joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac4c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40acc3
push esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40acb3
xor eax, eax
jmp 0x40acc2
push esi
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9a6c
mov esp, ebp
pop ebp
ret

Function at 0x40acd1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov edx, 0xf8d5527a
push 0xc0209385
mov ecx, 0x16f831c7
call fcn.004015a5
lea edx, [ebp - 0x108]
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ad04
test esi, esi
je 0x40ad3f
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ad1b
sub ecx, edx
mov byte [ebp + ecx - 0x108], 0x2f
lea ecx, [ebp + ecx - 0x107]
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
test al, al
jne 0x40ad35
push 0x104
lea eax, [ebp - 0x310]
xor esi, esi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 5
push esi
push esi
lea eax, [ebp - 0x310]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b9a6c
mov esp, ebp
pop ebp
ret

Function at 0x40ad84
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp + 0x94], eax
push edi
xor edi, edi
mov dword [ebp - 0x80], 0x114
push 0x10c
lea eax, [ebp - 0x78]
mov dword [ebp - 0x7c], edi
push edi
push eax
call fcn.004bf040
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jae 0x40ae07
push esi
mov esi, dword [0x52aa64]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
test eax, eax
je 0x40adf9
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 4]
inc edi
sub eax, dword [esi]
sar eax, 2
cmp edi, eax
jb 0x40ade1
mov eax, dword [esi]
sub esp, 0xc
mov dword [esi + 4], eax
call fcn.0040cce0
pop esi
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
pop edi
call fcn.004b9a6c
lea esp, [ebp + 0x98]
pop ebp
ret
Function at 0x40ae51
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0x52b408aa
mov edx, 0xefd20943
mov ecx, 0xe22a367d
call fcn.004012b5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x407ec8
push 0xaaf0249
mov edx, 0xb7c903b0
mov ecx, 0xba313ca4
call fcn.0040128b
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52ab34], eax
xor edx, edx
mov ecx, fcn.00407f4f
call fcn.0040807d
lea eax, [esp + 4]
push eax
xor eax, eax
push eax
push eax
push 0x4078c8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x52ab0c], eax
pop esi
pop ecx
ret
push esi
mov esi, ecx
push 0x18
mov dword [0x52aa60], esi
call fcn.004ba21e
pop ecx
test eax, eax
je 0x40ae7e
mov ecx, dword [0x52aa54]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov byte [eax + 0x16], cl
jmp 0x40ae80
xor eax, eax
mov dword [0x52aa4c], eax
mov eax, dword [0x52aa58]
mov eax, dword [eax + 0x14]
shr eax, 6
and al, 1
movzx eax, al
push eax
call fcn.0040cfd5
push esi
call fcn.0040e868
pop esi
jmp 0x407e82
Function at 0x40aea7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor edx, edx
mov ecx, 0x61c274f1
push edi
mov dword [ebp - 0x29c], edx
mov edx, 0x8fef1762
push 0xb71ad68f
call fcn.004015cf
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40af31
push 0x137a40c
mov edx, 0x39c265fc
mov ecx, 0xd7ef0671
call fcn.004015a5
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40af31
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x2a8]
push ecx
lea ecx, [ebp - 0x2ac]
push ecx
call eax
mov eax, dword [ebp - 0x29c]
and eax, 0xfffffff
mov dword [ebp - 0x29c], eax
jmp 0x40af37
mov eax, dword [ebp - 0x29c]
xor esi, esi
cmp eax, 0x55f0
jb 0x40b0da
lea eax, [ebp - 0x294]
mov edx, 0x15d46de2
push eax
push 0x20019
push esi
push 0x2d21ac24
mov ecx, 0xfbf90e81
call fcn.004015cf
pop ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b0da
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x298], 0x40
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x298]
mov edi, esi
push eax
lea eax, [ebp - 0x88]
push eax
push esi
jmp 0x40b0ba
lea eax, [ebp - 0x2a0]
inc edi
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b0a1
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0x208
push eax
lea eax, [ebp - 0x290]
mov edx, 0xaf8fe7e2
push eax
lea eax, [ebp - 0x2b8]
mov ecx, 0x41a284cd
push eax
push esi
push 0x977a260a
call fcn.004015cf
pop ecx
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esi, [ebp - 0x290]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x40b01a
sub esi, ecx
sar esi, 1
cmp esi, 0xc
jbe 0x40b093
push 0x2caf3489
mov edx, 0x145af563
mov ecx, 0xfa77966c
call fcn.004015cf
pop ecx
push eax
lea eax, [ebp + esi*2 - 0x2a8]
push eax
call fcn.004baea8
pop ecx
xor esi, esi
pop ecx
test eax, eax
jne 0x40b095
push 4
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 1
push eax
push 4
push esi
push 0xccbdfb37
mov edx, 0xf4483adb
mov ecx, 0x1a655838
call fcn.004015cf
pop ecx
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40b095
xor esi, esi
push dword [ebp - 0x2a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2b4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40afa4
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x52aa4c]
cmp dword [eax + 8], esi
je 0x40b0eb
call fcn.0040d2da
jmp 0x40b0f6
push esi
xor edx, edx
xor ecx, ecx
call fcn.0041e1ae
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b9a6c
mov esp, ebp
pop ebp
ret
Function at 0x40b8d3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x38
lea eax, [ebp - 0x38]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.004bf040
push 0xf59d74e6
mov edx, 0xcd68b50a
mov dword [ebp - 0x3c], 0x3c
mov ecx, 0x2345d77f
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], esi
call fcn.004015cf
push 0xd62e54f4
mov edx, 0xeedb9512
mov dword [ebp - 0x30], eax
mov ecx, 0xf6f77f
mov dword [ebp - 0x2c], edi
call fcn.004015cf
and dword [ebp - 0x24], 0
add esp, 0x14
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x20], 5
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b9ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp - 4], eax
add cl, 0x41
movzx eax, cl
mov ecx, dword [eax*4 + 0x52aa34]
test ecx, ecx
je 0x40ba1f
cmp byte [ecx + 0x7f], 0
je 0x40ba1f
lea eax, [ebp - 0x20c]
push eax
call fcn.00428bc7
lea eax, [ebp - 0x20c]
push eax
call fcn.0041fe91
pop ecx
test al, al
je 0x40ba1f
push 5
push 0
push 0
lea eax, [ebp - 0x20c]
mov edx, 0x1572b104
push eax
push 0x2d8770e6
mov ecx, 0xfb5fd36d
call fcn.004015cf
pop ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9a6c
mov esp, ebp
pop ebp
ret

Function at 0x40ba2d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x3a
pop edi
mov word [ebp - 0xa], di
mov esi, ecx
push 0x5c
pop edi
movzx ecx, dl
and edx, 0xff00
mov word [ebp - 8], di
xor edi, edi
mov word [ebp - 6], di
mov edi, 0x2400
lea eax, [ecx + 0x41]
mov word [ebp - 0xc], ax
cmp edx, edi
ja 0x40baf9
je 0x40baf1
cmp edx, 0x2000
je 0x40badd
cmp edx, 0x2100
je 0x40bab4
cmp edx, 0x2200
je 0x40baa6
cmp edx, 0x2300
jne 0x40bb37
mov edx, eax
mov ecx, esi
call fcn.00414b3e
jmp 0x40bb37
mov edx, eax
mov ecx, esi
call fcn.00414acc
jmp 0x40bb37
push 5
xor esi, esi
lea eax, [ebp - 0xc]
push esi
push esi
push eax
push 0xba7b0023
mov edx, 0x828ec1c1
mov ecx, 0x6ca3a39c
call fcn.004015cf
pop ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40bb37
add cl, 0x41
movzx eax, cl
mov ecx, esi
push eax
push 7
pop edx
call fcn.0041e1ae
pop ecx
jmp 0x40bb37
push eax
call fcn.0040e087
jmp 0x40bb37
cmp edx, 0x2500
je 0x40bb32
cmp edx, 0x2600
je 0x40bb29
cmp edx, 0x2700
je 0x40bb25
cmp edx, 0x2800
jne 0x40bb37
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.0040b8d3
jmp 0x40bb37
xor dl, dl
jmp 0x40bb2b
mov dl, 1
call fcn.0040b950
jmp 0x40bb37
call fcn.0040b9ad
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b9a6c
mov esp, ebp
pop ebp
ret
Function at 0x40c17d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, 0x104
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, 0x4ef5ec
lea eax, [ebp - 0x414]
push ebx
push eax
push 0xfe732498
mov edx, 0x8fcb3595
mov ecx, 0xde8f0628
call fcn.00401485
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041fe91
add esp, 0x14
test al, al
jne 0x40c238
mov ecx, dword [0x52aa50]
lea eax, [ebp - 0x20c]
push edi
push eax
push 0xf
call fcn.0042126e
test eax, eax
jne 0x40c222
movzx edx, word [0x51f41c]
lea eax, [ebp - 0x20c]
push edi
push eax
xor edx, 0x9191
mov ecx, 0x51f41e
call fcn.00412903
pop ecx
pop ecx
push 0x10
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40c2a6
