joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aded
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0xc], esi
cmp dword [esi + 0xc], ebx
je 0x40af54
mov dword [ebp - 0x48], 0x28
call fcn.0040aba9
mov ecx, esi
mov dword [ebp - 0x44], eax
call fcn.0040abd9
push ebx
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], 1
mov word [ebp - 0x3a], 0x20
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.USER32.dll_GetDC]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x40af54
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40af45
mov ecx, esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0040aba9
mov ecx, esi
mov dword [ebp - 0x18], eax
call fcn.0040abd9
push ebx
mov dword [ebp - 0x14], eax
push ebx
push ebx
lea eax, [ebp - 0x48]
push ebx
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esi + 0xc]
lea esi, [ebp - 0x20]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 4]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
mov ecx, edi
call fcn.0040a6e2
push ebx
push dword [ebp - 8]
call fcn.0040ac4d
pop ecx
mov esi, eax
pop ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 4]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
cmp dword [ebp + 8], ebx
je 0x40af45
push ebx
push ebx
push ebx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
push ebx
push ebx
push ebx
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push dword [ebp + 8]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp + 8]
call esi
push dword [edi + 0xc]
lea esi, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040a6e2
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push eax
push 0xe
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push 1
pop eax
jmp 0x40af56
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40dacf
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
je 0x40dae6
push 8
mov eax, esi
pop ecx
mov byte [eax], bl
inc eax
dec ecx
jne 0x40dae0
push 0xf0000000
push 0x18
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40db18
lea eax, [esi + 4]
push eax
push ebx
push ebx
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40db1c
push esi
call fcn.0040db21
pop ecx
xor al, al
jmp 0x40db1e
mov al, 1
pop esi
pop ebx
ret

Function at 0x40de32
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION_
lea ecx, [ebp - 8]
mov dword [ebp - 4], esi
call fcn.0040182e
lea eax, [ebp - 0xc]
mov ebx, 0xf003f
push eax
push ebx
push esi
mov edi, SysReAllocString
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40de7c
lea ecx, [ebp - 4]
call fcn.0040df4e
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], esi
je 0x40df18
cmp eax, esi
je 0x40dec6
lea eax, [ebp - 0xc]
mov dword [ebp + 0xc], esi
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x40deb5
lea ecx, [ebp - 4]
call fcn.0040df4e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
je 0x40dec6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push ebx
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40deeb
lea ecx, [ebp - 4]
call fcn.0040df4e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040ddce
mov eax, dword [eax]
pop ecx
lea ecx, [ebp + 0xc]
push 4
push ecx
push 4
push esi
push eax
push dword [ebp - 4]
mov dword [ebp + 0xc], 0x2af9
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea ecx, [ebp - 0xc]
jmp 0x40df32
lea eax, [ebp + 0xc]
push eax
call fcn.0040ddce
pop ecx
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
lea ecx, [ebp + 0xc]
call fcn.00401802
lea ecx, [ebp - 8]
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.0040df4e
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e073
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
lea eax, [ebp - 0x24c]
push 0x104
push eax
push dword [0x4a1708]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax - 8], esi
jne 0x40e0c6
lea eax, [ebp - 0x24c]
test eax, eax
je 0x40e0b6
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.004018f3
push 0x3c
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.00442580
add esp, 0xc
lea eax, [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
push eax
call fcn.004017bc
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x40], esi
