joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045d6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
mov dword [ebp - 0x21c], eax
xor esi, esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.004045a3
mov ebx, eax
cmp ebx, esi
je 0x40463e
cmp dword [ebp - 0x214], esi
je 0x404637
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4046d9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x404666
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.004045d6
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x4046ea
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x404646
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], esi
je 0x4046b1
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], esi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x214], esi
je 0x4046d7
push dword [ebp - 0x214]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425271
leave
ret 4
cmp dword [ebp - 0x214], esi
je 0x4046fe
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x4046d9
Function at 0x40576d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [0x44fe44], eax
push esi
jle 0x405826
cmp dword [0x450310], eax
jle 0x4057a3
sub dword [0x450310], 5
jmp 0x405826
dec dword [0x44fe44]
mov esi, 0x400
push esi
push eax
lea eax, [ebp - 0x408]
push eax
mov dword [0x450310], 0x1c20
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x40c]
push eax
push str.UpdateTipCycle
push str.SOFTWARE360Safe_softmgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x40c], 4
mov dword [ebp - 0x410], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x405826
cmp dword [ebp - 0x40c], 4
jne 0x405826
cmp dword [ebp - 0x408], 1
jne 0x405826
push str.softmgrSoftupNotify.exe
xor esi, esi
call fcn.0040ad36
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00425271
leave
ret

Function at 0x4064ea
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x234
mov eax, 0x43e746
call fcn.00429c87
mov eax, dword [ebp + 8]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], edi
push 8
push str.Software360safe_tpi
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x228]
mov dword [ebp - 4], edi
call fcn.004045a3
test eax, eax
jne 0x40661f
mov dword [ebp - 0x220], edi
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
mov dword [ebp - 0x238], 0x104
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40661f
xor esi, esi
push dword [esi + 0x44fe28]
lea eax, [ebp - 0x21c]
push eax
call fcn.00426398
pop ecx
pop ecx
test eax, eax
je 0x406609
add esi, 4
cmp esi, 8
jb 0x40657f
xor esi, esi
mov dword [ebp - 0x22c], edi
xor ebx, ebx
push dword [ebx + 0x44fd38]
lea eax, [ebp - 0x21c]
push eax
call fcn.00426398
pop ecx
pop ecx
test eax, eax
je 0x4065cf
add ebx, 0x14
inc esi
cmp ebx, 0xf0
jb 0x4065a9
jmp 0x4065eb
mov eax, dword [ebp - 0x230]
mov dword [eax + esi*4], 1
imul esi, esi, 0x14
add esi, 0x44fd38
mov dword [ebp - 0x22c], esi
mov edx, dword [ebp - 0x22c]
push edi
push dword [ebp - 0x228]
lea ecx, [ebp - 0x21c]
push dword [ebp - 0x234]
call fcn.0040633c
inc dword [ebp - 0x220]
cmp dword [ebp - 0x220], 0x200
jl 0x406541
cmp dword [ebp - 0x228], edi
je 0x406633
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00429d0a
ret 8
Function at 0x406786
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x43e5ea
call fcn.00429c1e
mov ebx, ecx
cmp dword [ebx + 0x7c], 0
jne 0x406897
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x34]
push esi
push eax
mov dword [ebp - 0x14], eax
call fcn.00405fc3
test eax, eax
jne 0x406897
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4067de
push esi
call fcn.004055b8
pop ecx
test eax, eax
jne 0x4067de
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov edi, 0x44fe48
call fcn.00409097
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x406897
push str.CreateTrayClient
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406890
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 1
call eax
mov edi, eax
test edi, edi
je 0x406890
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jb 0x406889
mov ebx, dword [ebx + 0x84]
and dword [ebp + 0xc], 0
test ebx, ebx
je 0x406889
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push ebx
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x406889
lea eax, [ebp - 0x40]
push eax
call fcn.004068a1
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], esi
call fcn.004031c2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x38], edi
call fcn.00405c12
lea esi, [ebp - 0x2c]
call fcn.0041c4c6
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
call fcn.004054cf
mov eax, edi
jmp 0x406899
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
call fcn.00429cf6
ret 8
Function at 0x406b62
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
push 0xc68
mov eax, 0x43d9ad
call fcn.00429c87
mov eax, dword [ebp + 8]
lea esi, [eax + 0x64]
mov eax, esi
mov dword [ebp - 0xc64], ecx
mov dword [ebp - 0xc58], esi
call fcn.004077c7
xor ebx, ebx
mov dword [ebp - 0xc60], ebx
mov dword [ebp - 0xc5c], ebx
push 0x20019
push str.Software360safemenuext
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xc60]
mov dword [ebp - 4], ebx
call fcn.004045a3
test eax, eax
jne 0x406dc7
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0xc60]
mov dword [ebp - 0xc50], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x406dbf
inc dword [ebp - 0xc50]
cmp dword [ebp - 0xc50], 0x64
jge 0x406dc7
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc48], ebx
push 0x20019
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0xc60]
lea eax, [ebp - 0xc4c]
call fcn.004045a3
test eax, eax
jne 0x406d78
push str.Application
lea eax, [ebp - 0xc4c]
push eax
lea esi, [ebp - 0xc54]
lea edi, [ebp - 0xc44]
mov dword [ebp - 0xc54], 0x410
call fcn.004091a4
test eax, eax
jne 0x406d78
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406d78
push 0x4425b8
lea eax, [ebp - 0xc4c]
push eax
lea edi, [ebp - 0x424]
mov dword [ebp - 0xc54], 0x208
call fcn.004091a4
test eax, eax
jne 0x406d78
mov esi, 0x410
push esi
lea eax, [ebp - 0x834]
push ebx
push eax
call fcn.004253c0
add esp, 0xc
push str.Parameters
lea eax, [ebp - 0xc4c]
mov dword [ebp - 0xc54], esi
push eax
lea esi, [ebp - 0xc54]
lea edi, [ebp - 0x834]
call fcn.004091a4
lea eax, [ebp - 0xc68]
push eax
push str.flags
lea eax, [ebp - 0xc4c]
push eax
mov dword [ebp - 0xc68], ebx
call fcn.0040920c
mov edi, dword [ebp - 0xc50]
lea eax, [ebp - 0x424]
push eax
lea eax, [edi + 0x64]
push eax
push dword [ebp - 0xc68]
push dword [ebp - 0xc64]
call dword [sym.imp.USER32.dll_AppendMenuW]
lea esi, [ebp - 0xc70]
call fcn.004054ba
lea esi, [ebp - 0xc6c]
call fcn.004054ba
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc70]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0xc74], edi
call fcn.004031c2
lea eax, [ebp - 0x834]
push eax
mov eax, esi
push eax
call fcn.004031c2
lea eax, [ebp - 0xc74]
push eax
mov eax, dword [ebp - 0xc58]
call fcn.00407760
mov eax, dword [ebp - 0xc6c]
add eax, 0xfffffff0
call fcn.004054cf
mov eax, dword [ebp - 0xc70]
add eax, 0xfffffff0
call fcn.004054cf
mov byte [ebp - 4], bl
cmp dword [ebp - 0xc4c], ebx
je 0x406d95
push dword [ebp - 0xc4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc4c], ebx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0xc50]
mov dword [ebp - 0xc48], ebx
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, dword [ebp - 0xc58]
test eax, eax
je 0x406be1
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0xc
cdq
pop ecx
idiv ecx
test eax, eax
jbe 0x406dea
push ebx
push ebx
push 0x800
push dword [ebp - 0xc64]
call dword [sym.imp.USER32.dll_AppendMenuW]
cmp dword [ebp - 0xc60], ebx
je 0x406dfe
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00429d0a
ret 4
Function at 0x408fa9
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push str.Path
xor edi, edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
inc edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80c], edi
mov dword [ebp - 0x810], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40906b
push str.360ver.dll
lea eax, [ebp - 0x808]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40906b
lea eax, [ebp - 0x808]
push eax
call fcn.00405600
mov esi, eax
pop ecx
test esi, esi
je 0x40906b
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00425271
leave
ret

Function at 0x40907b
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret 8

Function at 0x409097
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004337b0
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x100c]
push ebx
push eax
call fcn.004253c0
add esp, 0xc
mov esi, 0x800
push 0x442f64
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push edi
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push 0x442f6c
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push edi
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push str.vL
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push dword [ebp + 8]
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push 0x442fbc
mov eax, esi
lea ecx, [ebp - 0x100c]
call fcn.00408f13
push 0x14
push edi
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40919d
push 0xc8
push 0x442ef8
mov esi, 0x44ffe0
push esi
call fcn.0043c932
add esp, 0xc
test eax, eax
jne 0x40918c
call fcn.00408fa9
test eax, eax
je 0x40918c
push 5
push ebx
push ebx
push 0x450178
jmp 0x409191
push 5
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.004266cb
int3
Function at 0x4091a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409208
cmp dword [ebp + 0xc], 1
je 0x4091e0
cmp dword [ebp + 0xc], 2
je 0x4091e0
push 0xd
pop eax
jmp 0x409208
mov eax, dword [ebp - 4]
test edi, edi
je 0x409202
test eax, eax
je 0x4091fd
test al, 1
jne 0x4091db
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x409202
jmp 0x4091db
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x4092ea
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push 5
push ebx
push 0x4532d9
mov dword [0x4526b0], 0x4431b8
mov dword [0x4526b4], ebx
mov dword [0x4526b8], ebx
call fcn.004253c0
push 0x208
push ebx
mov esi, 0x4526bc
push esi
call fcn.004253c0
push esi
mov eax, str.safemonMiniDump.dmp
call fcn.0040a54b
add esp, 0x1c
mov esi, str.dbghelp.dll
push esi
mov dword [0x4532cc], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x4532d0], eax
cmp eax, ebx
jne 0x40935f
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4532d0], eax
cmp eax, ebx
je 0x409370
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4526b8], eax
push 0xc365
lea eax, [ebp - 4]
push eax
call fcn.00409ada
mov edx, dword [eax]
push 0x4528c4
mov ecx, 0x104
call fcn.00405a76
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004054cf
push 0xc366
lea eax, [ebp - 4]
push eax
call fcn.00409ada
mov edx, dword [eax]
push 0x452acc
mov ecx, 0x400
call fcn.00405a76
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004054cf
pop esi
mov dword [0x4532d4], ebx
mov byte [0x4532d8], bl
mov eax, 0x4526b0
pop ebx
leave
ret

Function at 0x40956b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
jne 0x40957a
xor al, al
jmp 0x4095d7
push 5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x409576
and dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push dword [ebp + 8]
call esi
test eax, eax
je 0x4095ca
push 5
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00426770
and dword [ebp - 8], 0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4095d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x4095d6
mov al, 1
pop esi
leave
ret 8
Function at 0x409a89
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
add edi, 0xc
push edi
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
test ebx, ebx
jbe 0x409ac5
mov ebp, str.360360TrayMiniDmp.dmp
push ebp
call fcn.00425946
pop ecx
mov ecx, esi
sub ecx, eax
cmp ebx, ecx
jae 0x409ac5
push ebp
mov eax, esi
mov ecx, edi
call fcn.00408f13
jmp 0x409ad5
push 0x208
push 0
push edi
call fcn.004253c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x409d91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409da8
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x409ddd
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x409dd9
cmp edi, eax
jae 0x409ddd
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x409dcb
cmp edi, eax
jb 0x409de1
xor eax, eax
jmp 0x409dea
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x409f09
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x80], esi
xor edi, edi
xor ebx, ebx
call fcn.0040a3e7
test eax, eax
je 0x409f8d
xor eax, eax
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.004253c0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x7c]
mov eax, 0x451040
mov dword [ebp - 0x7c], edi
call fcn.0041c14e
cmp dword [ebp - 0x7c], edi
je 0x409f85
push 0xbb8
push esi
lea eax, [ebp - 0x78]
push eax
call dword [ebp - 0x7c]
jmp 0x409f87
xor eax, eax
mov ebx, eax
cmp eax, edi
jne 0x409ff3
push 8
call fcn.004254b1
mov esi, eax
pop ecx
cmp esi, edi
je 0x409fa2
call fcn.004054ba
jmp 0x409fa4
xor esi, esi
cmp esi, edi
jne 0x409fac
xor eax, eax
jmp 0x409ff3
push dword [ebp - 0x80]
push esi
call fcn.004031c2
push edi
push edi
push esi
push 0x409ef2
push edi
push edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x409ff1
push dword [ebp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x409ff1
mov eax, dword [esi]
mov ebx, dword [esi + 4]
sub eax, 0x10
call fcn.004054cf
push esi
call fcn.00425266
pop ecx
mov eax, ebx
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425271
add ebp, 0x194
leave
ret
Function at 0x40a00b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp word [0x4545b8], 0
jne 0x40a01f
xor eax, eax
leave
ret
push esi
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.004253c0
mov eax, dword [ebp + 8]
and dword [ebp - 0x34], 0
and dword [ebp - 0x24], 0
mov esi, 0x4545b8
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x1000
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 1
call fcn.0040a32a
pop esi
test eax, eax
je 0x40a01b
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret

Function at 0x40a078
Capabilities:
Accept command line arguments

Disassembly:
push 0xc
mov eax, 0x43e94b
call fcn.00429c1e
push str._elevated
lea eax, [ebp - 0x10]
push eax
call fcn.00409ada
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40a0f1
xor edi, edi
inc edi
cmp dword [ebp - 0x14], edi
jle 0x40a0f1
mov esi, 0x443258
push esi
call fcn.00425946
pop ecx
push eax
push esi
lea eax, [ebp - 0x10]
call fcn.0040a2ab
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + edi*4]
test ebx, ebx
jne 0x40a0da
xor eax, eax
jmp 0x40a0e1
push ebx
call fcn.00425946
pop ecx
push eax
push ebx
lea eax, [ebp - 0x10]
call fcn.0040a2ab
inc edi
cmp edi, dword [ebp - 0x14]
jl 0x40a0bb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x10]
push 0xbb8
call fcn.00409f09
pop ecx
test eax, eax
jne 0x40a128
push dword [ebp - 0x10]
call fcn.0040a00b
pop ecx
test eax, eax
jne 0x40a128
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004054cf
xor eax, eax
jmp 0x40a136
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004054cf
xor eax, eax
inc eax
call fcn.00429cf6
ret
Function at 0x40a13c
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
push ebx
push esi
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push 2
mov edi, eax
mov dword [ebp - 0x80], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, ebx
jne 0x40a17d
xor eax, eax
jmp 0x40a1e5
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40a198
cmp dword [ebp - 0x78], edi
je 0x40a19e
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a189
jmp 0x40a1dc
mov edi, dword [ebp - 0x68]
test edi, edi
je 0x40a1dc
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40a1c0
cmp dword [ebp - 0x78], edi
je 0x40a1c6
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a1b1
jmp 0x40a1dc
push 0x44325c
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40a1dc
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp + 0x1ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425271
add ebp, 0x1b0
leave
ret

Function at 0x40a4bb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
push 2
mov eax, 0x400
pop edx
mov esi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004250c7
mov edi, eax
pop ecx
mov ebx, 0x4425b8
test edi, edi
je 0x40a53d
push dword [ebp + 0x14]
push esi
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esi - 2]
cmp eax, ecx
jb 0x40a527
push edi
call fcn.0042548b
add esi, esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004250c7
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40a4e8
test edi, edi
je 0x40a53d
push edi
push dword [ebp + 0x10]
call fcn.004031c2
push edi
call fcn.0042548b
pop ecx
jmp 0x40a546
push ebx
push dword [ebp + 0x10]
call fcn.004031c2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a592
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x40a5b2
xor eax, eax
jmp 0x40a605
push edi
push esi
call fcn.00425716
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x40a5c4
xor eax, eax
jmp 0x40a604
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40a5fb
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x443314
push edi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push edi
call fcn.004257e0
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret