joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
push edi
mov edi, 0x103
lea eax, [ebp - 0x104]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
call fcn.0040918f
pop ecx
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
mov esi, eax
cmp byte [esi], 0x5c
je 0x40578e
push 0x41c534
push esi
call fcn.00413510
pop ecx
pop ecx
push esi
call fcn.0040918f
mov esi, dword [ebp + 8]
pop ecx
mov ebx, eax
cmp byte [esi], 0
jne 0x4057ba
push dword [ebp + 0xc]
push ebx
call fcn.00413500
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.00413500
add esp, 0x10
jmp 0x405812
push 0x5c
push esi
call fcn.00413320
pop ecx
test eax, eax
pop ecx
jne 0x4057cb
push esi
jmp 0x4057a2
cmp byte [esi], 0x2e
jne 0x405812
cmp byte [esi + 1], 0x5c
jne 0x405812
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call fcn.00413500
lea eax, [ebp - 0x104]
push eax
call fcn.0040919c
lea eax, [esi + 2]
push edi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0040c6bc
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.00413500
add esp, 0x20
cmp dword [0x423800], 0
je 0x405884
mov ebx, 0x207
lea eax, [ebp - 0x30c]
push ebx
push esi
push eax
call fcn.0040c7b3
lea eax, [ebp - 0x30c]
push edi
push eax
call fcn.00405507
lea eax, [ebp - 0x30c]
push edi
push eax
push esi
call fcn.0040c7db
push ebx
lea eax, [ebp - 0x514]
push esi
push eax
call fcn.0040c7b3
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0041951d
add esp, 0x34
test eax, eax
je 0x40588d
push edi
lea eax, [ebp - 0x30c]
push esi
push eax
call fcn.0040c9df
add esp, 0xc
jmp 0x405890
push edi
push esi
call fcn.00405302
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405895
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x420]
push ebx
push 1
push edi
mov ebp, 0x80000002
push esi
mov byte [esi], bl
push ebp
mov byte [edi], bl
call fcn.00401998
add esp, 0x14
cmp dword [0x423800], ebx
je 0x4058dd
push 1
push 1
push edi
push esi
push ebp
call fcn.00401998
add esp, 0x14
push ebx
push 1
push edi
push esi
push 0x80000001
call fcn.00401998
xor eax, eax
cmp byte [edi], bl
mov ebp, 0x4236c0
push ebp
push str.wcx_ftp.ini
sete al
push edi
mov dword [esp + 0x30], eax
call fcn.00405740
xor eax, eax
cmp byte [esi], bl
push ebp
push str.wincmd.ini
sete al
push esi
mov dword [esp + 0x40], eax
call fcn.00405740
add esp, 0x2c
cmp dword [esp + 0x14], ebx
je 0x4059d5
push esi
lea eax, [esp + 0x1c]
push 0x3ff
push eax
push ebx
push ebx
push str.Configuration
mov byte [esp + 0x30], bl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x18], bl
jne 0x4059d5
push 0x41c460
push esi
call fcn.00413500
push 2
push esi
call fcn.00405302
push esi
call fcn.0040919c
push 3
push str.GHISLERwincmd.ini
push esi
call fcn.0040c6bc
add esp, 0x20
lea eax, [esp + 0x18]
push esi
push 0x3ff
push eax
push ebx
push ebx
push str.Configuration
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x18], bl
jne 0x4059ac
push ebp
push str.wincmd.ini
push esi
mov byte [esi], bl
call fcn.00405740
add esp, 0xc
jmp 0x4059d5
cmp dword [esp + 0x10], ebx
je 0x4059d5
push esi
push edi
call fcn.00413500
push 0x5c
push edi
call fcn.00413670
add esp, 0x10
cmp eax, ebx
je 0x4059d5
push str.wcx_ftp.ini
push eax
call fcn.00413500
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret
Function at 0x4059e0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
lea eax, [ebp - 0x30c]
push edi
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00405895
lea eax, [ebp - 0x208]
push 0x422de0
push eax
call fcn.00413500
mov edi, 0x423b40
lea eax, [ebp - 0x208]
push edi
push str.wincmd.ini
push eax
call fcn.00405740
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004139a0
add esp, 0x24
test eax, eax
je 0x405a57
lea eax, [ebp - 0x208]
push 1
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor ebx, ebx
cmp dword [0x420b08], ebx
je 0x405ac7
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00413500
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00413670
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x405a8e
inc esi
jmp 0x405a94
lea esi, [ebp - 0x104]
lea eax, [ebp - 0x30c]
push 0x5c
push eax
call fcn.00413670
pop ecx
cmp eax, ebx
pop ecx
je 0x405aab
inc eax
jmp 0x405ab1
lea eax, [ebp - 0x30c]
cmp byte [eax], bl
je 0x405ac0
push eax
push esi
call fcn.00413500
pop ecx
pop ecx
jmp 0x405b3f
push str.wcx_ftp.ini
jmp 0x405ab6
push ebx
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x208]
mov esi, 0x80000002
push eax
push esi
mov byte [ebp - 0x104], bl
call fcn.00401998
add esp, 0x14
cmp dword [0x423800], ebx
je 0x405b0f
push 1
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00401998
add esp, 0x14
push ebx
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x208]
push eax
push 0x80000001
call fcn.00401998
push edi
lea eax, [ebp - 0x104]
push str.wcx_ftp.ini
push eax
call fcn.00405740
add esp, 0x20
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.004139a0
pop ecx
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
je 0x405b71
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret
Function at 0x405b73
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
xor ebx, ebx
lea eax, [ebp + 0xc]
push ebx
push eax
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
push ebx
and eax, 0x100
or al, 2
push eax
push ebx
push ebx
push ebx
push dword [0x41c078]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405d9b
push esi
mov esi, 0x422de0
push edi
push esi
call fcn.00413210
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
cmp dword [0x420b08], ebx
pop ecx
je 0x405c69
push eax
push esi
push 1
push ebx
push str.IniFileName
push dword [ebp + 0xc]
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00405895
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00413500
lea eax, [ebp - 0x310]
push 0x5c
push eax
call fcn.00413670
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x405c18
inc esi
jmp 0x405c1e
lea esi, [ebp - 0x310]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00413670
pop ecx
cmp eax, ebx
pop ecx
je 0x405c35
inc eax
jmp 0x405c3b
lea eax, [ebp - 0x108]
cmp byte [eax], bl
je 0x405c42
push eax
jmp 0x405c47
push str.wcx_ftp.ini
push esi
call fcn.00413500
pop ecx
lea eax, [ebp - 0x310]
pop ecx
push eax
call fcn.00413210
pop ecx
inc eax
push eax
lea eax, [ebp - 0x310]
jmp 0x405d66
mov eax, 0x80000001
cmp dword [ebp + 8], eax
jne 0x405d74
push ebx
lea ecx, [ebp - 0x108]
push 1
push ecx
lea ecx, [ebp - 0x20c]
mov byte [ebp - 0x20c], bl
push ecx
push eax
mov byte [ebp - 0x108], bl
call fcn.00401998
add esp, 0x14
xor eax, eax
cmp byte [ebp - 0x20c], bl
setne al
mov dword [ebp + 8], eax
xor eax, eax
cmp byte [ebp - 0x108], bl
setne al
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
je 0x405cc6
cmp eax, ebx
jne 0x405d74
push ebx
lea eax, [ebp - 0x108]
push 1
push eax
lea eax, [ebp - 0x20c]
mov esi, 0x80000002
push eax
push esi
mov byte [ebp - 0x20c], bl
mov byte [ebp - 0x108], bl
call fcn.00401998
add esp, 0x14
cmp dword [0x423800], ebx
je 0x405d14
push 1
lea eax, [ebp - 0x108]
push 1
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00401998
add esp, 0x14
cmp dword [ebp + 8], ebx
jne 0x405d44
cmp byte [ebp - 0x20c], bl
je 0x405d44
lea eax, [ebp - 0x20c]
push eax
call fcn.00413210
pop ecx
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push str.IniFileName
push dword [ebp + 0xc]
call edi
cmp dword [ebp - 4], ebx
jne 0x405d74
cmp byte [ebp - 0x108], bl
je 0x405d74
lea eax, [ebp - 0x108]
push eax
call fcn.00413210
pop ecx
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push ebx
push str.FtpIniName
push dword [ebp + 0xc]
call edi
mov esi, 0x423b40
push esi
call fcn.00413210
pop ecx
inc eax
push eax
push esi
push 1
push ebx
