joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413210
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
push esi
mov esi, dword [ebx + 0xc]
push edi
mov dword [esp + 0xc], 0
call fcn.00412d50
mov esi, eax
test esi, esi
jne 0x41323f
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0xc]
lea eax, [esp + 0x10]
push eax
xor eax, eax
call fcn.00413010
add esp, 4
test eax, eax
jne 0x4132d1
mov edx, dword [ebx + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push edx
push eax
push eax
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00412e40
add esp, 0x24
test eax, eax
je 0x41328d
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push ecx
mov ecx, dword [ebx + 0x10]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4132c4
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00412d50
mov ebx, eax
test ebx, ebx
je 0x413467
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
xor eax, eax
mov ecx, esi
call fcn.00413010
add esp, 4
test eax, eax
jne 0x4134b6
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x413473
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4134a9
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4134a9
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4134c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
push esi
mov esi, dword [ebx + 0xc]
push edi
mov dword [esp + 8], 0
call fcn.00412d50
mov esi, eax
test esi, esi
jne 0x4134ef
mov eax, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
push ecx
call fcn.00413410
add esp, 8
test eax, eax
jne 0x4135ca
mov ecx, 0x41
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0xc]
push edx
call fcn.00413010
add esp, 4
test eax, eax
jne 0x4135ca
mov ecx, dword [ebx + 8]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push esi
call fcn.00412e40
add esp, 0x24
test eax, eax
je 0x413559
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
je 0x41357b
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push esi
lea ecx, [ebx + 4]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4135b0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4135c8
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413750
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00412d50
mov ebx, eax
test ebx, ebx
jne 0x413779
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
call fcn.00413410
add esp, 8
test eax, eax
jne 0x4137fd
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
xor eax, eax
mov ecx, esi
call fcn.00413010
add esp, 4
test eax, eax
jne 0x4137fd
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push 2
push eax
push eax
push eax
lea edx, [esp + 0x2c]
push edx
push ebx
call fcn.00412e40
add esp, 0x24
test eax, eax
jne 0x4137e4
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4137f0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413bb0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x31c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
lea ebx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, esi
sub ebx, esi
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x413bd7
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00413b00
add esp, 0x10
test eax, eax
jne 0x413cd0
lea edi, [esp + 0x10]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x413c20
mov dx, word [0x46d0a4]
lea eax, [esp + 0x118]
mov word [edi], dx
mov edx, eax
jmp 0x413c40
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413c40
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413c50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00413bb0
add esp, 4
test eax, eax
jne 0x413d8f
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x413c90
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x413c90
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x11c]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00413b00
add esp, 0x10
test eax, eax
je 0x413c15
mov esi, dword [ebp + 8]
call fcn.00412d50
mov esi, eax
test esi, esi
jne 0x413ce7
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x224]
mov ecx, edi
call fcn.00413010
add esp, 4
test eax, eax
jne 0x413d8f
push eax
push edi
call fcn.00413410
add esp, 8
test eax, eax
jne 0x413d8f
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push 2
push eax
push eax
push eax
lea edx, [esp + 0x134]
push edx
push esi
call fcn.00412e40
add esp, 0x24
test eax, eax
jne 0x413d76
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x220]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x413d82
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4167c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [esp + 0x28]
push str.Selected_
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
call fcn.00416280
mov eax, dword [ebp + 0xc]
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x416812
lea edi, [esp + 0x28]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x416822
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
lea edx, [esp + 0x34]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [esp + 0x18]
jne 0x4168cd
test dword [esi + 0x28], 0x1000000
je 0x416891
