joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414051
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [0x443de8], 1
call edi
mov si, ax
and esi, 0x3ff
call edi
push 7
pop ecx
shr ax, 0xa
cmp si, cx
jne 0x414088
and dword [0x443de8], 0
jmp 0x4142c8
cmp si, 0xc
jne 0x41409d
mov dword [0x443de8], 2
jmp 0x4142c8
cmp si, 0x10
jne 0x4140b2
mov dword [0x443de8], 3
jmp 0x4142c8
cmp si, 0x15
jne 0x4140c7
mov dword [0x443de8], 4
jmp 0x4142c8
cmp si, 0x12
jne 0x4140dc
mov dword [0x443de8], 5
jmp 0x4142c8
cmp si, 4
jne 0x414105
cmp ax, 1
mov dword [0x443de8], 6
jne 0x4142c8
mov dword [0x443de8], 0xe
jmp 0x4142c8
cmp si, 5
jne 0x414116
mov dword [0x443de8], ecx
jmp 0x4142c8
cmp si, 0x19
jne 0x41412b
mov dword [0x443de8], 8
jmp 0x4142c8
push 0x16
pop edi
cmp si, di
jne 0x414142
mov dword [0x443de8], 0x25
jmp 0x4142c8
cmp si, 0x1d
jne 0x414157
mov dword [0x443de8], 0xa
jmp 0x4142c8
push 0x13
pop edx
cmp si, dx
jne 0x41416e
mov dword [0x443de8], 0xb
jmp 0x4142c8
cmp si, 0xb
jne 0x414183
mov dword [0x443de8], 0xc
jmp 0x4142c8
cmp si, 0xa
jne 0x4141ac
cmp ax, 8
mov dword [0x443de8], 0xd
jne 0x4142c8
mov dword [0x443de8], 0x24
jmp 0x4142c8
push 0x14
pop eax
cmp si, ax
jne 0x4141c3
mov dword [0x443de8], 0xf
jmp 0x4142c8
cmp si, 0xe
jne 0x4141d8
mov dword [0x443de8], 0x10
jmp 0x4142c8
cmp si, 8
jne 0x4141ed
mov dword [0x443de8], 0x11
jmp 0x4142c8
cmp si, 0x1f
jne 0x414202
mov dword [0x443de8], 0x12
jmp 0x4142c8
push 0x1a
pop ecx
cmp si, cx
jne 0x414215
mov dword [0x443de8], edx
jmp 0x4142c8
cmp si, 0x11
je 0x4142c3
cmp si, 6
jne 0x414234
mov dword [0x443de8], 0x15
jmp 0x4142c8
cmp si, 2
jne 0x414245
mov dword [0x443de8], edi
jmp 0x4142c8
push 0x22
pop eax
cmp si, ax
jne 0x414259
mov dword [0x443de8], 0x17
jmp 0x4142c8
cmp si, 3
jne 0x41426b
mov dword [0x443de8], 0x18
jmp 0x4142c8
cmp si, 0x24
je 0x41410b
cmp si, 0x3e
jne 0x414287
mov dword [0x443de8], 0x1b
jmp 0x4142c8
cmp si, 0x21
jne 0x414299
mov dword [0x443de8], 0x1c
jmp 0x4142c8
cmp si, 0x64
jne 0x4142ab
mov dword [0x443de8], 0x1d
jmp 0x4142c8
cmp si, 0x1b
jne 0x4142bd
mov dword [0x443de8], 0x1e
jmp 0x4142c8
cmp si, 0x1e
jne 0x4142c8
mov dword [0x443de8], eax
push dword [0x443de8]
push ecx
mov ecx, esp
push 0x444ca0
call fcn.00407038
push ecx
mov ecx, esp
push 0x4a7054
call fcn.004017a8
call fcn.00412490
add esp, 0xc
pop edi
pop esi
ret

Function at 0x4149fe
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x114
mov esi, 0x47f820
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x47f820], edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
call esi
mov eax, dword [0x47f824]
movzx edx, word [0x47f828]
movzx ecx, ax
shl ecx, 0x10
or ecx, edx
cmp eax, 5
mov dword [0x4a71b8], ecx
mov ecx, dword [0x4421a0]
mov dword [ebp - 4], ecx
jb 0x414a87
push 0x11c
mov edi, 0x47f700
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x47f700], 0x11c
push edi
call esi
mov eax, dword [0x47f704]
mov dword [0x47f824], eax
mov eax, dword [0x47f708]
mov dword [0x47f828], eax
lea ecx, [ebp - 4]
call fcn.004017ee
pop edi
pop esi
leave
ret
Function at 0x414f42
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x47ec38]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.RunGetPixelColor
lea ecx, [ebp - 4]
call fcn.0040181a
mov eax, dword [eax]
push 5
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004017ee
pop esi
leave
ret

Function at 0x415110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push edi
push str.powershell.exe
lea ecx, [ebp - 4]
call fcn.0040181a
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [0x47ec20]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x840], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x83c]
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x840]
push edx
push eax
mov dword [ebp - 0x3c], 0x200
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], str._UserProfile_