push str.InstallDir
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4066b6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, 0x20019
push eax
xor ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
push ebx
push dword [0x41c078]
push dword [ebp + 8]
call esi
test eax, eax
je 0x40680c
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [0x41c074]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x406815
lea eax, [ebp - 0xc]
push eax
push dword [0x41c078]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40680c
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov ebx, str.IniFileName
mov dword [ebp - 0x10], 1
push ebx
mov dword [ebp - 8], 0x103
push dword [ebp - 4]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x406775
lea eax, [ebp - 0x114]
push eax
call fcn.00413210
pop ecx
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push ebx
push dword [ebp - 0xc]
call edi
lea eax, [ebp - 8]
mov ebx, str.FtpIniName
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
mov dword [ebp - 8], 0x103
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4067bc
lea eax, [ebp - 0x114]
push eax
call fcn.00413210
pop ecx
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push ebx
push dword [ebp - 0xc]
call edi
lea eax, [ebp - 8]
mov ebx, str.InstallDir
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
mov dword [ebp - 8], 0x103
push dword [ebp - 4]
call esi
test eax, eax
jne 0x406803
lea eax, [ebp - 0x114]
push eax
call fcn.00413210
pop ecx
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push ebx
push dword [ebp - 0xc]
call edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4092bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00413500
cmp byte [ebp - 0x108], 0
pop ecx
pop ecx
je 0x4092f5
lea eax, [ebp - 0x108]
push eax
call fcn.0040918f
dec eax
pop ecx
cmp byte [eax], 0x5c
jne 0x4092f5
and byte [eax], 0
cmp byte [ebp - 0x107], 0x3a
jne 0x40932a
cmp byte [ebp - 0x106], 0
jne 0x40932a
lea eax, [ebp - 0x108]
push 0x41c534
push eax
call fcn.00413510
pop ecx
lea eax, [ebp - 0x108]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
jmp 0x409378
push dword [ebp + 8]
call fcn.00409228
cmp eax, 2
pop ecx
jne 0x40933d
push 1
pop eax
leave
ret
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00413500
lea eax, [ebp - 0x108]
push eax
call fcn.0040919c
lea eax, [ebp - 0x108]
push 0x41c530
push eax
call fcn.00413510
lea eax, [ebp - 0x108]
push eax
call fcn.00409228
add esp, 0x18
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x40952b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x110]
xor ebx, ebx
push edi
push eax
mov dword [0x4229a8], ebx
mov dword [ebp - 4], ebx
call fcn.00413ac0
add esp, 0xc
cmp dword [ebp + 0xc], ebx
mov esi, 0x8000080
jne 0x4095c7
push ebx
push esi
push 2
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4095b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4095a6
push dword [0x420b04]
push esi
push 0x41c78c
push edi
call fcn.0040b467
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4095b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409117
pop ecx
mov edi, eax
jmp 0x4095e6
push ebx
push ebx
push ebx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4095e6
push edi
call fcn.004092bc
mov edi, eax
lea eax, [ebp - 0x110]
neg edi
sbb edi, edi
push eax
and edi, 0xfffffffe
inc edi
inc edi
call fcn.0040919c
pop ecx
pop ecx
cmp edi, 2
jne 0x409733
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.00413670
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x409609
inc dword [ebp - 8]
cmp byte [ebp - 0x110], 0x5c
jne 0x409634
cmp byte [ebp - 0x10f], 0x5c
jne 0x409634
lea eax, [ebp - 0x10e]
push 0x5c
push eax
call fcn.00413320
pop ecx
cmp eax, ebx
pop ecx
je 0x40964e
push 0x5c
inc eax
jmp 0x40963c
push 0x5c
lea eax, [ebp - 0x110]
push eax
call fcn.00413320
pop ecx
cmp eax, ebx
