joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403630
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40366f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
mov dword [ecx], edx
mov eax, 1
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x403680
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
add eax, 1
ret

Function at 0x4038c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
call fcn.00403880
mov dword [0x441730], eax
lea eax, [esp + 8]
push eax
xor esi, esi
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x18]
cmp edx, 2
mov ecx, dword [esp + 0x10]
lea edi, [esi + 1]
jne 0x40392d
mov eax, dword [esp + 0xc]
cmp eax, 0xa
jb 0x403914
mov dword [0x441720], edi
cmp eax, 7
jb 0x403952
mov dword [0x441724], edi
mov dword [0x441728], edi
mov dword [0x44172c], edi
mov esi, edi
cmp dword [0x441720], 0
je 0x40399b
pop edi
mov eax, 0x400
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp eax, 6
jne 0x403973
cmp ecx, 3
jb 0x403962
mov dword [0x441724], edi
cmp ecx, 2
jb 0x40396d
mov dword [0x441728], edi
cmp ecx, edi
jb 0x40392b
jmp 0x403925
cmp eax, 5
jne 0x40392d
cmp dword [esp + 0x10], edi
pop edi
sbb eax, eax
and eax, 0xfffffff8
add eax, 0x10
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp dword [0x441724], 0
je 0x4039c0
pop edi
mov eax, 0x200
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp dword [0x441728], 0
je 0x4039e5
pop edi
mov eax, 0x100
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp dword [0x44172c], 0
je 0x403a0a
pop edi
mov eax, 0x80
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
test esi, esi
je 0x403a2a
pop edi
mov eax, 0x20
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp edx, edi
jne 0x403a9c
cmp ecx, 0x5a
jne 0x403a4d
pop edi
lea eax, [ecx - 0x56]
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp ecx, 0xa
jne 0x403a9c
mov eax, dword [esp + 0x14]
and eax, 0xffff
cmp eax, 0x8ae
jb 0x403a7c
pop edi
lea eax, [ecx - 8]
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
cmp eax, 0x7c4
jne 0x403a9c
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00411168
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00411168
add esp, 0x98
ret
Function at 0x403af0
Capabilities:
Get session information

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 8
push 0xffffffffffffffff
push 0
mov dword [esp + 0x14], 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x403b2e
mov eax, dword [esp]
push esi
mov esi, dword [eax]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
pop esi
jne 0x403b2e
mov eax, 1
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x403ba0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x104], eax
cmp dword [esp + 0x110], 0
push esi
mov esi, dword [esp + 0x110]
je 0x403c10
push esi
call fcn.00403b70
add esp, 4
test eax, eax
je 0x403c10
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00411180
push esi
push str.__s_
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.00411069
mov edx, dword [esp + 0x134]
add esp, 0x1c
push edx
lea eax, [esp + 8]
push eax
jmp 0x403c19
mov ecx, dword [esp + 0x118]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x108]
cmp eax, 0x20
sbb eax, eax
pop esi
xor ecx, esp
add eax, 1
call fcn.00411168
add esp, 0x108
ret

Function at 0x403cb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00411180
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x58], 5
mov dword [esp + 0x30], str.Winsta0Default
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x14], eax
call fcn.00403c40
add esp, 0x10
test eax, eax
je 0x403d95
mov edx, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push edx
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], edi
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x403d23
mov dword [esp + 8], edi
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push 0
push eax
push 0x410
push 0
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x403d78
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x403d67
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x403d73
push eax
call esi
mov edi, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x403d86
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, dword [esp + 0xc]
push eax
call esi
mov eax, edi
pop edi
pop esi
add esp, 0x5c
ret
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push 1
push ecx
push edx
call fcn.00403ba0
add esp, 0xc
add esp, 0x5c
ret
Function at 0x404870
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x318], eax
mov ecx, dword [esp + 0x324]
mov eax, dword [esp + 0x320]
push edi
lea edx, [esp + 0xc]
push edx
push 0x4417c0
lea edx, [esp + 0x10]
push edx
push 0
push ecx
mov edi, 0x104
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4048d1
xor eax, eax
pop edi
mov ecx, dword [esp + 0x318]
xor ecx, esp
call fcn.00411168
add esp, 0x31c
ret
cmp dword [esp + 8], 4
jne 0x4048f6
mov eax, dword [0x4417c0]
push eax
push 0x4369f4
push edi
push 0x4417c0
call fcn.00411069
add esp, 0x10
jmp 0x404b0a
push ebx
push ebp
push esi
push 0x103
lea ecx, [esp + 0x21]
push 0
push ecx
mov byte [esp + 0x28], 0
call fcn.00411180
push 0x4417c0
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.004111fa
xor ebp, ebp
mov edx, 1
lea ebx, [esp + 0x34]
lea ecx, [ebp + 3]
lea eax, [esp + 0x36]
add esp, 0x18
sub ebx, edx
sub eax, ecx
mov esi, edi
mov dword [esp + 0x10], eax
mov edi, edi
mov al, byte [ebx + edx]
cmp al, 0x25
jne 0x40495f
cmp esi, 0x104
jne 0x404953
mov esi, ebp
jmp 0x404967
cmp edi, 0x104
jne 0x404967
mov edi, ebp
jmp 0x404967
test al, al
je 0x404a17
mov al, byte [esp + edx + 0x1c]
cmp al, 0x25
jne 0x404987
cmp esi, 0x104
jne 0x40497b
mov esi, edx
jmp 0x40498f
cmp edi, 0x104
jne 0x40498f
mov edi, edx
jmp 0x40498f
test al, al
je 0x404a17
mov eax, dword [esp + 0x10]
mov al, byte [eax + ecx]
cmp al, 0x25
jne 0x4049b4
cmp esi, 0x104
jne 0x4049a7
lea esi, [ecx - 1]
jmp 0x4049b8
cmp edi, 0x104
jne 0x4049b8
lea edi, [ecx - 1]
jmp 0x4049b8
test al, al
je 0x404a17
mov al, byte [esp + ecx + 0x1c]
cmp al, 0x25
jne 0x4049d8
cmp esi, 0x104
jne 0x4049cc
mov esi, ecx
jmp 0x4049dc
cmp edi, 0x104
jne 0x4049dc
mov edi, ecx
jmp 0x4049dc
test al, al
je 0x404a17
mov al, byte [esp + ebp + 0x20]
cmp al, 0x25
jne 0x4049fe
cmp esi, 0x104
jne 0x4049f1
lea esi, [ebp + 4]
jmp 0x404a02
cmp edi, 0x104
jne 0x404a02
lea edi, [ebp + 4]
jmp 0x404a02
test al, al
je 0x404a17
add edx, 5
add ebp, 5
add ecx, 5
cmp edx, 0x105
jl 0x404940
cmp esi, 0x104
je 0x404b07
cmp edi, 0x104
je 0x404b07
push 0x103
lea ecx, [esp + 0x125]
push 0
push ecx
mov byte [esp + 0x12c], 0
call fcn.00411180
mov edx, edi
sub edx, esi
sub edx, 1
push edx
lea eax, [esp + esi + 0x2d]
push eax
lea ecx, [esp + 0x134]
push 0x104
push ecx
call fcn.0041125f
push 0x103
lea edx, [esp + 0x245]
push 0
push edx
mov byte [esp + 0x24c], 0
call fcn.00411180
add esp, 0x28
push 0x104
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x128]
push 0x104
push eax
call fcn.0041125f
lea ecx, [esp + 0x234]
push ecx
lea edx, [esp + 0x134]
push 0x104
push edx
call fcn.00411ae8
lea eax, [esp + edi + 0x39]
push eax
lea ecx, [esp + 0x140]
push 0x104
push ecx
call fcn.00411ae8
lea edx, [esp + 0x148]
push edx
push 0x104
push 0x4417c0
call fcn.004111fa
add esp, 0x34
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x31c]
pop edi
xor ecx, esp
mov eax, 0x4417c0
call fcn.00411168
add esp, 0x31c
ret
Function at 0x404dd0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00404cf0
add esp, 4
test eax, eax
push 1
je 0x404df1
push 1
push esi
call fcn.00403ba0
add esp, 0xc
pop esi
ret
mov eax, dword [esp + 0x10]
push 0
push 0
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret

Function at 0x405e60
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00411180
add esp, 0xc
cmp dword [0x441730], 0
push 1
je 0x405ec1
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404b30
push eax
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.004111fa
add esp, 0x1c
jmp 0x405ed0
push 0x26
lea edx, [esp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.ElantechETDApi.dll
lea eax, [esp + 4]
push 0x104
push eax
call fcn.00411ae8
lea ecx, [esp + 0xc]
push ecx
call fcn.00403b70
mov ecx, dword [esp + 0x114]
add esp, 0x10
xor ecx, esp
call fcn.00411168
add esp, 0x108
ret

Function at 0x406a70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00411180
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.StlFspAPI32.dll
lea edx, [esp + 4]
push 0x104
push edx
call fcn.00411ae8
lea eax, [esp + 0xc]
push eax
call fcn.00403b70
mov ecx, dword [esp + 0x114]
add esp, 0x10
xor ecx, esp
call fcn.00411168
add esp, 0x108
ret

Function at 0x408fc0
Capabilities:
Create thread

Disassembly:
cmp dword [0x441c58], 0
jne 0x409000
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x441c58], eax
je 0x409000
push 0
push 0
push 0
push 0x408df0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x441c5c], eax
mov eax, 1
ret
xor eax, eax
ret
Function at 0x40b780
Capabilities:
Create thread

