joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502d95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov ecx, 0x546d80
call fcn.00501f54
lea ecx, [ebp - 0x48]
call fcn.00403fe0
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp + 0xc]
call fcn.0040d2e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x408a1c
jmp 0x408aa3
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x408a3c
jmp 0x408aa3
mov edx, dword [ebp - 0x18]
push edx
call fcn.004d3b16
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x408a59
jmp 0x408aa3
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x408a89
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x18]
je 0x408a8b
jmp 0x408aa3
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00403da0
xor edx, edx
jne 0x4089ed
cmp dword [ebp - 0x10], 0xffffffff
je 0x408ab3
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x408acb
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.004d3890
add esp, 4
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
call fcn.00403ee0
mov ecx, dword [ebp - 0x20]
or ecx, 1
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00403eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040d100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x408d80
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502e25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov dword [ebp - 0x20], 0
mov ecx, 0x546d80
call fcn.00501f54
lea eax, [ebp - 0x18]
push eax
call fcn.004081a0
add esp, 4
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x408efd
lea ecx, [ebp - 0x10]
push ecx
call fcn.00408260
add esp, 4
mov byte [ebp - 4], 1
push 0x208
push 0
lea edx, [ebp - 0x244]
push edx
call fcn.004d75f0
add esp, 0xc
mov dword [ebp - 0x24], 0x104
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp - 0x244]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040d1a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0040d2a0
movzx eax, al
test eax, eax
jne 0x408ee5
lea ecx, [ebp - 0x14]
call fcn.0040d2a0
movzx ecx, al
test ecx, ecx
jne 0x408ee5
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0040c860
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x408ee5
lea edx, [ebp - 0x1c]
push edx
call fcn.00408750
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.0040caa0
add esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 4
push 0x52c3c4
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.0040c9e0
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040d0d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x38]
call fcn.0040d100
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.0040d100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0040d100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040d100
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d100
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040d220
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040d100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x408f40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x546d80
call fcn.00501f54
cmp dword [ebp + 8], 0
jne 0x408f58
jmp 0x408f91
push 0x52c3e4
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408f87
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
jmp 0x408f91
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret
Function at 0x409660
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502ef5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov ecx, 0x546d80
call fcn.00501f54
lea ecx, [ebp - 0x40]
call fcn.0040c020
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x52c44c
call fcn.0040d120
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
mov edx, dword [ebp + 8]
push edx
call fcn.0040d220
mov byte [ebp - 4], 0
call fcn.00408fa0
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.0040c090
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x10]
call fcn.0040d250
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], 0
jmp 0x4096f3
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x1c]
jae 0x4097b4
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x40]
call fcn.0040c060
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
jne 0x409785
push 1
mov ecx, dword [ebp - 0x18]
call fcn.0040d370
movzx eax, ax
cmp eax, 0x3a
je 0x409746
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d100
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040c1e0
jmp 0x4097cf
push 0x52c450
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040c9e0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040cfe0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040d100
jmp 0x4096ea
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040cfe0
push 0
lea ecx, [ebp - 0x10]
call fcn.0040d2e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x52c454
lea ecx, [ebp - 0x10]
call fcn.0040cfb0
jmp 0x4096ea
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d100
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040c1e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4097e0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 0x546d80
call fcn.00501f54
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp + 8]
call fcn.0040d2e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409841
mov byte [ebp - 2], 0
lea ecx, [ebp + 8]
call fcn.0040d100
lea ecx, [ebp + 0x10]
call fcn.0040d100
mov al, byte [ebp - 2]
jmp 0x4098d1
lea ecx, [ebp + 0x10]
call fcn.0040d2e0
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x409862
jmp 0x4098ae
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x409879
jmp 0x4098ae
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4098a6
jmp 0x4098ae
mov byte [ebp - 1], 1
xor ecx, ecx
jne 0x409841
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
lea ecx, [ebp + 8]
call fcn.0040d100
lea ecx, [ebp + 0x10]
call fcn.0040d100
mov al, byte [ebp - 3]
mov esp, ebp
pop ebp
ret
Function at 0x409c20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov ecx, 0x546d80
call fcn.00501f54
push 0
push 0x80
push 3
push 0
push 1
push connect
mov ecx, dword [ebp + 8]
call fcn.0040d2e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x409c64
xor eax, eax
jmp 0x409dbe
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0x5210ed
push 0x200000
call fcn.004d3d28
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x409cb4
xor eax, eax
jmp 0x409dbe
mov dword [ebp - 0xc], 0
call fcn.00407990
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x44c]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.0040f0f0
cmp dword [ebp - 0x10], 0
jl 0x409d9f
jg 0x409ce8
cmp dword [ebp - 0x14], 0
jbe 0x409d9f
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
jg 0x409d0e
jl 0x409d00
cmp dword [ebp - 0x14], 0x200000
jae 0x409d0e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x409d1a
xor edx, edx
mov dword [ebp - 0x28], 0x200000
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409d3e
jmp 0x409d9f
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
sbb edx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
jne 0x409d7c
lea eax, [ebp - 0x44c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040f2f0
add esp, 0xc
mov dword [ebp - 0xc], eax
jmp 0x409d9a
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x44c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0040f370
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x409cd2
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.004d3890
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x409dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, 0x546d80
call fcn.00501f54
lea ecx, [ebp - 0x30]
call fcn.00403fe0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea ecx, [ebp + 8]
call fcn.0040d2e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x409e22
jmp 0x409e73
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
call fcn.00403d30
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
call fcn.00403d50
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x409e6d
mov ecx, dword [ebp + 0xc]
call fcn.00403d30
cmp dword [ebp - 8], eax
je 0x409e6f
jmp 0x409e73
xor ecx, ecx
jne 0x409df6
cmp dword [ebp - 4], 0xffffffff
je 0x409e83
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
call fcn.00403eb0
lea ecx, [ebp + 8]
call fcn.0040d100
mov esp, ebp
pop ebp
ret
Function at 0x40aa80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50301d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, 0x546d80
call fcn.00501f54
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 1
lea eax, [ebp + 8]
push eax
push 0x52c6f8
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040c920
add esp, 0xc
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 2
push 0x52c6f4
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040c9e0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp + 8]
call fcn.0040d0d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040d100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0040d100
push 0x3c
push 0
lea ecx, [ebp - 0x70]
push ecx
call fcn.004d75f0
add esp, 0xc
mov dword [ebp - 0x70], 0x3c
movzx edx, byte [ebp + 0x1c]
test edx, edx
je 0x40ab4e
mov dword [ebp - 0x6c], 0x440
jmp 0x40ab55
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
lea ecx, [ebp + 8]
call fcn.0040d2e0
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 0xc]
call fcn.0040d2e0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40ab91
mov dword [ebp - 0x54], 5
jmp 0x40ab98
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x14], 0
je 0x40abbe
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x40abe2
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040d100
mov eax, dword [ebp - 0x30]
jmp 0x40ac2b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ac40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502c7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov dword [ebp - 0x14], 0
mov ecx, 0x546d80
call fcn.00501f54
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.004d75f0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040d1a0
mov dword [ebp - 4], 0
push 0x52c700
lea ecx, [ebp - 0x10]
call fcn.0040cfb0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d220
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ad00
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502e25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
mov dword [ebp - 0x20], 0
mov ecx, 0x546d80
call fcn.00501f54
lea eax, [ebp - 0x18]
push eax
call fcn.0040ac40
add esp, 4
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x40ae7d
lea ecx, [ebp - 0x10]
push ecx
call fcn.00408260
add esp, 4
mov byte [ebp - 4], 1
push 0x208
push 0
lea edx, [ebp - 0x244]
push edx
call fcn.004d75f0
add esp, 0xc
mov dword [ebp - 0x24], 0x104
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp - 0x244]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040d1a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0040d2a0
movzx eax, al
test eax, eax
jne 0x40ae65
lea ecx, [ebp - 0x14]
call fcn.0040d2a0
movzx ecx, al
test ecx, ecx
jne 0x40ae65
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0040c860
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40ae65
lea edx, [ebp - 0x1c]
push edx
call fcn.00408750
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.0040caa0
add esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 4
push str.AppDataRoamingMicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.0040c9e0
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040d0d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x38]
call fcn.0040d100
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.0040d100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0040d100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040d100
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d100
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040d220
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040d100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40aec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502c5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x808
mov dword [ebp - 0x10], 0
mov ecx, 0x546d80
call fcn.00501f54
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x40af16
mov eax, dword [ebp + 8]
push eax
call fcn.00407db0
add esp, 4
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
jmp 0x40afab
lea ecx, [ebp - 0x14]
call fcn.0040d250
mov dword [ebp - 4], 0
push 0x800
push 0
lea edx, [ebp - 0x814]
push edx
call fcn.004d75f0
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0x814]
push eax
call fcn.004d75f0
add esp, 0xc
push 0
push 0x10
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40af84
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040d0a0
push 0x52c6fc
lea ecx, [ebp - 0x14]
call fcn.0040cfb0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d220
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b2d0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50308d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov ecx, 0x546d80
call fcn.00501f54
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x513918
push 1
push 0
push 0x513988
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40b44b
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x513938
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40b43d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
call fcn.0040d2e0
mov dword [ebp - 0x24], eax
push 2
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40b42f
push 0x5c
mov ecx, dword [ebp + 0xc]
call fcn.0040ce10
push eax
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040cb70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp + 0xc]
call fcn.0040d2e0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040d2e0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 0xc]
call fcn.0040d2e0
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x44], edx
push 1
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040d100
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 8]
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret