joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x820
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004142a0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x824]
push 0x410
push 0x410
push eax
call fcn.00411c9b
add esp, 0x20
cmp word [ebp - 0x824], 0
je 0x40132d
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x401830
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x210], edx
xor esi, esi
call fcn.0040f690
mov edi, eax
test edi, edi
je 0x401974
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401861
sub ecx, edx
sar ecx, 1
je 0x401974
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], esi
push 0x4323d8
push eax
call fcn.0040fdf0
xor eax, eax
mov dword [ebp - 0x214], esi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004142a0
add esp, 0x18
mov dword [ebp - 0x21c], 0x206
lea eax, [ebp - 0x214]
mov dword [ebp - 0x220], 1
push eax
push 0x20019
push 0
push dword [ebp - 0x218]
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40195b
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x432460
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40194f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push str._sTemp
push eax
call fcn.0040fdf0
mov esi, dword [ebp - 0x210]
add esp, 0xc
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401940
sub esi, ecx
sar esi, 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004114dd
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x210]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x404690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429d9e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4371c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [edi], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.004049f0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x24]
push eax
push 0
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004049f0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov edx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x68], eax
mov dword [edi + 0x58], edx
mov dword [edi + 0x60], 0
mov byte [edi + 0x64], 0
movsx eax, byte [edx + 8]
and eax, 8
shr eax, 3
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [edx + 0x18]
call fcn.004047e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x405e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x405e81
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x405e70
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x40b1c0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b1df
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40b1f6
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x40b208
push eax
call edi
mov dword [esi + 4], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x40b2cf
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x40b297
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x40b292
push 0x1c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
push ecx
push eax
movdqu xmmword [ebp - 0x18], xmm0
movq qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b292
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 8]
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b2ac
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40b2bd
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x40b2cf
push eax
call edi
mov dword [esi + 4], 0xffffffff
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b350
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x40b364
xor al, al
pop edi
pop ebp
ret 4
mov ecx, 0x5a4d
push esi
cmp word [eax], cx
jne 0x40b3c7
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x40b3c7
mov ecx, dword [ecx + eax + 0x98]
test ecx, ecx
je 0x40b3c7
lea esi, [ecx + eax]
test esi, esi
je 0x40b3c7
lea eax, [esi + 8]
test eax, eax
je 0x40b3c7
cmp byte [eax], 0x30
lea edx, [eax + 1]
jne 0x40b3c7
mov al, byte [edx]
cmp al, 0x82
jne 0x40b3c7
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
je 0x40b3c7
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], eax
mov al, 1
pop esi
pop edi
pop ebp
ret 4
pop esi
xor al, al
pop edi
pop ebp
ret 4
Function at 0x40c310
Capabilities:
Check os version
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x114
xor edi, edi
mov dword [ebp - 0x93c], edx
lea eax, [ebp - 0x938]
mov dword [ebp - 0x940], 0x104
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0x944], ebx
call fcn.004142a0
add esp, 0xc
mov dword [ebp - 0x938], 0x114
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x928], 2
jne 0x40c3cd
cmp dword [ebp - 0x934], 6
jb 0x40c3cd
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x43285c
call esi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c419
push str.QueryFullProcessImageNameW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c3c4
lea ecx, [ebp - 0x940]
push ecx
push dword [ebp - 0x93c]
push edi
push dword [ebp - 0x944]
call eax
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40c419
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Window_is_XP_n
call esi
push dword [ebp - 0x940]
push dword [ebp - 0x93c]
push 0
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov edi, eax
test edi, edi
jne 0x40c419
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x824]
push str.GetModulePathWrap___:_GetModuleFileNameEx___err___d_n
push eax
call fcn.0040b470
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call esi
push edi
push dword [ebp - 0x93c]
lea eax, [ebp - 0x824]
push str.GetModulePathWrap___Out_:_lpszModPath___s__ret__int____d_n
push eax
call fcn.0040b470
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x40c6e0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
xor esi, esi
push edi
push str.IsMSISrvFree___In
mov dword [ebp - 0x828], esi
lea edi, [esi + 0xa]
call ebx
push str.Global_MSIExecute
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x82c], eax
test eax, eax
je 0x40c821
push esi
push str.IsMSISrvFree___:_Mutex_is_opened__GetLastError_____d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
push 0x4e20
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, 0x102
ja 0x40c7b0
je 0x40c7a7
test esi, esi
je 0x40c796
cmp esi, 0x80
jne 0x40c7d9
push str.IsMSISrvFree___:_WAIT_ABANDONED__iCount_set_to_0._n
lea eax, [ebp - 0x824]
xor edi, edi
push 0x104
push eax
call fcn.00412a0b
add esp, 0xc
jmp 0x40c7d9
mov dword [ebp - 0x828], 1
push str.IsMSISrvFree___:_Mutex_is_closed__iCount_set_to_0._n
jmp 0x40c77e
dec edi
push edi
push str.IsMSISrvFree___:_WAIT_TIMEOUT__iCount___d_n
jmp 0x40c7c5
cmp esi, 0xffffffff
jne 0x40c7d9
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.IsMSISrvFree___:_WAIT_FAILED__iCount_set_to_0__ret___d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
test edi, edi
jne 0x40c750
push esi
push str._nIsMSISrvFree___:_Do_not_wait_any_more._n_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x828]
jmp 0x40c84f
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsMSISrvFree___:_OpenMutex___err_ret___d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
push esi
push str.IsMSISrvFree___Out_ret___d_n
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x40d0e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x2a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
mov ebx, edx
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40d1c5
push 0x27
lea eax, [ebp - 0x9c]
push eax
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
js 0x40d1c5
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x4c]
push edx
push str._d._d._d._d
push 0x24
push eax
call fcn.0040cdc0
add esp, 0x1c
test eax, eax
js 0x40d1c5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push str._lsApplicationsCache_lsv_ls.msi
push edi
call fcn.0040fdf0
add esp, 0x14
test eax, eax
js 0x40d1c5
push 1
push 1
push dword [edi]
push ebx
call fcn.00410610
test eax, eax
jns 0x40d1c5
cmp dword [ebp + 8], 1
jne 0x40d1c5
push edi
push 0
mov edx, ebx
mov ecx, esi
call fcn.0040d0e0
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret

Function at 0x40d1e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x2a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
mov ebx, edx
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40d2c5
push 0x27
lea eax, [ebp - 0x9c]
push eax
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
js 0x40d2c5
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x4c]
push edx
push str._d._d._d._d
push 0x24
push eax
call fcn.0040cdc0
add esp, 0x1c
test eax, eax
js 0x40d2c5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push str._lsApplicationsCache_lsv_ls.mst
push edi
call fcn.0040fdf0
add esp, 0x14
test eax, eax
js 0x40d2c5
push 1
push 1
push dword [edi]
push ebx
call fcn.00410610
test eax, eax
jns 0x40d2c5
cmp dword [ebp + 8], 1
jne 0x40d2c5
push edi
push 0
mov edx, ebx
mov ecx, esi
call fcn.0040d1e0
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x40ec70
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x834]
push esi
push edi
push eax
lea eax, [ebp - 0x828]
mov dword [ebp - 0x82c], edx
push eax
push 0x18
xor esi, esi
mov dword [ebp - 0x830], ecx
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x828], esi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x40ed45
mov edi, dword [ebp - 0x828]
test edi, edi
je 0x40ed83
mov ecx, dword [ebp - 0x830]
mov esi, 1
test ecx, ecx
je 0x40ece6
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x82c]
test ecx, ecx
je 0x40ed05
lea eax, [edi + 0x82]
push eax
push 0x104
push ecx
call fcn.00412a0b
add esp, 0xc
test ebx, ebx
je 0x40ed1b
lea eax, [edi + 0x60]
push eax
push 0x104
push ebx
call fcn.00412a0b
add esp, 0xc
mov eax, dword [ebp - 0x830]
push dword [eax]
lea eax, [ebp - 0x824]
push ebx
push dword [ebp - 0x82c]
push 0x433100
push 0x410
push eax
call fcn.00412a0b
add esp, 0x18
jmp 0x40ed65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4331a8
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x828]
test eax, eax
je 0x40ed83
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret

Function at 0x40eda0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40edfe
push dword [esi]
lea eax, [ebp - 0x824]
push 0x433238
push 0x410
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004114dd
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4332b8
lea ecx, [ebp - 0x824]
push 0x410
push ecx
call fcn.00412a0b
add esp, 0x10
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x40ee40
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x828]
push eax
push edi
mov esi, edx
mov dword [ebp - 0x828], 0
push esi
push ecx
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x40eeb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x433328
lea ecx, [ebp - 0x824]
push 0x410
push ecx
call fcn.00412a0b
add esp, 0x10
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004114dd
mov esp, ebp
pop ebp
ret
push dword [edi]
lea ecx, [ebp - 0x824]
push esi
push 0x4333c8
push 0x410
push ecx
call fcn.00412a0b
add esp, 0x14
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004114dd
mov esp, ebp
pop ebp
ret

Function at 0x40ef00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x82c], eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, ebx
mov ecx, eax
call fcn.0040eda0
mov esi, eax
test esi, esi
je 0x40f012
mov ecx, dword [ebx]
lea eax, [ebp - 0x828]
push eax
mov edx, 5
mov dword [ebp - 0x828], 0
call fcn.0040ee40
mov esi, eax
add esp, 4
test esi, esi
je 0x40f012
mov eax, dword [ebp - 0x828]
test eax, eax
je 0x40ef9e
test edi, edi
je 0x40ef9e
push eax
push 0x104
push edi
call fcn.00412a0b
mov eax, dword [ebp - 0x828]
add esp, 0xc
test eax, eax
je 0x40ef94
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov dword [ebp - 0x828], 0
mov ecx, dword [ebx]
lea eax, [ebp - 0x828]
push eax
mov edx, 7
call fcn.0040ee40
mov esi, eax
add esp, 4
test esi, esi
je 0x40f012
mov eax, dword [ebp - 0x828]
test eax, eax
je 0x40efee
mov ecx, dword [ebp - 0x82c]
test ecx, ecx
je 0x40efee
push eax
push 0x104
push ecx
call fcn.00412a0b
mov eax, dword [ebp - 0x828]
add esp, 0xc
test eax, eax
je 0x40efee
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push dword [ebx]
lea eax, [ebp - 0x824]
push dword [ebp - 0x82c]
push edi
push 0x433460
push 0x410
push eax
call fcn.00412a0b
add esp, 0x18
jmp 0x40f02b
push 0x433508
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a0b
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x40f050
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
push eax
push 1
push 0
push edx
push 0x80000002
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f0f3
push ebx
push esi
push edi
push eax
push 0x433648
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [edi]
mov dword [ebp - 0x214], eax
cmp ecx, 2
je 0x40f0bb
cmp ecx, 1
jne 0x40f0e1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
mov dword [ebx], eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0041459b
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret
Function at 0x40f4c0
Capabilities:
Get user security identifier
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc40], eax
push 0x410
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc38], ebx
push ebx
push eax
mov edi, edx
mov dword [ebp - 0xc3c], ebx
mov esi, ecx
call fcn.004142a0
push esi
push edi
push 0x433948
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00412a0b
lea eax, [ebp - 0x414]
push eax
push 0x433954
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00412a0b
add esp, 0x30
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc3c]
push eax
push ebx
lea eax, [ebp - 0xc38]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov eax, dword [ebp - 0xc38]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40f580
push eax
push 8
call esi
push eax
call edi
mov ebx, eax
mov ecx, dword [ebp - 0xc3c]
test ecx, ecx
je 0x40f598
add ecx, ecx
push ecx
push 8
call esi
push eax
call edi
mov edi, eax
jmp 0x40f59a
xor edi, edi
test ebx, ebx
je 0x40f629
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc3c]
push eax
push edi
lea eax, [ebp - 0xc38]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x40f5eb
push dword [ebp - 0xc40]
push ebx
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x40f619
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4336d8
jmp 0x40f5f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x433998
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call eax
push ebx
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
jmp 0x40f62f
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x40f63b
push edi
push 0
call esi
push eax
call ebx
mov ebx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc34]
push dword [ebx]
push 0x4339fc
push 0x410
push eax
call fcn.00412a0b
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.004114dd
mov esp, ebp
pop ebp
ret