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x840]
push 0x2e
push eax
call sub.MSVCRT.dll_wcsrchr
pop ecx
pop ecx
pop edi
test eax, eax
je 0x415198
lea eax, [ebp - 0x840]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x18], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x24], 6
push eax
mov dword [ebp - 0x34], 0x4438bc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 4]
call fcn.004017ee
lea ecx, [ebp + 0xc]
call fcn.004017ee
leave
ret

Function at 0x415342
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push str.SoftwareMicrosoftWindows_DefenderWindows_Defender_Exploit_GuardControlled_Folder_AccessAllowedApplications
lea ecx, [ebp - 0x10]
call fcn.0040181a
lea eax, [ebp - 0x14]
xor esi, esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 1
push esi
push esi
push esi
push dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 8], esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x415381
mov edi, dword [ebp - 8]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 2
push eax
call fcn.004326d1
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xc], esi
lea ecx, [ebp - 4]
jne 0x4153d0
call fcn.004017ee
cmp edi, esi
je 0x4153cb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop esi
jmp 0x4153e0
call fcn.004017ee
cmp edi, esi
je 0x4153e0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
call fcn.004017ee
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x41604c
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x4a710c]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x416068
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x4a710c], edi
cmp dword [0x4a7104], edi
jne 0x416076
mov dword [0x4a6a98], edi
push dword [esi + 4]
mov ecx, 0x4a6c78
push dword [0x4a6a98]
call fcn.00431dc5
cmp dword [esp + 0xc], edi
je 0x4160aa
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push eax
push 0x4212c0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4a710c], eax
push 1
pop eax
pop edi
pop esi
ret 4

Function at 0x416853
Capabilities:
Find taskbar
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a6a88]
push ebx
cmp dword [0x443ec0], eax
mov ebx, ecx
mov ecx, dword [0x4a6a80]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 8], ecx
je 0x4168cf
imul ecx, ecx, 0x3e8
push 0x3f6
mov dword [0x443ec4], ecx
mov dword [0x443ec0], eax
push dword [ebx + 4]
call edi
mov ecx, dword [0x4a6a88]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call esi
push 0x3f5
push dword [ebx + 4]
call edi
mov ecx, dword [0x4a6a88]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call esi
mov eax, dword [0x4a6a88]
test eax, eax
je 0x4169f9
lea eax, [ebp - 0x10]
xor esi, esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x47f424]
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x47f420]
sub eax, edx
sub ecx, dword [ebp - 0x10]
cmp eax, 1
jg 0x416900
cmp eax, 0xffffffff
jge 0x416903
push 1
pop esi
cmp ecx, 1
jg 0x41690d
cmp ecx, 0xffffffff
jge 0x416910
push 1
pop esi
mov eax, dword [ebp - 0x10]
mov dword [0x47f424], edx
test esi, esi
mov dword [0x47f420], eax
jne 0x41697c
and dword [ebp - 4], esi
lea esi, [ebp - 0x210]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 4]
mov word [esi], ax
inc esi
inc esi
cmp dword [ebp - 4], 0xff
jl 0x41692b
lea eax, [ebp - 0x210]
push 0x1fe
mov esi, 0x47f428
push eax
push esi
call sub.MSVCRT.dll__memicmp
add esp, 0xc
test eax, eax
je 0x4169fe
lea eax, [ebp - 0x210]
push 0x1fe
push eax
push esi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
imul eax, eax, 0x3e8
mov dword [0x443ec4], eax
fild dword [0x443ec4]
fild dword [ebp - 8]
fmul dword [0x43ecf8]
fdivp st(1)
fmul dword [0x43ecf4]
call sub.MSVCRT.dll__ftol
mov esi, eax
cmp esi, dword [0x443ec8]
je 0x4169f6
push 0x3f5
mov dword [0x443ec8], esi
push dword [ebx + 4]
call edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push esi
push 0x402
push eax
call edi
cmp dword [0x443ec8], ebx
jne 0x4169f6
push ebx
push str.Shell_TrayWnd
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
push ebx
push 0x1a3
push 0x111
push eax
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
sub dword [0x443ec4], 0x14
jmp 0x41698a
Function at 0x416a07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [0x4a71c4], 0
jne 0x416afc
mov edx, dword [0x4a71c8]
mov dword [0x4a71c4], 1
test edx, edx
jne 0x416a4c
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, eax
test edx, edx
mov dword [0x4a71c8], edx
je 0x416afc
mov eax, dword [0x4a71cc]
test eax, eax
jne 0x416b01
mov ax, word [0x444f00]
push edi
push 0x3f
mov word [ebp - 0x100], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0xfe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
and byte [ebp - 0xf0], 0
lea eax, [ebp - 0x100]
push eax
push edx
mov byte [ebp - 0xff], 0x68
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x77
mov byte [ebp - 0xfc], 0x53
mov byte [ebp - 0xfb], 0x79
mov byte [ebp - 0xfa], 0x73
mov byte [ebp - 0xf9], 0x74
mov byte [ebp - 0xf8], 0x65
mov byte [ebp - 0xf7], 0x6d
mov byte [ebp - 0xf6], 0x43
mov byte [ebp - 0xf5], 0x75
mov byte [ebp - 0xf4], 0x72
mov byte [ebp - 0xf3], 0x73
mov byte [ebp - 0xf2], 0x6f
mov byte [ebp - 0xf1], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a71cc], eax
pop edi
jmp 0x416b01
mov eax, dword [0x4a71cc]
cmp dword [ebp + 0xc], 0
je 0x416b12
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
leave
ret
test eax, eax
je 0x416b1d
push dword [ebp + 8]
call eax
leave
ret
xor eax, eax
leave
ret
Function at 0x416b6c
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test byte [0x47f41c], 1
jne 0x416b8c
or byte [0x47f41c], 1
call sub.MSVCRT.dll_clock
mov dword [0x47f418], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call ebx
call dword [sym.imp.USER32.dll_GetCursor]
mov esi, dword [0x47f414]
mov edx, dword [0x47f410]
mov eax, esi
mov ecx, edx
sub eax, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
cmp eax, 1
jg 0x416bc6
cmp eax, 0xffffffff
jge 0x416bc9
push 1
pop edi
cmp ecx, 1
jg 0x416bd3
cmp ecx, 0xffffffff
jge 0x416bd6
push 1
pop edi
cmp dword [0x4a70b0], 0
je 0x416bec
cmp edx, dword [ebp - 0xc]
jne 0x416be9
cmp esi, dword [ebp - 8]
je 0x416bec
push 1
pop edi
cmp dword [0x4a71d0], 0
jne 0x416c08
call fcn.00416827
test eax, eax
je 0x416c08
call sub.MSVCRT.dll_clock
mov dword [0x47f418], eax
cmp dword [ebp + 0xc], 0x200
jbe 0x416c1a
cmp dword [ebp + 0xc], 0x20d
jbe 0x416c23
cmp dword [ebp + 0xc], 0x20a
jne 0x416c26
push 3
pop edi
test edi, edi
je 0x416c6b
cmp dword [0x4a71d0], 0
je 0x416c5f
push 1
call fcn.00416b21
mov eax, dword [ebp - 0xc]
and dword [0x4a71d0], 0
mov dword [0x47f628], eax
mov eax, dword [ebp - 8]
cmp edi, 3
pop ecx
mov dword [0x47f62c], eax
jne 0x416c5f
push 1
pop esi
jmp 0x416d83
call sub.MSVCRT.dll_clock
mov dword [0x47f418], eax
jmp 0x416c7f
cmp dword [0x4a71d0], 0
jne 0x416d4f
mov dword [ebp - 4], 1
cmp dword [0x4a71d0], 0
jne 0x416d4f
call fcn.00416827
test eax, eax
je 0x416d4f
call sub.MSVCRT.dll_clock
mov ecx, dword [0x443dc0]
imul ecx, ecx, 0x3e8
sub eax, ecx
mov dword [0x47f418], eax
call sub.MSVCRT.dll_clock
mov ecx, dword [0x443dc0]
sub eax, dword [0x47f418]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jle 0x416cf4
lea eax, [ebp - 0xc]
push eax
call ebx
push 0
call fcn.00416b21
mov eax, dword [ebp - 0xc]
pop ecx
mov dword [0x47f410], eax
mov eax, dword [ebp - 8]
mov dword [0x4a71d0], 1
mov dword [0x47f414], eax
call sub.MSVCRT.dll_clock
mov ecx, dword [0x443dc0]
sub eax, dword [0x47f418]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jg 0x416d48
sub ecx, eax
mov dword [ebp + 0xc], ecx
jns 0x416d1a
and dword [ebp + 0xc], 0
fild dword [ebp + 0xc]
push 0
fmul qword [0x43ece0]
