joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x144], 0x3c
mov dword [ebp - 0x140], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - 0x138], str.runas
mov dword [ebp - 0x130], 0x4da9e4
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x124], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret

Function at 0x41b110
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x144], 0x3c
mov dword [ebp - 0x140], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - 0x138], str.runas
mov dword [ebp - 0x130], 0x4daa00
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x124], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret

Function at 0x41b1b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x144], 0x3c
mov dword [ebp - 0x140], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - 0x138], str.runas
mov dword [ebp - 0x130], 0x4da9d4
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x124], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x41b980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b9d0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xa
push eax
push 0x4f8ba8
push 0
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x41b9e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41ba3a
mov ecx, 0x4f8ba8
lea edx, [ecx + 1]
jmp 0x41ba10
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ba10
sub ecx, edx
push ecx
push 0x4f8ba8
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x41c680
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 2
jne 0x41c723
cmp dword [edi + 0x134], 5
jne 0x41c6cc
push str.SOCKS5_USER
call fcn.004aed9a
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c7a0
push str.SOCKS5_USER
call fcn.0041c200
test eax, eax
je 0x41c6c4
mov esi, dword [eax + 4]
test esi, esi
jne 0x41c7a0
cmp dword [edi + 0x134], 4
jne 0x41c705
push str.SOCKS4_USER
call fcn.004aed9a
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c7a0
push str.SOCKS4_USER
call fcn.0041c200
test eax, eax
je 0x41c6fd
mov esi, dword [eax + 4]
test esi, esi
jne 0x41c7a0
push str.SOCKS_USER
call fcn.004aed9a
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c7a0
push str.SOCKS_USER
jmp 0x41c740
cmp eax, 3
jne 0x41c750
push str.HTTP_PROXY_USER
call fcn.004aed9a
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c7a0
push str.HTTP_PROXY_USER
call fcn.0041c200
test eax, eax
je 0x41c74c
mov esi, dword [eax + 4]
test esi, esi
jne 0x41c7a0
push str.CONNECT_USER
call fcn.004aed9a
mov esi, eax
add esp, 4
test esi, esi
jne 0x41c7a0
push str.CONNECT_USER
call fcn.0041c200
test eax, eax
je 0x41c774
mov esi, dword [eax + 4]
test esi, esi
jne 0x41c7a0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x400
push eax
push 0x551758
mov byte [0x551758], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
pop edi
mov eax, 0x551758
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41cb60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x41cb70
push str.0123456789.
push edi
sub esi, ecx
call fcn.004aec80
add esp, 8
push edi
cmp eax, esi
jne 0x41cba8
mov esi, dword [ebp + 0xc]
mov eax, 2
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esi + 4], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x41cbdc
movsx ecx, word [edi + 0xa]
mov esi, dword [ebp + 0xc]
push ecx
mov ecx, dword [edi + 0xc]
lea eax, [esi + 4]
push dword [ecx]
push eax
call fcn.004b6150
mov ax, word [edi + 8]
add esp, 0xc
mov word [esi], ax
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 8

Function at 0x41cbf0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi], 1
lea edi, [esi + 0x10]
jne 0x41cc15
movzx esi, word [esi + 0x110]
jmp 0x41cc48
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.0041cb60
test eax, eax
js 0x41cc41
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0041c5e0
test eax, eax
je 0x41cc41
mov dword [esi], 1
movzx esi, word [esi + 0x110]
jmp 0x41cc48
mov edi, dword [esi + 4]
movzx esi, word [esi + 8]
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.0041cb60
test eax, eax
jns 0x41cc6b
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
or ecx, 0xffffffff
cmp eax, 0xffffffff
pop edi
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004aca59
mov esp, ebp
pop ebp
ret 8

Function at 0x41ce00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
jle 0x41ce2f
mov ebx, dword [ebp + 0xc]
push 0
push esi
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x41ce38
sub esi, eax
add edi, eax
test esi, esi
jg 0x41ce12
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 0xc
Function at 0x41ce50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
jle 0x41ce83
mov ebx, dword [ebp + 0xc]
push 0
push esi
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x41ce8c
test eax, eax
je 0x41ce8c
sub esi, eax
add edi, eax
test esi, esi
jg 0x41ce62
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 0xc

Function at 0x41cf90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0xc], 0
jne 0x41cfc0
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.0041c7b0
mov edi, eax
test edi, edi
jne 0x41cffb
push dword [ebx + 4]
push dword [ebx + 0xc]
push str.Enter_SOCKS5_password_for__s__s:
push ebx
call fcn.0041cf50
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x41cffb
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 0xc]
mov edx, ecx
push esi
mov byte [ebp - 0x404], 1
lea esi, [edx + 1]
jmp 0x41d010
mov al, byte [edx]
inc edx
test al, al
jne 0x41d010
sub edx, esi
lea esi, [ebp - 0x402]
mov byte [ebp - 0x403], dl
sub esi, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x41d027
mov esi, edi
lea ecx, [ebp - 0x402]
add edx, ecx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41d041
sub esi, ecx
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x408], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d055
sub ecx, dword [ebp - 0x408]
mov byte [edx], cl
inc edx
mov dword [ebp - 0x408], edx
mov ecx, edi
sub edx, edi
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x41d070
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d082
sub ecx, edx
push ecx
push 0
push edi
call fcn.004b67a0
add esp, 0xc
mov dword [ebx + 0x13c], 0
lea eax, [ebp - 0x404]
sub esi, eax
add esi, dword [ebp - 0x408]
push esi
push eax
push dword [ebp + 8]
call fcn.0041ce00
mov dword [ebx + 0x13c], 1
mov esi, 2
mov ebx, dword [ebp + 8]
xor edi, edi
lea ecx, [ecx]
push 0
push esi
lea eax, [ebp - 0x404]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x41d0f4
test eax, eax
je 0x41d0f4
sub esi, eax
add edi, eax
test esi, esi
jg 0x41d0d0
movzx eax, byte [ebp - 0x403]
mov ecx, dword [ebp - 4]
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
pop edi
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret 4
Function at 0x41d620
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov word [ebp - 0x104], 0x104
mov edx, 1
movzx eax, byte [ebx + 0x111]
mov ecx, dword [ebx + 0x118]
test ecx, ecx
mov byte [ebp - 0x102], al
movzx eax, byte [ebx + 0x110]
mov byte [ebp - 0x101], al
mov dword [ebp - 0x100], ecx
movzx eax, byte [ebp - 0xfd]
cmove eax, edx
mov edx, dword [ebx + 0xc]
mov byte [ebp - 0xfd], al
test edx, edx
jne 0x41d697
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret 4
push esi
lea esi, [ebp - 0xfc]
mov ecx, edx
push edi
sub esi, edx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x41d6a3
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x41d6b3
sub edx, ecx
lea edi, [ebp - 0xfb]
add edi, edx
cmp dword [ebx + 0x134], 4
jne 0x41d6fc
cmp dword [ebx + 0x118], 0
jne 0x41d6fc
lea ecx, [ebx + 0x10]
mov esi, edi
mov edx, ecx
sub esi, ecx
nop
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x41d6e0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d6f0
sub ecx, edx
inc edi
add edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x104]
sub edi, eax
push edi
push eax
push ebx
call fcn.0041ce00
mov esi, 8
xor edi, edi
push 0
push esi
lea eax, [ebp - 0x104]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x41d73a
test eax, eax
je 0x41d73a
sub esi, eax
add edi, eax
test esi, esi
jg 0x41d716
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [ebp - 0x103], 0x5a
pop edi
sete al
xor ecx, ebp
pop esi
dec eax
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret 4

Function at 0x41d760
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push 0x54ef50
call fcn.004ae3f3
mov eax, 0x54ef50
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d780
push 0
sub eax, edx
push eax
push 0x54ef50
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_send]
inc eax
neg eax
sbb eax, eax
neg eax
dec eax
pop ebp
ret
Function at 0x41d7b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x41d7c0
sub esi, ecx
mov eax, 0x55555556
push ebx
push edi
mov dword [ebp - 0xc], esi
lea ecx, [esi + 2]
imul ecx
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
shl ebx, 2
mov dword [ebp - 4], ebx
lea eax, [ebx + 1]
push eax
call fcn.004ae57a
add esp, 4
mov dword [0x551750], eax
xor edx, edx
xor edi, edi
mov ecx, eax
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x41d856
mov eax, dword [ebp - 4]
lea ebx, [edx - 6]
mov esi, dword [ebp + 8]
lea esp, [esp]
dec eax
mov dword [ebp - 4], eax
cmp edi, 6
jge 0x41d82e
mov cl, byte [esi]
add edi, 8
shl edx, 8
add ebx, 8
movzx eax, cl
or edx, eax
test cl, cl
je 0x41d82e
inc esi
mov ecx, ebx
mov eax, edx
sar eax, cl
sub edi, 6
mov ecx, dword [ebp - 8]
and eax, 0x3f
sub ebx, 6
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
test eax, eax
jne 0x41d810
mov esi, dword [ebp - 0xc]
mov eax, 0x55555556
mov byte [ecx], 0
imul esi
pop edi
mov eax, edx
shr eax, 0x1f
add eax, edx
pop ebx
lea eax, [eax + eax*2]
sub esi, eax
dec esi
je 0x41d880
dec esi
je 0x41d884
mov eax, dword [0x551750]
pop esi
mov esp, ebp
pop ebp
ret 4
dec ecx
mov byte [ecx], 0x3d
mov eax, dword [0x551750]
mov byte [ecx - 1], 0x3d
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41dfc0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x198]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
inc dword [esi + 0x124]
mov eax, 0x457
push 0x100
mov word [esi + 0x12c], ax
lea eax, [esi + 0x10]
push edi
push eax
mov dword [esi + 0x130], 1
call fcn.004ae040
mov ax, word [ebp + 0x14]
add esp, 0xc
mov ecx, esi
mov word [esi + 0x110], ax
push ebx
push dword [ebp + 8]
call fcn.0041c870
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
lea ebx, [ebx]
cmp dword [esi], 1
jne 0x41e04e
movzx eax, word [esi + 0x110]
jmp 0x41e052
movzx eax, word [esi + 8]
push eax
push ecx
mov ecx, esi
call fcn.0041cbf0
mov edi, eax
cmp edi, 0xffffffff
je 0x41e0a8
cmp dword [esi], 2
jne 0x41e084
cmp dword [esi + 0x138], 1
jne 0x41e084
lea eax, [esi + 0x114]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.0041cb60
test eax, eax
js 0x41e0a8
mov eax, dword [esi]
sub eax, 2
je 0x41e0bd
dec eax
jne 0x41e0e7
push edi
mov ecx, esi
call fcn.0041d9d0
cmp eax, 0xffffffff
je 0x41e0a5
cmp eax, 1
jne 0x41e0e7
push edi
call ebx
jmp 0x41e040
push edi
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0x134], 5
jne 0x41e0d2
push edi
mov ecx, esi
call fcn.0041d2b0
test eax, eax
js 0x41e0a8
cmp dword [esi + 0x134], 4
jne 0x41e0e7
push edi
mov ecx, esi
call fcn.0041d620
test eax, eax
js 0x41e0a8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41e540
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x218]
mov ebx, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ecx, ecx
mov edi, edi
mov al, byte [ebp + ecx - 0x218]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x111], al
test al, al
jne 0x41e570
lea ecx, [ebp - 0x110]
dec ecx
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41e590
mov eax, dword [str.__settingshelper]
lea edi, [ebp - 0x110]
mov dword [ecx], eax
dec edi
mov eax, dword [0x4e1404]
mov dword [ecx + 4], eax
mov eax, dword [0x4e1408]
mov dword [ecx + 8], eax
mov eax, dword [0x4e140c]
mov dword [ecx + 0xc], eax
mov al, byte [0x4e1410]
mov byte [ecx + 0x10], al
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x41e5c8
mov ax, word [0x4e0498]
mov edx, ebx
mov word [edi], ax
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x41e5e0
lea edi, [ebp - 0x110]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41e5f0
mov ecx, edx
mov dword [ebp - 0x21c], 0
shr ecx, 2
lea eax, [ebp - 0x278]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x44
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004b67a0
add esp, 0xc
mov dword [ebp - 0x270], str.Winsta0Default
xorps xmm0, xmm0
mov dword [ebp - 0x278], 0x44
mov eax, 5
movdqu xmmword [ebp - 0x230], xmm0
push 0
push str.Shell_TrayWnd
mov word [ebp - 0x248], ax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41e723
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x41e723
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41e723
lea eax, [ebp - 0x21c]
push eax
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x41e701
push ecx
call esi
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x41e70e
push eax
call esi
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x41e71b
push eax
call esi
cmp edi, 0x522
jne 0x41e72a
mov ecx, ebx
call fcn.00419a60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x41e930
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 4], 0
jne 0x41e94e
push str.34F673E0_878F_11D5_B98A_00B0D07B8C7C
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41e97e
push 0
push 0
push 0
push 6
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
xor edx, edx
mov dword [esi + 0xc], ecx
test ecx, ecx
movzx eax, bl
mov dword [esi + 0x109c4], ecx
cmove eax, edx
pop esi
pop ebx
ret
pop esi
mov al, bl
pop ebx
ret

Function at 0x41e990
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x10], 0
jne 0x41e9ae
push str.34F673E0_878F_11D5_B98A_57B0D07B8C7C
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41e9de
push 0
push 0
push 0
push 6
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
xor edx, edx
mov dword [esi + 0x18], ecx
test ecx, ecx
movzx eax, bl
mov dword [esi + 0x109c8], ecx
cmove eax, edx
pop esi
pop ebx
ret
pop esi
mov al, bl
pop ebx
ret
Function at 0x420ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cddb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4f5568]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x10], eax
push 4
push dword [eax + 4]
lea esi, [eax + 4]
lea ebx, [eax + 0x14]
mov eax, dword [ebx]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edx, dword [ebp + 8]
mov ecx, esi
mov edi, dword [ebp + 0xc]
push edi
mov eax, dword [edx + 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [edx + 0x20]
mov dword [edx + 0x24], eax
mov eax, dword [edx]
mov dword [edx + 4], eax
lea eax, [esp + 0x18]
push eax
call fcn.004201f0
push 4
mov dword [esp + 0x3c], 0
push dword [esp + 0x18]
mov eax, dword [esi]
mov esi, dword [sym.imp.GDI32.dll_CombineRgn]
push eax
push eax
call esi
push edi
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
call fcn.004201f0
mov eax, dword [ebx]
mov ebx, dword [esp + 0x24]
push 4
push ebx
push eax
push eax
call esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push edi
push eax
lea ecx, [esi + 0xc]
call fcn.004201f0
mov byte [esp + 0x38], 2
mov eax, dword [esi + 0xc]
mov esi, dword [esp + 0x1c]
push 4
push esi
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x14]
push 1
push 1
lea eax, [edi + 0x20]
push eax
call fcn.004202e0
push 1
push 1
push edi
lea ecx, [esp + 0x28]
call fcn.004202e0
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x20], 0
setle al
cmp dword [ecx + 0x1c], 0
movzx eax, al
push eax
setle al
movzx eax, al
push eax
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x30]
call fcn.004202e0
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ecx + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x20]
mov dword [edi + 0x1c], eax
call esi
push dword [esp + 0x20]
call fcn.004ae337
add esp, 4
push ebx
call esi
push dword [esp + 0x28]
call fcn.004ae337
add esp, 4
push dword [esp + 0x14]
call esi
push dword [esp + 0x18]
call fcn.004ae337
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8