pop ecx
jne 0x40964e
lea eax, [ebp - 0x110]
inc eax
push 0x5c
push eax
call fcn.00413320
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4096db
jmp 0x409665
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
je 0x4096db
mov byte [eax], bl
lea eax, [ebp - 0x110]
push eax
call fcn.004092bc
test eax, eax
pop ecx
jne 0x4096c1
lea eax, [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4096c1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
jne 0x4096b4
push dword [0x420b04]
lea eax, [ebp - 0x110]
push eax
call fcn.0040b36d
pop ecx
test eax, eax
pop ecx
jne 0x4096c1
call edi
push eax
call fcn.00409117
pop ecx
mov edi, eax
jmp 0x4096c3
xor edi, edi
mov eax, dword [ebp - 0xc]
push 0x5c
mov byte [eax], 0x5c
inc eax
push eax
call fcn.00413320
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x409662
cmp dword [ebp + 0xc], ebx
jne 0x409733
push ebx
push esi
push 2
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call edi
cmp eax, 5
jne 0x40971e
push dword [0x420b04]
push esi
push 0x41c78c
push dword [ebp + 8]
call fcn.0040b467
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x409731
call edi
push eax
call fcn.00409117
pop ecx
mov edi, eax
jmp 0x409733
xor edi, edi
mov eax, dword [ebp - 4]
mov dword [0x4229a8], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a468
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00414000
push ebx
push esi
push edi
xor ebx, ebx
push 0x124
push ebx
push dword [ebp + 0x10]
mov dword [0x422ac4], ebx
mov dword [0x420b9c], ebx
call fcn.004140b0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
je 0x40a4b5
cmp word [eax], bx
je 0x40a4b5
push ebx
push 0x8020
mov dword [0x420ba0], eax
push str.___.cab
jmp 0x40a4be
push ebx
push 0x8020
push dword [ebp + 8]
call fcn.00409757
or esi, 0xffffffff
add esp, 0xc
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x40a641
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
je 0x40a5bc
mov ecx, 0x1000
cmp eax, ecx
mov dword [0x422ac0], ecx
jle 0x40a4fb
lea edi, [eax - 0x1000]
jmp 0x40a502
xor edi, edi
mov dword [0x422ac0], eax
or esi, 0xffffffff
push ebx
push edi
push dword [ebp + 0xc]
call fcn.00409979
add esp, 0xc
cmp eax, 0xffffffff
je 0x40a596
push dword [0x422ac0]
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.0040986d
mov ecx, dword [0x422ac0]
add esp, 0xc
cmp eax, ecx
jne 0x40a596
cmp edi, ebx
jne 0x40a542
mov esi, 0x7fffffff
lea eax, [ecx - 0x16]
cmp eax, ebx
jl 0x40a579
cmp byte [ebp + eax - 0x1000], 0x50
jne 0x40a571
cmp byte [ebp + eax - 0xfff], 0x4b
jne 0x40a571
cmp byte [ebp + eax - 0xffe], 5
jne 0x40a571
cmp byte [ebp + eax - 0xffd], 6
je 0x40a576
dec eax
jns 0x40a549
jmp 0x40a579
lea esi, [eax + edi]
cmp esi, 0xffffffff
jne 0x40a58d
push 0x16
pop eax
sub eax, ecx
add edi, eax
jns 0x40a505
xor edi, edi
cmp esi, ebx
jge 0x40a59b
jmp 0x40a505
or esi, 0xffffffff
jmp 0x40a5bc
cmp esi, 0x7fffffff
je 0x40a596
mov eax, esi
sub eax, edi
cmp esi, 0x2e
mov eax, dword [ebp + eax - 0xff0]
mov dword [0x4229a0], ebx
jge 0x40a5c6
push 0xfffffffffffffffe
pop esi
push dword [ebp + 0xc]
call fcn.00409944
jmp 0x40a640
push ebx
sub esi, eax
push eax
add esi, 4
push dword [ebp + 0xc]
mov dword [0x422ac0], esi
call fcn.00409979
or esi, 0xffffffff
add esp, 0xc
cmp eax, esi
je 0x40a641
mov eax, dword [0x422ac0]
inc eax
push eax
call fcn.00413c32
push dword [0x422ac0]
mov dword [0x422ac4], eax
push eax
push dword [ebp + 0xc]
call fcn.0040986d
add esp, 0x10
cmp eax, esi
jne 0x40a620
push dword [0x422ac4]
call fcn.00413bc9
pop ecx
mov dword [0x422ac4], ebx
jmp 0x40a641
push dword [ebp + 0xc]
call fcn.00409944
push dword [ebp + 0x10]
call fcn.0040a308
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x40a641
push dword [ebp + 0x10]
call fcn.0040a450
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push edi
mov edi, dword [0x4240b0]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40af4a
push 4
and dword [ebp - 4], 0
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.EnableLUA
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40af41
cmp dword [ebp - 4], eax
setne al
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret
Function at 0x40b28a
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push edi
or edi, 0xffffffff
cmp dword [ebp + 8], edi
jne 0x40b2a0
mov eax, edi
jmp 0x40b2fa
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push 0x800
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413733
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x40b2f7
push esi
push esi
lea eax, [ebp - 0x404]
push 0x3ff
push eax
push edi
push dword [ebp + 0x10]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x404]
push eax
call fcn.00413467
pop ecx
mov edi, eax
mov eax, edi
pop esi
pop edi
leave
ret

Function at 0x40b9af
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push ebx
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
push ebx
call edi
test eax, eax
jne 0x40ba2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40ba2c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 8]
push 0x40
call esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call esi
cmp dword [ebp - 0xc], ebx
pop esi
je 0x40ba2c
cmp eax, ebx
je 0x40ba2c
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push ebx
call edi
test eax, eax
je 0x40ba2c
mov eax, dword [ebp - 0xc]
jmp 0x40ba2e
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x40babf
Capabilities:
Get session user name

Disassembly:
cmp dword [0x420be0], 0
jne 0x40baf2
push str.secur32.dll
mov dword [0x420be0], 1
call fcn.0040c877
test eax, eax
pop ecx
je 0x40baf2
push str.GetUserNameExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x420bdc], eax
mov eax, dword [0x420bdc]
test eax, eax
je 0x40bb09
push dword [esp + 8]
push dword [esp + 8]
push 2
call eax
jmp 0x40bb0b
xor eax, eax
test eax, eax
jne 0x40bb1d
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
ret
Function at 0x40bc3d
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
xor edi, edi
cmp word [0x421f80], di
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
je 0x40bd47
mov esi, 0x103
mov ebx, str.administrator
push esi
push 0x421f80
push ebx
call fcn.0040c67c
add esp, 0xc
lea eax, [ebp - 0x2c]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40bd32
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x207
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040babf
pop ecx
test eax, eax
pop ecx
je 0x40bcdc
lea eax, [ebp - 0x234]
push esi
push eax
push str.cghisler
call fcn.0040c67c
lea eax, [ebp - 0x234]
push eax
call fcn.0040b9af
add esp, 0x10
cmp eax, edi
mov dword [ebp - 8], eax
je 0x40bcdc
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
lea eax, [ebp - 4]
push eax
push 0x41df18
push ebx
push 2
call fcn.0040bb6c
add esp, 0x10
test eax, eax
je 0x40bd04
push edi
lea eax, [ebp - 0x2c]
push dword [ebp - 4]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, 0x1000
push eax
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040bb1e
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x40bd32
push edi
push str.tcmadmin
push str.Failed_to_create_security_descriptor_
jmp 0x40bd73
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x18]
jmp 0x40bd49
xor eax, eax
push eax
mov eax, 0x800
push edi
push eax
push eax
push 1
push 6
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40bd7f
push edi
push str.tcmadmin
push str.Failed_to_create_pipe_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x40bd9b
cmp dword [ebp - 4], edi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x40bd8f
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], edi
je 0x40bd99
push dword [ebp - 8]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret