joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4122b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
test eax, eax
push edi
mov edi, dword [esp + 0x1c]
mov dword [edi], 0
jbe 0x412345
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
add esi, 4
mov dword [esp + 0x10], eax
mov ebx, 4
lea ecx, [ecx]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esi - 4]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412325
cmp dword [esp + 0x28], ebx
jne 0x412325
cmp dword [esp + 0x24], 1
jne 0x412334
mov ecx, dword [esi]
mov eax, dword [edi]
or eax, ecx
jmp 0x412332
mov eax, dword [esi + 4]
test eax, eax
je 0x412334
mov edx, dword [esi]
mov eax, dword [edi]
or eax, edx
mov dword [edi], eax
mov eax, dword [esp + 0x10]
add esi, 0xc
dec eax
mov dword [esp + 0x10], eax
jne 0x4122e0
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x413200
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
push esi
mov esi, dword [ebx + 0xc]
push edi
mov dword [esp + 0xc], 0
call fcn.00412d40
mov esi, eax
test esi, esi
jne 0x41322f
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0xc]
lea eax, [esp + 0x10]
push eax
xor eax, eax
call fcn.00413000
add esp, 4
test eax, eax
jne 0x4132c1
mov edx, dword [ebx + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push edx
push eax
push eax
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00412e30
add esp, 0x24
test eax, eax
je 0x41327d
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push ecx
mov ecx, dword [ebx + 0x10]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4132b4
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00412d40
mov ebx, eax
test ebx, ebx
je 0x413457
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
xor eax, eax
mov ecx, esi
call fcn.00413000
add esp, 4
test eax, eax
jne 0x4134a6
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x413463
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x413499
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x413499
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4134b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
push esi
mov esi, dword [ebx + 0xc]
push edi
mov dword [esp + 8], 0
call fcn.00412d40
mov esi, eax
test esi, esi
jne 0x4134df
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
push ecx
call fcn.00413400
add esp, 8
test eax, eax
jne 0x4135ba
mov ecx, 0x41
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0xc]
push edx
call fcn.00413000
add esp, 4
test eax, eax
jne 0x4135ba
mov ecx, dword [ebx + 8]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push esi
call fcn.00412e30
add esp, 0x24
test eax, eax
je 0x413549
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
je 0x41356b
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push esi
lea ecx, [ebx + 4]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4135a0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4135b8
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413740
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00412d40
mov ebx, eax
test ebx, ebx
jne 0x413769
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
call fcn.00413400
add esp, 8
test eax, eax
jne 0x4137ed
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
xor eax, eax
mov ecx, esi
call fcn.00413000
add esp, 4
test eax, eax
jne 0x4137ed
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push 2
push eax
push eax
push eax
lea edx, [esp + 0x2c]
push edx
push ebx
call fcn.00412e30
add esp, 0x24
test eax, eax
jne 0x4137d4
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4137e0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413ba0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x31c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
lea ebx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, esi
sub ebx, esi
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x413bc7
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00413af0
add esp, 0x10
test eax, eax
jne 0x413cc0
lea edi, [esp + 0x10]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x413c10
mov dx, word [0x46d0a4]
lea eax, [esp + 0x118]
mov word [edi], dx
mov edx, eax
jmp 0x413c30
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413c30
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413c40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00413ba0
add esp, 4
test eax, eax
jne 0x413d7f
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x413c80
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x413c80
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x11c]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00413af0
add esp, 0x10
test eax, eax
je 0x413c05
mov esi, dword [ebp + 8]
call fcn.00412d40
mov esi, eax
test esi, esi
jne 0x413cd7
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x224]
mov ecx, edi
call fcn.00413000
add esp, 4
test eax, eax
jne 0x413d7f
push eax
push edi
call fcn.00413400
add esp, 8
test eax, eax
jne 0x413d7f
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push 2
push eax
push eax
push eax
lea edx, [esp + 0x134]
push edx
push esi
call fcn.00412e30