Disassembly:
cmp dword [0x441cb4], 0
jne 0x40b796
cmp dword [0x441cb8], 0
je 0x40b83c
cmp dword [esp + 4], 0
je 0x40b7e5
cmp dword [0x441ce8], 0
jne 0x40b83c
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x441ce8], eax
je 0x40b83c
cmp dword [0x441ce4], 0
jne 0x40b83c
push 0
push 0
push 0
push 0x40b5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x441ce4], eax
ret
mov eax, dword [0x441ce8]
test eax, eax
je 0x40b83c
cmp dword [0x441ce4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40b82e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x441ce4]
push 0x5dc
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x441ce4]
push ecx
call esi
mov eax, dword [0x441ce8]
mov dword [0x441ce4], 0
push eax
call esi
mov dword [0x441ce8], 0
pop esi
ret

Function at 0x40c830
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x208], eax
cmp dword [0x441f20], 0
je 0x40c867
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00411168
add esp, 0x20c
ret
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00411180
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x103
lea edx, [esp + 0x109]
push 0
push edx
mov byte [esp + 0x110], 0
call fcn.00411180
lea eax, [esp + 0xc]
push eax
push str._sPowrProf.dll
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.00411069
add esp, 0x1c
lea edx, [esp + 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x441f20], eax
je 0x40c9aa
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetSuspendState
push eax
call esi
mov dword [0x441f24], eax
mov eax, dword [0x441f20]
push str.IsPwrSuspendAllowed
push eax
call esi
mov ecx, dword [0x441f20]
push str.IsPwrHibernateAllowed
push ecx
mov dword [0x441f2c], eax
call esi
mov edx, dword [0x441f20]
push str.GetPwrCapabilities
push edx
mov dword [0x441f28], eax
call esi
mov dword [0x441f40], eax
mov eax, dword [0x441f20]
push str.CallNtPowerInformation
push eax
call esi
mov ecx, dword [0x441f20]
push str.PowerWriteDCValueIndex
push ecx
mov dword [0x441f4c], eax
call esi
mov edx, dword [0x441f20]
push str.PowerWriteACValueIndex
push edx
mov dword [0x441f30], eax
call esi
mov dword [0x441f34], eax
mov eax, dword [0x441f20]
push str.PowerSetActiveScheme
push eax
call esi
mov ecx, dword [0x441f20]
push str.PowerGetActiveScheme
push ecx
mov dword [0x441f38], eax
call esi
mov dword [0x441f3c], eax
mov eax, 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00411168
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.00411168
add esp, 0x20c
ret
Function at 0x40cb40
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40cba9
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x6000c
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret

Function at 0x40ce50
Capabilities:
Create thread

Disassembly:
cmp dword [0x441f24], 0
je 0x40ce8c
cmp dword [esp + 4], 0
mov eax, 0x40cd20
jne 0x40ce6a
mov eax, 0x40cd00
push 0
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40ce86
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x40f5a0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 0
je 0x40f61d
cmp dword [esp + 0xc], 0
push esi
mov esi, dword [esp + 8]
je 0x40f5be
push 0
push esi
call fcn.0040f2f0
add esp, 8
cmp dword [section..data], 0
je 0x40f617
cmp dword [0x441728], 0
je 0x40f602
push 0
push 0x20
call fcn.004034e0
add esp, 8
call fcn.00403ac0
test eax, eax
jne 0x40f600
push eax
push eax
push eax
push 0x40f150
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40f600
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
push 0xffffffffffffffff
push 0xf170
push 0x112
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
ret
pop esi
jmp fcn.0040ed60
cmp dword [esp + 0xc], 0
je 0x40f634
mov eax, dword [esp + 4]
push 1
push eax
call fcn.0040f2f0
add esp, 8
ret
cmp dword [section..data], 0
je 0x40f618
mov ecx, dword [esp + 4]
push 2
push 0xf170
push 0x112
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
ret

Function at 0x40f7b0
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
je 0x40f7fd
mov eax, dword [0x440174]
cmp eax, 2
jne 0x40f7de
push 0x104
push 0x4422e0
push 0x4377ac
call fcn.0040f460
add esp, 0xc
mov dword [0x440174], eax
cmp eax, 1
jne 0x40f86e
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push 0x4422e0
jmp 0x40f83c
mov eax, dword [0x440170]
cmp eax, 2
jne 0x40f823
push 0x104
push 0x4421d8
push 0x43779c
call fcn.0040f460
add esp, 0xc
mov dword [0x440170], eax
cmp eax, 1
jne 0x40f86e
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push 0x4421d8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f86e
push 0
push 0
push 1
lea eax, [esp + 0x14]
push eax
push esi
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x40f880
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
call fcn.0040ef40
add esp, 4
test eax, eax
je 0x40efea
mov ecx, dword [esp]
mov eax, dword [esp + 8]
and ecx, 1
cmp eax, ecx
jne 0x40efea
push eax
call fcn.0040ef80
add esp, 4
pop ecx
ret
xor eax, eax
pop ecx
ret
cmp dword [esp + 4], 0
jne 0x40f88c
call fcn.0040eff0
cmp dword [0x4421cc], 0
je 0x40f9c0
call fcn.0040f1d0
test eax, eax
je 0x40f9c0
push ebp
call fcn.0040f060
mov ebp, eax
cmp ebp, 2
je 0x40f9bf
test byte [0x4421c8], 1
je 0x40f905
xor eax, eax
cmp ebp, 1
setne al
push eax
call fcn.0040ef80
add esp, 4
test eax, eax
je 0x40f905
cmp ebp, 1
jne 0x40f905
call fcn.00403ac0
test eax, eax
jne 0x40f900
push eax
push eax
push eax
push 0x40f190
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40f905
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f905
call fcn.0040f0b0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
xor edi, edi
xor ebx, ebx
test byte [0x4421c8], 2
je 0x40f936
push 0x2004
call esi
test eax, eax
jne 0x40f92d
cmp ebp, 1
je 0x40f931
jmp 0x40f936
test ebp, ebp
jne 0x40f936
mov edi, 1
test byte [0x4421c8], 4
je 0x40f95a
push 0x2003
call esi
test eax, eax
jne 0x40f951
cmp ebp, 1
je 0x40f955
jmp 0x40f95a
test ebp, ebp
jne 0x40f95a
mov ebx, 1
test edi, edi
jne 0x40f962
test ebx, ebx
je 0x40f9bc
cmp dword [0x4422dc], 0
je 0x40f97a
cmp ebp, 1
jne 0x40f97a
push 0
call 0x40efc0
add esp, 4
test edi, edi
je 0x40f988
push 1
call fcn.0040f7b0
add esp, 4
test ebx, ebx
je 0x40f996
push 0
call fcn.0040f7b0
add esp, 4
test edi, edi
jne 0x40f99e
test ebx, ebx
je 0x40f9bc
cmp dword [0x4422dc], 0
je 0x40f9bc
test ebp, ebp
jne 0x40f9bc
pop edi
pop esi
pop ebx
pop ebp
mov dword [esp + 4], 1
jmp 0x40efc0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40f9d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
push esi
lea eax, [esp + 4]
push eax
push ecx
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE103180000
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push esi
push esi
push str.D3DOGL_EnableConsumerStereoSupport
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40fa27
test byte [esp + 0xc], 1
je 0x40fa27
lea esi, [eax + 1]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x40fa40
Capabilities:
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4401f0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00411180
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add esp, 0xc
cmp dword [0x441730], 0
push 0x104
je 0x40fa8e
lea ecx, [esp + 8]
push ecx
push str._windir_SysWOW64_nvstlink.exe
jmp 0x40fa98
lea edx, [esp + 8]
push edx
push str._windir_System32_nvstlink.exe
call esi
lea eax, [esp + 4]
push eax
call fcn.00403b70
add esp, 4
test eax, eax
je 0x40faee
cmp dword [esp + 0x110], 0
mov eax, str._enable
jne 0x40fabf
mov eax, str._disable
push 1
push 0
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00411168
add esp, 0x108
ret
push 0x104
lea edx, [esp + 8]
push edx
push str._ProgramFiles_NVIDIA_Corporation3D_Vision_nvstlink.exe
call esi
lea eax, [esp + 4]
push eax
call fcn.00403b70
add esp, 4
test eax, eax
jne 0x40faab
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00411168
add esp, 0x108
ret

Function at 0x410c30
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x442430
push 0x43a64c
push 1
push 0
push 0x43a71c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x410d18
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jge 0x410c78
cmp eax, 0x80010119
jne 0x410d18
push esi
push edi
push str.._rootwmi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x442434
push 0
push 0
push 0
push 0
push 0
mov esi, eax
mov eax, dword [0x442430]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push esi
push eax
call edx
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
pop edi
pop esi
jl 0x410d18
mov eax, dword [0x442434]
push eax
call fcn.00410980
add esp, 4
test eax, eax
je 0x410d18
call fcn.004105c0
test eax, eax
je 0x410d18
push 8
call fcn.004120be
add esp, 4
test eax, eax
je 0x410ced
mov dword [eax], vtable.CBrightnessObjectSink.0
mov dword [eax + 4], 1
jmp 0x410cef
xor eax, eax
mov ecx, dword [0x442434]
push eax
push ecx
mov dword [0x442438], eax
call fcn.004105f0
add esp, 8
test eax, eax
je 0x410d18
mov dword [0x442424], 1
mov eax, 1
ret
xor eax, eax
ret