joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f0cc
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x4c
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0x48], eax
movaps xmm0, xmmword [0x444e70]
and dword [esp + 8], 0
and dword [esp + 4], 0
push ebx
push ebp
push esi
movups xmmword [esp + 0x34], xmm0
mov ebx, ecx
mov byte [esp + 0xf], dl
movaps xmm0, xmmword [0x444e70]
push edi
movups xmmword [esp + 0x48], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push str.kernel32.dll
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetSystemDefaultUILanguage
push esi
call edi
test eax, eax
je 0x40f148
call eax
movzx eax, ax
mov dword [esp + 0x14], eax
push str.GetUserDefaultUILanguage
push esi
call edi
test eax, eax
je 0x40f15d
call eax
movzx eax, ax
mov dword [esp + 0x18], eax
mov edi, dword [ebx + 4]
xor esi, esi
push 8
pop ebp
test edi, edi
jle 0x40f261
mov dword [esp + 0x34], 4
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x28], 0x1c
mov dword [esp + 0x30], 0x18
push esi
mov ecx, ebx
call fcn.0040a952
mov dl, byte [esp + 0x13]
movzx ecx, word [eax]
mov eax, dword [esp + 0x1c]
cmp cx, ax
jne 0x40f1bf
push 4
test dl, dl
pop eax
cmovne eax, dword [esp + 0x24]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x1c]
cmp cl, al
jne 0x40f1d1
push 0x14
test dl, dl
pop eax
cmovne eax, dword [esp + 0x28]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x20]
cmp cx, ax
jne 0x40f1ef
push 0xc
xor ebp, ebp
test dl, dl
pop eax
cmovne eax, ebp
push 8
pop ebp
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x20]
cmp cl, al
jne 0x40f201
push 0x1c
test dl, dl
pop eax
cmovne eax, dword [esp + 0x2c]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x14]
cmp cx, ax
jne 0x40f219
xor eax, eax
test dl, dl
cmovne eax, ebp
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x14]
cmp cl, al
jne 0x40f22b
push 0x10
test dl, dl
pop eax
cmovne eax, dword [esp + 0x30]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x18]
cmp cx, ax
jne 0x40f245
test dl, dl
mov eax, ebp
cmovne eax, dword [esp + 0x34]
mov dword [esp + eax + 0x38], esi
mov eax, dword [esp + 0x18]
cmp cl, al
jne 0x40f258
push 0x18
pop eax
push 0x10
test dl, dl
pop ecx
cmovne eax, ecx
mov dword [esp + eax + 0x38], esi
inc esi
cmp esi, edi
jl 0x40f195
xor eax, eax
mov edx, dword [esp + eax*4 + 0x38]
test edx, edx
jns 0x40f274
inc eax
cmp eax, ebp
jb 0x40f263
push 0
jmp 0x40f275
push edx
mov ecx, ebx
call fcn.0040a952
mov ecx, dword [esp + 0x58]
pop edi
pop esi
mov ax, word [eax]
pop ebp
pop ebx
xor ecx, esp
call fcn.004246ea
add esp, 0x4c
ret
Function at 0x40f302
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
call fcn.0040522e
push eax
mov ecx, edi
call fcn.004028b4
push 0
push 0x43f2b8
push 2
movzx ebp, bx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [esp + 0x18], eax
lea ecx, [eax - 1]
push ecx
push 0x78
lea ecx, [esp + 0x1c]
call fcn.0040ba6a
mov esi, dword [esp + 0x14]
cmp dword [esi - 4], 1
jle 0x40f35a
push dword [esi - 0xc]
lea ecx, [esp + 0x18]
call fcn.00404d3d
mov esi, dword [esp + 0x14]
push dword [esp + 0x18]
push esi
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push esi
push ebx
push str._d__s
push edi
call fcn.0040a5cf
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.004052ff
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x40f56b
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
mov ebp, ecx
push 2
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x1c]
push eax
push esi
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
cmp byte [ebp + 0x2c], al
push 5
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3e9
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
push ecx
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp + 0x30], 0
jne 0x40f5e4
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x30], eax
cmp byte [ebp + 0x2c], 0
je 0x40f5ef
mov eax, dword [ebp + 0x30]
jmp 0x40f5f3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 0x206
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0040f782
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
xor ecx, esp
call fcn.004246ea
add esp, 0x2c
ret

Function at 0x40f9be
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
mov ecx, 0x448a9c
call fcn.0040f949
cmp byte [0x448aa4], 0
je 0x40f9e5
push dword [0x448a9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40fa15
cmp dword [0x448a9c], 0
je 0x40fa15
xor ecx, ecx
lea eax, [ebp + 8]
push eax
push ecx
push 0x448a98
push 0x40fa37
push ecx
push ecx
