joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407e62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407e69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407e58
mov eax, 1
add ebx, ebx
jne 0x407e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407e70
jne 0x407e8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407e70
xor ecx, ecx
sub eax, 3
jb 0x407ea0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407f12
mov ebp, eax
add ebx, ebx
jne 0x407eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407eb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407edc
inc ecx
add ebx, ebx
jne 0x407ec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ebd
jne 0x407ed9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ebd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407efc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407eed
jmp 0x407e5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407efc
add edi, ecx
jmp 0x407e5e
pop esi
mov edi, esi
mov ecx, 0x59
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407f1a
cmp byte [edi], 0
jne 0x407f1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x407f1f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407f8e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x81dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x82a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407f4c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x82ac]
or eax, eax
je 0x407f88
mov dword [ebx], eax
add ebx, 4
jmp 0x407f69
call dword [esi + 0x82a8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x407fbf
cmp al, 0xef
ja 0x407fb2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x407f94
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x407fa1
mov ebp, dword [esi + 0x82b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407ff3
sub esp, 0xffffff80
jmp 0x4012a8
Function at 0x404af2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x477084]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [esp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.00404d62
mov ebx, eax
cmp ebx, esi
je 0x404b54
cmp dword [esp + 0x10], esi
je 0x404b50
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x404bca
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x404b72
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00404af2
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x404be1
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x404b5c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], esi
je 0x404bad
push dword [esp + 0x10]
call ebx
mov dword [esp + 0x10], esi
push dword [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.00404a84
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x404bc8
push dword [esp + 0x10]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00410b60
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x10], esi
je 0x404bf1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
jmp 0x404bca

Function at 0x404bff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x404c0d
push 0xd
pop eax
jmp 0x404c30
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 1
push 0
jmp loc.00488578
pop ebp
ret 0xc
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403b2f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.00403d35
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407830
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403bf0
push esi
inc edi
push 0x5d
push edi
call fcn.00407830
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403bef
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407830
pop ecx
pop ecx
cmp eax, ebx
je 0x403bef
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403bb4
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403be6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403bdd
cmp eax, 2
je 0x403bdd
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403d35
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403d35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403d44
pop dword [ebp - 0x48]
mov eax, 0x1fe2500f
add eax, 0xe05ded35
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x43a271a5
add dword [ebp - 0x58], 0xaafd3a6
mov dword [ebp - 0x54], 0xb0950330
add dword [ebp - 0x54], 0x819e4915
mov dword [ebp - 0x50], 0x2cbd1b8f
add dword [ebp - 0x50], 0x1f8f289f
mov dword [ebp - 0x4c], 0x40104f33
add dword [ebp - 0x4c], 0xbfefb0cd
lea eax, [ebp - 0x58]
push eax
mov eax, 0xdeb09dd2
sub eax, 0xde6e6d5e
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xcdce662e
sub dword [ebp - 0x58], 0x595bfcd8
mov dword [ebp - 0x54], 0x26142bb5
add dword [ebp - 0x54], 0x1b5835c0
mov dword [ebp - 0x50], 0x26d8ae85
add dword [ebp - 0x50], 0x3c96bde7
mov dword [ebp - 0x4c], 0xfe2ff47
sub dword [ebp - 0x4c], 0xfe2ff47
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x443ab
push 0
call eax
mov ecx, 0x48adb411
add ecx, 0xb752ad58
xor edi, edi
add edi, eax
mov ebx, 0x626cd5c6
sub ebx, 0x622991c6
add ebx, dword [ebp - 0x48]
mov esi, 0xe4ae7b8d
xor dword [ebp - 0x24], 0xefc28d40
mov edx, dword [ebx]
sub dword [ebp - 0x3c], ecx
add edx, esi
mov dword [edi], edx
sub dword [ebp - 0x2c], 0xe6c08fa7
add edi, 0xd0fbdb86
sub edi, 0xd0fbdb82
add ebx, 4
loop 0x403e5d
add eax, 0xc958573d
sub eax, 0xc956dec6
mov ebx, eax
add eax, 0x717979e7
sub eax, 0x717979e2
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0xea1028
Capabilities:
Encode data using xor

Disassembly:
jmp 0xea1032
pushal
call 0xea1038
pop ebp
sub ebp, 0x10
sub ebp, 0xaa1028
jmp 0xea104e
mov eax, 0xaa1028
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0x32918c28
xor byte [eax], dl
inc eax
dec ecx
jne 0xea1065
jmp 0xea1078
mov dword [0x14a1a3e5], eax
sub byte [eax], ch
sub byte [ecx + 0x2828d0e9], ch
sub byte [ebx], ch
in eax, 0x90
sub eax, 0x92282828
add byte [eax], ch
sub byte [eax], ch
invalid

Function at 0x1001152
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push 0x104
lea eax, [ebp - 0x170]
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
call fcn.010010e4
cmp eax, 1
jl 0x100121b
push ebx
xor ebx, ebx
cmp byte [ebp - 0x170], bl
push esi
lea esi, [ebp - 0x170]
je 0x10011bb
cmp byte [esi], 0x3a
je 0x100119e
inc esi
cmp byte [esi], bl
jne 0x1001192
jmp 0x10011a1
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x10011bb
push 0x10010ac
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10011c1
lea esi, [ebp - 0x170]
push 0x29
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1001219
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x1001219
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x1001219
push ebx
lea eax, [ebp - 0x14]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor eax, eax
leave
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401029
or eax, 0xffffffff
jmp 0x40103c
mov edx, dword [ebp - 4]
and edx, 1
je 0x40103a
mov eax, 1
jmp 0x40103c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfffffc19
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
jle 0x4011a9
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401a70
add esp, 0xc
push 0
push 0x8000080
push 3
push 0
push 3
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40115d
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4011a9
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40118b
mov dword [ebp - 0xc], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4011a9
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 4]
je 0x40119c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x4011a9
cmp dword [ebp - 0x10], 0xffffffff
je 0x4011b9
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4011d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfffffc19
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x401289
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401233
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401289
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401261
mov dword [ebp - 0xc], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401289
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 4]
je 0x40127b
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401282
mov dword [ebp - 0xc], 0
jmp 0x401289
cmp dword [ebp - 0x10], 0xffffffff
je 0x401299
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4012b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfffffc19
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x40138e
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401313
mov dword [ebp - 0xc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x40138e
push 2
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40133a
mov dword [ebp - 0xc], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x40138e
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401366
mov dword [ebp - 0xc], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
je 0x401380
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x401387
mov dword [ebp - 0xc], 0
jmp 0x40138e
cmp dword [ebp - 0x10], 0xffffffff
je 0x40139e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x401a54
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4372c4]
jne 0x401a5e
repz ret
jmp fcn.00403cb6
Function at 0x40a030
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004049db
and dword [ebp - 4], 0
cmp dword [0x439338], 0
mov ebx, eax
jne 0x40a0e1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a192
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42c744
push edi
call esi
test eax, eax
je 0x40a192
push eax
call fcn.00404969
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439338], eax
call esi
push eax
call fcn.00404969
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43933c], eax
call esi
push eax
call fcn.00404969
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x439340], eax
call esi
push eax
call fcn.00404969
pop ecx
mov dword [0x439348], eax
test eax, eax
je 0x40a0e1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404969
pop ecx
mov dword [0x439344], eax
mov eax, dword [0x439344]
cmp eax, ebx
je 0x40a139
cmp dword [0x439348], ebx
je 0x40a139
push eax
call fcn.004049e4
push dword [0x439348]
mov esi, eax
call fcn.004049e4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a139
test edi, edi
je 0x40a139
call esi
test eax, eax
je 0x40a130
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a130
test byte [ebp - 0xc], 1
jne 0x40a139
or dword [ebp + 0x10], 0x200000
jmp 0x40a172
mov eax, dword [0x43933c]
cmp eax, ebx
je 0x40a172
push eax
call fcn.004049e4
pop ecx
test eax, eax
je 0x40a172
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a172
mov eax, dword [0x439340]
cmp eax, ebx
je 0x40a172
push eax
call fcn.004049e4
pop ecx
test eax, eax
je 0x40a172
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439338]
call fcn.004049e4
pop ecx
test eax, eax
je 0x40a192
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a194
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b4b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 1
jne 0x40b4d6
mov dword [ebp - 4], str.RootCIMV2
jmp 0x40b4dd
mov dword [ebp - 4], str.RootWMI
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x210], 0
jne 0x40b530
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40b530
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 1
je 0x40b530
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeEx_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
jmp 0x40b6a5
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x210], 0
jne 0x40b5a7
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40b59a
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0x80010119
je 0x40b59a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeSecurity_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
jmp 0x40b6a5
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x210], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x214], 0
jne 0x40b60b
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0x214
push ecx
push 0x42b45c
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x42b52c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40b60b
mov eax, dword [ebp - 0x18]
mov dword [eax], str._CoCreateInstance_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 3
jmp 0x40b6a5
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x218], 0
jne 0x40b69e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, 0x218
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x214]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x214]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xc]
call ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x20c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0
je 0x40b694
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._ConnectServer_Call_Error
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x218], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40b6a5
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x40b7e0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40b833
mov dword [ebp - 0x14], 0xffffffff
jmp 0x40b8fd
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x40b84e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x40b8f6
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x40b88c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x40b8f6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x40b8b4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x451328
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40b8db
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x451324]
shl eax, 8
add eax, 0x451428
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x451324]
add ecx, 1
mov dword [0x451324], ecx
cmp dword [ebp - 0x10], 0
je 0x40b8f1
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x40b845
jmp 0x40b8fd
cmp dword [ebp - 0x10], 0
je 0x40b90c
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x40b91b
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4