joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c92
Capabilities:
Read file on windows

Disassembly:
push 0x418
mov eax, 0x437d3c
call fcn.004226b6
mov edi, edx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x424], 0x443654
mov dword [ebp - 0x420], ebx
and dword [ebp - 4], 0
and dword [ebp - 0x414], 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x3ff
lea eax, [ebp - 0x410]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x415d23
cmp eax, 0x400
jae 0x415da8
mov byte [ebp + eax - 0x410], 0
mov ecx, edi
lea eax, [ebp - 0x410]
push eax
call fcn.0040821d
jmp 0x415cda
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x415d97
add eax, 0xfffffffe
mov ecx, edi
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040812e
mov byte [ebp - 4], 1
mov edx, dword [eax]
mov ecx, dword [edi]
sub ecx, 0x10
mov dword [ebp - 0x418], ecx
lea esi, [edx - 0x10]
cmp esi, ecx
je 0x415d89
cmp dword [ecx + 0xc], 0
jl 0x415d7e
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x415d7e
mov ecx, esi
call fcn.00404f5e
mov ecx, dword [ebp - 0x418]
mov esi, eax
call fcn.00402471
lea eax, [esi + 0x10]
mov dword [edi], eax
jmp 0x415d89
push dword [edx - 0xc]
mov ecx, edi
push edx
call fcn.004026cf
mov ecx, dword [ebp - 0x41c]
lea ecx, [ecx - 0x10]
call fcn.00402471
test ebx, ebx
je 0x415da2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00422671
ret
call fcn.004222e1
int3

Function at 0x415fd9
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x437d6c
call fcn.00422682
mov edi, ecx
cmp dword [edi + 4], 0
mov esi, dword [ebp + 8]
mov dword [edi + 0x10], esi
jne 0x415ffa
xor eax, eax
jmp 0x416084
xor ebx, ebx
test esi, esi
je 0x41602d
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x10], eax
cmp eax, dword [edi + 0x18]
je 0x416021
mov edx, dword [edi + 0x14]
lea ecx, [edi + 0x14]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x18], eax
mov eax, dword [esi]
mov ecx, esi
push dword [edi + 0x18]
call dword [eax + 0x20]
xor ebx, ebx
lea eax, [ebp + 8]
push eax
push ebx
push edi
push 0x41608c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov dword [ebp - 0x14], 0x443654
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
test esi, esi
je 0x41605a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp + 8]
test edi, edi
je 0x416082
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0042265c
ret 4
Function at 0x416656
Capabilities:
Delete file

Disassembly:
push 0xa54
mov eax, 0x437e9f
call fcn.004226b6
mov esi, ecx
mov dword [ebp - 0xa5c], esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x2e
mov dword [ebp - 0xa54], edi
push dword [ebx]
call fcn.00423f5c
pop ecx
pop ecx
test eax, eax
je 0x41687e
sub eax, dword [ebx]
sar eax, 1
test eax, eax
jle 0x41687e
push eax
lea eax, [ebp - 0xa40]
mov ecx, ebx
push eax
call fcn.0040812e
and dword [ebp - 4], 0
call fcn.0040219e
push eax
lea ecx, [ebp - 0xa48]
call fcn.00401fe1
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa48]
push dword [ebp - 0xa40]
push dword [ebx]
push dword [edi]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.00408430
mov ecx, dword [esi + 0x10]
add esp, 0x14
test ecx, ecx
je 0x4166eb
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
push ecx
lea eax, [ebp - 0xa60]
push 0x8000008
push eax
lea ecx, [esi + 0xc]
lea edx, [ebp - 0xa48]
call fcn.004152e1
add esp, 0xc
mov byte [ebp - 0xa39], 1
lea ecx, [ebp - 0xa40]
call fcn.004079e3
mov edi, dword [ebp - 0xa40]
test al, al
je 0x416732
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x416845
call fcn.0040219e
push eax
lea ecx, [ebp - 0xa4c]
call fcn.00401fe1
push ecx
mov ecx, dword [ebp - 0xa54]
lea edx, [ebp - 0xa4c]
mov byte [ebp - 4], 2
call fcn.00415c92
pop ecx
call fcn.0040219e
push eax
lea ecx, [ebp - 0xa44]
call fcn.00401fe1
push 0x514
lea eax, [ebp - 0xa38]
mov byte [ebp - 4], 3
push eax
push 0xca
push dword [0x44ecf8]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0xa38]
push eax
lea ecx, [ebp - 0xa50]
call fcn.00402742
push 0x5c
mov byte [ebp - 4], 4
mov esi, dword [edi - 0xc]
push edi
call fcn.00423f5c
pop ecx
pop ecx
test eax, eax
jne 0x4167b8
or eax, 0xffffffff
jmp 0x4167bc
sub eax, edi
sar eax, 1
sub esi, eax
lea ecx, [ebp - 0xa40]
push esi
lea eax, [ebp - 0xa58]
push eax
call fcn.00412ae2
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0xa4c]
push esi
push dword [eax]
lea eax, [ebp - 0xa44]
push dword [ebp - 0xa50]
push eax
call fcn.00408430
mov byte [ebp - 4], 4
add esp, 0x10
mov ecx, dword [ebp - 0xa58]
lea ecx, [ecx - 0x10]
call fcn.00402471
lea ecx, [ebp - 0xa44]
call fcn.0040dd43
mov ecx, dword [ebp - 0xa50]
mov byte [ebp - 0xa39], 0
lea ecx, [ecx - 0x10]
call fcn.00402471
mov ecx, dword [ebp - 0xa44]
lea ecx, [ecx - 0x10]
call fcn.00402471
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00402471
mov esi, dword [ebp - 0xa5c]
mov eax, dword [ebp - 0xa54]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x416860
mov eax, dword [ecx]
push ebx
call dword [eax + 0x18]
mov ecx, dword [ebp - 0xa48]
add ecx, 0xfffffff0
call fcn.00402471
lea ecx, [edi - 0x10]
call fcn.00402471
mov al, byte [ebp - 0xa39]
jmp 0x416880
mov al, 1
call fcn.00422671
ret 8
Function at 0x416cd9
Capabilities:
Create thread

Disassembly:
push 0x38
mov eax, 0x437f12
call fcn.00422682
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x10], eax
cmp dword [eax], ebx
je 0x416d22
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
cmp ebx, dword [esi + 0x18]
je 0x416d13
mov edx, dword [esi + 0x14]
lea ecx, [esi + 0x14]
call dword [edx + 4]
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x10]
push dword [esi + 0x18]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor ebx, ebx
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x416fac
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov dword [ebp - 0x44], 0x443654
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x10]
cmp dword [ecx], ebx
je 0x416dda
mov ecx, esi
call fcn.00416e0c
mov ecx, dword [esi]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x30], edx
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x14], ebx
mov edx, dword [eax + 4]
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
test edx, edx
jle 0x416dbc
mov edi, dword [ebp - 0x3c]
add ecx, 0x78
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push esi
mov ecx, eax
call fcn.004041c5
mov ecx, dword [ebp - 0x18]
push dword [eax]
call fcn.0040b67b
mov eax, dword [eax + 0xc]
add edi, eax
mov eax, dword [ebp - 0x20]
adc ebx, 0
inc esi
cmp esi, dword [ebp - 0x1c]
jl 0x416d8b
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
jmp 0x416dbf
mov edx, dword [ebp - 0x3c]
mov eax, dword [esi + 0x10]
add edx, dword [ebp - 0x2c]
adc ebx, dword [ebp - 0x30]
mov ecx, dword [eax]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp + 8]
test edi, edi
je 0x416e02
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0042265c
ret 4
Function at 0x417093
Capabilities:
Copy file
Get common file path

Disassembly:
push 0x420
mov eax, 0x437fa3
call fcn.004226b6
mov esi, ecx
mov edi, dword [ebp + 8]
and dword [esi], 0
call fcn.0041d844
mov ebx, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4500d8]
cmp eax, dword [ecx + 4]
jle 0x4170fe
push 0x4500d8
call fcn.00421e36
cmp dword [0x4500d8], 0xffffffff
pop ecx
jne 0x4170fe
and dword [ebp - 4], 0
sub esp, 0x10
mov ecx, 0x4500e0
push 0
push 0xa
call fcn.0041d7f5
or dword [ebp - 4], 0xffffffff
push 0x4500d8
call fcn.00421dec
pop ecx
push ecx
push 0x4500e0
mov ecx, ebx
call fcn.0041d8a4
test al, al
je 0x4171fc
push edi
call fcn.00417212
test al, al
je 0x4171fc
mov ebx, 0x208
lea eax, [ebp - 0x21c]
push ebx
push 0
push eax
call fcn.00423750
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
xor ebx, ebx
lea eax, [ebp - 0x424]
push ebx
push eax
call fcn.00423750
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push ebx
push str.shim_clone
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x424]
mov ecx, esi
push eax
call fcn.004172b5
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x428], bl
mov dword [ebp - 4], 1
call fcn.0041e81d
mov eax, dword [0x44fc50]
test eax, eax
je 0x4171b6
lea ecx, [ebp - 0x42c]
push ecx
call eax
mov byte [ebp - 0x428], 1
push ebx
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
sete al
mov byte [esi + 4], al
je 0x4171d3
push edi
mov ecx, esi
call fcn.004172b5
mov dword [ebp - 4], 2
cmp byte [ebp - 0x428], 0
je 0x417208
call fcn.0041e81d
mov eax, dword [0x44fc4c]
test eax, eax
je 0x417208
lea ecx, [ebp - 0x42c]
push ecx
call eax
jmp 0x417208
push edi
mov ecx, esi
call fcn.004172b5
mov byte [esi + 4], 0
mov eax, esi
call fcn.00422671
ret 4

Function at 0x417212
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, esi
mov ecx, ebx
cmp word [esi], bx
je 0x417250
lea eax, [eax + 2]
inc ecx
cmp word [eax], bx
jne 0x417247
mov eax, ebx
lea edx, [ebp - 0x20c]
cmp word [ebp - 0x20c], ax
je 0x41726e
lea edx, [edx + 2]
inc eax
cmp word [edx], bx
jne 0x417261
cmp ecx, eax
jb 0x41729f
mov ecx, ebx
mov eax, ebx
lea edx, [ebp - 0x20c]
cmp word [ebp - 0x20c], ax
je 0x4172a3
lea edx, [edx + 2]
inc eax
cmp word [edx], bx
jne 0x417281
cmp ecx, eax
jae 0x4172a3
mov ax, word [esi + ecx*2]
cmp ax, word [ebp + ecx*2 - 0x20c]
jne 0x41729f
inc ecx
jmp 0x417270
xor al, al
jmp 0x4172a5
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00421c45
leave
ret 4
Function at 0x4173af
Capabilities:
Delete file
Get file version info

Disassembly:
push 0x20
mov eax, 0x437fd3
call fcn.00422682
mov dword [ebp - 0x24], edx
xor edi, edi
mov esi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00417093
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x41744c
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b63b
mov esi, dword [ebp - 0x10]
test al, al
jne 0x4173fd
push 8
pop edi
jmp 0x417454
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41744c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x444d80
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x417454
cmp dword [ebp - 0x20], 0
je 0x417454
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
test ecx, ecx
je 0x41743e
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x417454
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
jmp 0x417454
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp byte [ebp - 0x28], 0
je 0x417463
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x2c]
call fcn.004221b9
pop ecx
push esi
call fcn.004221b9
pop ecx
mov eax, edi
call fcn.0042265c
ret
Function at 0x41747b
Capabilities:
Get file version info

Disassembly:
push 0x28
mov eax, 0x438006
call fcn.00422682
mov eax, ecx
mov dword [ebp - 0x34], eax
xor ebx, ebx
mov edi, ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00404f5e
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
cmp dword [esi - 4], 1
jle 0x4174be
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00402489
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4175df
push eax
lea ecx, [ebp - 0x18]
call fcn.0040b63b
test al, al
jne 0x4174e9
mov edi, dword [ebp - 0x18]
jmp 0x4175df
cmp dword [esi - 4], 1
jle 0x4174fd
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00402489
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4175df
call fcn.0040219e
push eax
lea ecx, [ebp - 0x10]
call fcn.00401fe1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x24]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x417552
cmp dword [ebp - 0x20], 0
je 0x417552
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax]
movzx eax, word [eax + 2]
jmp 0x41755c
mov ecx, 0x409
mov eax, 0x4e2
push 0x446f24
push eax
push ecx
lea eax, [ebp - 0x10]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.00408430
mov eax, dword [ebp - 0x10]
add esp, 0x14
cmp dword [eax - 4], 1
jle 0x41758b
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402489
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4175d4
cmp dword [ebp - 0x28], 0
je 0x4175d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4175bb
push eax
call fcn.00425b9b
mov ebx, eax
mov eax, dword [ebp - 0x30]
pop ecx
mov ecx, dword [ebp - 0x34]
push ebx
push eax
call fcn.004026cf
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402471
mov bl, 1
jmp 0x4175df
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402471
lea ecx, [esi - 0x10]
call fcn.00402471
push edi
call fcn.004221b9
pop ecx
mov al, bl
call fcn.0042265c
ret
Function at 0x417aec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push esi
push 0x417bc3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x417b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x417b45
cmp byte [ebp + 0x10], 0
je 0x417b43
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp + 0x10]
jmp 0x417b45
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x4185c5
Capabilities:
Check os version

Disassembly:
sub esp, 0x148
mov eax, dword [0x44e080]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x15c]
lea eax, [esp + 0x10]
push 0x30
pop esi
push esi
xor ebp, ebp
mov ebx, ecx
push ebp
push eax
call fcn.00423750
push 0x110
lea eax, [esp + 0x54]
mov dword [esp + 0x50], 0x114
push ebp
push eax
call fcn.00423750
add esp, 0x18
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x418628
cmp dword [esp + 0x44], 6
jae 0x41862b
push 0x2c
pop esi
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.USER32.dll_GetParent]
or dword [esp + 0x14], 1
mov dword [esp + 0x18], eax
mov eax, dword [0x44ecf8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
push eax
push ebp
push 0x432
push dword [ebx]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421c45
add esp, 0x148
ret 0x10

Function at 0x419126
Capabilities:
Shutdown system

Disassembly:
push 0x1c
mov eax, 0x43826e
call fcn.004226b6
and dword [ebp - 0x24], 0
mov esi, 0x443654
mov dword [ebp - 0x28], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404ec2
lea eax, [ebp - 0x24]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4191ad
lea eax, [ebp - 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor ecx, ecx
mov dword [ebp - 0x14], 2
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push ecx
push dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4191ad
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4191af
xor bl, bl
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x28], esi
je 0x4191c1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
call fcn.00422671
ret
Function at 0x419e7b
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x8c
mov eax, dword [0x44e080]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov eax, edx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push ecx
mov dword [esp + 0x3c], eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x419fb8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x419fb8
test ebp, ebp
je 0x419fb8
push 0x10000
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.0040b63b
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x419fb1
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
call fcn.00401383
push ebx
lea eax, [esp + 0x18]
push eax
push 0x10000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419f61
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x419f61
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx]
cmp eax, ebp
jbe 0x419f44
mov ecx, ebp
mov byte [esp + 0x13], 1
sub ecx, edx
mov dword [esp + 0x14], ecx
push ecx
push esi
lea ecx, [esp + 0x2c]
call fcn.00401260
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp byte [esp + 0x13], bl
je 0x419f0d
lea ecx, [esp + 0x24]
call fcn.00401305
cmp byte [esp + 0x8c], bl
je 0x419fb1
mov esi, dword [esp + 0x20]
mov ebp, ebx
mov dl, byte [esp + ebp + 0x7c]
mov cl, dl
shr cl, 4
cmp cl, 0xa
sbb al, al
and dl, 0xf
and al, 0xd9
add al, 0x57
add al, cl
cmp dl, 0xa
mov byte [esi + ebp*2], al
sbb al, al
and al, 0xd9
add al, 0x57
add al, dl
mov byte [esi + ebp*2 + 1], al
inc ebp
cmp ebp, 0x10
jl 0x419f79
mov byte [esi + 0x20], bl
mov bl, 1
mov esi, dword [esp + 0x1c]
push esi
call fcn.004221b9
pop ecx
test edi, edi
je 0x419fc3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x98]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421c45
add esp, 0x8c
ret
Function at 0x41a385
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x194
push 0xffffffffffffffff
push 0x4383b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x44e080]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov esi, ecx
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41a3ee
xor al, al
jmp 0x41a533
mov edi, dword [esi]
mov eax, dword [edi - 0xc]
cmp eax, 0x4f
jle 0x41a401
lea edi, [edi + eax*2]
add edi, 0xffffff62
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xc8
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x41a42f
cmp dword [ebp - 0x18], 0xc8
jbe 0x41a525
call fcn.0040219e
push eax
lea ecx, [ebp - 0x10]
call fcn.00401fe1
mov eax, dword [ebp - 0x1c]
and dword [ebp - 4], 0
push 0x20
pop ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x41a493
push 0
mov ecx, esi
call fcn.004083ed
push 0x22
pop ecx
cmp ax, cx
je 0x41a493
push 0
push ebx
mov ecx, esi
call fcn.0040818c
cmp eax, 0xffffffff
je 0x41a493
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00408546
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.00404e09
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00408546
jmp 0x41a4d3
mov edx, dword [esi]
mov ebx, dword [ebp - 0x10]
add ebx, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x41a4d0
cmp dword [ebx + 0xc], 0
jl 0x41a4c4
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x41a4c4
call fcn.00404f5e
mov ecx, ebx
mov esi, eax
call fcn.00402471
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x41a4d0
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.004026cf
push 0x20
pop ebx
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x41a4f5
push 0
mov ecx, esi
call fcn.004083ed
cmp ax, bx
je 0x41a4f5
push ebx
lea ecx, [ebp - 0x10]
call fcn.00408546
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.00404e09
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.00402471
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.00421c45
add ebp, 0x194
leave
ret