joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4157d0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
test edi, edi
jne 0x415808
mov eax, 0x8000ffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00415730
test eax, eax
je 0x41587d
push 0x404b84
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4158cd
push 0x404b94
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4158cd
cmp dword [ebp + 8], 0
je 0x415854
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0x8000
push 0x402e2c
jmp 0x415867
lea edx, [ebp - 0x210]
push edx
push 0
push 0x8000
push 0x402e3c
call eax
mov esi, eax
test esi, esi
js 0x4158d2
mov eax, dword [ebp - 0x210]
push 0x404bb0
push eax
jmp 0x4158c2
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.0040d442
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x4158d2
push 0x404bb0
lea ecx, [ebp - 0x20c]
push ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x4158d2
mov esi, 0x8000ffff
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4158e3
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
Function at 0x415a90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push edi
push SysReAllocStringLen
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415acf
mov edi, 0x8000ffff
jmp 0x415bdd
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415b6d
mov edi, ebx
shr edi, 1
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420cf5
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x415b1b
push esi
mov edi, 0x8007000e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415bdc
xor ecx, ecx
push ecx
lea edx, [ebp - 0x10]
push edx
push ebx
push eax
push esi
mov word [eax + edi*2], cx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415b68
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x415b4f
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415bdc
call edi
mov edi, eax
and edi, 0xffff
push esi
or edi, 0x80070000
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415bdc
cmp ebx, dword [ebp - 0x10]
je 0x415b7b
push esi
mov edi, 0x8000ffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415bdc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
call fcn.00415c00
xor esi, esi
cmp eax, esi
jne 0x415bc0
jmp 0x415ba0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
mov dword [eax + 8], ecx
mov dword [ebp - 8], eax
push edx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
call fcn.00415c00
cmp eax, esi
je 0x415ba0
mov edi, eax
cmp eax, esi
jl 0x415bd0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
jmp 0x415bdc
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x415bdc
call fcn.00415df0
pop ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00420ceb
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x415ed0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push 0x206
mov esi, edx
push ecx
lea edx, [ebp - 0x20a]
push edx
mov dword [ebp - 0x214], eax
mov word [ebp - 0x20c], cx
call fcn.0040d442
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 0x210], 0
mov eax, 0x404c24
jne 0x415f2c
mov eax, 0x404c40
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x415f56
pop edi
mov eax, 0x8000ffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x415f3f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push 0
cmp eax, 0xb7
jne 0x415fb3
lea edx, [ebp - 0x210]
push edx
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415fce
cmp dword [ebp - 0x210], 4
je 0x41600a
mov esi, 0x8000ffff
jmp 0x415fdc
lea eax, [ebp - 0x210]
push eax
push 4
push esi
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x415fa3
call ebx
test eax, eax
jg 0x415ff8
call ebx
mov esi, eax
test esi, esi
jns 0x415fe3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
call ebx
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x415fd8
mov ecx, dword [ebp - 0x214]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
Function at 0x416ca0
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [ebp - 0x61a]
push ecx
mov word [ebp - 0x61c], ax
call fcn.0040d442
xor edx, edx
push 0x206
lea eax, [ebp - 0x20a]
push edx
push eax
mov word [ebp - 0x20c], dx
call fcn.0040d442
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x412]
push edx
mov word [ebp - 0x414], cx
call fcn.0040d442
add esp, 0x24
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
js 0x416df6
cmp byte [ebp + 8], 0
je 0x416d34
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 2
jmp 0x416d41
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x416df6
push edi
lea edx, [ebp - 0x414]
push 0x104
push edx
call fcn.00420d20
add esp, 0xc
test eax, eax
jne 0x416d89
push 0x404d30
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00420d20
add esp, 0xc
test eax, eax
je 0x416d90
mov esi, 0x80004005
jmp 0x416df6
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x416db6
mov esi, 0x8000ffff
jmp 0x416df6
lea edi, [ebp - 0x61c]
call fcn.00417fe0
mov esi, eax
test esi, esi
js 0x416df6
mov ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x416df6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x416de6
call esi
mov esi, eax
jmp 0x416df6
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
Function at 0x416e50
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0040d442
xor edx, edx
push 0x206
lea eax, [ebp - 0x412]
push edx
push eax
mov word [ebp - 0x414], dx
call fcn.0040d442
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.0040d442
add esp, 0x24
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x416ed8
mov esi, 0x8000ffff
test esi, esi
js 0x416f61
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x404d48
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 0x104
jae 0x416f4d
test eax, eax
je 0x416f4d
lea edx, [ebp - 0x20c]
push 0x5c
push edx
call fcn.0042063b
add esp, 8
test eax, eax
je 0x416f4d
lea edx, [ebp - 0x20c]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.0042063b
add esp, 8
test eax, eax
je 0x416f4d
push 0x404d64
lea edx, [ebp - 0x20c]
push edx
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x416f61
mov eax, 0x8000ffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret

Function at 0x4173b0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
xor edi, edi
push 0x38
lea eax, [ebp - 0x3c]
push edi
push eax
mov dword [ebp - 0x40], edi
call fcn.0040d442
add esp, 0xc
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x4173eb
push edi
mov esi, 0x8000ffff
call fcn.00420ceb
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea esi, [ebp - 4]
mov edx, ebx
call fcn.00415900
mov esi, eax
test esi, esi
js 0x41747a
push 0x208
call fcn.00420cf5
mov edi, eax
add esp, 4
test edi, edi
jne 0x417416
mov esi, 0x8007000e
jmp 0x41747a
call fcn.00416e50
mov esi, eax
test esi, esi
js 0x41747a
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x4500
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x4036a0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41747a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41746a
call esi
mov esi, eax
jmp 0x41747a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x417488
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
call eax
push edi
call fcn.00420ceb
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4174a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
mov edi, ecx
lea ecx, [ebp - 0xa2c]
push ecx
push 0
push 0
push 0x10
push 0
mov dword [ebp - 0xa30], edi
mov dword [ebp - 0xa34], eax
mov ebx, 2
call esi
test eax, eax
js 0x417614
lea edx, [ebp - 0x824]
push edx
push 0
push 0
push ebx
push 0
call esi
test eax, eax
js 0x417614
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00420751
add esp, 0xc
test eax, eax
je 0x417536
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esp, [esp]
push 0x404d30
lea ecx, [ebp - 0x20c]
push ecx
push 0x404d3c
mov eax, 0x104
lea edi, [ebp - 0x414]
call fcn.00417d80
add esp, 0xc
test eax, eax
js 0x41758c
mov edx, edi
push edx
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0x61c]
push ecx
call esi
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4175d8
push 0x404d30
lea eax, [ebp - 0x20c]
push eax
push 0x404d3c
mov eax, 0x104
lea edi, [ebp - 0x61c]
call fcn.00417d80
add esp, 0xc
test eax, eax
js 0x417602
mov ecx, edi
push ecx
lea edx, [ebp - 0xa2c]
push edx
lea eax, [ebp - 0x414]
push eax
call esi
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417602
mov edx, dword [ebp - 0xa30]
push ebx
push edx
push 0x404e2c
mov eax, 0x104
lea edi, [ebp - 0x20c]
call fcn.00417d80
add esp, 0xc
test eax, eax
js 0x417614
inc ebx
jmp 0x417540
mov eax, dword [ebp - 0xa34]
push eax
lea ebx, [ebp - 0x20c]
call fcn.00417df0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
Function at 0x417990
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x20c]
mov esi, 0x404e40
mov edx, ecx
push edi
xor eax, eax
mov edi, 0x104
sub esi, edx
lea ecx, [ecx]
movzx edx, word [esi + ecx]
test dx, dx
je 0x4179d4
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x4179c0
jmp 0x4179d8
test edi, edi
jne 0x4179e0
sub ecx, 2
mov eax, 0x8007007a
xor edx, edx
mov word [ecx], dx
test eax, eax
js 0x417aa5
mov edx, 0x104
lea eax, [ebp - 0x20c]
xor esi, esi
lea ebx, [ebx]
cmp word [eax], si
je 0x417a0d
add eax, 2
dec edx
jne 0x417a00
jmp 0x417a11
test edx, edx
jne 0x417a54
mov esi, 0x80070057
xor ecx, ecx
mov eax, esi
test esi, esi
js 0x417a36
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x20c]
mov edx, 0x404f68
call fcn.00417d20
test eax, eax
js 0x417aa5
mov edx, 0x104
lea eax, [ebp - 0x20c]
xor esi, esi
cmp word [eax], si
je 0x417a5d
add eax, 2
dec edx
jne 0x417a47
jmp 0x417a61
mov ecx, 0x104
sub ecx, edx
jmp 0x417a18
test edx, edx
jne 0x417ab7
mov esi, 0x80070057
xor ecx, ecx
test esi, esi
js 0x417aa3
mov edx, dword [ebp + 8]
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x20c]
call fcn.00417d20
mov esi, eax
test esi, esi
js 0x417aa3
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
mov eax, 0x8000ffff
jne 0x417aa5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x104
sub ecx, edx
jmp 0x417a68

Function at 0x417ad0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, esi
push edi
xor edi, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417ae0
sub eax, edx
sar eax, 1
xor ecx, ecx
add eax, 1
adc ecx, ecx
mov dword [ebp - 4], ecx
jne 0x417b11
cmp eax, 0xffffffff
ja 0x417b11
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
test ecx, ecx
jne 0x417b11
cmp eax, 0xffffffff
jbe 0x417b1d
mov eax, 0x8000ffff
pop edi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov eax, 0x8000ffff
jne 0x417b3c
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x4180b0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0040d442
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
xor esi, esi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x418140
cmp dword [ebp - 0x108], 2
jne 0x41812f
mov eax, dword [ebp - 0x114]
cmp eax, 6
jb 0x41812f
jne 0x41811b
cmp dword [ebp - 0x110], 1
sbb eax, eax
inc eax
je 0x41812f
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret

Function at 0x418160
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0040d442
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
xor esi, esi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4181de
cmp dword [ebp - 0x108], 2
jne 0x4181cd
cmp dword [ebp - 0x114], 6
jb 0x4181cd
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420627
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret

Function at 0x418e30
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x118]
push eax
mov esi, 1
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x124], 4
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x418ee1
cmp dword [ebp - 0x114], 6
jb 0x418ee1
lea ecx, [ebp - 0x11c]
push ecx
push 0x20019
push 0
push 0x4050f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418ee3
mov ecx, dword [ebp - 0x11c]
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push 0x405164
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x120], 0
jne 0x418ee3
xor esi, esi
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x418ef4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420627
mov esp, ebp
pop ebp
ret
Function at 0x418f10
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x418f72
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x10]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x418f68
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x418fcb
call fcn.00418e30
test eax, eax
je 0x418fc8
lea edx, [ebp - 0x14]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x418fc8
lea ecx, [ebp - 0x20]
push ecx
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x12
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x418fc8
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 3
mov eax, 1
je 0x418fcb
mov eax, dword [ebp - 0x10]
call fcn.00419fe0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00420627
mov esp, ebp
pop ebp
ret

Function at 0x418ff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20219
push 0
push 0x4034a0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419051
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp - 8]
push 0x4034e0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x419051
or eax, 0xffffffff
mov dword [ebp - 4], eax
jmp 0x419054
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x419065
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x419070
xor eax, eax
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x419079
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x419090
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 8]
push eax
push 0x20219
push 0
push 0x4034a0
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4190fe
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x403908
push eax
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
je 0x4190fe
or eax, 0xffffffff
mov dword [ebp - 4], eax
jmp 0x419101
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x419112
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x41911b
xor eax, eax
jmp 0x41912e
test eax, eax
je 0x41912e
cmp eax, 1
je 0x41912e
cmp eax, 2
je 0x41912e
mov eax, 2
lea ecx, [ebp - 8]
push ecx
push 0x20219
push 0
push 0x4034a0
push SysReAllocStringLen
mov edi, eax
mov dword [ebp - 4], 0xffffffff
call esi
test eax, eax
jne 0x41917c
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x403908
push ecx
mov dword [ebp - 0xc], 4
call ebx
test eax, eax
je 0x41917c
or eax, 0xffffffff
mov dword [ebp - 4], eax
jmp 0x41917f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x419190
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x419199
xor eax, eax
jmp 0x4191ac
test eax, eax
je 0x4191ac
cmp eax, 1
je 0x4191ac
cmp eax, 2
je 0x4191ac
mov eax, 2
cmp edi, eax
jbe 0x4191b2
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4191c0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x202
push 0
push 0
push 0
push 0x4034a0
push SysReAllocStringLen
mov dword [ebp - 8], 2
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419215
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x403908
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x419223
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret