x900
push esi
push esi
push ebx
push edi
call fcn.00410f98
add esp, 0x24
test eax, eax
js 0x40f660
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 8

Function at 0x40f67a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x214], eax
cmp dword [ebx], 0
push esi
jne 0x40f77a
call fcn.0040f588
test eax, eax
je 0x40f6ea
push 0x900
push ecx
push ecx
mov ecx, dword [ebp - 0x214]
mov edx, 0x104
push esi
mov dword [ebx], 1
call fcn.00410ebe
push esi
push 0x4049b8
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
jmp 0x40f76d
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40f78d
lea eax, [ebp - 0x210]
push eax
push 0x404a00
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.0040f588
test eax, eax
lea eax, [ebp - 0x210]
je 0x40f772
push 0x900
push ecx
push ecx
mov ecx, dword [ebp - 0x214]
mov edx, 0x104
push eax
mov dword [ebx], 1
call fcn.00410ebe
xor eax, eax
inc eax
jmp 0x40f78f
push eax
push 0x404a48
jmp 0x40f77f
push 0x404a98
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41060e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
xor ebx, ebx
mov dword [esi + 0x218], ebx
lea edi, [esi + 0x21c]
mov word [esi], ax
mov word [edi], ax
lea eax, [ebp - 0x420]
push eax
push 0x20019
push ebx
push 0x4050e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41074f
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x428], 0x20a
lea eax, [ebp - 0x428]
mov dword [ebp - 0x424], 1
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x40515c
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410743
push 0x208
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0x105
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x900
push ecx
push ecx
lea eax, [ebp - 0x41c]
mov edx, 0x105
push eax
mov ecx, edi
call fcn.00410ebe
test eax, eax
jns 0x41071d
mov dword [esi + 0x218], ebx
jmp 0x410743
push edi
push 0x405168
push 0x900
push ebx
push ebx
push 0x105
push esi
call fcn.00410f98
add esp, 0x1c
test eax, eax
js 0x410715
mov ecx, esi
call fcn.0041052f
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret

Function at 0x4107b7
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 0x105
lea edi, [esi + 0x21c]
mov dword [esi + 0x218], ebx
push edi
mov word [esi], ax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push 0x405180
push 0x900
push ebx
push ebx
push 0x105
push esi
call fcn.00410f98
add esp, 0x1c
test eax, eax
jns 0x410810
mov dword [esi + 0x218], ebx
jmp 0x4108ad
mov ecx, esi
call fcn.00410767
test eax, eax
jne 0x4108a6
mov word [edi], ax
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x4010e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4108ad
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push ebx
push 0x40515c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41089b
push edi
push 0x405180
push 0x900
push ebx
push ebx
push 0x105
push esi
call fcn.00410f98
add esp, 0x1c
test eax, eax
jns 0x410894
mov dword [esi + 0x218], ebx
jmp 0x41089b
mov ecx, esi
call fcn.0041052f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4108ad
mov ecx, esi
call fcn.0041052f
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret