joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b50
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x407b6c
pop esi
pop ecx
ret
push edi
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x407190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x407b94
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x408270
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov edx, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push eax
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x408296
xor eax, eax
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push str.Start
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], 4
call edi
cmp dword [esp + 8], 2
jne 0x408348
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
sub eax, 0x10
mov dword [esp + 0x14], 0x10000
mov edx, dword [eax + 8]
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x8000
or ecx, edx
jge 0x4082fc
push 0x8000
mov ecx, esi
call fcn.00407c90
mov eax, dword [esi]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push 0
push str.ImagePath
push edx
call edi
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x40832d
push ecx
push eax
call fcn.00495a6d
add esp, 8
test eax, eax
jl 0x40835b
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x40835b
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
xor eax, eax
test edi, edi
sete al
mov esi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ecx
ret 0xc
push 0x80070057
call fcn.004010b0
int3
Function at 0x409810
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
xor ebp, ebp
push str.System
mov esi, ecx
push ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, ebp
jne 0x409856
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetStartTime_error:__d
push esi
call fcn.00408af0
add esp, 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push edi
push 0x10000
call fcn.00493554
mov edi, eax
add esp, 4
lea eax, [esp + 0x2c]
push eax
push ebx
mov dword [esp + 0x20], edi
mov esi, edi
call dword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
lea ecx, [esp + 0x10]
push ecx
push ebx
mov dword [esp + 0x18], ebp
call dword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x10000
push edi
push ecx
push 0xa
push ebx
mov dword [esp + 0x40], ebp
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
test eax, eax
je 0x409996
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x4098c0
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x2c]
jbe 0x409992
test ebp, ebp
jne 0x409992
cmp dword [esp + 0x14], ebp
jbe 0x40995e
test ebp, ebp
jne 0x40995e
mov eax, dword [esi + 8]
push str.Microsoft_Windows_Kernel_General
lea edi, [esi + 0x38]
push edi
mov dword [esp + 0x18], eax
call ebx
test eax, eax
jne 0x409903
cmp dword [esi + 0x14], 0xc
jne 0x409903
mov ebp, dword [esi + 0xc]
push str.Microsoft_Windows_Kernel_Boot
push edi
call ebx
test eax, eax
jne 0x40991c
cmp dword [esi + 0x14], 0x12
jne 0x40991c
test ebp, ebp
jne 0x40991c
mov ebp, dword [esi + 0xc]
push str.Microsoft_Windows_Wininit
push edi
call ebx
test eax, eax
jne 0x40992e
cmp dword [esi + 0x14], 0xe
je 0x409943
push str.Microsoft_Windows_Winlogon
push edi
call ebx
test eax, eax
jne 0x40994a
cmp dword [esi + 0x14], 0x1b59
jne 0x40994a
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x14]
sub eax, dword [esi]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], eax
add esi, dword [esi]
test eax, eax
ja 0x4098e0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push 0x10000
push edi
push ecx
push 0xa
push edx
mov esi, edi
mov dword [esp + 0x38], 0x10000
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
test eax, eax
jne 0x4098c0
mov ebx, dword [esp + 0x20]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push edi
call fcn.00494968
mov edi, dword [esp + 0x34]
push ebp
push str.GetStartTime_begin:__d
push edi
call fcn.00408af0
mov esi, dword [esp + 0x34]
push esi
push str.GetStartTime_wininit:__d
push edi
call fcn.00408af0
add esp, 0x1c
pop edi
test ebp, ebp
je 0x4099d9
test esi, esi
je 0x4099d9
cmp esi, ebp
jbe 0x4099d9
sub esi, ebp
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x24]
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x40a130
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x18
push edi
mov edi, ecx
call fcn.00406890
test eax, eax
jne 0x40a14b
mov eax, 0x80004005
pop edi
add esp, 0x18
ret 4
mov ecx, dword [0x4cb544]
push ebx
lea eax, [esp + 0x10]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [esp + 0x20], 0x4b3318
mov dword [esp + 0x24], 0x4b3038
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004040c0
cmp eax, ebx
jl 0x40a285
push esi
push 0x20006
push str.AppID
push SysReAllocString
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.004016c0
cmp eax, ebx
je 0x40a1cd
push eax
call fcn.00401270
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
je 0x40a1c2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
mov edx, dword [esp + 0x14]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push 0x4b3038
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00401640
mov esi, eax
cmp esi, ebx
je 0x40a21b
lea ecx, [esp + 0xc]
call fcn.004020b0
lea ecx, [esp + 0x14]
call fcn.004020b0
push esi
call fcn.00401270
add esp, 4
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
mov eax, dword [esp + 0xc]
push str.LocalService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esp + 0x28], bl
je 0x40a270
push 1
lea ecx, [edi + 0x40]
push ecx
push str.LocalService
lea ecx, [esp + 0x18]
call fcn.00401740
mov ecx, edi
call fcn.004066f0
test eax, eax
jne 0x40a270
lea ecx, [esp + 0xc]
call fcn.004020b0
lea ecx, [esp + 0x14]
call fcn.004020b0
pop esi
pop ebx
mov eax, 0x80004005
pop edi
add esp, 0x18
ret 4
lea ecx, [esp + 0xc]
call fcn.004020b0
lea ecx, [esp + 0x14]
call fcn.004020b0
xor eax, eax
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4

Function at 0x40ae80
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x14
call fcn.00406890
test eax, eax
jne 0x40ae95
mov eax, 0x80004005
add esp, 0x14
ret
lea eax, [esp]
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40af1c
mov eax, dword [esp]
push ebp
push esi
push edi
push 0x20006
push 0x4b3038
mov ebp, eax
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004016c0
test eax, eax
je 0x40af29
push eax
call fcn.00401270
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x40af0c
push eax
call edi
test ebp, ebp
je 0x40af13
push ebp
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
push eax
call fcn.00401270
add esp, 4
add esp, 0x14
ret
mov esi, dword [esp + 0x10]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.00408900
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
test esi, esi
je 0x40af4f
push esi
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40af5a
push eax
call edi
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x14
ret
Function at 0x40b340
Capabilities:
Modify service

Disassembly:
sub esp, 0x80c
mov eax, dword [0x4ca1d0]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x814]
push ebp
push edi
xor ebp, ebp
push ebx
mov edi, ecx
mov dword [esp + 0x10], ebp
call fcn.0040a130
test bl, bl
je 0x40b462
push esi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x40b466
push 1
add edi, 0x40
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40b3ad
push eax
mov ebx, 1
call ebp
push esi
call ebp
test ebx, ebx
je 0x40b45c
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x40b3d4
call fcn.00401250
jmp 0x40b468
push 2
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40b44e
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0x400
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00494ec0
add esp, 0xc
push str.Glarysoft_Startup_Manager_Servers
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x14]
push eax
push 1
lea edx, [esp + 0x20]
push esi
mov dword [esp + 0x20], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
call ebp
mov esi, dword [esp + 0x10]
push ebx
call ebp
mov eax, esi
jmp 0x40b468
call fcn.00401250
push ebx
mov esi, eax
call ebp
mov eax, esi
jmp 0x40b468
mov eax, dword [esp + 0x10]
jmp 0x40b468
mov eax, ebp
jmp 0x40b469
mov eax, ebp
pop esi
mov ecx, dword [esp + 0x814]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049473c
add esp, 0x80c
ret 4
Function at 0x40b850
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4b0a78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ca1d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
call fcn.00408130
mov esi, dword [esp + 0x20]
push str.Log_
push eax
push esi
mov dword [esp + 0x24], 0
call fcn.0040a050
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0x10
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b8c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x20], 0
je 0x40b8e6
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b8e6
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x40b900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b0ac1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ca1d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [0x4d3dfc]
mov edx, dword [eax + 0xc]
mov ecx, 0x4d3dfc
mov dword [esp + 0x20], ebx
call edx
mov esi, dword [esp + 0x28]
add eax, 0x10
mov dword [esi], eax
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], 1
call fcn.0040b850
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax]
push ecx
push edx
push str._sSession__d.log
push esi
mov dword [esp + 0x30], 1
call fcn.004088c0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b9a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x40b9c0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b08d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca1d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x318]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x20], 1
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
lea esi, [edi + 0x2bc]
push ecx
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.004084d0
mov ebx, dword [esp + 0x14]
mov ebp, dword [esi + 0x18]
mov eax, dword [esi]
test ebx, ebx
je 0x40ba2f
cmp ebx, eax
je 0x40ba34
call fcn.004948d8
cmp dword [esp + 0x18], ebp
je 0x40baf6
test ebx, ebx
jne 0x40baeb
call fcn.004948d8
xor eax, eax
mov edx, dword [esp + 0x18]
cmp edx, dword [eax + 0x18]
jne 0x40ba5b
call fcn.004948d8
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x10], 0
je 0x40baf6
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x38]
push edx
mov ecx, edi
call fcn.0040b900
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40baa3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
jne 0x40baf2
call fcn.004948d8
xor eax, eax
mov ebp, dword [esp + 0x18]
cmp ebp, dword [eax + 0x18]
jne 0x40babc
call fcn.004948d8
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40bacb
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
push ebp
push ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0040a290
lea ecx, [edi + 0x390]
call fcn.0040fe20
mov edx, dword [esp + 0x1c]
push edx
jmp 0x40bafb
mov eax, dword [ebx]
jmp 0x40ba4d
mov eax, dword [ebx]
jmp 0x40baae
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x40cc50
Capabilities:
Get user security identifier

Disassembly:
push 0xffffffffffffffff
push 0x4b0b71
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca1d0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x4d3dfc]
mov edx, dword [eax + 0xc]
mov ecx, 0x4d3dfc
mov dword [esp + 0x34], ebx
call edx
mov ecx, dword [esp + 0x3c]
add eax, 0x10
mov dword [ecx], eax
mov edx, dword [0x4d3dfc]
mov eax, dword [edx + 0xc]
mov edi, 1
mov ecx, 0x4d3dfc
mov dword [esp + 0x34], ebx
mov dword [esp + 0x1c], edi
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov ebp, 0x7fff
push ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call fcn.00493554
mov edi, eax
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebp
add esp, 4
or eax, ecx
jge 0x40ccf8
push ebp
lea ecx, [esp + 0x1c]
call fcn.00407c90
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x24]
push edx
push esi
lea eax, [esp + 0x30]
push eax
push edi
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea edx, [esp + 0x14]
push edx
push edi
mov dword [esp + 0x1c], ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov edx, dword [esp + 0x14]
cmp edx, ebx
jne 0x40cd30
xor eax, eax
jmp 0x40cd44
mov eax, edx
lea ebp, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40cd35
sub eax, ebp
sar eax, 1
mov ebp, dword [esp + 0x3c]
push eax
push edx
mov ecx, ebp
call fcn.00408760
push edi
call fcn.00494968
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esi - 0x10]
mov byte [esp + 0x34], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x40de00
Capabilities:
Access peb ldr_data
Get session information
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x4b0d20
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ca1d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x1c], edi
mov eax, dword [0x4d3dfc]
mov edx, dword [eax + 0xc]
mov ecx, 0x4d3dfc
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x34]
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x30], edi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x40dea4
mov edx, dword [0x4d3dfc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4d3dfc
call eax
mov edi, dword [esp + 0x30]
add eax, 0x10
mov dword [edi], eax
mov ecx, edi
call fcn.00407270
lea eax, [esi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40df1c
mov ecx, dword [eax]
push eax
jmp 0x40df15
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 5
push ebx
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x40decd
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.0040c540
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x40dedb
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
push esi
call fcn.004070a0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40df1c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x40e260
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push 0xffffffffffffffff
push 0x4b0db0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ca1d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push 0x4bf3c0
push 1
push ebx
push 0x4bf3d0
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x40e376
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x14]
mov byte [esp + 0x30], 1
call eax
cmp eax, ebx
mov eax, dword [esp + 0x1c]
jl 0x40e366
cmp eax, ebx
je 0x40e368
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jl 0x40e362
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40e362
lea ebx, [ebx]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
dec eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + eax*4]
push ecx
push eax
mov ecx, edi
call fcn.0040d510
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + ecx*4]
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x40e310
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push eax
call edx
test eax, eax
jge 0x40e302
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov byte [esp + 0x28], bl
je 0x40e376
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
cmp eax, ebx
je 0x40e38e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4102d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x4102b0
push 0
push 0
mov dword [ecx + 4], 0
call fcn.004962ed
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x410380
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
xor eax, eax
push edi
xor ebp, ebp
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x14]
push eax
push 8
mov esi, ecx
mov eax, dword [esi + 0x38]
lea ecx, [esp + 0x20]
push ecx
push 8
lea edx, [esp + 0x54]
push edx
push 0x8000c010
push eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4103f0
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov edi, eax
jmp 0x4103ff
push str.FINDPROCESSTIME_Error____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x18]
jne 0x410451
push ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x38]
push 0x20
lea edx, [esp + 0x28]
push edx
push 8
lea eax, [esp + 0x54]
push eax
push 0x8000c00c
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x410446
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
adc edx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
push str.GETPROCESSTIME_Error____n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
pop edi
pop esi
pop ebp
mov edx, ebx
pop ebx
add esp, 0x2c
ret 8