joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4524e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452602
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00451bbc
xor eax, eax
push ebp
push 0x4525e5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x452530
call fcn.00403e60
jmp 0x4525ec
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4525cf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4525cf
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004037fc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4525cf
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040b330
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x45261c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x457fb8]
mov dl, 1
mov eax, dword [0x450b5c]
call fcn.0040bc7c
call fcn.00403db4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4525ec
mov eax, dword [ebp - 4]
call fcn.00451bc8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452609
lea eax, [ebp - 0x28]
call fcn.004043d8
ret
Function at 0x452668
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4527b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00451bbc
xor eax, eax
push ebp
push 0x452795
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4526cd
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4526cd
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x45277f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4526e0
call fcn.00403e60
jmp 0x45279c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45277f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x45277f
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004037fc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x45277f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040b330
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4527cc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x457fb8]
mov dl, 1
mov eax, dword [0x450b5c]
call fcn.0040bc7c
call fcn.00403db4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45279c
mov eax, dword [ebp - 4]
call fcn.00451bc8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4527b9
lea eax, [ebp - 0x28]
call fcn.004043d8
ret
Function at 0x405bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405c49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405c49
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x405c3a
cmp esi, edx
jae 0x405c49
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x405c28
cmp esi, edx
jae 0x405c49
cmp word [esi], 0
je 0x405c49
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4062b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519e80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov edi, dword [ecx]
mov esi, dword [eax]
mov eax, dword [0x56cec0]
cmp eax, dword [esi + 4]
jle 0x40631e
push 0x56cec0
call fcn.004af7b6
add esp, 4
cmp dword [0x56cec0], 0xffffffff
jne 0x40631e
push 0x56cec0
mov dword [0x56cec4], 0
call fcn.004af76c
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0x31], 0
movlpd qword [ebp - 0x20], xmm0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
call fcn.00432a45
add esp, 4
mov dword [ebp - 4], 1
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x31]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0x407210
push 0x56cec4
call fcn.00432c10
add esp, 0xc
test eax, eax
je 0x406462
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00432a7f
mov eax, dword [0x56ceb8]
add esp, 4
cmp eax, dword [esi + 4]
jle 0x4063bb
push 0x56ceb8
call fcn.004af7b6
add esp, 4
cmp dword [0x56ceb8], 0xffffffff
jne 0x4063bb
push 0x56ceb8
mov dword [0x56cebc], 0
call fcn.004af76c
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0x32], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 5
push eax
call fcn.00432a45
add esp, 4
mov dword [ebp - 4], 6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x32]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
push 0x407160
push 0x56cebc
call fcn.00432c10
add esp, 0xc
test eax, eax
je 0x406448
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 7
push eax
call fcn.00432a7f
add esp, 4
push edi
push 1
push 0x56ad48
push 0x56ad54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 8
push eax
call fcn.00432aa0
add esp, 4
mov byte [ebp - 4], 6
test al, al
je 0x4064a0
jmp 0x40648d
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.00432aa0
add esp, 4
mov byte [ebp - 4], 1
test al, al
je 0x4064a0
sub esp, 8
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.00404e30
call fcn.00404e90
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00404e30
call fcn.00404e90
call fcn.00432c28
int3
Function at 0x4064b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519e80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov edi, dword [ecx]
mov esi, dword [eax]
mov eax, dword [0x56ced0]
cmp eax, dword [esi + 4]
jle 0x40651e
push 0x56ced0
call fcn.004af7b6
add esp, 4
cmp dword [0x56ced0], 0xffffffff
jne 0x40651e
push 0x56ced0
mov dword [0x56ced4], 0
call fcn.004af76c
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0x31], 0
movlpd qword [ebp - 0x20], xmm0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
call fcn.00432a45
add esp, 4
mov dword [ebp - 4], 1
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x31]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0x407350
push 0x56ced4
call fcn.00432c10
add esp, 0xc
test eax, eax
je 0x406662
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00432a7f