push esi
call fcn.00409067
mov esi, eax
call fcn.0040914b
test esi, esi
je 0x40c2b6
test eax, eax
je 0x40c2b6
push edi
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004bb2a8
pop ecx
pop ecx
test eax, eax
je 0x40c2a2
push 1
push esi
push 0xb5f8a98d
mov edx, 0x8d0d686e
mov ecx, 0x63200a59
call fcn.004015cf
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00420744
add esp, 0x10
test eax, eax
jne 0x40c348
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004b9a6c
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x52aa50]
lea eax, [ebp - 0x20c]
push edi
push eax
push 0x10
call fcn.0042126e
test eax, eax
jne 0x40c2f0
movzx edx, word [0x51f4a4]
lea eax, [ebp - 0x20c]
push edi
push eax
xor edx, 0x9191
mov ecx, 0x51f4a6
call fcn.00412903
pop ecx
pop ecx
push 0x14
push ebx
lea eax, [ebp - 0x20c]
xor esi, esi
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40c2a2
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push esi
push 0x58577f4a
mov edx, 0x60a2bea9
mov ecx, 0x8e8fdce8
call fcn.004015cf
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00420744
add esp, 0x10
cmp eax, 0x64
jne 0x40c2a2
call fcn.0040c0fb
xor eax, eax
jmp 0x40c2a5
Function at 0x40c5a2
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x4d2d35
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x518450]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
xor ebx, ebx
mov dword [ebp], ebx
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x14], 1
mov dword [esp + 0x18], eax
jle 0x40c6d7
test eax, eax
je 0x40c6d7
xor esi, esi
inc esi
cmp dword [esp + 0x14], esi
jle 0x40c6d7
mov ecx, dword [eax + esi*4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x40c620
cmp eax, 0x2f
jne 0x40c6c8
movzx eax, word [ecx + 2]
push eax
call fcn.00420328
movzx eax, ax
pop ecx
sub eax, 0x64
je 0x40c722
dec eax
je 0x40c71d
sub eax, 0xd
je 0x40c6ed
sub eax, 6
jne 0x40c6c8
mov eax, dword [esp + 0x18]
mov eax, dword [eax + esi*4]
movzx eax, word [eax + 4]
push eax
call fcn.00420328
movzx eax, ax
pop ecx
cmp eax, 0x69
jne 0x40c680
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
call fcn.00409859
mov dword [ebp], eax
call fcn.00409904
call fcn.0040c540
jmp 0x40c6c8
cmp eax, 0x75
jne 0x40c699
xor edi, edi
xor ecx, ecx
inc edi
call fcn.00409859
mov dword [ebp], eax
call fcn.00409fb0
jmp 0x40c6c8
cmp eax, 0x66
jne 0x40c6ab
xor ecx, ecx
xor edi, edi
inc ecx
inc edi
call fcn.00409859
jmp 0x40c6b8
cmp eax, 0x72
jne 0x40c6bd
xor edi, edi
inc edi
call fcn.00406a23
mov dword [ebp], eax
jmp 0x40c6c8
cmp eax, 0x68
jne 0x40c6c8
mov eax, dword [esp + 0x1c]
mov byte [eax], bl
mov eax, dword [esp + 0x18]
inc esi
cmp esi, dword [esp + 0x14]
jl 0x40c60c
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x70
call fcn.004ba21e
pop ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ebx
test eax, eax
je 0x40c70b
push ebx
mov ecx, eax
call fcn.0040d344
mov ebx, eax
xor ecx, ecx
mov dword [0x52aa58], ebx
call fcn.004127ca
xor eax, eax
inc eax
jmp 0x40c6d9
xor ecx, ecx
inc ecx
jmp 0x40c724
xor ecx, ecx
call fcn.0040c51b
jmp 0x40c718
Function at 0x40ca75
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov byte [0x52aa68], 1
push ebx
push esi
push edi
push 0x4c
call fcn.004ba21e
xor ebx, ebx
pop ecx
test eax, eax
je 0x40ca9f
mov ecx, eax
call fcn.004207e4
jmp 0x40caa1
mov eax, ebx
mov esi, dword [ebp + 8]
mov dword [0x52aa50], eax
mov dword [0x52aa54], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0xe22cb963
mov edx, 0xdad97890
mov ecx, 0x34f41f15
call fcn.004015a5
pop ecx
push eax
push 0x38f9be5c
mov edx, 0xc7fb2
mov ecx, 0xee211823
call fcn.004015a5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cb0f
lea ecx, [esp + 0x14]
push ecx
call eax
movzx eax, word [esp + 0x14]
test eax, eax
jne 0x40cc59
push dword [ebp + 0x10]
call fcn.00423778
pop ecx
test al, al
jne 0x40cc59
lea edx, [esp + 0xf]
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], 1
call fcn.0040c5a2
test eax, eax
je 0x40cb43
mov eax, dword [esp + 0x10]
jmp 0x40cc5b
push 0x70
call fcn.004ba21e
pop ecx
test eax, eax
je 0x40cb59
push ebx
mov ecx, eax
call fcn.0040d344
