joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405848
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00405767
test eax, eax
je 0x4058c7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40589b
push 0x10020
lea eax, [esi + 0x230]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x40589f
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4058ca
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x40589b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040797f
leave
ret

Function at 0x40597c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0xc]
push esi
push edi
push eax
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x4214e0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4059d6
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push edi
push str.iLastSvcSuccess
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x230]
mov dword [ebp - 0x18], 0x405b40
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
cmp dword [esi + 0x454], edi
je 0x405a16
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x405a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x454], edi
cmp dword [esi + 0x454], edi
jne 0x405a1d
mov ecx, esi
call fcn.00405bdd
pop edi
pop esi
leave
ret

Function at 0x406594
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x104
push ebx
lea edi, [esi + 4]
mov dword [esi], vtable.CArmReport.0
push edi
call fcn.004095e0
add esp, 0xc
push edi
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4065e4
mov ebx, 0x104
mov ecx, edi
push str.Temp_
mov edx, ebx
call fcn.00403aa0
push str.ArmReport.ini
mov edx, ebx
mov ecx, edi
call fcn.00403aa0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4069d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea ebx, [ecx + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4069f3
push 3
pop eax
jmp 0x406a9b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406a03
push 2
jmp 0x4069ed
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x82
push 2
pop edx
add esi, esi
cmp esi, 0x821
jae 0x406a96
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040801f
lea ecx, [esi + esi]
mov dword [edi], eax
push ecx
push 0
push eax
call fcn.004095e0
add esp, 0x10
push ebx
push esi
push dword [edi]
push 0
push dword [ebp + 8]
push str.SESSION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 4], eax
test eax, eax
je 0x406a60
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x406a72
push dword [edi]
call fcn.00407990
and dword [edi], 0
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
je 0x406a8f
inc eax
push 2
pop edx
cmp esi, eax
jbe 0x406a10
cmp dword [edi], 0
je 0x406a96
push dword [edi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x406a96
xor eax, eax
jmp 0x406a99
mov eax, 0xe8
jmp 0x406a99
push 0xd
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x406b35
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x20019
push esi
xor ebx, ebx
mov dword [ebp - 0xc], esi
push 0x4214e0
inc ebx
mov dword [ebp - 0x14], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x427944], bl
mov dword [0x427948], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406bdb
push edi
push 4
pop edi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x422654
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406ba0
cmp dword [ebp - 0xc], ebx
je 0x406bc7
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.iLogLevelDev
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406bd1
cmp dword [ebp - 0x14], ebx
jne 0x406bd1
mov dword [0x427948], 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4070c3
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407108
push esi
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x407107
push 0xc00
mov ecx, esi
call dword [0x41b2b0]
call esi
pop esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004095e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x407145
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x421398
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040797f
leave
ret

Function at 0x4071dd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x20a
lea eax, [ebp - 0x41c]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.004095e0
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004095e0
add esp, 0x18
mov dword [ebp - 0x420], ebx
mov ecx, 0x105
mov dword [ebp - 0x428], ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x424], ebx
push ecx
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
push ecx
lea eax, [ebp - 0x41c]
push eax
push 0x42281c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edi, 0x104
test eax, eax
je 0x40727d
push 0xa
push edi
push esi
push dword [ebp - 0x420]
call fcn.0040cf72
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x407297
push str.thsnYaViMRAeBoda
mov edx, edi
mov ecx, esi
call fcn.00403aa0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040797f
leave
ret
Function at 0x40cd7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
test dword [edx + 0x3cfffffc], esp

Function at 0x40d07e
Capabilities:
Encode data using xor

Disassembly:
mov byte [ebp - 0x3f0], 0x9d
mov byte [ebp - 0x3ef], 0x94
mov byte [ebp - 0x3ee], 0xb0
mov byte [ebp - 0x3ed], 0xf1
call fcn.0040be16
xor dword [ecx], eax
shr dword [eax - 0x3fb7a73], 0xff
call dword [eax - 0x18]
ja 0x40d09a
invalid

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1cf03fce
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1952008e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x404f98
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.msvcrt.dll_getenv]
push edi
mov edi, 0x401a98
push edi
call esi
test eax, eax
pop ecx
je 0x404fc2
push edi
call esi
push eax
call dword [sym.imp.msvcrt.dll_atoi]
push eax
call sym.libusb0.dll_usb_set_debug
add esp, 0xc
pop edi
pop esi
jmp fcn.00404506
Function at 0x405564
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x40e13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp + 8]
push 5
and ecx, 0xff
pop edx
cmp ecx, edx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x21c], esi
jle 0x4055aa
mov ecx, edx
cmp dword [0x40e670], ecx
mov dword [ebp - 0x208], ecx
jge 0x4055c1
cmp ecx, 1
jne 0x40577e
push ebx
mov ebx, dword [ecx*4 + 0x40e020]
push edi
xor edi, edi
and dword [ebp - 0x218], edi
cmp ecx, edx
mov dword [ebp - 0x20c], ebx
mov ebx, eax
jle 0x4055e4
mov dword [ebp - 0x208], edx
test word [ebp + 8], 0x100
je 0x405618
push dword [ebp - 0x214]
lea eax, [ebp - 0x204]
push esi
mov esi, 0x1ff
push esi
push eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
add esp, 0x10
test eax, eax
jle 0x4056f7
mov edi, eax
jmp 0x4056f5
test eax, eax
je 0x405658
mov esi, dword [0x40e044]
jmp 0x40564e
test ebx, ebx
je 0x405658
cmp byte [ebx], 0
je 0x405654
push eax
push ebx
call dword [sym.imp.msvcrt.dll_strstr]
cmp eax, ebx
pop ecx
pop ecx
jne 0x40564b
mov eax, dword [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405640
sub eax, edx
add ebx, eax
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x405624
test ebx, ebx
jne 0x40565d
mov ebx, 0x401b08
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x40569f
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40566a
sub eax, edx
je 0x40569f
push ebx
push dword [ebp - 0x20c]
mov esi, 0x1ff
push dword [ebp - 0x210]
lea eax, [ebp - 0x204]
push 0x401afc
push esi
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x18
jmp 0x4056c1
push ebx
push dword [ebp - 0x210]
mov esi, 0x1ff
push 0x401af0
lea eax, [ebp - 0x204]
push esi
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x14
test eax, eax
jl 0x4056f9
push dword [ebp - 0x214]
mov ecx, esi
push dword [ebp - 0x21c]
sub ecx, eax
mov dword [ebp - 0x218], eax
mov edi, eax
push ecx
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
add esp, 0x10
test eax, eax
jle 0x4056f7
add edi, eax
test eax, eax
jge 0x4056fb
mov edi, esi
xor esi, esi
inc esi
cmp dword [ebp - 0x208], esi
mov byte [ebp + edi - 0x204], 0
jne 0x405731
push edi
lea eax, [ebp - 0x204]
push eax
push 0x40e678
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
mov byte [edi + 0x40e678], 0
mov dword [0x40e674], esi
mov eax, dword [0x40e66c]
test eax, eax
je 0x405761
push edi
lea ecx, [ebp - 0x204]
push ecx
push dword [ebp - 0x218]
push ebx
push dword [ebp - 0x20c]
push dword [ebp - 0x210]
push dword [ebp + 8]
call eax
add esp, 0x1c
test eax, eax
jne 0x40577c
mov eax, dword [ebp - 0x208]
cmp dword [0x40e670], eax
jl 0x40577c
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040bd71
leave
ret
Function at 0x40588d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x40e13c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x94
push esi
lea eax, [ebp - 0x98]
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x98], esi
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x98]
inc esi
push eax
mov dword [0x40e8e0], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40593c
push 2
pop eax
cmp dword [ebp - 0x88], eax
jne 0x40593c
cmp dword [ebp - 0x94], 5
jne 0x40591f
cmp dword [ebp - 0x90], 0
je 0x405937
cmp dword [ebp - 0x90], esi
jne 0x40590b
mov dword [0x40e8e0], 3
jmp 0x40593c
cmp dword [ebp - 0x90], eax
jne 0x40593c
mov dword [0x40e8e0], 4
jmp 0x40593c
cmp dword [ebp - 0x94], 6
jb 0x40593c
cmp dword [ebp - 0x8c], 0x1b58
sbb eax, eax
add eax, 6
mov dword [0x40e8e0], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040bd71
leave
ret

Function at 0x405b6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push edi
call fcn.0040946b
test eax, eax
je 0x405cac
push 0x401fe4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x40e8b0], eax
jne 0x405bad
push 0x401fc0
push 0x4012c4
push 0x401fa8
call fcn.00405833
add esp, 0xc
xor eax, eax
pop edi
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401f98
push eax
call esi
push 0x401f88
push dword [0x40e8b0]
mov dword [0x40e8bc], eax
call esi
push 0x401f70
push dword [0x40e8b0]
mov dword [0x40e8c0], eax
call esi
push 0x401f5c
push dword [0x40e8b0]
mov dword [0x40e8c4], eax
call esi
push 0x401f4c
push dword [0x40e8b0]
mov dword [0x40e8c8], eax
call esi
push 0x401f3c
push dword [0x40e8b0]
mov dword [0x40e8cc], eax
call esi
push 0x401f2c
push dword [0x40e8b0]
mov dword [0x40e8d0], eax
call esi
push 0x401f18
push dword [0x40e8b0]
mov dword [0x40e8d4], eax
call esi
push 0x401f08
push dword [0x40e8b0]
mov dword [0x40e8d8], eax
call esi
cmp dword [0x40e8bc], edi
mov dword [0x40e8dc], eax
pop esi
je 0x405c96
cmp dword [0x40e8c0], edi
je 0x405c96
cmp dword [0x40e8c4], edi
je 0x405c96
cmp dword [0x40e8c8], edi
je 0x405c96
cmp dword [0x40e8cc], edi
je 0x405c96
cmp dword [0x40e8d0], edi
je 0x405c96
cmp dword [0x40e8d4], edi
je 0x405c96
cmp dword [0x40e8d8], edi
je 0x405c96
cmp eax, edi
jne 0x405cac
push dword [0x40e8b0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x401ed4
jmp 0x405b97
xor eax, eax
inc eax
pop edi
ret
Function at 0x405fdb
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd4c
mov eax, dword [0x40e13c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xd48], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xe
pop ecx
push 0x1c
mov esi, 0x4021e8
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0xd40]
mov esi, 0x402178
lea edi, [ebp - 0xac]
push eax
mov dword [ebp - 0xd4c], ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xd40], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x406043
or eax, 0xffffffff
jmp 0x4061c8
cmp dword [ebp - 0xd3c], 5
jne 0x406106
cmp dword [ebp - 0xd38], 1
jb 0x406106
push 0x402170
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_fopen]
call ebx
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xd44], eax
je 0x40603b
mov edi, dword [sym.imp.msvcrt.dll_fgetws]
push eax
mov esi, 0x400
jmp 0x4060a5
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xcac]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x4060b8
push dword [ebp - 0xd44]
lea eax, [ebp - 0xcac]
push esi
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x406085
jmp 0x4060c2
mov dword [ebp - 0xd48], 1
push dword [ebp - 0xd44]
mov esi, dword [sym.imp.msvcrt.dll_fclose]
call esi
cmp dword [ebp - 0xd48], 0
pop ecx
jne 0x4061c6
push 0x40216c
push dword [ebp - 0xd4c]
call ebx
mov edi, eax
lea eax, [ebp - 0xac]
push edi
push eax
call dword [sym.imp.msvcrt.dll_fputws]
push edi
call esi
add esp, 0x14
jmp 0x4061c6
mov edi, dword [sym.imp.msvcrt.dll_fopen]
push 0x402168
push ebx
call edi
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xd44], eax
je 0x40603b
mov ebx, dword [sym.imp.msvcrt.dll_fgets]
push eax
mov esi, 0x400
jmp 0x40614f
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.msvcrt.dll_strstr]
test eax, eax
pop ecx
pop ecx
jne 0x406162
push dword [ebp - 0xd44]
lea eax, [ebp - 0x4ac]
push esi
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x406132
jmp 0x40616c
mov dword [ebp - 0xd48], 1
push dword [ebp - 0xd44]
mov ebx, dword [sym.imp.msvcrt.dll_fclose]
call ebx
cmp dword [ebp - 0xd48], 0
pop ecx
jne 0x4061c6
push 0x402164
push dword [ebp - 0xd4c]
call edi
mov esi, dword [sym.imp.msvcrt.dll_fputs]
push eax
mov edi, 0x402160
push edi
mov dword [ebp - 0xd44], eax
call esi
push dword [ebp - 0xd44]
lea eax, [ebp - 0x3c]
push eax
call esi
push dword [ebp - 0xd44]
push edi
call esi
push dword [ebp - 0xd44]
call ebx
add esp, 0x24
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd71
leave
ret
Function at 0x4061dc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x40e13c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push 6
push esi
push esi
push esi
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
push 0x402284
push 0x402270
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp ebx, 0xffffffff
jne 0x406248
push 0x402250
push 0x4012c4
push 0x402230
call fcn.00405833
add esp, 0xc
xor eax, eax
jmp 0x4062d9
lea eax, [ebp - 0x20]
push eax
push esi
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
push ebx
call esi
test eax, eax
je 0x4062cc
push edi
xor eax, eax
lea edi, [ebp - 0x148]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x148], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
je 0x4062b4
test word [ebp - 0x144], 0x180
je 0x4062b4
push 0x402220
push 0x4012c4
push 0x402230
call fcn.0040586f
add esp, 0xc
mov dword [ebp - 0x150], 1
inc dword [ebp - 0x14c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14c]
push ebx
call esi
test eax, eax
jne 0x40625b
pop edi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bd71
leave
ret

Function at 0x406a06
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40e13c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [0x40e8e0], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
jne 0x406a3b
call fcn.0040588d
cmp dword [0x40e8e0], 3
jg 0x406a49
xor eax, eax
inc eax
jmp 0x406a8e
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x406a8b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x406a82
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040bd71
leave
ret
Function at 0x4091fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40921d
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00408f2f
dec esp
pop ds
cmp dword [ecx], esp
lea eax, [ebp - 0x40]
push eax
call fcn.00408f3f
push eax
push esi
push dword [ebp + 8]
call fcn.00408ef4
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00408f2f
invalid

Function at 0x409e0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00408f0d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00408f3f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00408ef4
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00408f2f
invalid