joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x41b074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov edi, 1
xor ebx, ebx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x81c], esi
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x80c], esi
cmp dword [ebp - 0x818], edi
jle 0x40396f
mov ecx, dword [ebp - 0x814]
mov esi, dword [ecx + edi*4]
push 1
push esi
push 0x4188e8
call fcn.00405ba4
add esp, 0xc
test eax, eax
jne 0x403929
mov ecx, esi
mov eax, 0x4188ec
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403896
test dx, dx
je 0x403892
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403896
add eax, 4
add ecx, 4
test dx, dx
jne 0x403870
xor eax, eax
jmp 0x40389b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4038ab
mov byte [0x42a3a4], 1
jmp 0x40395c
mov ecx, esi
mov eax, str._batch
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4038d8
test dx, dx
je 0x4038d4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4038d8
add eax, 4
add ecx, 4
test dx, dx
jne 0x4038b2
xor eax, eax
jmp 0x4038dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4038ea
mov byte [0x42a3a5], 1
jmp 0x40395c
mov ecx, esi
mov eax, str._clearall
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403917
test dx, dx
je 0x403913
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403917
add eax, 4
add ecx, 4
test dx, dx
jne 0x4038f1
xor eax, eax
jmp 0x40391c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40395c
mov byte [0x42a3a6], 1
jmp 0x40395c
test ebx, ebx
jne 0x40393a
mov dword [ebp - 0x81c], esi
mov ebx, 1
jmp 0x40395c
cmp ebx, 1
jne 0x40394c
mov dword [ebp - 0x80c], esi
mov ebx, 2
jmp 0x40395c
cmp ebx, 2
jne 0x40395c
mov dword [ebp - 0x810], esi
mov ebx, 3
inc edi
cmp edi, dword [ebp - 0x818]
jl 0x403847
mov esi, dword [ebp - 0x81c]
push 0x1000
push 0
push 0x425188
call fcn.00406a10
add esp, 0xc
push 0x4000
push 0
push 0x426188
call fcn.00406a10
add esp, 0xc
push 0x4000
push 0
push 0x41d188
call fcn.00406a10
add esp, 0xc
cmp byte [0x42a3a6], 0
jne 0x403a53
test esi, esi
je 0x403a46
mov ecx, esi
mov byte [0x425188], 2
call fcn.00403a70
mov esi, dword [ebp - 0x80c]
mov byte [0x42a3a7], 1
test esi, esi
je 0x403a25
push esi
push str.Removing_WLAN__s_by_command_line
lea edx, [ebp - 0x808]
call fcn.00401000
add esp, 8
cmp byte [0x42a3a4], 0
je 0x403a10
lea edx, [ebp - 0x808]
push edx
mov ebx, str.Debug
call fcn.00403450
add esp, 4
push esi
mov byte [0x425189], 1
call fcn.00405ce3
add esp, 4
mov dword [0x42618c], eax
mov eax, dword [ebp - 0x810]
test eax, eax
je 0x403a53
push eax
mov byte [0x42518a], 3
call fcn.00405ce3
add esp, 4
mov dword [0x426190], eax
jmp 0x403a53
mov eax, dword [ebp - 0x814]
mov ecx, dword [eax]
call fcn.00403d30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00404b74
mov esp, ebp
pop ebp
ret
Function at 0x404550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi*4 + 0x426188]
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
push str._name_
push eax
call fcn.00405870
lea edi, [eax + 6]
push str.__name_
push edi
call fcn.00405870
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4045a3
push str.Invalid_attached_file__no___name__found
mov ebx, str.Error
call fcn.00403450
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, edi
mov dword [ebp - 8], eax
add eax, dword [0x41cf80]
mov dword [ebp - 4], eax
cmp eax, 0x100
jbe 0x4045c2
mov dword [ebp - 4], 0x100
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040561e
mov ecx, dword [0x41cf80]
push ecx
push 0x41cf88
lea esi, [esi*4 + 0x41d188]
push eax
mov dword [esi], eax
call fcn.00404c41
mov edx, dword [ebp - 8]
mov eax, dword [esi]
mov ecx, dword [0x41cf80]
push edx
lea edx, [eax + ecx*2]
push edi
push edx
call fcn.00405800
mov eax, dword [esi]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [ebp + 8]
mov edi, dword [eax*4 + 0x421188]
mov edx, dword [esi]
mov ecx, dword [ebp - 0xc]
add ebx, 7
push 0x418ef0
sub edi, ebx
add edi, dword [ecx]
push edx
call fcn.00404d4b
mov esi, eax
add esp, 0x24
test esi, esi
je 0x40464c
push esi
push 1
push edi
push ebx
call fcn.00405b2a
add esp, 0x10
push esi
call fcn.0040555b
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404b74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b074]
jne 0x404b7e
repz ret
jmp fcn.00406a8a

Function at 0x40aa26
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40aa4d
call fcn.0040747b
mov dword [eax], esi
call fcn.00407468
push 0x16
pop esi
mov dword [eax], esi
call fcn.00407416
mov eax, esi
jmp 0x40aaa2
test dword [ebp + 0xc], 0xfffffff9
jne 0x40aa33
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40aa7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040748e
pop ecx
call fcn.00407468
mov eax, dword [eax]
jmp 0x40aaa2
test al, 0x10
jne 0x40aaa0
test al, 1
je 0x40aaa0
test byte [ebp + 0xc], 2
je 0x40aaa0
call fcn.0040747b
mov dword [eax], 5
call fcn.00407468
mov dword [eax], 0xd
jmp 0x40aa71
xor eax, eax
pop esi
pop ebp
ret
Function at 0x410f10
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409b63
and dword [ebp - 0x14], 0
cmp dword [0x41cf64], 0
mov dword [ebp - 0x18], eax
jne 0x410fc3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41106b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x417380
push ebx
call edi
test eax, eax
je 0x41106b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41cf64], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41cf68], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41cf6c], eax
call edi
push eax
call esi
mov dword [0x41cf74], eax
test eax, eax
je 0x410fc3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41cf70], eax
mov eax, dword [0x41cf70]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41101c
cmp dword [0x41cf74], ecx
je 0x41101c
push eax
call esi
push dword [0x41cf74]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41101c
test ebx, ebx
je 0x41101c
call edi
test eax, eax
je 0x411013
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411013
test byte [ebp - 8], 1
jne 0x41101c
or dword [ebp + 0x10], 0x200000
jmp 0x41104f
mov eax, dword [0x41cf68]
cmp eax, dword [ebp - 0x18]
je 0x41104f
push eax
call esi
test eax, eax
je 0x41104f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41104f
mov eax, dword [0x41cf6c]
cmp eax, dword [ebp - 0x18]
je 0x41104f
push eax
call esi
test eax, eax
je 0x41104f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41cf64]
call esi
test eax, eax
je 0x41106b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41106d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404b74
leave
ret
Function at 0xce2422
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0xc218dc
ror edx, 3
dec edx
rol edx, 2
cmc
lea edx, [edx + 0x68b97d79]
cmp ah, dl
xor edx, 0x54b1a1e
clc
test ebx, esi
stc
add edx, 0x79a7391b
rol edx, 2
inc edx
not edx
test di, 0x3a4e
xor ebx, edx
stc
add ebp, edx
jmp 0x84ffc6
push eax
bswap ebx
cmovnp edx, esp
push ebp
cwd
cwde
mov ecx, 0
rdtsc
bswap si
dec di
push ecx
mov dl, 0x62
lahf
mov edi, dword [esp + 0x28]
bswap edi
cdq
rdtsc
mov bl, bh
inc edi
bt eax, ebp
rol edi, 2
clc
sbb si, 0x7e93
cbw
neg edi
rcl al, cl
sub edi, 0xdef2b73
ror edi, 1
rcr eax, cl
lea edi, [edi + ecx]
xor eax, esp
mov esi, esp
movzx ebp, bp
and bp, si
rcr bh, 0x80
lea esp, [esp - 0xc0]
mov ebx, edi
cmovge ebp, esi
setnp al
mov eax, 0
bts bp, bp
adc dl, 0x73
sub ebx, eax
shl dh, 0x1f
lea ebp, [0x7f7f62]
test bh, 0x24
sal dh, cl
xor dl, bl
lea edi, [edi - 4]
movzx edx, ax
mov edx, dword [edi]
cmp ebx, 0x6ee22ff4
xor edx, ebx
test si, 0x6274
test eax, eax
cmc
add edx, 0xe30295
clc
jmp 0x7efbb2
push ebp
ret
push ebx
push edi
dec edi
bswap edi
not edi
push edx
movsx edi, si
cmovns di, di
xchg dx, di
push ecx
movzx cx, bl
jmp 0x7f7eef
push esi
xchg esi, esi
jmp 0x7befef
Function at 0x4019c4
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov ecx, 0x56f130
jmp 0x4019b8
mov eax, 0x4c8bba
call fcn.0049c8c4
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00419e84
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
call fcn.00401a99
push 1
lea ecx, [esi + 0x30]
pop ebx
mov byte [ebp - 4], bl
call fcn.0042f432
mov eax, dword [0x56a9b8]
lea ecx, [esi + 0x58]
mov dword [ecx], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x5c], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x70], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x78], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov edi, 0x56f1b4
mov byte [ebp - 4], 6
push edi
mov dword [esi], 0x4d2940
mov dword [esi + 0x14], 0x4d293c
mov dword [esi + 0x30], 0x4d2930
mov dword [esi + 0x50], ebx
call fcn.004b9382
push edi
lea ecx, [esi + 0x5c]
call fcn.004b9382
and dword [esi + 0x6c], 0
push edi
lea ecx, [esi + 0x70]
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 0x80
mov dword [esi + 0x68], 0x48
call fcn.004b9382
and dword [esi + 0x74], 0
push edi
lea ecx, [esi + 0x78]
call fcn.004b9382
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4054af
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x4c91b8
call fcn.0049c8c4
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
push 0x56f1b4
lea ecx, [ebp - 0x10]
call fcn.004b925f
add esi, 0x200
xor edi, edi
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040817d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x405559
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00408191
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xc8]
cmp dword [eax + 0x800], 0x64
jne 0x405554
cmp dword [eax + 0x808], 0x64
jne 0x405554
push dword [eax + 0x530]
lea edi, [eax + 0x530]
call ebx
test eax, eax
je 0x405552
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x40552f
push 0x4f4984
lea ecx, [ebp - 0x10]
call fcn.004b95dc
push 0x4f4980
lea ecx, [ebp - 0x10]
call fcn.004b95dc
push edi
lea ecx, [ebp - 0x10]
call fcn.004b9618
push 0x4f4980
lea ecx, [ebp - 0x10]
call fcn.004b95dc
xor edi, edi
cmp dword [ebp - 0x18], edi
jne 0x4054df
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x40559b
lea eax, [ebp - 0x14]
push eax
call fcn.00402057
pop ecx
push dword [ebp - 0x14]
call ebx
test eax, eax
je 0x405580
push 5
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
jmp 0x40558c
push 1
push edi
push edi
push dword [ebp - 0x10]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.004b91eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b91eb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x413ac9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4ca804
call fcn.0049c8c4
push ecx
mov eax, dword [0x56a9b8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], eax
mov eax, dword [0x56a9b8]
and dword [ebp - 4], 0
mov dword [esi + 0x20], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x24], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x28], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x2c], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x30], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x34], eax
mov eax, dword [0x56a9b8]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 7
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], 0x4d5b4c
mov dword [esi + 0xc], eax
call fcn.0041895d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41781e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4caba3
call fcn.0049c8c4
sub esp, 0x10
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.004b925f
push 1
lea ecx, [ebp - 0x14]
pop ebx
push 0x2e
mov dword [ebp - 4], ebx
call fcn.004b5560
push dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
call fcn.004b925f
mov eax, dword [0x56a9b8]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
mov edi, str._s_s._s
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
push eax
call fcn.004b54c1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x41789f
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004b8f58
mov dword [ebp - 0x1c], ebx
jmp 0x4178f5
push ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 0x10]
mov ebx, str._s___d_
lea eax, [ebp + 0x14]
push ebx
push eax
call fcn.004b54c1
add esp, 0x10
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
push eax
call fcn.004b54c1
add esp, 0x14
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4178e2
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
push dword [ebp + 0x10]
jmp 0x4178ab
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004b8f58
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004b91eb
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 1
call fcn.004b91eb
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b91eb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41792b
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cabdf
call fcn.0049c8c4
sub esp, 0x10
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.004b925f
push 1
lea ecx, [ebp - 0x14]
pop ebx
push 0x2e
mov dword [ebp - 4], ebx
call fcn.004b5560
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.004b925f
mov eax, dword [0x56a9b8]
mov dword [ebp + 0x14], eax
push dword [ebp - 0x14]
mov edi, str._s_s._s
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
push eax
call fcn.004b54c1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push dword [ebp + 0x14]
call esi
test eax, eax
jne 0x4179ac
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004b8f58
mov dword [ebp - 0x1c], ebx
jmp 0x417a02
push ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 0x10]
mov ebx, str._s___d_
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004b54c1
add esp, 0x10
lea eax, [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
push eax
call fcn.004b54c1
add esp, 0x14
push dword [ebp + 0x14]
call esi
test eax, eax
je 0x4179ef
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
push dword [ebp + 0x10]
jmp 0x4179b8
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
call fcn.004b8f58
mov dword [ebp - 0x1c], 1
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 2
call fcn.004b91eb
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b91eb
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b91eb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x417ba1
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, 0x2b4
push esi
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.0049cb00
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
neg eax
sbb eax, eax
mov ecx, 0x4010
and al, 0x90
add eax, 0x80
cmp dword [ebp + 0xc], 0
je 0x417be2
inc ecx
cmp dword [ebp + 0x10], 0
je 0x417beb
or ecx, 2
push ecx
lea ecx, [ebp - 0x2b4]
push esi
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop esi
jne 0x417c08
or eax, 0xffffffff
leave
ret
mov eax, dword [ebp - 0x2b0]
leave
ret
Function at 0x417d43
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4cac50
call fcn.0049c8c4
push ecx
push ecx
push ebx
push 0x56f1b4
lea ecx, [ebp - 0x10]
call fcn.004b925f
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00417629
pop ecx
test eax, eax
pop ecx
je 0x417d7f
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004b9382
mov eax, dword [0x56a9b8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push str._e___s_
push eax
call fcn.004b54c1
add esp, 0xc
push 1
push ebx
push dword [ebp - 0x14]
push str.explorer.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004b91eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b91eb
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x417eea
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x417f4c
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x417f4c
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x417f4e
xor eax, eax
pop esi
leave
ret

Function at 0x41a7a3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4cb0cf
call fcn.0049c8c4
sub esp, 0x80c
and word [ebp - 0x818], 0
push ebx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
and dword [ebp - 0x18], 0
stosw word es:[edi], ax
lea eax, [ebp - 0x818]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x56a9b8]
mov dword [ebp - 0x10], eax
push 1
lea eax, [ebp - 0x10]
pop ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00417467
mov eax, dword [0x56a9b8]
pop ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x818]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x14]
push 0x4f590c
push eax
call fcn.004b54c1
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.004b8f58
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004b91eb
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004b91eb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41c7c2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0049db50
push ebx
push edi
xor edi, edi
push 0x1001
lea eax, [ebp - 0x1010]
push edi
mov ebx, ecx
push eax
call fcn.0049cb00
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, ebx
mov dword [ebp - 8], 0x1001
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.0041c886
test eax, eax
jne 0x41c830
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41c835
or eax, 0xffffffff
jmp 0x41c85e
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
push 3
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41c853
or edi, 0xffffffff
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x41cbe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0049db50
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push 0x56f1b4
call fcn.004b9382
xor esi, esi
push 0x1001
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.0049cb00
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 1
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41cc43
or eax, 0xffffffff
jmp 0x41cc9d
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1001
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp + 8]
push eax
push esi
push esi
mov dword [ebp + 8], 3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
test eax, eax
je 0x41cc7a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41cc3e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
je 0x41cc3e
push dword [ebp + 0xc]
lea eax, [ebp - 0x1010]
mov ecx, ebx
push dword [ebp - 4]
push eax
call fcn.0041cca3
neg eax
sbb eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x426ab3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0049db50
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push 0x56f1b4
call fcn.004b9382
xor esi, esi
push 0x1001
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.0049cb00
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 1
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x426b16
or eax, 0xffffffff
jmp 0x426b70
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1001
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp + 8]
push eax
push esi
push esi
mov dword [ebp + 8], 3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
test eax, eax
je 0x426b4d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426b11
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
je 0x426b11
push dword [ebp + 0xc]
lea eax, [ebp - 0x1010]
mov ecx, ebx
push dword [ebp - 4]
push eax
call fcn.00426c18
neg eax
sbb eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x426b76
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0049db50
push ebx
push edi
xor edi, edi
push 0x1001
lea eax, [ebp - 0x1010]
push edi
mov ebx, ecx
push eax
call fcn.0049cb00
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, ebx
mov dword [ebp - 8], 0x1001
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.00426d27
test eax, eax
jne 0x426be4
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x426be9
or eax, 0xffffffff
jmp 0x426c12
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
push 3
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x426c07
or edi, 0xffffffff
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 8