mov dword [ebp + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov ecx, 0x448aa8
call fcn.00409839
pop ebp
ret 4
Function at 0x40fa65
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x420
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x434]
and dword [esi], 0
call fcn.0041d11a
mov ebx, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x44a140]
cmp eax, dword [ecx + 4]
jle 0x40fad4
mov ebp, 0x44a140
push ebp
call fcn.00424824
cmp dword [0x44a140], 0xffffffff
pop ecx
jne 0x40fad4
push ecx
push ecx
push 0
push ecx
push 0
push 0xa
mov ecx, 0x44a148
call fcn.0041d066
push ebp
call fcn.004247e5
pop ecx
push 0
push 0x44a148
mov ecx, ebx
call fcn.0041d24c
test al, al
je 0x40fb93
push edi
call fcn.0040fbbc
test al, al
je 0x40fb93
mov ebx, 0x208
lea eax, [esp + 0x18]
push ebx
push 0
push eax
call fcn.00425780
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
xor ebx, ebx
lea eax, [esp + 0x224]
push ebx
push eax
call fcn.00425780
add esp, 0xc
lea eax, [esp + 0x220]
push eax
push ebx
push 0x44162c
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x220]
mov ecx, esi
push eax
call fcn.0040fc40
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x14], bl
call fcn.0041c0d3
push ebx
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
dec eax
neg eax
sbb al, al
add al, 1
mov byte [esi + 4], al
jne 0x40fb88
push edi
mov ecx, esi
call fcn.0040fc40
lea ecx, [esp + 0x10]
call fcn.0041c0b3
jmp 0x40fb9f
push edi
mov ecx, esi
call fcn.0040fc40
mov byte [esi + 4], 0
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004246ea
add esp, 0x420
ret 4

Function at 0x40fbbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
push esi
push 0x24
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x20c]
call fcn.0040153f
mov ecx, edi
mov ebx, eax
call fcn.0040153f
cmp eax, ebx
jae 0x40fc05
xor al, al
jmp 0x40fc2d
test ebx, ebx
je 0x40fc2b
lea eax, [ebp - 0x20c]
sub edi, eax
lea eax, [edi + esi*2]
mov ax, word [ebp + eax - 0x20c]
cmp ax, word [ebp + esi*2 - 0x20c]
jne 0x40fc01
inc esi
cmp esi, ebx
jb 0x40fc11
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004246ea
mov esp, ebp
pop ebp
ret 4
Function at 0x40fda0
Capabilities:
Delete file
Get file version info

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x1c], edx
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], edi
mov esi, edi
call fcn.0040fa65
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x24]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
test ebp, ebp
je 0x40fe3d
push 0x43a4f1
push ebp
call fcn.00424bbb
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40fde9
push 8
pop edi
jmp 0x40fe45
push esi
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40fe3d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push 0x43f234
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40fe45
cmp dword [esp + 0x18], edi
je 0x40fe45
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
test ecx, ecx
je 0x40fe2e
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x40fe45
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
jmp 0x40fe45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp byte [esp + 0x24], 0
je 0x40fe56
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x20]
call fcn.00424704
pop ecx
push esi
call fcn.00424704
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x40fe70
Capabilities:
Get file version info

Disassembly:
sub esp, 0x20
mov eax, ecx
push ebx
push ebp
push esi
mov ecx, dword [eax]
xor ebx, ebx
push edi
sub ecx, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], ebx
call fcn.0040ab13
lea esi, [eax + 0x10]
cmp dword [esi - 4], 1
mov dword [esp + 0x10], esi
jle 0x40feaa
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.00404d3d
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
test ebp, ebp
je 0x40ffc2
push 0x43a4f1
push ebp
call fcn.00424bbb
mov edi, eax
mov dword [esp + 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x40ffc2
cmp dword [esi - 4], 1
jle 0x40fef1
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.00404d3d
mov esi, dword [esp + 0x10]
push edi
push ebp
push dword [esp + 0x20]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40ffc2
call fcn.0040522e
push eax
lea ecx, [esp + 0x14]
call fcn.004028b4
mov ebp, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push str.VarFileInfoTranslation
push edi
call ebp
test eax, eax
je 0x40ff4b
cmp dword [esp + 0x1c], ebx
je 0x40ff4b
mov ecx, dword [esp + 0x20]
push 0x44168c
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
jmp 0x40ff5a
push 0x44168c
