joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea20
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40eb16
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40eb16
xor esi, esi
cmp dword [0x447538], ebx
mov dword [eax], ebx
jbe 0x40ea70
mov edi, 0x4474e8
push dword [edi]
push dword [ebp + 8]
call fcn.0040eb1d
test eax, eax
pop ecx
pop ecx
je 0x41c246
inc esi
add edi, 0x14
cmp esi, dword [0x447538]
jb 0x40ea50
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x7a
jne 0x40eb0d
push dword [ebp - 4]
call fcn.00403734
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
je 0x40eb06
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
je 0x40eaff
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
push ebx
call edi
test eax, eax
je 0x41c2ec
xor esi, esi
push dword [ebp - 0xc]
call fcn.004036f0
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
cmp esi, ebx
je 0x40eaed
jmp 0x40ea70
mov esi, 0x8007000e
jmp 0x40eae4
mov esi, 0x8007000e
jmp 0x40eaed
cmp esi, ebx
jle 0x40eaed
jmp 0x41c326
mov esi, 0x80070057
jmp 0x40eaed
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea edi, [esi + esi*4]
shl edi, 2
push ebx
push dword [edi + 0x4474f8]
xor eax, eax
mov al, byte [edi + 0x4474f2]
push dword [edi + 0x4474f4]
push eax
lea eax, [edi + 0x4474ec]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41c280
xor esi, esi
jmp 0x41c2aa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41c292
call esi
mov esi, eax
jmp 0x41c2a2
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jne 0x40ea70
xor eax, eax
mov al, byte [edi + 0x4474f2]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
je 0x41c2d9
push dword [ebp - 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x41c2de
mov esi, 0x8007000e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x40eaf6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41c2fe
call esi
mov esi, eax
jmp 0x41c30e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
je 0x40eae4
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40eae4
and esi, 0xffff
or esi, 0x80070000
jmp 0x40eaed
Function at 0x40ec1b
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0040e992
mov esi, eax
test esi, esi
jl 0x40ec53
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp - 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call fcn.0040ec5a
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x40f61e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
push esi
push dword [ebp + 8]
lea ebx, [ebp - 8]
mov dword [ebp - 4], eax
call fcn.00409ea4
mov esi, eax
test esi, esi
jne 0x40f71b
call fcn.004046e1
test al, al
mov byte [ebp + 0xb], al
je 0x40f65b
call dword [sym.imp.ole32.dll_CoRevertToSelf]
mov ebx, str.C:Documents_and_SettingsAll_UsersApplication_DataMicrosoftMachine_Debug_Managermdm.ini
push ebx
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0x409d8c
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x218]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f687
sub eax, esi
cmp eax, 0x1ef
jae 0x40f72e
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
call fcn.0040f735
mov esi, eax
test esi, esi
jne 0x40f706
cmp byte [ebp - 0x218], al
push edi
jne 0x41bde4
lea eax, [ebp - 0x18]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f6bf
lea edi, [ebp - 0x218]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40f6cf
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
and ecx, 3
push dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
pop edi
je 0x41bdff
xor esi, esi
cmp byte [ebp + 0xb], 0
je 0x40f712
push esi
call fcn.00404730
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, esi
pop esi
pop ebx
call fcn.004037c0
leave
ret 0xc
mov esi, 0x80004005
jmp 0x40f706
lea edi, [ebp - 0x218]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41bdeb
mov esi, 0x41be2c
movsw word es:[edi], word [esi]
jmp 0x40f6ba
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41be14
call esi
mov esi, eax
jmp 0x40f706
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40f706
Function at 0x4102d5
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
push edi
jne 0x410367
call fcn.004046e1
cmp al, bl
mov byte [esp + 0xf], al
je 0x4102f6
call dword [sym.imp.ole32.dll_CoRevertToSelf]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x41bffa
push ebp
push esi
push ebx
push esi
push 0x41036c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], eax
je 0x41bfd0
push 0x2710
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41bfb2
xor edi, edi
push dword [esi + 8]
call ebp
mov dword [esi + 8], ebx
pop ebp
cmp byte [esp + 0xf], bl
je 0x410360
push edi
call fcn.00404730
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
xor edi, edi
inc edi
jmp 0x410360
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call ebp
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov edi, 0x80004005
jmp 0x410349
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x41bfe5
call edi
mov edi, eax
jmp 0x410349
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x410349
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41c00f
call esi
mov edi, eax
jmp 0x410352
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x410352

Function at 0x41413a
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
xor ebx, ebx
cmp dword [edi], ebx
jne 0x4141b8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x413e94
push ebx
push ebx
push ebx
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esp + 0xc], eax
je 0x41932b
push ebp
push edi
push ebx
push esi
push 0x4141bd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], eax
je 0x419301
push 0x7530
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4192e3
xor esi, esi
push dword [esp + 0x10]
call ebp
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
xor esi, esi
inc esi
jmp 0x4141b1
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call ebp
mov dword [esi + 0x1c], ebx
mov dword [edi], ebx
mov esi, 0x80004005
jmp 0x4141aa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x419316
call esi
mov esi, eax
jmp 0x4141aa
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x4141aa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x419340
call esi
mov esi, eax
jmp 0x4141b1
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x4141b1
Function at 0x414446
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp - 4], ebx
jne 0x41c670
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x41452d
cmp dword [ebp + 8], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
je 0x41452d
push dword [ebp + 8]
call fcn.00413e1a
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
je 0x414526
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x41c6b7
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov dword [ebp + 8], esp
push esp
push esi
push ebx
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41c68d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 0x4138f4
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41451f
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x41451f
push 1
push ebx
push ebx
push eax
call fcn.00414534
mov ecx, dword [esi + 0xc]
xor ebx, ebx
add eax, ecx
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
adc edx, ebx
test eax, eax
mov dword [edi + 4], edx
jne 0x41c677
mov esi, dword [ebp - 4]
push dword [ebp + 0xc]
call fcn.004036f0
pop ecx
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov esi, 0x80004005
jmp 0x41450a
mov esi, 0x8007000e
jmp 0x414513
mov esi, 0x80070057
jmp 0x414513
mov dword [eax], ebx
jmp 0x41445f
mov cl, byte [esi + 0x1c]
and cl, byte [esi + 0x18]
and cl, 1
neg cl
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
jmp 0x414507
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41c6a2
call esi
mov esi, eax
jmp 0x41450a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x41450a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41c6c9
call esi
mov esi, eax
jmp 0x41c6d9
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x41450a
jmp 0x41451f

Function at 0x414842
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43dd10
call fcn.004036d1
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004148d5
and dword [ebp - 4], 0
mov dword [esi], 0x40485c
mov dword [esi + 4], 0x40c780
mov dword [esi + 8], 0x413ab0
mov dword [esi + 0xc], 0x404a68
mov dword [esi + 0x10], 0x413944
mov dword [esi + 0x14], 0x408de0
mov dword [esi + 0x18], 0x40c694
mov dword [esi + 0x2c], 0x406ce0
mov dword [esi + 0x30], 0x413920
mov dword [esi + 0x34], 0x407014
mov dword [esi + 0x38], 0x40c3a8
mov dword [esi + 0x3c], 0x40c7e0
mov dword [esi + 0x40], 0x40f9b8
mov ecx, dword [0x446a10]
mov eax, dword [ecx]
call dword [eax]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41484d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43dd10
call fcn.004036d1
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004148d5
and dword [ebp - 4], 0
mov dword [esi], 0x40485c
mov dword [esi + 4], 0x40c780
mov dword [esi + 8], 0x413ab0
mov dword [esi + 0xc], 0x404a68
mov dword [esi + 0x10], 0x413944
mov dword [esi + 0x14], 0x408de0
mov dword [esi + 0x18], 0x40c694
mov dword [esi + 0x2c], 0x406ce0
mov dword [esi + 0x30], 0x413920
mov dword [esi + 0x34], 0x407014
mov dword [esi + 0x38], 0x40c3a8
mov dword [esi + 0x3c], 0x40c7e0
mov dword [esi + 0x40], 0x40f9b8
mov ecx, dword [0x446a10]
mov eax, dword [ecx]
call dword [eax]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4148d5
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x44148c
call fcn.004036d1
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x54]
mov dword [ebp - 0x10], esi
call fcn.004049de
and dword [ebp - 4], 0
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.00414da2
mov byte [ebp - 4], 1
lea ebx, [esi + 0x40]
mov ecx, ebx
call fcn.0041676b
mov byte [ebp - 4], 2
mov dword [edi], 0x40c6b4
xor edi, edi
lea ecx, [esi + 0x78]
mov dword [esi], 0x409968
mov dword [esi + 4], 0x40c7ac
mov dword [esi + 8], 0x4139c4
mov dword [esi + 0xc], 0x40bf08
mov dword [esi + 0x10], 0x4139a0
mov dword [esi + 0x14], 0x408df4
mov dword [esi + 0x2c], 0x40b41c
mov dword [esi + 0x30], 0x41397c
mov dword [esi + 0x34], 0x40702c
mov dword [esi + 0x38], 0x40dec4
mov dword [esi + 0x3c], 0x40f9f8
mov dword [ebx], 0x40f9d8
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
call fcn.004149bc
mov byte [ebp - 4], 3
lea ecx, [esi + 0x84]
call fcn.004149bc
mov byte [ebp - 4], 4
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov byte [ebp - 4], 5
mov dword [esi + 0x9c], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414a45
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
cmp byte [ebp + 0xc], 0
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x134]
je 0x414b08
push 0x414af0
push eax
call fcn.0040c98d
add esp, 0xc
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x134]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x414b12
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x414b12
xor eax, eax
inc eax
cmp dword [ebp + 8], 2
je 0x414ad8
cmp dword [ebp + 8], eax
jne 0x414ae0
cmp dword [ebp - 8], 2
jbe 0x414ae0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.004037c0
leave
ret 0xc
push 0x414b24
jmp 0x414a71
cmp esi, 0xea
je 0x41c4fc
jmp 0x41c4de
cmp esi, 2
je 0x41c4fc
test esi, esi
jg 0x41c4ee
mov eax, esi
jmp 0x414ae0
and esi, 0xffff
or esi, 0x80070000
jmp 0x41c4e7
xor eax, eax
inc eax
jmp 0x414ae0

Function at 0x414f24
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43dc30
call fcn.004036d1
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00414f72
and dword [ebp - 4], 0
and dword [esi + 0x30], 0
mov dword [esi], 0x409c54
mov dword [esi + 4], 0x413908
mov dword [esi + 8], 0x40b3f4
mov dword [esi + 0xc], 0x4138f8
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x414fc6
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push esi
push 0x4150cc
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
cmp eax, esi
mov dword [esp + 8], eax
je 0x41bb92
push 0x4150b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x41507c
push ebp
push edi
mov ebp, str.C:Documents_and_SettingsAll_UsersApplication_DataMicrosoftMachine_Debug_Managermdm.ini
push ebp
push esi
push esi
push 0x23
push esi
call eax
test eax, eax
jne 0x41507a
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41500e
push 8
pop ecx
mov esi, 0x415094
rep movsd dword es:[edi], dword [esi]
push 0
push ebp
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41503b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41507a
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41503e
mov esi, 0x4138f4
mov eax, 0x4150d8
movsw word es:[edi], word [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x415054
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x415062
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov bl, 1
pop edi
pop ebp
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
je 0x41bb92
pop esi
pop ebx
pop ecx
ret
xor eax, eax
mov cl, byte [eax + 0x4150d8]
mov byte [eax + str.C:Documents_and_SettingsAll_UsersApplication_DataMicrosoftMachine_Debug_Managermdm.ini], cl
inc eax
test cl, cl
jne 0x41bb94
jmp 0x41508e

Function at 0x4151c0
Capabilities:
Check mutex on windows

Disassembly:
push 0x10
push 0x415260
call fcn.00403685
mov esi, 0x80004005
mov dword [ebp - 0x1c], esi
call fcn.00415809
xor edi, edi
test eax, eax
jne 0x41527f
push 0x415230
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x41c646
mov dword [ebp - 4], edi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41521b
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.00414563
mov esi, eax
mov dword [ebp - 0x1c], esi
or dword [ebp - 4], 0xffffffff
call fcn.0041526c
mov eax, esi
call fcn.004036c0
ret 8
push 0x41528c
jmp 0x4151e8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x41c65b
call esi
mov esi, eax
jmp 0x415224
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x415224
Function at 0x41558b
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.004044c3
xor esi, esi
cmp eax, 4
je 0x415627
push edi
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push 0x41563c
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
pop edi
je 0x41562e
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41562e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov al, byte [ebp + 8]
neg al
push esi
push esi
push 0x10
mov dword [ebp - 0x1c], 1
sbb eax, eax
and eax, 2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4194fd
call esi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x419512
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x41561e
test eax, eax
jg 0x41951f
call esi
mov esi, eax
jmp 0x415627
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x415627

Function at 0x4158dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x4159e8
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
cmp esi, ebx
jl 0x4159c4
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call fcn.00415a16
push dword [ebp - 8]
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, eax
call edi
cmp esi, ebx
mov dword [ebp - 8], ebx
jl 0x4159c3
push dword [ebp - 0xc]
lea eax, [ebp - 0x180]
push 0x4159f8
push eax
call fcn.0040c98d
add esp, 0xc
push dword [ebp - 0xc]
call edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x180]
push eax
push 0x80000000
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x4159d7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x3c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x4159d7
xor esi, esi
inc esi
cmp dword [ebp - 0x18], esi
jne 0x4159c3
cmp dword [ebp - 0x10], 2
jbe 0x4159c3
push dword [ebp + 8]
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00414a45
mov esi, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, esi
pop esi
pop ebx
call fcn.004037c0
leave
ret 4
cmp esi, 2
jne 0x41c50c
jmp 0x41c504
xor esi, esi
inc esi
jmp 0x4159c3
cmp esi, ebx
jle 0x4159c3
and esi, 0xffff
or esi, 0x80070000
jmp 0x4159c3
Function at 0x416d77
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43dd10
call fcn.004036d1
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x40485c
mov dword [esi + 4], 0x40c780
mov dword [esi + 8], 0x413ab0
mov dword [esi + 0xc], 0x404a68
mov dword [esi + 0x10], 0x413944
mov dword [esi + 0x14], 0x408de0
mov dword [esi + 0x18], 0x40c694
mov dword [esi + 0x2c], 0x406ce0
mov dword [esi + 0x30], 0x413920
mov dword [esi + 0x34], 0x407014
mov dword [esi + 0x38], 0x40c3a8
mov dword [esi + 0x3c], 0x40c7e0
mov dword [esi + 0x40], 0x40f9b8
and dword [ebp - 4], 0
mov dword [esi + 0x54], 0xc0000001
call fcn.00417028
mov ecx, dword [0x446a10]
mov eax, dword [ecx]
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00416e15
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41729b
Capabilities:
Query or enumerate registry value

Disassembly:
mov esi, eax
shl esi, 2
lea eax, [esi + 0x28]
push eax
call fcn.00403734
test eax, eax
pop ecx
mov dword [ebp - 0x14], eax
je 0x416854
test ebx, ebx
jne 0x419ecc
mov ebx, dword [ebp - 0x14]
add dword [ebp - 8], 0xa
cmp edi, dword [ebp - 8]
ja 0x4172fe
jmp 0x417333
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call dword [0x446f78]
mov ecx, dword [ebp + 8]
xor edi, edi
cmp ecx, edi
mov dword [ebp - 0x18], eax
je 0x41739e
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x41739e
mov dword [ecx], edi
mov dword [eax], edi
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0x416af4
mov ecx, 0x446a18
call fcn.00418401
mov esi, eax
cmp esi, edi
jne 0x417384
xor ebx, ebx
mov dword [ebp - 8], edi
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, esi
jne 0x417371
mov eax, dword [ebp - 8]
inc edi
cmp edi, eax
mov dword [ebp - 0x10], edi
ja 0x41682f
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.0040366c
mov eax, esp
push dword [ebp - 0x18]
lea ecx, [ebp - 0x21c]
push esi
push ecx
push eax
call fcn.0040cd05
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx + edi*4 - 4], eax
jmp 0x4172fe
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea esp, [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004037c0
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, 0x80070057
jmp 0x417384
mov ecx, esi
mov edi, eax
mov eax, ecx
shr ecx, 2
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.004036f0
mov edi, dword [ebp - 0x10]
pop ecx
jmp 0x41684d