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.UsedBySelectedProfile
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x416891
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4168aa
mov edx, dword [ebp + 8]
push 1
lea ecx, [esp + 0x2c]
push ecx
push edi
push edx
mov ecx, esi
call fcn.004166b0
mov ebx, eax
test ebx, ebx
jne 0x4168b2
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x10], 0
je 0x41691c
test dword [esi + 0x28], 0x1000000
je 0x41691c
lea ecx, [esp + 0x28]
push 0x2d
push ecx
call fcn.0045ec30
mov esi, eax
add esp, 8
test esi, esi
je 0x41691c
mov bl, byte [esi + 1]
mov ecx, dword [ebp + 8]
test bl, bl
setne dl
dec dl
push 1
lea eax, [esp + 0x2c]
push eax
push edi
push ecx
mov ecx, dword [esp + 0x28]
and edx, 0x31
mov byte [esi + 1], dl
call fcn.004166b0
mov byte [esi + 1], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4229a0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x28
mov eax, dword [0x491098]
push ebx
xor ebx, ebx
cmp eax, 4
mov dword [esp + 0x10], ebx
jae 0x4229bb
xor eax, eax
pop ebx
add esp, 0x28
ret
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 0x28], 0x220
mov dword [esp + 0x2c], 0x222
mov dword [esp + 0x30], 0x221
mov dword [esp + 0x34], 0x223
mov dword [esp + 0x18], ebx
xor esi, esi
mov edi, edi
mov ecx, dword [esp + esi*4 + 0x28]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 0x20
push 2
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], 5
call edi
test eax, eax
je 0x422a71
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
push ebp
mov dword [esp + 0x20], ebx
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x422a48
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0x14], ebx
je 0x422a7e
mov eax, dword [esp + esi*4 + 0x28]
pop edi
add eax, 0xfffffde0
cmp eax, 3
pop esi
pop ebp
ja case.default.0x422a6a
jmp dword [eax*4 + 0x422ac0]
push str.GetUserType._Failed_to_AllocateAndInitializeSid
call fcn.00411060
add esp, 4
inc esi
cmp esi, 4
jb 0x4229f0
mov eax, dword [esp + 0x18]
jmp 0x422a5d
mov eax, 1
pop ebx
add esp, 0x28
ret
mov eax, 2
pop ebx
add esp, 0x28
ret
mov eax, 3
pop ebx
add esp, 0x28
ret
mov eax, 4
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
pop ebx
add esp, 0x28
ret

Function at 0x422c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
je 0x422cf4
cmp byte [eax], 0
je 0x422cf4
lea ecx, [esp + 4]
push ecx
push 0x2001f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422cf4
push esi
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.SGCountDown
push edx
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x422cdf
cmp dword [esp + 0x14], 4
jne 0x422cdf
mov eax, dword [esp + 4]
push eax
push str.GetSGCountDown__SGCountDown___d_n
mov dword [esi], eax
call fcn.0040aac0
add esp, 8
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x423050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov edx, dword [ebp + 0xb0]
push ebx
mov ebx, dword [ebp + 0xb4]
push esi
push edi
xor eax, eax
mov ecx, 0x27
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x27
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xb8]
mov dword [esp + 0xc], 3
mov dword [esp + 0x14], 1
mov dword [eax], 0
jmp 0x4230a0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4231a6
xor edx, edx
mov dword [esp + 0x10], edx
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xa8]
test eax, eax
mov word [esp + 0x3c], 0x9c
jne 0x4230e2
lea ecx, [esp + 0x18]
push ecx
push edx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
jmp 0x4230f4
mov ecx, dword [ebp + 8]
push 2
lea eax, [esp + 0x1c]
push eax
push edx
push ecx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExA]
test eax, eax
je 0x42318b
mov edi, dword [ebp + 0x78]
mov esi, dword [ebp + 0x7c]
cmp edi, esi
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
jbe 0x42311a
cmp ecx, eax
jb 0x423120
cmp edi, esi
jae 0x423134
cmp ecx, eax
jbe 0x423134
mov edx, ecx
mov ecx, eax
mov eax, edx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
mov edx, dword [ebp + 0x74]
cmp dword [esp + 0x80], edx
jne 0x42322d
cmp eax, esi
jne 0x42322d
cmp ecx, edi
jne 0x42322d
mov eax, dword [esp + 0x90]
mov ecx, dword [ebp + 0x84]
cmp eax, ecx
mov dword [esp + 0x14], 0
jne 0x423204
mov eax, dword [ebp + 0xb8]
mov dword [eax], 1
mov eax, dword [ebp + 0xac]
test eax, eax
je 0x42322d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0xb0]
dec ecx
test eax, eax
mov dword [esp + 0xc], ecx
jne 0x4230a0
mov eax, dword [ebp + 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x68]
push ecx
mov ecx, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x70]
push ecx
mov ecx, dword [ebx + 0x6c]
push eax
mov eax, dword [edx + 0x68]
push ecx
mov ecx, dword [edx + 0x78]
push eax
mov eax, dword [edx + 0x70]
push ecx
mov ecx, dword [edx + 0x6c]
mov edx, dword [ebp + 0xac]
push eax
mov eax, dword [ebp + 0xa8]
push ecx
mov ecx, dword [ebp + 0x74]
push edx
mov edx, dword [ebp + 0x84]
push eax
mov eax, dword [ebp + 0x7c]
push ecx
mov ecx, dword [ebp + 0x78]
push edx
push eax
push ecx
push str.GetLowerAndHigherRefreshrateMode:_ModeIn_x_d__y_d__f_d__Bpp_d_nbRawMode_d_nbFindMatching_d_nModeLower_x_d__y_d__f_d__Bpp_d_nModeHigher_x_d__y_d__f_d__Bpp_d_nbMatchModeFound___d