mov eax, dword [0x56cec8]
add esp, 4
cmp eax, dword [esi + 4]
jle 0x4065bb
push 0x56cec8
call fcn.004af7b6
add esp, 4
cmp dword [0x56cec8], 0xffffffff
jne 0x4065bb
push 0x56cec8
mov dword [0x56cecc], 0
call fcn.004af76c
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0x32], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 5
push eax
call fcn.00432a45
add esp, 4
mov dword [ebp - 4], 6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x32]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
push 0x4072b0
push 0x56cecc
call fcn.00432c10
add esp, 0xc
test eax, eax
je 0x406648
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 7
push eax
call fcn.00432a7f
add esp, 4
push edi
push 0
push 0x56ad1c
push 0x56ad34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 8
push eax
call fcn.00432aa0
add esp, 4
mov byte [ebp - 4], 6
test al, al
je 0x4066a0
jmp 0x40668d
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.00432aa0
add esp, 4
mov byte [ebp - 4], 1
test al, al
je 0x4066a0
sub esp, 8
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.00404e30
call fcn.00404e90
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00404e30
call fcn.00404e90
call fcn.00432c28
int3
Function at 0x406c70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519e80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov edi, dword [ecx]
mov esi, dword [eax]
mov eax, dword [0x56cf10]
cmp eax, dword [esi + 4]
jle 0x406cde
push 0x56cf10
call fcn.004af7b6
add esp, 4
cmp dword [0x56cf10], 0xffffffff
jne 0x406cde
push 0x56cf10
mov dword [0x56cf14], 0
call fcn.004af76c
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0x31], 0
movlpd qword [ebp - 0x20], xmm0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
call fcn.00432a45
add esp, 4
mov dword [ebp - 4], 1
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x31]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0x407880
push 0x56cf14
call fcn.00432c10
add esp, 0xc
test eax, eax
je 0x406e22
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00432a7f
mov eax, dword [0x56cf08]
add esp, 4
cmp eax, dword [esi + 4]
jle 0x406d7b
push 0x56cf08
call fcn.004af7b6
add esp, 4
cmp dword [0x56cf08], 0xffffffff
jne 0x406d7b
push 0x56cf08
mov dword [0x56cf0c], 0
call fcn.004af76c
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0x32], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 5
push eax
call fcn.00432a45
add esp, 4
mov dword [ebp - 4], 6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x32]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
push 0x4077e0
push 0x56cf0c
call fcn.00432c10
add esp, 0xc
test eax, eax
je 0x406e08
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 7
push eax
call fcn.00432a7f
add esp, 4
push edi
push 1
push 0x56ac90
push 0x56acac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 8
push eax
call fcn.00432aa0
add esp, 4
mov byte [ebp - 4], 6
test al, al
je 0x406e60
jmp 0x406e4d
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.00432aa0
add esp, 4
mov byte [ebp - 4], 1
test al, al
je 0x406e60
sub esp, 8
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.00404e30
call fcn.00404e90
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00404e30
call fcn.00404e90
call fcn.00432c28
int3
Function at 0x408ca0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004b01b0
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x4000
lea eax, [ebp - 0x4004]
mov esi, ecx
push 0
push eax
call fcn.004efd80
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x408d92
lea eax, [ebp - 0x4008]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x408d92
cmp eax, 0x3fff
ja 0x408d92
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x408d92
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x547740
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x408d92
push 0x208
push 0
push 0x56b110
call fcn.004efd80
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x5477a8
push 0x103
push 0x56b110
call fcn.0040a4e0
add esp, 0x28
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004af60c
mov esp, ebp
pop ebp
ret

Function at 0x4090c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x40913e
test esi, esi
je 0x40913e
push 5
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40913e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x409138
mov eax, dword [esi]
mov dword [edi], eax
mov al, byte [esi + 4]
mov byte [edi + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x409138
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004af60c
mov esp, ebp
pop ebp
ret
Function at 0x409c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x56ad80
mov dword [ebp - 0x74], 0x2d002d
lea esi, [ebp - 0x74]
mov dword [ebp - 0x70], 0x650070
push edi
mov dword [ebp - 0x6c], 0x3d0070
mov edx, 0x38
mov dword [ebp - 0x68], 0x6c0025
sub esi, eax
mov dword [ebp - 0x64], 0x75006c
mov dword [ebp - 0x60], 0x2d0020
mov dword [ebp - 0x5c], 0x70002d
mov dword [ebp - 0x58], 0x640069
mov dword [ebp - 0x54], 0x25003d
mov dword [ebp - 0x50], 0x200064
mov dword [ebp - 0x4c], 0x2d002d
mov dword [ebp - 0x48], 0x690074
mov dword [ebp - 0x44], 0x3d0064
mov dword [ebp - 0x40], 0x640025
mov dword [ebp - 0x3c], 0x2d0020
mov dword [ebp - 0x38], 0x73002d
mov dword [ebp - 0x34], 0x630072
mov dword [ebp - 0x30], 0x25003d
mov dword [ebp - 0x2c], 0x200073
mov dword [ebp - 0x28], 0x2d002d
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x3d0072
