joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408766
Capabilities:
Create process on windows

Disassembly:
push 0x94
mov eax, 0x410287
call fcn.0040ee58
mov esi, ecx
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_void_]
xor ebx, ebx
lea ecx, [ebp - 0x2c]
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const__]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::MakeLower_void_]
call fcn.0040be8e
test al, al
je 0x408822
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x2c]
call fcn.00408534
test eax, eax
je 0x408822
lea ecx, [ebp - 0x48]
call fcn.004086b3
test eax, eax
je 0x408822
push 0x44
pop edi
push edi
lea eax, [ebp - 0xa0]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - 0xa0], edi
xor eax, eax
lea edi, [ebp - 0x58]
add esp, 0xc
stosd dword es:[edi], eax
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xa0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.Cmmlib.dll_public:_wchar_t_const____thiscall_Cmm::CStringT_wchar_t_::operator_wchar_t_const__void_const]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x408810
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408822
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public_virtual:_void___thiscall_Cmm::CStringT_wchar_t_::destructor_void_]
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public_virtual:_void___thiscall_Cmm::CStringT_wchar_t_::destructor_void_]
call fcn.0040ee13
ret

Function at 0x409439
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], esi
mov ebx, edi
call dword [sym.imp.Cmmlib.dll_public:_int___thiscall_Cmm::CStringT_wchar_t_::IsEmpty_void_const]
test eax, eax
jne 0x409497
mov ecx, esi
call dword [sym.imp.Cmmlib.dll_public:_unsigned_int___thiscall_Cmm::CStringT_wchar_t_::length_void_const]
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea esi, [edi + 2]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040e044
pop ecx
mov ecx, dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.Cmmlib.dll_public:_wchar_t_const____thiscall_Cmm::CStringT_wchar_t_::c_str_void_const]
push eax
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor eax, eax
add esp, 0xc
mov dword [ebx + edi*2], eax
xor edi, edi
push 0x14
pop eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x12], edi
mov dword [ebp - 0xa], edi
mov dword [ebp - 0xe], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test ebx, ebx
je 0x4094cc
push ebx
call fcn.0040e03f
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a277
Capabilities:
Enumerate processes

Disassembly:
push 0x294
mov eax, 0x40ef25
call fcn.0040ee58
mov edi, ecx
mov esi, dword [edi]
push dword [esi + 4]
push edi
call fcn.00404782
xor ebx, ebx
mov dword [esi + 4], esi
push ebx
mov dword [esi], esi
mov dword [esi + 8], esi
push 2
mov dword [edi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a2b7
xor eax, eax
jmp 0x40a3ab
push 0x228
lea eax, [ebp - 0x284]
mov dword [ebp - 0x288], 0x22c
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x18], ebx
add esp, 0xc
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x288]
mov dword [ebp - 4], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40a391
mov ebx, dword [ebp - 0x270]
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x28c], ebx
push eax
mov ecx, edi
call fcn.00404ea3
mov eax, dword [ebp - 0x290]
cmp byte [eax + 0xd], 0
jne 0x40a332
cmp ebx, dword [eax + 0x10]
jb 0x40a332
cmp eax, dword [edi]
jne 0x40a334
xor ebx, ebx
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x30]
push eax
mov edx, ebx
call fcn.0040a13f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x28]
push eax
call fcn.00404117
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2a0]
mov ecx, edi
push eax
call fcn.00405259
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.004040b9
lea eax, [ebp - 0x288]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40a2fc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.004040b9
xor eax, eax
inc eax
call fcn.0040ee13
ret