push 0x4e2
push 0x409
lea eax, [esp + 0x1c]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.0040a5cf
mov edi, dword [esp + 0x24]
add esp, 0x14
cmp dword [edi - 4], 1
jle 0x40ff86
push dword [edi - 0xc]
lea ecx, [esp + 0x14]
call fcn.00404d3d
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x40ffba
cmp dword [esp + 0x24], ebx
je 0x40ffba
push dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
call fcn.00404f39
lea ecx, [edi - 0x10]
call fcn.004052ff
mov bl, 1
jmp 0x40ffc2
lea ecx, [edi - 0x10]
call fcn.004052ff
lea ecx, [esi - 0x10]
call fcn.004052ff
push dword [esp + 0x14]
call fcn.00424704
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret
Function at 0x410192
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x10], 0xc8
mov edi, edx
mov ebp, ecx
push ebx
jmp 0x4101b0
add dword [esp + 0x10], 2
push esi
call fcn.00424704
pop ecx
push dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0040eb18
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push ebx
push dword [edi]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x4101aa
test eax, eax
jne 0x410270
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x41021c
cmp eax, 2
je 0x41021c
cmp eax, 7
je 0x41021c
cmp eax, 4
jne 0x410270
push dword [esi]
push 0x441710
push dword [esp + 0x28]
call fcn.0040a5cf
add esp, 0xc
jmp 0x41026d
mov eax, dword [esp + 0x10]
shr eax, 1
xor ecx, ecx
mov dword [esp + 0x10], eax
mov word [esi + eax*2], cx
mov edi, dword [esp + 0x10]
jmp 0x410237
dec edi
mov dword [esp + 0x10], edi
cmp word [esi + edi*2], bx
je 0x410232
inc edi
mov dword [esp + 0x10], edi
call fcn.0040522e
push eax
push edi
push esi
lea ecx, [esp + 0x20]
call fcn.0040a186
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
call fcn.00409e7f
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004052ff
xor ebx, ebx
inc ebx
push esi
call fcn.00424704
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x410281
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [edx]
push ebx
push esi
push edi
sub ecx, 0x10
call fcn.0040ab13
xor ebx, ebx
lea esi, [eax + 0x10]
mov dword [ebp - 4], esi
push 0x5c
push esi
call fcn.00426705
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x410354
sub edi, esi
sar edi, 1
js 0x410354
mov eax, dword [esi - 0xc]
lea ecx, [edi + 1]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.0040999a
mov eax, dword [esi - 0xc]
lea ecx, [ebp - 4]
sub eax, edi
push eax
push edi
call fcn.00409df3
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
push eax
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [ebp - 0x10], 0
je 0x410349
mov edi, dword [ebp - 8]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x410331
inc ebx
cmp dword [ebp - 0x10], eax
je 0x410324
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea ecx, [edi - 0x10]
call fcn.004052ff
jmp 0x41029c
cmp dword [ebp - 0x10], 0
je 0x410344
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea ecx, [edi - 0x10]
jmp 0x41034f
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.004052ff
lea ecx, [esi - 0x10]
call fcn.004052ff
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410365
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
mov dword [ebp - 0x64], 0x44
lea eax, [ebp - 0x60]
mov esi, edx
push ebx
push eax
mov edi, ecx
call fcn.00425780
add esp, 0xc
mov dword [ebp - 0xc], ebx
xorps xmm0, xmm0
mov byte [ebp - 8], bl
movups xmmword [ebp - 0x1c], xmm0
cmp byte [ebp + 0x10], bl
je 0x4103a4
lea ecx, [ebp - 0xc]
call fcn.0041c0d3
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], ebx
cmove ecx, eax
mov eax, dword [edi]
xor edx, edx
cmp dword [eax - 0xc], ebx
cmove eax, edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x64]
push edx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4103fb
cmp dword [ebp + 8], ebx
je 0x4103f0
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea ecx, [ebp - 0xc]
call fcn.0041c0b3
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41040c
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x14], edx
push 0x38
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], ebx
push ebx
push eax
mov edi, ecx
call fcn.00425780
mov ebp, dword [esp + 0x6c]
mov eax, 0x400
mov esi, dword [edi]
add esp, 0xc
test ebp, ebp
mov dword [esp + 0x1c], 0x3c
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov ecx, edi
mov dword [esp + 0x20], eax
call fcn.0040b420
test al, al
je 0x41045c
add esi, 8
mov ecx, dword [esp + 0x30]
xor eax, eax
cmp byte [esp + 0x64], al
mov dword [esp + 0x2c], esi
sete al
mov dword [esp + 0x28], str.open
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
cmovne ecx, eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax]
cmp dword [ecx - 0xc], ebx
jne 0x4104a8
mov edx, edi
lea ecx, [esp + 0x60]
call fcn.0040ad8c
mov edi, dword [esp + 0x64]
xor ebx, ebx
inc ebx
jmp 0x4104be
add ecx, 0xfffffff0
call fcn.0040ab13
push 2
pop ebx
lea edi, [eax + 0x10]
mov dword [esp + 0x64], edi
lea eax, [esp + 0x64]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.0040ab13
lea esi, [eax + 0x10]
mov dword [esp + 0x64], esi
test bl, 2
je 0x4104df
lea ecx, [edi - 0x10]
and ebx, 0xfffffffd
call fcn.004052ff
test bl, 1
je 0x4104f0
mov ecx, dword [esp + 0x60]
lea ecx, [ecx - 0x10]
call fcn.004052ff
lea ecx, [esp + 0x64]
mov edi, esi
call fcn.0040b420
test al, al
je 0x410502
lea edi, [esi + 8]
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x410519
xor ebx, ebx
jmp 0x41054e
test ebp, ebp
je 0x41053b
cmp dword [esp + 0x54], 0
je 0x41054c
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x54], 0
je 0x41054c
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.004052ff
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x48
ret
Function at 0x4107f8
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
push 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x410834
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4108d8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x18]
mov esi, ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x410881
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4108cb
push 0x43a4f1
push dword [ebp - 0x10]
call fcn.00424bbb
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push esi
push 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4108cb
cmp dword [ebp - 0x10], ebx
je 0x4108cb
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4108d1
push dword [ebp - 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x4108d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00424704
pop ecx
cmp dword [ebp - 0x18], 0
je 0x4108e7
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004246ea
mov esp, ebp
pop ebp
ret

Function at 0x4108f9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x41095f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x410953
cmp dword [ebp - 0x218], ebx
je 0x410959
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41093d
jmp 0x41095f
mov esi, dword [ebp - 0x228]
test edi, edi
je 0x41096a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004246ea
mov esp, ebp
pop ebp
ret
Function at 0x410bf8
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x448010]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, edx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], ebx
mov esi, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, 0x3ff
jmp 0x410c5a
cmp eax, 0x400
jae 0x410cc2
mov byte [esp + eax + 0x18], 0
mov ecx, edi
lea eax, [esp + 0x18]
push eax
call fcn.0040ba1a
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x24]
push eax
push esi
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x410c40
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x410c9e
add eax, 0xfffffffe
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0040995a
push eax
mov ecx, edi
call fcn.00409e7f
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004052ff
test esi, esi
je 0x410ca9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004246ea
add esp, 0x414
ret
call fcn.00424ce7
int3

Function at 0x411678
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov edi, 0x100
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004246fb
pop ecx
push dword [ebp + 4]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
cmp ebx, 0xfe
jne 0x4116e8
push esi
add edi, edi
call fcn.00424704
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004246fb
pop ecx
pop ecx
push dword [ebp + 4]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
lea eax, [edi - 2]
cmp ebx, eax
je 0x4116b2
mov ecx, dword [esp + 0x18]
call fcn.0040972d
call fcn.0040522e
push eax
lea ecx, [esp + 0x14]
call fcn.004028b4
xor edi, edi
movzx eax, word [esi + edi*2]
test ax, ax
je 0x411717
push eax
lea ecx, [esp + 0x14]
call fcn.0040aa7a
jmp 0x411738
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x41172f
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
call fcn.00409766
lea ecx, [esp + 0x10]
call fcn.00404fb9
inc edi
cmp edi, ebx
jbe 0x411702
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004052ff
push esi
call fcn.00424704
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4