call sub.MSVCRT.dll__ftol
push eax
push 0x402
push 0x3f3
push dword [0x4a70b8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
mov dword [0x47f410], eax
mov eax, dword [ebp - 8]
mov dword [0x47f414], eax
je 0x416cf4
cmp dword [0x4a71d0], 0
jne 0x416cf4
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
mov edi, 0x8000
test edi, eax
je 0x416d91
xor esi, esi
call sub.MSVCRT.dll_clock
mov dword [0x47f418], eax
mov eax, esi
jmp 0x416d4a
push 4
call esi
test edi, eax
jne 0x416dae
push 2
call esi
test edi, eax
jne 0x416dae
cmp dword [ebp + 0xc], 0x20a
jne 0x416cb1
call sub.MSVCRT.dll_clock
mov dword [0x47f418], eax
jmp 0x416d48
Function at 0x417387
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x443ecc]
cmp eax, 0xffffffff
jne 0x417448
and dword [0x443ecc], 0
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
mov eax, dword [0x4421a0]
cmp dword [ebp - 0x114], 5
mov dword [ebp - 4], eax
jb 0x417424
push 0x11c
lea eax, [ebp - 0x234]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x11c
push eax
call esi
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x114], 6
jb 0x417437
mov dword [0x443ecc], 1
mov esi, dword [0x443ecc]
lea ecx, [ebp - 4]
call fcn.004017ee
mov eax, esi
pop esi
leave
ret
Function at 0x41744a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push ebx
push esi
push edi
push 0xd
pop ecx
mov esi, str.shell32.dll_Control_RunDLL
lea edi, [ebp - 0x240]
push 0x72
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [ebp + 0xc]
cmp ax, 0x80d8
jne 0x4174af
push str._sysdm.cpl__3
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 5
lea eax, [ebp - 0x240]
push 0
push eax
push str.rundll32.exe
push str.open
push 0
jmp 0x417586
cmp ax, 0x80d9
jne 0x4174c5
xor eax, eax
push 5
push eax
push eax
push str.taskmgr.exe
jmp 0x417580
cmp ax, 0x80da
jne 0x41755f
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0xf003f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x3c
mov ebx, eax
pop edi
lea eax, [ebp - 0x40]
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x40], edi
push str.rundll32.exe
call fcn.00407038
push esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x3c], esi
call fcn.00401b61
cmp ebx, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], str._netplwiz.dll_UsersRunDll
je 0x417548
call fcn.00417387
test eax, eax
je 0x417548
mov dword [ebp - 0x34], 0x4438bc
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp + 0xc]
call fcn.004017ee
jmp 0x417665
cmp ax, 0x80db
jne 0x41756f
push str._desk.cpl__3
jmp 0x417486
cmp ax, 0x80dc
jne 0x417591
xor eax, eax
push 5
push eax
push eax
push str.msinfo32.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x417665
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp ax, 0x80dd
mov edi, str.open
jne 0x4175cb
lea eax, [ebp - 0x240]
push str._desk.cpl__0
push eax
call ebx
push 5
lea eax, [ebp - 0x240]
push 0
push eax
push str.rundll32.exe
push edi
push 0
call esi
cmp word [ebp + 0xc], 0xd17e
jne 0x4175f6
lea eax, [ebp - 0x240]
push str._desk.cpl___desktop
push eax
call ebx
push 5
lea eax, [ebp - 0x240]
push 0
push eax
push str.rundll32.exe
push edi
push 0
call esi
cmp word [ebp + 0xc], 0xd180
jne 0x417621
lea eax, [ebp - 0x240]
push str._desk.cpl__2
push eax
call ebx
push 5
lea eax, [ebp - 0x240]
push 0
push eax
push str.rundll32.exe
push edi
push 0
call esi
cmp word [ebp + 0xc], 0xd181
jne 0x41764e
lea eax, [ebp - 0x240]
push str._desk.cpl__1
push eax
call ebx
xor ebx, ebx
push 5
lea eax, [ebp - 0x240]
push ebx
push eax
push str.rundll32.exe
push edi
push ebx
call esi
jmp 0x417650
xor ebx, ebx
cmp word [ebp + 0xc], 0xd182
jne 0x417665
push 5
push ebx
push ebx
push str.dpiscaling
push edi
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x419e3c
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [ecx + 0xa78], 3
jne 0x419e63
mov ecx, dword [ebp + 8]
push 0x47eaf4
call fcn.0040181a
mov eax, dword [ebp + 8]
jmp 0x41a004
mov eax, dword [0x4421a0]
and word [ebp - 0x218], 0
push esi
push edi
push 0x7f
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x216]
mov esi, pe_nt_image_headers32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x218]
test eax, eax
jne 0x419eb7
xor eax, eax
jmp 0x419ec0
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0xc]
call fcn.004018df
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x218]
test eax, eax
je 0x419ef7
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004018df
cmp dword [0x4a7144], 0
mov esi, 0x442920
je 0x419f39
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push esi
push eax
call fcn.00408d6d
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00401acd
lea ecx, [ebp - 8]
call fcn.004017ee
cmp dword [0x4a7148], 0
mov edi, 0x4453c0
je 0x419f82
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x14]
push 0x4453b8
push eax
call fcn.00408d6d
push eax
lea eax, [ebp - 8]
push eax
call fcn.00401a81
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00401acd
lea ecx, [ebp - 8]
call fcn.004017ee
lea ecx, [ebp - 0x14]
call fcn.004017ee
cmp dword [0x4a714c], 0
je 0x419fc2
push edi
push 0x4a6c34
lea eax, [ebp - 8]
push 0x4453ac
push eax
call fcn.00408d6d
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401a81
push eax
lea ecx, [ebp - 4]
call fcn.00401b49
lea ecx, [ebp - 0x14]
call fcn.004017ee
lea ecx, [ebp - 8]
call fcn.004017ee
mov edi, 0x442918
push esi
push edi
lea ecx, [ebp - 4]
call fcn.00401c27
push esi
push edi
lea ecx, [ebp - 4]
call fcn.00401c27
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004017a8
lea ecx, [ebp - 0x10]
call fcn.004017ee
lea ecx, [ebp - 0xc]
call fcn.004017ee
lea ecx, [ebp - 4]
call fcn.004017ee
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 4
Function at 0x41bb56
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
push ebx
sub eax, 0x202
push edi
mov ebx, ecx
je 0x41bccc
sub eax, 3
jne 0x41bce3
lea eax, [ebp - 0x1c]
push esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp + 0x10], eax
lea eax, [ebp - 8]
push 0x69e1
push eax
call fcn.00428fb5
pop ecx
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
pop ecx
xor edi, edi
push dword [eax]
push 0x2b66
push edi
push dword [ebp + 0x10]
call esi
lea ecx, [ebp - 8]
call fcn.004017ee
push edi
push edi
push 0x801
push dword [ebp + 0x10]
call esi
lea eax, [ebp - 0xc]
push 0x5dc2
push eax
call fcn.00428fb5
pop ecx
pop ecx
push dword [eax]
push 0x2b67
push edi
push dword [ebp + 0x10]
call esi
lea ecx, [ebp - 0xc]
call fcn.004017ee
lea eax, [ebp - 0x10]
push 0x69dd
push eax
call fcn.00428fb5
pop ecx
pop ecx
push dword [eax]
push 0x2b68
push edi
push dword [ebp + 0x10]
call esi
lea ecx, [ebp - 0x10]
call fcn.004017ee
lea eax, [ebp - 0x14]
push 0x69de
push eax
call fcn.00428fb5
pop ecx
pop ecx
push dword [eax]
push 0x2b69
push edi
push dword [ebp + 0x10]
call esi
lea ecx, [ebp - 0x14]
call fcn.004017ee
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebx + 4]
push esi
push dword [ebp - 0x1c]
call fcn.00423bcb
pop ecx
pop ecx
push edi
push ebx
push edi
push esi
push eax
push 0x108
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x2b67
mov dword [ebp - 4], eax
mov ebx, str.open
jne 0x41bc8b
push 5
push edi
push edi
push str.taskmgr.exe
push ebx
push edi
call esi
cmp dword [ebp - 4], 0x2b68
jne 0x41bca1
push 5
push edi
push edi
push str.perfmon.exe
push ebx
push edi
call esi
cmp dword [ebp - 4], 0x2b69
jne 0x41bcbb
push 5
push edi
push str._res
push str.perfmon.exe
push ebx
push edi
call esi
cmp dword [ebp + 0x10], edi
pop esi
je 0x41bce3
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x41bce3
xor edi, edi
push 5
push edi
push edi
push str.taskmgr.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
pop eax
pop edi
pop ebx
leave
ret 0x10