Function at 0x40a60b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
test ecx, ecx
jne 0x40a61c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40a637
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40a637
mov edx, 0x410
xor ecx, ecx
and eax, edx
inc ecx
cmp eax, edx
cmove esi, ecx
mov eax, esi
pop esi
ret
Function at 0x40a63b
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x400
lea eax, [ebp - 0x408]
push edi
xor esi, esi
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [0x41e4fc], esi
je 0x40a67a
mov eax, dword [0x41c040]
jmp 0x40a726
push esi
push 0x1a
lea eax, [ebp - 0x408]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40a701
push 0x413720
lea eax, [ebp - 0x408]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x413724
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [ebp - 0x408]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._appsafecheck.txt
lea eax, [ebp - 0x408]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [ebp - 0x408]
push esi
push 0x80
push 4
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x41c038], eax
call fcn.004021a4
xor edi, edi
inc edi
test eax, eax
je 0x40a718
call fcn.0040a581
test eax, eax
je 0x40a718
mov esi, edi
mov dword [0x41c040], esi
mov eax, esi
mov dword [0x41e4fc], edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040db50
leave
ret

Function at 0x40a734
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x40a787
mov eax, dword [0x41c038]
cmp eax, 0xffffffff
je 0x40a787
push edi
xor edi, edi
push 2
push edi
push edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40a75f
sub ecx, edx
lea eax, [ebp - 4]
push edi
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push esi
push dword [0x41c038]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
jmp 0x40a789
xor eax, eax
pop esi
leave
ret
Function at 0x40a78c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, edx
push 0x250
push eax
mov dword [ebp - 0x25c], eax
mov ebx, ecx
lea eax, [ebp - 0x258]
or esi, 0xffffffff
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x268], eax
test ebx, ebx
je 0x40a94e
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x25c]
jne 0x40a7e1
sub ecx, edx
sar ecx, 1
je 0x40a94e
test edi, edi
je 0x40a94e
xor eax, eax
mov dword [edi], eax
call fcn.00402100
test eax, eax
jne 0x40a93f
call fcn.0040a63b
test eax, eax
je 0x40a93f
mov ecx, ebx
call fcn.0040a60b
test eax, eax
je 0x40a847
lea edx, [ebp - 0x268]
mov ecx, ebx
call fcn.0040abea
test eax, eax
jne 0x40a847
mov dword [edi], 1
jmp 0x40a93f
push 0xffffffffffffffff
push 0x415428
or edx, 0xffffffff
mov ecx, ebx
call fcn.0040a045
mov dword [ebp - 0x264], eax
pop ecx
pop ecx
test eax, eax
jne 0x40a86b
push 0xe
jmp 0x40a950
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x25c], esi
cmp esi, 0xffffffff
jne 0x40a897
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
jmp 0x40a934
test byte [ebp - 0x258], 0x10
je 0x40a90f
lea eax, [ebp - 0x22c]
push 0x414fb8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40a90f
lea eax, [ebp - 0x22c]
push 0x41542c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40a90f
lea eax, [ebp - 0x22c]
or edx, 0xffffffff
push 0xffffffffffffffff
push eax
mov ecx, ebx
call fcn.0040a045
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40a909
mov edx, edi
mov ecx, esi
call fcn.0040a78c
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x40a902
cmp dword [edi], eax
jne 0x40a927
mov ecx, esi
call fcn.0040a030
mov esi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40a897
jmp 0x40a934
mov ecx, esi
call fcn.0040a030
mov esi, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x264]
call fcn.0040a030
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x260]
jmp 0x40a951
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040db50
leave
ret
Function at 0x40ae6b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
xor esi, esi
lea eax, [ebp - 0x808]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x808]
push esi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40aee0
push 0x4136e4
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x80c]
mov dword [ebp - 0x80c], esi
lea ecx, [ebp - 0x808]
call fcn.0040a78c
test eax, eax
jne 0x40aee0
cmp dword [ebp - 0x80c], esi
jne 0x40aee3
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040db50
leave
ret
Function at 0x40b4d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x40b575
push 0x400
xor ebx, ebx
lea eax, [ebp - 0x404]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, ebx
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push dword [esi + 0x4155c0]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40b56d
lea ecx, [ebp - 0x404]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b52f
sub ecx, edx
je 0x40b56d
cmp byte [ebp + ecx - 0x405], 0x5c
jne 0x40b557
lea eax, [ecx - 1]
mov ecx, eax
cmp eax, 0x400
jae 0x40b58b
mov byte [ebp + eax - 0x404], bl
push ecx
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x40b586
add esi, 4
cmp esi, 8
jb 0x40b50c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040db50
leave
ret
xor eax, eax
inc eax
jmp 0x40b577
call fcn.0040e16e
int3

Function at 0x40b864
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0xc30], esi
je 0x40b896
cmp dword [edi + 0xc34], esi
je 0x40b896
xor eax, eax
inc eax
jmp 0x40b9c5
cmp dword [ebp + 8], esi
jne 0x40b8a2
xor eax, eax
jmp 0x40b9c5
push 0x410
lea eax, [ebp - 0x418]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
push dword [ebp + 8]
mov edx, 0x82
push ecx
lea ecx, [ebp - 0x418]
call fcn.0040b5ea
mov ebx, 0x104
lea ecx, [ebp - 0x418]
push 0x414afc
mov edx, ebx
call fcn.0040b591
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
test eax, eax
jne 0x40b90a
push str._CptShareAPIWrapper::Init__Failed_to_call_SetDllDirectory_to:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x410
lea eax, [ebp - 0x828]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea eax, [ebp - 0x418]
mov edx, 0x82
push eax
push ecx
lea ecx, [ebp - 0x828]
call fcn.0040b5ea
push str.ucrtbase.dll
mov edx, ebx
lea ecx, [ebp - 0x828]
call fcn.0040b591
push 8
push esi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push str.CptShare.dll
mov edx, ebx
lea ecx, [ebp - 0x418]
call fcn.0040b591
push ecx
lea ecx, [ebp - 0x418]
call fcn.0040b6a4
mov ecx, eax
lea eax, [edi + 0xc34]
mov dword [edi + 0xc30], ecx
mov dword [eax], esi
test ecx, ecx
je 0x40b9b4
push str.cpt_create_helper
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [edi + 0xc34]
test ebx, ebx
je 0x40b9b4
push eax
mov ecx, ebx
call dword [0x411670]
call ebx
pop ecx
lea eax, [edi + 0xc34]
cmp dword [edi + 0xc30], esi
je 0x40b9c3
cmp dword [eax], esi
je 0x40b9c3
xor esi, esi
inc esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040db50
leave
ret 8
Function at 0x40b9d6
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x40ba9a
mov ecx, esi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40b9fd
sub ecx, edx
sar ecx, 1
je 0x40ba9a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40ba9a
push 0x410
lea eax, [ebp - 0x414]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
push edi
push 0x411cf8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40ba8e
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40ba9a
lea esi, [ebp - 0x414]
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40ba9d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040db50
leave
ret 4
Function at 0x40bd30
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x410720
call fcn.0040ee58
push ecx
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const__]
xor ebx, ebx
lea ecx, [ebp - 0x2c]
push 0x414afc
mov dword [ebp - 4], ebx
call dword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____thiscall_Cmm::CStringT_wchar_t_::operator_wchar_t_const__]
push str.Installer.exe
lea ecx, [ebp - 0x64]
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_wchar_t_const__]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call dword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____thiscall_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const__]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call dword [sym.imp.Cmmlib.dll_public_virtual:_void___thiscall_Cmm::CStringT_wchar_t_::destructor_void_]
push str._upgrade
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_wchar_t_const__]
mov byte [ebp - 4], 2
call dword [sym.imp.Cmmlib.dll_public:_static_class_Cmm::CommandLine____cdecl_Cmm::CommandLine::ForCurrentProcess_void_]
mov esi, eax
test esi, esi
je 0x40bdb7
push str.___prevParam
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____thiscall_Cmm::CStringT_wchar_t_::operator_wchar_t_const__]
push esi
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____thiscall_Cmm::CStringT_wchar_t_::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
call fcn.004010d0
test eax, eax
jne 0x40bdd8
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public:_wchar_t_const____thiscall_Cmm::CStringT_wchar_t_::c_str_void_const]
push ebx
xor edx, edx
mov ecx, eax
call fcn.0040186b
pop ecx
test eax, eax
je 0x40bdff
push 1
push ebx
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public:_wchar_t_const____thiscall_Cmm::CStringT_wchar_t_::c_str_void_const]
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public:_wchar_t_const____thiscall_Cmm::CStringT_wchar_t_::operator_wchar_t_const__void_const]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
setg bl
lea ecx, [ebp - 0x48]
call dword [sym.imp.Cmmlib.dll_public_virtual:_void___thiscall_Cmm::CStringT_wchar_t_::destructor_void_]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public_virtual:_void___thiscall_Cmm::CStringT_wchar_t_::destructor_void_]
mov eax, ebx
call fcn.0040ee13
ret
Function at 0x40be19
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
mov word [ebp - 8], 0x500
push eax
mov esi, ecx
lea eax, [ebp - 0xc]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 0x220
push 0x20
push 2
push eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40be7e
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop esi
call fcn.0040db50
leave
ret

Function at 0x40be8e
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0xf01ff
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40bebb
xor al, al
jmp 0x40bf32
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0x12
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [ebp - 0xc], 3
jne 0x40bf01
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x13
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40bf10
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
jmp 0x40bf13
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40bf27
call fcn.0040be19
push dword [ebp - 4]
mov bl, al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
leave
ret
Function at 0x40bf35
Capabilities:
Encode data using xor

Disassembly:
push 0x28
mov eax, 0x41075e
call fcn.0040ee58
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], edi
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_void_]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.Cmmlib.dll_unsigned_char____cdecl_Cmm::base64Decode_class_Cmm::CStringT_wchar_t__const___unsigned_int__]
mov dword [ebp - 0x34], eax
pop ecx
pop ecx
test eax, eax
je 0x40bfbb
mov ecx, dword [ebp - 0x30]
test cl, 1
jne 0x40bfb3
xor esi, esi
mov bl, 1
mov edx, esi
test ecx, ecx
je 0x40bf92
xor byte [edx + eax], bl
inc bl
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, dword [ebp - 0x34]
cmp edx, ecx
jb 0x40bf82
shr ecx, 1
cmp word [eax + ecx*2 - 2], si
je 0x40bfa7
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.Cmmlib.dll_void___cdecl_Cmm::base64FreeDecodeBuffer_unsigned_char___]
jmp 0x40bfba
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_Cmm::CStringT_wchar_t_::assign_wchar_t_const__]
jmp 0x40bf9b
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const__]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.Cmmlib.dll_public_virtual:_void___thiscall_Cmm::CStringT_wchar_t_::destructor_void_]
mov eax, edi
call fcn.0040ee13
ret

Function at 0x40bfd8
Capabilities:
Get common file path

Disassembly:
push 0x424
mov eax, 0x4107b8
call fcn.0040ee58
mov esi, ecx
mov dword [ebp - 0x42c], esi
xor ebx, ebx
lea eax, [ebp - 0x424]
push 0x412
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x430], esi
push eax
mov dword [ebp - 0x428], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x424]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.system32msiexec.exe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, 0x415754
mov ecx, esi
push edi
call dword [sym.imp.Cmmlib.dll_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_wchar_t_const__]
lea eax, [ebp - 0x424]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
mov dword [ebp - 0x428], 1
call dword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____thiscall_Cmm::CStringT_wchar_t_::operator_wchar_t_const__]
push edi
mov ecx, esi
call dword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____thiscall_Cmm::CStringT_wchar_t_::operator_wchar_t_const__]
mov eax, esi
call fcn.0040ee13
ret