jmp 0x40cb5b
mov eax, ebx
mov dword [0x52aa58], eax
call fcn.0041228c
test eax, eax
jne 0x40cb7a
call fcn.0040c9c9
test eax, eax
jne 0x40cb7a
push 3
pop eax
jmp 0x40cc5b
push str.MUTEX_XREVEAL
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40cbbd
push ebx
push str.XrevealWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40cbb5
push ebx
push ebx
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x40cc5b
call fcn.0040c480
test eax, eax
jne 0x40cbca
push 2
jmp 0x40cb74
call fcn.0040c81d
test eax, eax
jne 0x40cbd7
push 6
jmp 0x40cb74
mov ecx, esi
call fcn.0040bf40
test eax, eax
je 0x40cc47
push 0x10
call fcn.004ba21e
pop ecx
test eax, eax
je 0x40cbfc
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov byte [eax + 0xc], 1
jmp 0x40cbfe
mov eax, ebx
sub esp, 0xc
mov dword [0x52aa64], eax
call fcn.0040cce0
movzx edx, byte [esp + 0xf]
mov ecx, esi
call fcn.0040bfb2
test eax, eax
je 0x40cc47
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40cc39
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x40cc23
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x52aa58]
call fcn.0040db96
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cce0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp + 0x94], eax
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x78]
push esi
mov esi, dword [0x52aa64]
push 0x10c
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.004bf040
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jb 0x40cd3c
sub esp, 0xc
mov ecx, esi
call fcn.0040cd7d
jmp 0x40cd3e
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
pop esi
call fcn.004b9a6c
lea esp, [ebp + 0x98]
pop ebp
ret 0xc

Function at 0x40d3af
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 0x14]
push esi
mov esi, eax
and esi, 0x3f
jne 0x40d3ca
or dword [ecx + 0x18], 0x1000000
and eax, 0xffffffc1
or eax, 1
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 0x14]
mov eax, edx
and al, 0x3f
cmp al, 1
jne 0x40d3e1
and edx, 0xffffffc2
or edx, 0x40000002
mov dword [ecx + 0x14], edx
mov edx, dword [ecx + 0x14]
mov eax, edx
and al, 0x3f
cmp al, 2
jne 0x40d3f8
and edx, 0xffffffc3
or edx, 0x82000003
mov dword [ecx + 0x14], edx
mov edx, dword [ecx + 0x14]
mov eax, edx
and eax, 0x3f
cmp al, 3
jne 0x40d410
and edx, 0xf7ffffc4
or edx, 4
mov dword [ecx + 0x14], edx
mov eax, dword [ecx + 0x14]
and eax, 0x3f
cmp esi, eax
pop esi
jne fcn.0040db96
ret

Function at 0x40d420
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp + 0x190], eax
lea eax, [ebp - 0x80]
push eax
push dword [0x52aaec]
push 0x80000001
test cl, cl
je 0x40d47b
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40d49c
lea ecx, [ebp - 0x7c]
call fcn.0040dc22
add eax, eax
push eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push 0x4ef5ec
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40d493
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40d49c
push 0x4ef5ec
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004b9a6c
lea esp, [ebp + 0x194]
pop ebp
ret
Function at 0x40d4b1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x518450]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
push dword [0x52aaec]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x40d4ec
xor al, al
jmp 0x40d562
push esi
push edi
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x106
push eax
lea eax, [ebp - 0x74]
mov edi, 0x4ef5ec
push eax
lea eax, [ebp - 0x7c]
xor esi, esi
push eax
push ebx
push edi
push dword [ebp - 0x78]
inc esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d555
lea ecx, [ebp + 0x198]
call fcn.0040dc22
add eax, eax
push eax
lea eax, [ebp + 0x198]
push eax
push esi
push ebx
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop esi
mov ecx, dword [ebp + 0x3a4]
xor ecx, ebp
pop ebx
call fcn.004b9a6c
lea esp, [ebp + 0x3a8]
pop ebp
ret

Function at 0x40d5b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
add eax, eax
xor ebx, ebx
mov dword [ebp + 0xc], eax
xor esi, esi
lea eax, [ebp + 0xc]
inc esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
movzx ecx, bl
cmove ecx, esi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret