joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9c1a80
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0xa0a230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
push edi
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x108], ecx
xor ebx, ebx
xor esi, esi
call fcn.0099cc50
add esp, 4
mov dword [ebp - 0x118], eax
test eax, eax
jne 0x9c1afa
push 0x100
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009bc270
push eax
mov eax, dword [ebp - 0x108]
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push eax
call fcn.0098bf60
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x9c1c63
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10c], eax
cmp eax, 0xffffffff
jne 0x9c1b56
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009bc270
mov edx, dword [ebp - 0x108]
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push edx
call fcn.0098bf60
add esp, 0x1c
mov esi, 0x4d
jmp 0x9c1c63
lea ecx, [ebp - 0x124]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x9c1ba0
push 0x100
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009bc270
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov eax, dword [ebp - 0x108]
push eax
call fcn.0098bf60
add esp, 0x1c
mov esi, 0x4d
jmp 0x9c1c56
mov edi, dword [ebp - 0x124]
cmp dword [ebp - 0x120], ebx
jl 0x9c1bd8
jg 0x9c1bb8
cmp edi, 0x100000
jbe 0x9c1bd8
mov ecx, dword [ebp - 0x108]
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ecx
call fcn.0098bf60
mov esi, 0x4d
jmp 0x9c1c53
lea edx, [edi + 1]
push edx
call dword [0xa0b33c]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x9c1bf0
lea esi, [eax + 0x1b]
jmp 0x9c1c56
test edi, edi
je 0x9c1c31
push 0
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10c]
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [esi + ebx]
push edx
push eax
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x9c1c97
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x9c1c93
add esi, eax
cmp esi, edi
jb 0x9c1bf4
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x11c]
push ecx
push ebx
push edx
mov edx, dword [ebp - 0x110]
mov ecx, edi
mov byte [edi + ebx], 0
call fcn.009c1810
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0xa0b340]
mov eax, dword [ebp - 0x118]
add esp, 4
test eax, eax
je 0x9c1c80
push eax
call fcn.0096aef5
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0096fab0
mov esp, ebp
pop ebp
ret
mov edi, esi
jmp 0x9c1c31
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.009bc270
mov edx, dword [ebp - 0x110]
push eax
push edx
push str.schannel:_failed_to_read_from_CA_file__s:__s
jmp 0x9c1b87
Function at 0x9c2650
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xa0a230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9c26e1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.009c25c0
mov ecx, esi
push 8
push ecx
call fcn.009c7cf0
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x9c26f2
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0096fab0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0096fab0
mov esp, ebp
pop ebp
ret

Function at 0x9c41c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x9c41f3
push 0x2e
push esi
call fcn.0096fbc0
add esp, 8
test eax, eax
je 0x9c41f1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x9c7d40
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9c7d79
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
ret
Function at 0x9c9200
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0xa0b33c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x9c922b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x9c9272
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x9c9275
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x9c92d6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x9c92a0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x9c930f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x9ff3aa
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x9ff3ab
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x9c92e0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x9c93e0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9c9413
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x9cb5a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9cb5cc
call fcn.0096daf8
mov dword [eax], esi
call fcn.0096dae5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0096e73a
mov eax, esi
jmp 0x9cb621
test dword [ebp + 0xc], 0xfffffff9
jne 0x9cb5b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9cb5f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096db0b
pop ecx
call fcn.0096dae5
mov eax, dword [eax]
jmp 0x9cb621
test al, 0x10
jne 0x9cb61f
test al, 1
je 0x9cb61f
test byte [ebp + 0xc], 2
je 0x9cb61f
call fcn.0096daf8
mov dword [eax], 5
call fcn.0096dae5
mov dword [eax], 0xd
jmp 0x9cb5f0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x100019e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
lahf
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000160a
push eax
push esi
push dword [ebp + 8]
call fcn.100015bf
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000160a
push eax
push esi
push dword [ebp + 8]
call fcn.100015bf
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100015fa
xor eax, 0x88e49d07
popfd
jl 0x10001a7f
invalid
invalid

Function at 0x10001ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x629072aa
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6f797f4d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4043f1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x40440a
cmp dword [esi], 2
jae 0x40440a
push 0x7a
pop eax
jmp 0x404468
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404468
cmp dword [ebp + 0x10], 7
je 0x404438
push 0xd
jmp 0x404407
mov ecx, dword [ebp + 0xc]
test edi, edi
je 0x404462
test cl, 1
jne 0x404434
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x404434
cmp word [edi + eax*2 - 2], 0
jne 0x404434
cmp eax, 1
jbe 0x404462
cmp word [edi + eax*2 - 4], 0
jne 0x404434
shr ecx, 1
mov dword [esi], ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4089ac
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x4089fd
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x408a0e
push 0xd
pop eax
jmp 0x408a3b
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x408a11
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x409397
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x18
mov eax, 0x452fcd
call fcn.0043e177
mov eax, dword [ebp + 0x20c]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
lea ecx, [ebp - 0x14]
call fcn.004043b0
mov ebx, eax
cmp ebx, esi
je 0x40941f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404395
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.0043e168
add ebp, 0x204
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x409437
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.00409397
cmp eax, esi
jne 0x409469
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x100
call ebx
test eax, eax
je 0x409427
lea ecx, [ebp - 0x14]
call fcn.00404395
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.004088f7
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00404395
mov eax, esi
jmp 0x4093fa
Function at 0x40c39e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x4535be
call fcn.0043e1aa
mov eax, dword [ebp + 0x410]
mov esi, dword [ebp + 0x414]
mov edi, dword [ebp + 0x418]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp], ebx
mov byte [ebp - 4], 1
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40c406
call fcn.00407ee3
mov esi, eax
jmp 0x40c50b
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x40c41f
call fcn.00407ee3
jmp 0x40c500
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x40c415
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x20], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40c491
mov byte [ebp - 4], bl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x40c459
lea ecx, [ebp]
call fcn.00417d8e
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00405950
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0043e168
add ebp, 0x408
leave
ret 0x10
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp]
call fcn.0040a6bf
mov dword [ebp - 4], 1
jmp 0x40c4c1
cmp dword [ebp], ebx
jne 0x40c4cd
mov esi, 0x8007000e
jmp 0x40c502
push esi
push dword [ebp]
push esi
push dword [ebp - 0x18]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x40c415
xor ecx, ecx
mov edx, dword [ebp]
mov word [edx + eax*2], cx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x28]
call fcn.0040bde7
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x40c45e
lea ecx, [ebp]
call fcn.00417d8e
jmp 0x40c45e
Function at 0x40cb95
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x5c
mov eax, 0x4536f2
call fcn.0043e177
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x38
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], 0x459144
call fcn.0043e5f0
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.0043e5f0
add esp, 0x18
call fcn.00417a90
mov eax, dword [eax + 4]
push 0x104
lea ecx, [ebp]
push ecx
push dword [eax + 0x44]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x214]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040c0a7
add esp, 0xc
mov byte [ebp - 4], 1
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040836a
test eax, eax
jne 0x40cc56
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0040c99d
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.004016db
push eax
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40cc90
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x10]
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004018f8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.004024cb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x214]
call fcn.004024cb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043e168
add ebp, 0x20c
leave
ret 4

Function at 0x40e1d4
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push dword [0x479118]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x413164
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
jne 0x413170
xor eax, eax
ret
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
ret

Function at 0x4135f6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.0043e5f0
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x413663
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
jne 0x413663
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__CSUComUtil::IsWindowsVistaOrLater__GetVersionEx_failed_with_error__d._n
call fcn.0043e38b
pop ecx
pop ecx
xor eax, eax
jmp 0x41366e
cmp dword [ebp - 0x7c], 6
jb 0x41366c
xor edi, edi
inc edi
mov eax, edi
mov ecx, dword [ebp + 0x9c]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e168
add ebp, 0xa0
leave
ret

Function at 0x4137c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413831
cmp dword [ebp + 0x10], 1
je 0x413809
cmp dword [ebp + 0x10], 2
je 0x413809
push 0xd
pop eax
jmp 0x413831
mov eax, dword [ebp - 4]
test edi, edi
je 0x41382b
test eax, eax
je 0x413826
test al, 1
jne 0x413804
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41382b
jmp 0x413804
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4141a0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x477930]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0041413d
test eax, eax
je 0x4141be
xor eax, eax
inc eax
jmp 0x414220
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x414205
push 0x45cd78
call fcn.0043e38b
pop ecx
jmp 0x41421c
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e168
leave
ret
Function at 0x41559e
Capabilities:
Get system information on windows

Disassembly:
push 4
mov eax, 0x454788
call fcn.0043e177
mov esi, ecx
push 0x24
lea eax, [esi + 4]
push 0
push eax
call fcn.0043e5f0
mov ebx, 0x11c
push ebx
lea edi, [esi + 0x28]
push 0
push edi
call fcn.0043e5f0
add esp, 0x18
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [edi], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
call ebx
mov dword [esi + 0x144], eax
test eax, eax
jne 0x41560c
push edi
mov dword [edi], 0x114
call ebx
test eax, eax
jne 0x41560c
push 0x45ae2a
lea ecx, [ebp - 0x10]
call fcn.0040720d
and dword [ebp - 4], 0
jmp 0x41561e
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00414f25
mov dword [ebp - 4], 1
push eax
lea ecx, [esi + 0x148]
call fcn.00402ef7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004024cb
xor eax, eax
call fcn.0043e24f
ret