call fcn.00401b75
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], 1
call fcn.004017bc
mov eax, dword [ebp - 8]
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x30], eax
je 0x40e122
mov dword [ebp - 0x38], 0x459904
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
lea ecx, [ebp + 8]
call fcn.00401802
lea ecx, [ebp + 0xc]
call fcn.00401802
mov eax, esi
pop esi
leave
ret
Function at 0x40e208
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
lea ecx, [ebp - 0x10]
call fcn.004070c2
mov eax, dword [0x4a16f0]
mov ebx, 0x81
mov dword [ebp - 0x844], eax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x840]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
lea eax, [ebp - 0x844]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
lea eax, [ebp - 0x844]
mov ecx, esp
push eax
call fcn.004070c2
lea eax, [ebp - 0x18]
push eax
call fcn.0040e153
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push str._selfdestruct.bat
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00401a95
mov edx, dword [0x4a16f0]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x42c]
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x228], edx
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [ebp - 0x634]
mov dword [ebp - 0x638], edx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x228]
push eax
push esi
call edi
lea eax, [ebp - 0x638]
push eax
push esi
call edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.004430e9
pop ecx
lea eax, [ebp - 0x430]
pop ecx
push esi
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x430]
lea ecx, [ebp - 8]
push eax
call fcn.004070c2
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x40e3da
push dword [ebp - 0xc]
mov eax, dword [0x4581d0]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.00408f2b
add esp, 0x14
lea ecx, [ebp - 4]
push 0x459918
push 0x459910
call fcn.00401c3b
mov eax, dword [ebp - 4]
cmp eax, esi
mov dword [ebp - 0x1c], eax
jne 0x40e36b
xor edi, edi
jmp 0x40e39b
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00442720
mov edi, esp
push esi
push esi
push ebx
and byte [edi], 0
push edi
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x20]
push esi
push ecx
push dword [eax - 8]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x638]
push esi
push eax
lea eax, [ebp - 0x228]
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00401802
lea ecx, [ebp - 8]
call fcn.00401802
lea ecx, [ebp - 0xc]
call fcn.00401802
lea ecx, [ebp - 0x18]
call fcn.00401802
lea ecx, [ebp - 0x10]
call fcn.00401802
lea esp, [ebp - 0x850]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40eb20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40eb5e
cmp dword [ebp + 0x10], esi
je 0x40eb80
push esi
push str.Create_Error_
push dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40eb80
lea eax, [ebp - 4]
push esi
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [eax + 0x14]
push dword [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop esi
lea ecx, [ebp + 8]
call fcn.00401802
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x40eb8e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40ebc9
push ebx
push str.Error1_
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40ec0a
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 8], ebx
lea eax, [edi + 1]
lea ecx, [esi + 4]
push eax
call fcn.00401b75
lea ecx, [ebp - 8]
push ebx
push ecx
push edi
push eax
mov dword [esi], eax
push dword [ebp - 4]
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
lea ecx, [ebp + 8]
call fcn.00401802
mov eax, ebx
pop ebx
leave
ret
Function at 0x412baa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
xor esi, esi
push 0x3c
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00442580
add esp, 0xc
lea ecx, [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], esi
push esi
mov dword [ebp - 0x2c], 0x45a328
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], 1
call fcn.00401b75
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401802
mov eax, esi
pop esi
leave
ret

Function at 0x41349a
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push esi
mov esi, ecx
push edi
mov dword [esi], 0x453d24
mov dword [esi + 0x1c], 0x453d20
mov dword [esi + 0x20], 0x453d1c
cmp dword [0x4ca4f8], 0
je 0x4134ec
push ebx
push 1
call fcn.00422c43
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push 5
push 0
push str.Shell_TrayWnd
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 5
push 0
push str.Shell_SecondaryTrayWnd
call edi
push eax
call ebx
pop ebx
lea ecx, [esi + 0xaf0]
call fcn.00408e82
lea ecx, [esi + 0xae4]
call fcn.004263bc
lea ecx, [esi + 0xa48]
call fcn.00436c8a
lea ecx, [esi + 0x7b8]
call fcn.00426d0a
lea ecx, [esi + 0x550]
call fcn.004072b3
mov eax, dword [esi + 0x544]
lea edi, [esi + 0x544]
test eax, eax
je 0x413541
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
test eax, eax
je 0x413541
and dword [edi], 0
lea ecx, [esi + 0x6c]
call fcn.004392cc
lea ecx, [esi + 0x44]
call int.0043a1e5
lea ecx, [esi + 0x24]
call fcn.0040aff5
pop edi
pop esi
ret

Function at 0x413cce
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x1a85
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x4a1790]
pop esi
ret 0x10

Function at 0x413e24
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea ecx, [ebp - 4]
push dword [ebp + 0x10]
call fcn.004017bc
mov ecx, dword [ebp + 0x10]
push 0x4a15c4
call fcn.004019af
cmp dword [0x45a040], 0
jne 0x413e82
push dword [0x4ca3fc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x10000
push eax
push eax
call fcn.00401b75
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
mov esi, eax
call fcn.00401bdd
jmp 0x413ea7
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push ecx
mov ecx, esp
push eax
call fcn.004017bc
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.004017bc
call fcn.00435d65
add esp, 0xc
mov esi, eax
lea ecx, [ebp - 4]
call fcn.00401802
lea ecx, [ebp + 8]
call fcn.00401802
lea ecx, [ebp + 0xc]
call fcn.00401802
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415b73
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [0x45a060], 1
call edi
mov si, ax
and esi, 0x3ff
call edi
push 7
pop ecx
shr ax, 0xa
cmp si, cx
jne 0x415baa
and dword [0x45a060], 0
jmp 0x415dea
cmp si, 0xc
jne 0x415bbf
mov dword [0x45a060], 2
jmp 0x415dea
cmp si, 0x10
jne 0x415bd4
mov dword [0x45a060], 3
jmp 0x415dea
cmp si, 0x15
jne 0x415be9
mov dword [0x45a060], 4
jmp 0x415dea
cmp si, 0x12
jne 0x415bfe
mov dword [0x45a060], 5
jmp 0x415dea
cmp si, 4
jne 0x415c27
cmp ax, 1
mov dword [0x45a060], 6
jne 0x415dea
mov dword [0x45a060], 0xe
jmp 0x415dea
cmp si, 5
jne 0x415c38
mov dword [0x45a060], ecx
jmp 0x415dea
cmp si, 0x19
jne 0x415c4d
mov dword [0x45a060], 8
jmp 0x415dea
push 0x16
pop edi
cmp si, di
jne 0x415c64
mov dword [0x45a060], 0x25
jmp 0x415dea
cmp si, 0x1d
jne 0x415c79
mov dword [0x45a060], 0xa
jmp 0x415dea
push 0x13
pop edx
cmp si, dx
jne 0x415c90
mov dword [0x45a060], 0xb
jmp 0x415dea
cmp si, 0xb
jne 0x415ca5
mov dword [0x45a060], 0xc
jmp 0x415dea
cmp si, 0xa
jne 0x415cce
cmp ax, 8
mov dword [0x45a060], 0xd
jne 0x415dea
mov dword [0x45a060], 0x24
jmp 0x415dea
push 0x14
pop eax
cmp si, ax
jne 0x415ce5
mov dword [0x45a060], 0xf
jmp 0x415dea
cmp si, 0xe
jne 0x415cfa
mov dword [0x45a060], 0x10
jmp 0x415dea
cmp si, 8
jne 0x415d0f
mov dword [0x45a060], 0x11
jmp 0x415dea
cmp si, 0x1f
jne 0x415d24
mov dword [0x45a060], 0x12
jmp 0x415dea
push 0x1a
pop ecx
cmp si, cx
jne 0x415d37
mov dword [0x45a060], edx
jmp 0x415dea
cmp si, 0x11
je 0x415de5
cmp si, 6
jne 0x415d56
mov dword [0x45a060], 0x15
jmp 0x415dea
cmp si, 2
jne 0x415d67
mov dword [0x45a060], edi
jmp 0x415dea
push 0x22
pop eax
cmp si, ax
jne 0x415d7b
mov dword [0x45a060], 0x17
jmp 0x415dea
cmp si, 3
jne 0x415d8d
mov dword [0x45a060], 0x18
jmp 0x415dea
cmp si, 0x24
je 0x415c2d
cmp si, 0x3e
jne 0x415da9
mov dword [0x45a060], 0x1b
jmp 0x415dea
cmp si, 0x21
jne 0x415dbb
mov dword [0x45a060], 0x1c
jmp 0x415dea
cmp si, 0x64
jne 0x415dcd
mov dword [0x45a060], 0x1d
jmp 0x415dea
cmp si, 0x1b
jne 0x415ddf
mov dword [0x45a060], 0x1e
jmp 0x415dea
cmp si, 0x1e
jne 0x415dea
mov dword [0x45a060], eax
push dword [0x45a060]
push ecx
mov ecx, esp
push 0x45af30
call fcn.004070c2
push ecx
mov ecx, esp
push 0x4ca404
call fcn.004017bc
call fcn.00413ec6
add esp, 0xc
pop edi
pop esi
ret
Function at 0x416704
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.004166df
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x416800
push ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, edi
mov dword [ebp + 0xc], eax
je 0x416800
push ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, edi
je 0x416800
push dword [ebp + 0xc]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [esi + 8], eax
je 0x416800
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x4167f4
push dword [ebp + 0xc]
push ebx
push eax
call fcn.00441de0
add esp, 0xc
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push edi
push dword [esi + 8]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4167eb
mov ebx, dword [ebp + 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
cmp eax, edi
je 0x4167b8
push edi
push ebx
mov ecx, eax
call fcn.00416809
jmp 0x4167ba
xor eax, eax
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4167eb
mov ecx, dword [eax + 8]
mov dword [eax + 8], edi
cmp ecx, edi
jne 0x4167db
mov al, 1
jmp 0x416802
mov ecx, dword [esi + 4]
cmp ecx, edi
je 0x4167e8
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 8], edi
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x416973
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x114
mov esi, 0x4a2bc8
push edi
push 0
push esi
call fcn.00442580
add esp, 0xc
mov dword [0x4a2bc8], edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
call esi
mov eax, dword [0x4a2bcc]
movzx edx, word [0x4a2bd0]
movzx ecx, ax
shl ecx, 0x10
or ecx, edx
cmp eax, 5
mov dword [0x4ca574], ecx
mov ecx, dword [0x4581d0]
mov dword [ebp - 4], ecx
jb 0x4169fc
push 0x11c
mov edi, 0x4a2aa8
push 0
push edi
call fcn.00442580
add esp, 0xc
mov dword [0x4a2aa8], 0x11c
push edi
call esi
mov eax, dword [0x4a2aac]
mov dword [0x4a2bcc], eax
mov eax, dword [0x4a2ab0]
mov dword [0x4a2bd0], eax
lea ecx, [ebp - 4]
call fcn.00401802
pop edi
pop esi
leave
ret
Function at 0x416ed6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x4a1708]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.RunGetPixelColor
lea ecx, [ebp - 4]
call fcn.0040182e
mov eax, dword [eax]
push 5
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00401802
pop esi
leave
ret

Function at 0x4170a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push edi
push str.powershell.exe
lea ecx, [ebp - 4]
call fcn.0040182e
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00442580
mov eax, dword [0x4a16f0]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x840], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x83c]
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x840]
push edx
push eax
mov dword [ebp - 0x3c], 0x200
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], str._UserProfile_
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x840]
push 0x2e
push eax
call fcn.00442d7e
pop ecx
pop ecx
pop edi
test eax, eax
je 0x41712c
lea eax, [ebp - 0x840]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x18], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x24], 6
push eax
mov dword [ebp - 0x34], 0x459904
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 4]
call fcn.00401802
lea ecx, [ebp + 0xc]
call fcn.00401802
leave
ret

Function at 0x4172d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push str.SoftwareMicrosoftWindows_DefenderWindows_Defender_Exploit_GuardControlled_Folder_AccessAllowedApplications
lea ecx, [ebp - 0x10]
call fcn.0040182e
lea eax, [ebp - 0x14]
xor esi, esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 1
push esi
push esi
push esi
push dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 8], esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x417317
mov edi, dword [ebp - 8]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 2
push eax
call fcn.00435cce
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xc], esi
lea ecx, [ebp - 4]
jne 0x417366
call fcn.00401802
cmp edi, esi
je 0x417361
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop esi
jmp 0x417376
call fcn.00401802
cmp edi, esi
je 0x417376
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
call fcn.00401802
mov eax, esi
pop edi
pop esi
leave
ret