call fcn.0040aac0
add esp, 0x40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jae 0x423215
mov ecx, dword [ebp + 0xb0]
cmp dword [ecx + 0x78], eax
jae 0x42322d
mov edi, ecx
jmp 0x423222
mov ecx, dword [ebx + 0x78]
cmp ecx, eax
ja 0x423220
test ecx, ecx
jne 0x42322d
mov edi, ebx
lea esi, [esp + 0x18]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov edx, eax
jmp 0x4230b2
Function at 0x4234a0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
cmp dword [0x491098], 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], 0
jb 0x423440
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4233de
call esi
push eax
push str.MyExitWindows._Open_Process_Token_failed._err_d
call fcn.0040aac0
add esp, 8
xor eax, eax
pop esi
add esp, 0x14
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call esi
test eax, eax
je 0x423440
call esi
push eax
push str.MyExitWindows._AdjustTokenPrivileges_failed_err_d
call fcn.0040aac0
mov ecx, dword [esp + 0xc]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x423477
call esi
push eax
push str.MyExitWindows._ExitWindowsEx_failed._err_d
call fcn.0040aac0
mov eax, dword [esp + 0xc]
add esp, 8
test eax, eax
je 0x423470
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x423486
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x14
ret
jmp 0x423390

Function at 0x4234c0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x4234ee
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4234df
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop esi
ret

Function at 0x423c00
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x423c36
push str.FAILURE:_EEUCreateThread:_Failed_to_create_thread.
call fcn.0040aac0
add esp, 4
mov eax, esi
pop esi
ret
push esi
push str.EEUCreateThread:_success_to_create_thread_0x_x.
call fcn.0040aac0
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x423c67
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x423c67
push esi
push str.EEUCreateThread__Set_thread__0x_x__to_highest_priority
call fcn.0040aac0
add esp, 8
mov eax, esi
pop esi
ret
Function at 0x4242a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], ebp
mov dword [esp + 0x18], 0
je 0x424446
test ebp, ebp
je 0x424446
push ebx
push edi
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x20]
push eax
push 0xf003f
push 0
push str.SoftwareATIACE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x424336
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push 0
push str.PATH
push eax
call ebx
test eax, eax
jne 0x424336
push str.GetACEPrbPath___ACE_PATH_is_OK
jmp 0x4243f3
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push 0
push str.SoftwareATI
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x424376
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.PATH
push ecx
call ebx
test eax, eax
jne 0x424376
push str.GetACEPrbPath___ACE_PATH_NEW_is_OK
jmp 0x4243f3
lea edx, [esp + 0x20]
push edx
push 0xf003f
push 0
push str.SoftwareWOW6432NodeATIACE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4243b6
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.PATH
push edx
call ebx
test eax, eax
jne 0x4243b6
push str.GetACEPrbPath___ACE_REMAP_PATH_is_OK
jmp 0x4243f3
lea eax, [esp + 0x20]
push eax
push 0xf003f
push 0
push str.SoftwareWOW6432NodeATI
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x424437
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x30]
push str.PATH
push eax
call ebx
test eax, eax
jne 0x424437
push str.GetACEPrbPath___ACE_REMAP_PATH_NEW_is_OK
call fcn.0040aac0
add esp, 4
push 0x5c
push esi
call fcn.0045ec30
add esp, 8
test eax, eax
je 0x424419
lea ecx, [esi + ebp - 1]
cmp eax, ecx
jae 0x424419
mov cl, byte [eax + 1]
test cl, cl
je 0x424421
lea edx, [esi + ebp - 1]
cmp eax, edx
jne 0x424424
mov byte [eax], 0
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
push str.GetACEPrbPath___Get_ACE_registry_key_failed_n
call fcn.0040aac0
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x4244d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
push esi
push edi
je 0x4244ec
mov dword [ebx], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4245ad
cmp byte [esi], 0
je 0x4245ad
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424512
sub eax, edx
cmp eax, 0x104
jbe 0x424527
mov eax, 0x103
push eax
lea eax, [esp + 0x6c]
push esi
push eax
call fcn.0045de50
lea ecx, [esp + 0x74]
push ecx
call fcn.0040aac0
xor edx, edx
xor eax, eax
mov dword [esp + 0x20], edx
mov ecx, 0x11
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x24], edx
add esp, 0x10
test eax, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0x44
je 0x4245b4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x4245de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.FAILURE:_Failed_to_CreateProcess_for__s
call fcn.0040aac0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42459f
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x424603
test ebx, ebx
je 0x424603
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret