joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45778d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45778d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4013d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, 0x18
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x54c
mov dword [ebp - 0x51c], eax
mov eax, 0x18
mov esi, dword fs:[0x18]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
mov dword [esp], edi
mov eax, 1
mov dword [esp + 8], eax
lea eax, [ebp - 0x51c]
mov dword [esp + 4], eax
call sym._GetTcpTable_12
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x4015d8
mov eax, dword [edi]
lea esi, [edi + 4]
test eax, eax
je 0x4015a9
mov dword [ebp - 0x52c], edi
lea esi, [esi]
mov ecx, dword [esi]
cmp ecx, 0xb
ja 0x401595
mov eax, 0x920
shr eax, cl
test al, 1
je 0x401595
mov eax, dword [esi + 4]
lea edx, [ebp - 0x498]
mov edi, 0x20
call sym._NETSTAT_host_name
mov edx, dword [esi + 8]
mov ecx, 0x405484
mov dword [esp + 4], edi
lea edi, [ebp - 0x518]
mov dword [esp + 8], ecx
mov dword [esp], edi
mov eax, edx
movzx edx, dh
shl eax, 8
and eax, 0xff00
or eax, edx
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x398]
call sym._NETSTAT_host_name
mov ecx, dword [esi + 0x10]
mov eax, ecx
movzx ecx, ch
shl eax, 8
and eax, 0xff00
or eax, ecx
mov dword [esp + 0xc], eax
lea ecx, [ebp - 0x4d8]
mov eax, 0x405484
mov dword [esp + 8], eax
mov eax, 0x20
mov dword [esp], ecx
mov dword [esp + 4], eax
call sym._swprintf
lea eax, [ebp - 0x498]
mov dword [esp + 0xc], eax
mov eax, str._s:_s
mov dword [esp + 0x10], edi
lea edi, [ebp - 0x298]
mov dword [esp + 8], eax
mov eax, 0xa0
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._swprintf
lea edx, [ebp - 0x398]
mov eax, str._s:_s
mov dword [esp + 0xc], edx
lea ecx, [ebp - 0x4d8]
mov edx, 0xa0
mov dword [esp + 4], edx
lea edx, [ebp - 0x158]
mov dword [esp + 0x10], ecx
mov dword [esp], edx
mov dword [esp + 8], eax
call sym._swprintf
mov eax, dword [esi]
lea edx, [ebp - 0x158]
mov dword [esp + 0xc], edx
mov ecx, 0x4054ac
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], str.____6s___22s___22s__s_n
shl eax, 5
add eax, 0x405140
mov dword [esp + 0x10], eax
call sym._NETSTAT_wprintf
mov eax, dword [ebp - 0x52c]
inc ebx
add esi, 0x14
cmp dword [eax], ebx
ja 0x401460
mov edi, eax
mov dword [esp + 8], edi
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], edi
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp ebx, 0x7a
jne 0x4015cb
mov eax, dword [ebp - 0x51c]
jmp 0x401400
Function at 0x401610
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, 0xc
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0xc
sub esp, 0x2bc
mov dword [ebp - 0x29c], ebx
mov esi, dword fs:[0x18]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], eax
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, 1
sub esp, 0xc
mov edi, eax
mov dword [esp + 8], ecx
lea eax, [ebp - 0x29c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._GetUdpTable_12
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x401768
mov eax, dword [edi]
test eax, eax
je 0x401738
lea esi, [ebp - 0x258]
lea esi, [esi]
lea edi, [edi]
mov eax, dword [edi + ebx*8 + 4]
mov edx, esi
call sym._NETSTAT_host_name
mov edx, dword [edi + ebx*8 + 8]
mov ecx, 0x405484
mov dword [esp + 8], ecx
inc ebx
mov eax, edx
movzx edx, dh
shl eax, 8
and eax, 0xff00
or eax, edx
mov dword [esp + 0xc], eax
mov eax, 0x20
mov dword [esp + 4], eax
lea eax, [ebp - 0x298]
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x298]
mov dword [esp + 0x10], eax
mov eax, str._s:_s
mov dword [esp + 8], eax
mov eax, 0xa0
mov dword [esp + 4], eax
lea eax, [ebp - 0x158]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x158]
mov dword [esp + 8], eax
mov eax, 0x405498
mov dword [esp + 4], eax
mov dword [esp], str.____6s___22s_:_n
call sym._NETSTAT_wprintf
cmp dword [edi], ebx
ja 0x4016a0
mov dword [esp + 8], edi
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp ebx, 0x7a
jne 0x40175a
mov eax, dword [ebp - 0x29c]
jmp 0x401640
Function at 0x4026a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x402710
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x402708
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4080c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x4026cd
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x4030e0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete dl
movzx edx, dl
inc edx
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x5c911e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x5c913e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5c912a
add dl, dl
jne 0x5c9149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5c919a
xor eax, eax
add dl, dl
jne 0x5c9156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5c923b
add dl, dl
jne 0x5c9165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5c9170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5c917b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5c9186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x5c9190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x5c9135
mov eax, 1
add dl, dl
jne 0x5c91a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x5c91b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5c919f
sub eax, ebx
mov ebx, 1
jne 0x5c91e6
mov ecx, 1
add dl, dl
jne 0x5c91cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5c91d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5c91c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5c9135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x5c91fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5c9208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5c91f4
cmp eax, 0x7d00
jae 0x5c922b
cmp eax, 0x500
jb 0x5c9226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5c9135
cmp eax, 0x7f
ja 0x5c922e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5c9135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x5c925c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x5c9135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4010c0
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, 0x1050
call fcn.0040da20
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x104c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x105c]
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x18], edi
mov esi, edx
mov dword [esp + 0x14], ebx
mov ecx, 0x10
lea eax, [esp + 0x1c]
lea ebx, [ebx]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x401100
lea eax, [esp + 0x34]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp ebp, ebx
je 0x4011ea
cmp esi, ebx
je 0x4011ea
mov eax, 1
test byte [esi + 0x105c], al
je 0x4011ea
mov dword [esi + 0x1060], eax
mov eax, edi
mov edx, esi
mov dword [esi + 0x103c], ebx
call fcn.00401060
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x26]
movzx ecx, word [esp + 0x24]
push edx
movzx edx, word [esp + 0x20]
push eax
movzx eax, word [esp + 0x2a]
push ecx
movzx ecx, word [esp + 0x2a]
push edx
push eax
push ecx
push str._u__u__u__u:_u:_u
lea ebx, [esi + 0x1000]
mov eax, 0x3c
call section..text
mov edx, dword [esp + 0x6c]
xor ebx, ebx
mov eax, edx
add esp, 0x1c
mov edx, ebx
mov cl, 0x20
mov dword [esi + 0x1058], 1
call fcn.0040f740
mov dword [esi + 0x1050], eax
mov eax, dword [esp + 0x54]
add dword [esi + 0x1050], eax
mov dword [esi + 0x1054], edx
push esi
adc dword [esi + 0x1054], ebx
mov dword [esi + 0x1074], ebx
call ebp
add esp, 4
cmp dword [esi + 0x1064], 0
je 0x4011fa
xor eax, eax
jmp 0x4012f4
mov ebx, 1
cmp dword [esi + 0x1074], ebx
jne 0x40120e
mov eax, ebx
jmp 0x4012f4
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push 3
push 0
push 0
push 0x120112
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4012a0
cmp dword [esi + 0x1070], ebx
push edi
mov ebx, ebp
jne 0x40124c
call fcn.00402750
jmp 0x401251
call fcn.004023c0
add esp, 4
push edi
test eax, eax
je 0x40129a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
lea edi, [esp + 0x5c]
call fcn.00401630
add esp, 4
test eax, eax
jne 0x401281
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4012a0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4012a0
mov dword [esp + 0x14], 1
jmp 0x4012a0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x4012f0
cmp dword [esi + 0x1064], 0
jne 0x4012f0
mov eax, 8
test byte [esi + 0x105c], al
je 0x4012f0
mov dword [esi + 0x1060], eax
mov eax, dword [esp + 0x18]
mov edx, esi
mov dword [esi + 0x103c], 0
call fcn.00401060
mov ecx, dword [esp + 0x14]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 2
push esi
mov dword [esi + 0x1058], ecx
call ebp
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7e
add esp, 0x1050
ret
Function at 0x401630
Capabilities:
Move file

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
cmp esi, ebp
je 0x401719
cmp edi, ebp
je 0x401719
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x401650
sub eax, edx
sar eax, 1
push ebx
mov ebx, eax
cmp ebx, 0x801
jbe 0x401673
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, esi
mov edx, edi
call fcn.00401060
push 0x5c
push ebp
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebp
jne 0x40169e
mov eax, edi
sub eax, edi
sar eax, 1
mov dword [esp + 0xc], 3
mov dword [esp + 0x14], eax
jmp 0x4016b7
add eax, 2
sub eax, edi
sar eax, 1
mov dword [esp + 0xc], 3
mov dword [esp + 0x14], eax
jmp 0x4016b7
mov eax, dword [esp + 0x14]
mov esi, eax
cmp esi, ebx
jae 0x4016f0
lea ecx, [ecx]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
call fcn.004064e8
mov ecx, dword [esp + 0x14]
mov eax, 0x4ec4ec4f
mul ecx
shr edx, 3
imul edx, edx, 0x1a
sub ecx, edx
add ecx, 0x41
mov word [edi + esi*2], cx
inc esi
add esp, 4
cmp esi, ebx
jb 0x4016c0
mov edx, dword [esp + 0x1c]
push edi
xor ecx, ecx
push edx
mov word [edi + esi*2 + 2], cx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40170e
sub dword [esp + 0xc], 1
jne 0x4016b3
mov eax, dword [esp + 0xc]
pop ebx
pop esi
pop ebp
add esp, 0xc
ret
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret

Function at 0x401810
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
mov ecx, dword [esi + 4]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea eax, [esp + 0xc]
push eax
push 0x506
push ecx
mov dword [esp + 0x1c], 0xffffff
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
call edi
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ebx, dword [sym.imp.USER32.dll_LoadBitmapW]
mov dword [esi + 0x24], eax
mov eax, dword [0x418680]
push 0x2777
push eax
call ebx
mov ecx, dword [0x418680]
push 0x2779
push ecx
mov dword [esi + 0x28], eax
call ebx
mov edx, dword [0x418680]
push 0x2778
push edx
mov dword [esi + 0x2c], eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
push 0x27e3
push eax
call ebx
mov ecx, dword [esi + 0x28]
push ecx
push 0
push 0x172
push eax
call edi
mov edx, dword [esi + 4]
push 0x27e6
push edx
call ebx
mov ecx, dword [esi + 0x28]
push ecx
push 0
push 0x172
push eax
call edi
mov edx, dword [esi + 4]
push 0x27e0
push edx
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x4018f0
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 4]
push 0x27d9
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x40191e
push 1
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
lea ecx, [esp]
push ecx
push 0
push esi
push 0x401940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
pop ecx
ret
Function at 0x401ca0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
mov ebp, dword [esp + 0x228]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0xf003f
xor edi, edi
push edi
push ebp
push reloc.K7UI.dll_Ordinal_1
mov dword [esp + 0x24], edi
xor ebx, ebx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x401e25
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x30]
push ecx
push eax
push eax
lea edx, [esp + 0x38]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jne 0x401e25
cmp dword [esp + 0x1c], esi
jne 0x401d24
cmp dword [esp + 0x20], esi
je 0x401e25
push 0x7ffe
call fcn.00405fb7
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x401d41
mov esi, 0xe
jmp 0x401e25
mov dword [esp + 0x14], esi
cmp dword [esp + 0x20], esi
jbe 0x401d8f
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push ebx
push 0
push edx
mov dword [esp + 0x38], 0x3fff
call esi
test eax, eax
jne 0x401d80
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x20]
jb 0x401d51
mov dword [esp + 0x14], edi
cmp dword [esp + 0x1c], edi
jbe 0x401e12
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0
push eax
mov dword [esp + 0x38], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x401e25
lea ecx, [esp + 0x28]
push ecx
push ebp
push str._s_s
mov eax, 0x7ffe
call section..text
add esp, 0xc
push ebx
push reloc.K7UI.dll_Ordinal_1
call edi
mov esi, eax
test esi, esi
je 0x401dfb
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x1c]
jb 0x401da0
test esi, esi
jne 0x401e25
mov edi, dword [esp + 0x24]
dec edi
neg edi
sbb edi, edi
and edi, 0xfffffcfa
add edi, 0x306
mov esi, edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401e34
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x401e41
push ebx
call fcn.00405eda
add esp, 4
mov ecx, dword [esp + 0x228]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7e
add esp, 0x21c
ret 4
Function at 0x401e60
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push 0x27e3
push eax
call ebx
mov ecx, dword [edi + 0x2c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push 0
push 0x172
push eax
call ebp
mov edx, dword [edi + 4]
push 0x27e2
push edx
call ebx
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 4]
push 0x27e2
push eax
call ebx
push 0
push 0
mov esi, eax
push 0x40a
push esi
call ebp
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x1e
push 1
push 0x40a
push esi
call ebp
mov esi, dword [esp + 0x10]
push edi
call fcn.004028b0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [edi + 4]
push 0x27e2
push ecx
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 4]
push 0x27e3
push edx
call ebx
mov ecx, dword [edi + 0x30]
push ecx
push 0
push 0x172
push eax
call ebp
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x4021c0
Capabilities:
Check os version
Get token membership

Disassembly:
sub esp, 0x174
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x170], eax
push esi
push edi
lea eax, [esp + 8]
push eax
xor edi, edi
push 1
push 0xa
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40221a
lea ecx, [esp + 8]
push ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4022d1
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4022d1
cmp dword [esp + 0x24], 6
jb 0x40227b
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0x12
push edx
call esi
test eax, eax
je 0x4022d1
cmp dword [esp + 0x14], 3
jne 0x40227b
mov edx, dword [esp + 8]
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x13
push edx
call esi
test eax, eax
je 0x4022d1
cmp dword [esp + 0xc], edi
jne 0x402297
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x4022d1
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x138]
push eax
push edi
push 0x1a
mov dword [esp + 0x28], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x4022d1
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x138]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 8], edi
jne 0x4022e4
push edi
call esi
mov dword [esp + 8], edi
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4022ef
push eax
call esi
mov ecx, dword [esp + 0x178]
mov eax, dword [esp + 0x10]
pop edi
pop esi
xor ecx, esp
call fcn.00405d7e
add esp, 0x174
ret

Function at 0x402310
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x4133a0
push 0x80000002
mov esi, 1
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4023a0
push 0xea68
lea ecx, [esp + 0x14]
push str.TSUpsInfo_08X
push ecx
mov dword [esp + 0x18], 4
call fcn.0040612d
add esp, 0xc
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402395
cmp dword [esp + 8], esi
jne 0x402395
xor esi, esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x60]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00405d7e
add esp, 0x60
ret