joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a4d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404e7b
and dword [ebp - 4], 0
cmp dword [0x440338], 0
mov ebx, eax
jne 0x40a581
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a632
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x432764
push edi
call esi
test eax, eax
je 0x40a632
push eax
call fcn.00404e09
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x440338], eax
call esi
push eax
call fcn.00404e09
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44033c], eax
call esi
push eax
call fcn.00404e09
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x440340], eax
call esi
push eax
call fcn.00404e09
pop ecx
mov dword [0x440348], eax
test eax, eax
je 0x40a581
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e09
pop ecx
mov dword [0x440344], eax
mov eax, dword [0x440344]
cmp eax, ebx
je 0x40a5d9
cmp dword [0x440348], ebx
je 0x40a5d9
push eax
call fcn.00404e84
push dword [0x440348]
mov esi, eax
call fcn.00404e84
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a5d9
test edi, edi
je 0x40a5d9
call esi
test eax, eax
je 0x40a5d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a5d0
test byte [ebp - 0xc], 1
jne 0x40a5d9
or dword [ebp + 0x10], 0x200000
jmp 0x40a612
mov eax, dword [0x44033c]
cmp eax, ebx
je 0x40a612
push eax
call fcn.00404e84
pop ecx
test eax, eax
je 0x40a612
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a612
mov eax, dword [0x440340]
cmp eax, ebx
je 0x40a612
push eax
call fcn.00404e84
pop ecx
test eax, eax
je 0x40a612
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440338]
call fcn.00404e84
pop ecx
test eax, eax
je 0x40a632
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a634
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b960
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 1
jne 0x40b986
mov dword [ebp - 4], str.RootCIMV2
jmp 0x40b98d
mov dword [ebp - 4], str.RootWMI
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x210], 0
jne 0x40b9e0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40b9e0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 1
je 0x40b9e0
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeEx_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
jmp 0x40bb55
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x210], 0
jne 0x40ba57
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40ba4a
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0x80010119
je 0x40ba4a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._CoInitializeSecurity_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
jmp 0x40bb55
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x210], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x214], 0
jne 0x40babb
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0x18]
add ecx, 0x214
push ecx
push 0x43147c
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x43154c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20c], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x20c], 0
je 0x40babb
mov eax, dword [ebp - 0x18]
mov dword [eax], str._CoCreateInstance_Call_Error
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 3
jmp 0x40bb55
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x218], 0
jne 0x40bb4e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add eax, 0x218
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x214]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x214]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0xc]
call ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x20c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x20c], 0
je 0x40bb44
mov ecx, dword [ebp - 0x18]
mov dword [ecx], str._ConnectServer_Call_Error
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x218], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40bb55
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x40bf60
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40bfb3
mov dword [ebp - 0x14], 0xffffffff
jmp 0x40c07d
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x40bfce
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x40c076
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x40c00c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x40c076
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x40c034
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x4585a0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40c05b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x45859c]
shl eax, 8
add eax, 0x4586a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x45859c]
add ecx, 1
mov dword [0x45859c], ecx
cmp dword [ebp - 0x10], 0
je 0x40c071
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x40bfc5
jmp 0x40c07d
cmp dword [ebp - 0x10], 0
je 0x40c08c
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x40c09b
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x40c340
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.Accept:___r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_n
mov dword [ebp - 0x20], str.Content_Type:_application_x_www_form_urlencoded_r_n
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x43321c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40c396
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x40c3bc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov eax, dword [0x43ef58]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x248
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x40c404
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40c465
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x40c43b
mov dword [ebp - 0x1c], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40c465
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x40c45e
mov dword [ebp - 0x1c], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40c465
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c520
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [0x43ef58], 0x100
push 0
push 0
push 0
push 0
push str.UserAgent_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x40c573
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40c6ba
cmp dword [ebp + 0x10], 0
je 0x40c58d
push 4
lea eax, [ebp + 0x10]
push eax
push 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x3c
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x100
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x800
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x40c5fd
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40c6ba
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 2
jne 0x40c633
mov dword [ebp - 0xc], 0xa00
push 4
lea edx, [ebp - 0xc]
push edx
push 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov edx, dword [0x43ef58]
or edx, 0x800000
mov dword [0x43ef58], edx
mov dword [0x4584c0], 1
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [0x4584c4], eax
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov dword [0x458598], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x24]
mov dword [0x456150], eax
push 0
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x40c6b3
mov dword [ebp - 8], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [0x4584c0], 0
mov dword [0x458598], 0
jmp 0x40c6ba
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e190
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x40e1df
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x40e31c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x40e202
mov dword [ebp - 0x18], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x40e316
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x40e22e
mov dword [ebp - 0x18], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x40e2b9
lea edx, [ebp - 8]
push edx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x40e254
mov dword [ebp - 0x18], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x40e2b9
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x40e27a
mov dword [ebp - 0x18], 0xfffffffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x40e2b9
cmp dword [ebp - 0x10], 0
je 0x40e28f
push 0x4581c0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 8], 0
je 0x40e2a4
push 0x4582c0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x40e2b9
push 0x4583c0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x40e2d1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x14]
call edx
cmp dword [ebp - 8], 0
je 0x40e2e9
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x14]
call ecx
cmp dword [ebp - 0x10], 0
je 0x40e301
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x40e316
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x40f7e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x40f85a
mov dword [ebp - 4], 0
jmp 0x40f8a3
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f8a3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401ef4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fb70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x43f768], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00401f10
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00401f10
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40fcc6
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x40fc19
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x40fc72
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x40fc70
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x40fc70
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x40fc0a
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40fc93
xor edx, edx
mov word [0x4578c0], dx
jmp 0x40fcc6
lea eax, [ebp - 0x218]
push eax
push 0x4333c0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40fcb4
xor ecx, ecx
mov word [0x4578c0], cx
jmp 0x40fcc6
lea edx, [ebp - 0x108]
push edx
push 0x4578c0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.0040f8c0
push 0x4333d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40fd0f
push 0x4333ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40fd0f
mov dword [0x43f76c], 2
jmp 0x40fd49
cmp dword [ebp - 0x10c], 0
je 0x40fd42
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x43f76c], eax
cmp dword [0x43f76c], 0
jne 0x40fd42
mov dword [0x43f76c], 3
jmp 0x40fd49
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ef4
mov esp, ebp
pop ebp
ret 4
Function at 0x411850
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x55b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x57d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0
jmp 0x4118de
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x43f7b8], 0
je 0x411929
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43f7b8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43f808]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4118d5
mov esp, ebp
pop ebp
ret

Function at 0x411930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 5
push 0x55b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x57d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0
jmp 0x4119be
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x43f7b8], 0
je 0x411a09
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43f7b8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x43f808]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4119b5
mov esp, ebp
pop ebp
ret
Function at 0x413350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x413396
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x4133d2
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4133c4
mov dword [ebp - 8], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4133d2
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413840
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1b0], 0x94
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1a0], 2
jne 0x413891
cmp dword [ebp - 0x1ac], 5
jb 0x413891
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x114], eax
jmp 0x413903
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.winhlp32.exe
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4138f0
push 0x6a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebp - 0x114], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x413903
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401ef4
mov esp, ebp
pop ebp
ret
Function at 0x41dd20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x43e2c4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x238], ax
push 0x22e
push 0
lea ecx, [ebp - 0x236]
push ecx
call fcn.00401f10
add esp, 0xc
mov dword [ebp - 0x240], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x41ddc1
lea edx, [ebp - 0x238]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.00401350
add esp, 0x10
test eax, eax
jne 0x41ddbd
mov dword [ebp - 0x240], 0
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41ddc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ef4
mov esp, ebp
pop ebp
ret 0x10