add esp, 0x24
test eax, eax
jne 0x413d66
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x220]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x413d72
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4167b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [esp + 0x28]
push str.Selected_
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
call fcn.00416270
mov eax, dword [ebp + 0xc]
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x416802
lea edi, [esp + 0x28]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416812
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
lea edx, [esp + 0x34]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [esp + 0x18]
jne 0x4168bd
test dword [esi + 0x28], 0x1000000
je 0x416881
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.UsedBySelectedProfile
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x416881
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41689a
mov edx, dword [ebp + 8]
push 1
lea ecx, [esp + 0x2c]
push ecx
push edi
push edx
mov ecx, esi
call fcn.004166a0
mov ebx, eax
test ebx, ebx
jne 0x4168a2
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x10], 0
je 0x41690c
test dword [esi + 0x28], 0x1000000
je 0x41690c
lea ecx, [esp + 0x28]
push 0x2d
push ecx
call fcn.0045ee10
mov esi, eax
add esp, 8
test esi, esi
je 0x41690c
mov bl, byte [esi + 1]
mov ecx, dword [ebp + 8]
test bl, bl
setne dl
dec dl
push 1
lea eax, [esp + 0x2c]
push eax
push edi
push ecx
mov ecx, dword [esp + 0x28]
and edx, 0x31
mov byte [esi + 1], dl
call fcn.004166a0
mov byte [esi + 1], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4227c0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30c
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
cmp byte [ebx], 0
jne 0x422912
call fcn.0044e280
cmp eax, 6
jge 0x422817
mov ax, word [0x478458]
mov esi, dword [ebp + 0xc]
mov word [ebx], ax
mov cl, byte [0x47845a]
mov byte [ebx + 2], cl
push str..txt
push esi
push 0x478458
jmp 0x422930
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x422850
mov eax, dword [ebp + 0x14]
test eax, eax
mov esi, dword [ebp + 0xc]
push str..txt
je 0x42280c
mov eax, dword [0x491164]
push eax
push esi
push 0x478458
lea ecx, [esp + 0x28]
push str._s_s__d_s
push ecx
call fcn.0045e6a9
add esp, 0x18
jmp 0x422942
mov esi, dword [ebp + 8]
test esi, esi
mov dword [esp + 0x10], esi
jne 0x422889
lea eax, [esp + 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x422889
push str.OpenProcessToken_Failed
call fcn.00411050
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [esp + 0x118], 0
mov ecx, 0x7f
lea edi, [esp + 0x11a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
stosw word es:[edi], ax
mov eax, dword [esp + 0x14]
push edx
push eax
mov dword [esp + 0x20], 0x100
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x4228e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.pFuncGetUserProfileDirectory_Failed
call fcn.00411050
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x100
push ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x12c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
jne 0x422912
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
test eax, eax
mov esi, dword [ebp + 0xc]
push str..txt
je 0x42292e
mov eax, dword [0x491164]
push eax
push esi
push ebx
jmp 0x422839
push esi
push ebx
lea edx, [esp + 0x24]
push str._s_s_s
push edx
call fcn.0045e6a9
add esp, 0x14
push 6
push str.Pollog
push esi
call fcn.0045f6e1
add esp, 0xc
test eax, eax
jne 0x422968
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x422968
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x18]
push ecx
call fcn.00410970
push 6
call fcn.004109a0
push str.EXIT_SetLogFileInfo
call fcn.00411050
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4229a0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x28
mov eax, dword [0x491098]
push ebx
xor ebx, ebx
cmp eax, 4
mov dword [esp + 0x10], ebx
jae 0x4229bb
xor eax, eax
pop ebx
add esp, 0x28
ret
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 0x28], 0x220
mov dword [esp + 0x2c], 0x222
mov dword [esp + 0x30], 0x221
mov dword [esp + 0x34], 0x223
mov dword [esp + 0x18], ebx
xor esi, esi
mov edi, edi
mov ecx, dword [esp + esi*4 + 0x28]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 0x20
push 2
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], 5
call edi
test eax, eax
je 0x422a71
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
push ebp
mov dword [esp + 0x20], ebx
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x422a48
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0x14], ebx
je 0x422a7e
mov eax, dword [esp + esi*4 + 0x28]
pop edi
add eax, 0xfffffde0
cmp eax, 3
pop esi
pop ebp
ja case.default.0x422a6a
jmp dword [eax*4 + 0x422ac0]
push str.GetUserType._Failed_to_AllocateAndInitializeSid
call fcn.00411050
add esp, 4
inc esi
cmp esi, 4
jb 0x4229f0
mov eax, dword [esp + 0x18]
jmp 0x422a5d
mov eax, 1
pop ebx
add esp, 0x28
ret
mov eax, 2
pop ebx
add esp, 0x28
ret
mov eax, 3
pop ebx
add esp, 0x28
ret
mov eax, 4
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
pop ebx
add esp, 0x28
ret

Function at 0x422c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
je 0x422cf4
cmp byte [eax], 0
je 0x422cf4
lea ecx, [esp + 4]
push ecx
push 0x2001f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422cf4
push esi
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.SGCountDown
push edx
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x422cdf
cmp dword [esp + 0x14], 4
jne 0x422cdf
mov eax, dword [esp + 4]
push eax
push str.GetSGCountDown__SGCountDown___d_n
mov dword [esi], eax
call fcn.0040aab0
add esp, 8
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x423050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov edx, dword [ebp + 0xb0]
push ebx
mov ebx, dword [ebp + 0xb4]
push esi
push edi
xor eax, eax
mov ecx, 0x27
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x27
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xb8]
mov dword [esp + 0xc], 3
mov dword [esp + 0x14], 1
mov dword [eax], 0
jmp 0x4230a0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4231a6
xor edx, edx
mov dword [esp + 0x10], edx
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xa8]
test eax, eax
mov word [esp + 0x3c], 0x9c
jne 0x4230e2
lea ecx, [esp + 0x18]
push ecx
push edx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
jmp 0x4230f4
mov ecx, dword [ebp + 8]
push 2
lea eax, [esp + 0x1c]
push eax
push edx
push ecx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExA]
test eax, eax
je 0x42318b
mov edi, dword [ebp + 0x78]
mov esi, dword [ebp + 0x7c]
cmp edi, esi
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
jbe 0x42311a
cmp ecx, eax
jb 0x423120
cmp edi, esi
jae 0x423134
cmp ecx, eax
jbe 0x423134
mov edx, ecx
mov ecx, eax
mov eax, edx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
mov edx, dword [ebp + 0x74]
cmp dword [esp + 0x80], edx
jne 0x42322d
cmp eax, esi
jne 0x42322d
cmp ecx, edi
jne 0x42322d
mov eax, dword [esp + 0x90]
mov ecx, dword [ebp + 0x84]
cmp eax, ecx
mov dword [esp + 0x14], 0
jne 0x423204
mov eax, dword [ebp + 0xb8]
mov dword [eax], 1
mov eax, dword [ebp + 0xac]
test eax, eax
je 0x42322d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0xb0]
dec ecx
test eax, eax
mov dword [esp + 0xc], ecx
jne 0x4230a0
mov eax, dword [ebp + 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x68]
push ecx
mov ecx, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x70]
push ecx
mov ecx, dword [ebx + 0x6c]
push eax
mov eax, dword [edx + 0x68]
push ecx
mov ecx, dword [edx + 0x78]
push eax
mov eax, dword [edx + 0x70]
push ecx
mov ecx, dword [edx + 0x6c]
mov edx, dword [ebp + 0xac]
push eax
mov eax, dword [ebp + 0xa8]
push ecx
mov ecx, dword [ebp + 0x74]
push edx
mov edx, dword [ebp + 0x84]
push eax
mov eax, dword [ebp + 0x7c]
push ecx
mov ecx, dword [ebp + 0x78]
push edx
push eax
push ecx
push str.GetLowerAndHigherRefreshrateMode:_ModeIn_x_d__y_d__f_d__Bpp_d_nbRawMode_d_nbFindMatching_d_nModeLower_x_d__y_d__f_d__Bpp_d_nModeHigher_x_d__y_d__f_d__Bpp_d_nbMatchModeFound___d
call fcn.0040aab0
add esp, 0x40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jae 0x423215
mov ecx, dword [ebp + 0xb0]
cmp dword [ecx + 0x78], eax
jae 0x42322d
mov edi, ecx
jmp 0x423222
mov ecx, dword [ebx + 0x78]
cmp ecx, eax
ja 0x423220
test ecx, ecx
jne 0x42322d
mov edi, ebx
lea esi, [esp + 0x18]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov edx, eax
jmp 0x4230b2
Function at 0x4234a0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
cmp dword [0x491098], 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], 0
jb 0x423440
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4233de
call esi
push eax
push str.MyExitWindows._Open_Process_Token_failed._err_d
call fcn.0040aab0
add esp, 8
xor eax, eax
pop esi
add esp, 0x14
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call esi
test eax, eax
je 0x423440
call esi
push eax
push str.MyExitWindows._AdjustTokenPrivileges_failed_err_d
call fcn.0040aab0
mov ecx, dword [esp + 0xc]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x423477
call esi
push eax
push str.MyExitWindows._ExitWindowsEx_failed._err_d
call fcn.0040aab0
mov eax, dword [esp + 0xc]
add esp, 8
test eax, eax
je 0x423470
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x423486
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x14
ret
jmp 0x423390

Function at 0x4234c0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x4234ee
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4234df
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop esi
ret

Function at 0x423c00
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x423c36
push str.FAILURE:_EEUCreateThread:_Failed_to_create_thread.
call fcn.0040aab0
add esp, 4
mov eax, esi
pop esi
ret
push esi
push str.EEUCreateThread:_success_to_create_thread_0x_x.
call fcn.0040aab0
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x423c67
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x423c67
push esi
push str.EEUCreateThread__Set_thread__0x_x__to_highest_priority
call fcn.0040aab0
add esp, 8
mov eax, esi
pop esi
ret