mov dword [ebp - 0x1c], 0x730025
mov dword [ebp - 0x18], 0x2d0020
mov dword [ebp - 0x14], 0x72002d
mov dword [ebp - 0x10], 0x700065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x64
lea ecx, [edx + 0x7fffffc6]
test ecx, ecx
je 0x409d74
movzx ecx, word [esi + eax]
test cx, cx
je 0x409d74
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409d56
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
Function at 0x40a570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x551378
push 0x4ef480
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x55f3a4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x434]
push eax
call fcn.004efd80
add esp, 0xc
push edi
push ecx
call fcn.0040a6e0
add esp, 4
push eax
push 0xff
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x440]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x434]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a694
mov dword [ebp - 0x43c], eax
push 0x210
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.004efd80
add esp, 0xc
mov dword [ebp - 0x438], 0x210
call fcn.0040a910
lea ecx, [ebp - 0x438]
push ecx
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push 0
push eax
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a694
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x107
jge 0x40a694
push 0x107
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 4], 0xfffffffe
call fcn.0040a6c6
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret 4

Function at 0x40a800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x55f3a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x56b668
mov dword [ebp - 0x64], 0x590053
lea esi, [ebp - 0x64]
mov dword [ebp - 0x60], 0x540053
push edi
mov dword [ebp - 0x5c], 0x4d0045
mov edx, 0x30
mov dword [ebp - 0x58], 0x43005c
sub esi, eax
mov dword [ebp - 0x54], 0x720075
mov dword [ebp - 0x50], 0x650072
mov dword [ebp - 0x4c], 0x74006e
mov dword [ebp - 0x48], 0x6f0043
mov dword [ebp - 0x44], 0x74006e
mov dword [ebp - 0x40], 0x6f0072
mov dword [ebp - 0x3c], 0x53006c
mov dword [ebp - 0x38], 0x740065
mov dword [ebp - 0x34], 0x53005c
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x690076
mov dword [ebp - 0x28], 0x650063
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x730025
mov dword [ebp - 0x1c], 0x50005c
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x6d0061
mov dword [ebp - 0x10], 0x740065
mov dword [ebp - 0xc], 0x720065
mov dword [ebp - 8], 0x73
nop word [eax + eax]
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x40a8ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x40a8ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40a8d0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
Function at 0x40ab40
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x551400
push 0x4ef480
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x55f3a4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x44], edx
mov eax, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], edi
mov dword [eax], edi
mov dword [edx], edi
lea eax, [ebp - 0x2c]
push eax
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x40abb6
cmp dword [ebp - 0x2c], edi
je 0x40abb6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40abee
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3f0
jne 0x40acd0
lea eax, [ebp - 0x2c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40acd0
cmp dword [ebp - 0x2c], 0
je 0x40acd0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 2
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call ebx
test eax, eax
jne 0x40acd0
cmp dword [ebp - 0x30], eax
jbe 0x40acd0
call esi
cmp eax, 0x7a
jne 0x40acd0
push dword [ebp - 0x30]
call fcn.004f7f01
add esp, 4
mov edi, eax
mov dword [ebp - 0x38], edi
test edi, edi
je 0x40acd0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
push edi
push 2
push dword [ebp - 0x2c]
call ebx
test eax, eax
je 0x40acd0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jne 0x40acd0
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40acd0
cmp dword [ebp - 0x34], 0
je 0x40acd0
xor esi, esi
mov dword [ebp - 0x3c], esi
cmp esi, dword [edi]
jae 0x40acd0
lea ebx, [edi + esi*8]
push dword [ebp - 0x34]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40acb9
inc esi
jmp 0x40ac9c
mov eax, dword [ebp - 0x40]
mov dword [eax], 1
mov eax, dword [ebx + 8]
shr eax, 2
and eax, 1
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0040acfb
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004af60c
mov esp, ebp
pop ebp
ret
Function at 0x40f000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], ecx
xor esi, esi
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x78]
mov eax, dword [edi + ebx + 0x20]
add edi, ebx
add eax, ebx
mov dword [ebp - 0xc], eax
mov edx, dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
add edx, ebx
add ecx, ebx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
cmp dword [edi + 0x18], esi
jbe 0x40f078
nop dword [eax + eax]
mov ecx, dword [eax + esi*4]
movzx eax, word [edx + esi*2]
add ecx, ebx
mov edx, dword [ebp - 4]
push dword [ebp - 8]
push ecx
mov eax, dword [edx + eax*4]
xor edx, edx
add eax, ebx
mov dword [ebp - 0x14], eax
adc edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
call fcn.0050643c
add esp, 8
test eax, eax
je 0x40f083
mov eax, dword [ebp - 0xc]
inc esi
mov edx, dword [ebp - 0x10]
cmp esi, dword [edi + 0x18]
jb 0x40f040
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret