joyce8/EMBER2024-capa huggingface dataset:
Function at 0x86b3e4
Capabilities:
Encode data using xor

Disassembly:
push edi
adc ecx, dword [reloc.MSVFW32.dll_DrawDibDraw]
xchg edx, eax
sbb al, 0x8d
sahf
inc eax
nop
mov byte [0xba61cab3], al
div byte [edx - 0x4f]
adc edx, dword [esi + reloc.MSVFW32.dll_DrawDibDraw]
push 0x6b
jno 0x86b456
cmp byte [ebx + 0x53], bh
add dword [eax - 0x46], edi
jnp 0x86b47e
add dword [esi + reloc.MSVFW32.dll_DrawDibDraw], 0x9c0d16d3
stosd dword es:[edi], eax
dec ebp
pop ds
jns 0x86b463
push ss
and eax, 0xd1767fb0
cmp byte [ebp - 3], dh
xchg dword [ebp + 0x4a014cde], eax
invalid
loopne 0x86b4bd
out 0xdb, eax
mov bh, ah
sub eax, 0x60aef74e
push ss
xchg esi, eax
sub eax, 0xda1b8380
pushfd
les ecx, [ebx + 0x7a1fca09]
or eax, 0x8165cd48
push dword [ecx + 0xd]
invalid
mov edx, 0x9bf383dc
add edi, eax
lodsd eax, dword [esi]
fsub dword [ecx - 0x34]
pop edx
mov ebp, dword cs:[edx + 0x5b]
scasb al, byte es:[edi]
in eax, dx
cmp eax, 0x4a36c464
wait
push ss
rol edi, 1
adc al, 0x89
sbb byte [esi - 0x7fdabccf], ch
dec esp
mov ecx, edi
mov dh, byte [ecx - 0x3dea398a]
jbe 0x86b4ab
invalid
in al, dx
or ecx, ebp
and byte [ebp + edi*8 - 0x23], al
out 0xbc, al
sahf
enter 0x3a34, 0xffffffffffffffde
mov al, byte [0x48dbc154]
daa
fisttp dword [eax + 0x27]
and byte [ecx + 0x96cf3fa], dh
push esp
cmp dword [esi], ebx
das
loope 0x86b54a
out dx, eax
mov dl, 0xd3
call 0xbf4b623d
sbb esp, eax
mov ebx, 0xbfb1647c
clc
add cl, byte [ebp - 0x43]
xor ebp, dword [ecx + reloc.MSVFW32.dll_DrawDibDraw]
out 0xd4, eax
pop eax
test byte [ebx - 0x4f], 0x32
int3
cmp eax, 0xb560f484
sti
or eax, dword [edi + ebp*2 - reloc.MSVFW32.dll_DrawDibDraw]
pop ds
cmp al, 0x66
jecxz 0x86b4ab
neg byte [eax - 0x16]
aaa
invalid
aam 0x37
and al, 0x9b
xchg edx, eax
dec eax
dec ecx
dec eax
mov byte [0xf6076bd0], al
fdivr dword [ebp + 0x5524baa6]
mov cl, 0x98
inc ecx
push ecx
jle 0x86b509
mov edi, 0x850b4a3e
invalid
Function at 0x878e94
Capabilities:
Encode data using xor

Disassembly:
hlt
cmp dword [ecx], reloc.MSVFW32.dll_DrawDibDraw
inc edx
not byte [edx + 0x6d]
test eax, 0xe8640fca
arpl word [esi], sp
xchg esp, eax
push ecx
ret
mov al, 0x6b
mov bl, 0xc8
xchg edx, eax
and al, 0xc3
xor ax, 0x6f6a
rcl dword [esi]
mov esp, 0x775e8962
imul eax, dword [reloc.MSVFW32.dll_DrawDibDraw], 0xfb102e61
popal
adc bl, bh
adc bl, bh
and eax, 0xfe4d5607
not cl
insb byte es:[edi], dx
pop ebp
mov word [ecx - 0x50552020], ds
push ebp
dec edi
out 0x1e, eax
out dx, al
jno 0x878e1b
push edi
stosb byte es:[edi], al
or al, 0xe0
sbb dword [0xb7d052e4], ebx
je 0x878e06
shl byte [ebx + 0x2b], 0x40
enter 0xffffffffffffcf2f, 0xb
loopne 0x878dfc
inc edx
iretd
imul ebp, dword [ecx], reloc.MSVFW32.dll_DrawDibDraw
popal
xchg dword [0xd7f72acd], ebp
push 0x1836af9
dec edx
jo 0x878e35
pushal
xchg ebp, eax
add eax, 0xb35ac347
jns 0x878e33
pop eax
push edi
ljmp 0x28c9

Function at 0x889eb6
Capabilities:
Encode data using xor

Disassembly:
out dx, al
xchg ecx, eax
in al, dx
adc al, ah
insd dword es:[edi], dx
pop esp
sub eax, 0xba6288e6
xor byte [edx + 0x36], cl
lcall 0xb6f0, 0x391de5d
aad 0xf4
cmp bh, bl
inc esp
lds ebp, [ebx + 0x22fc78b4]
push ebp
fldz
lcall 0x9a12, 0xcf5213c0
pop edi
popal
push ebx
in al, dx
sar byte [ebx + 1], cl
sar dword [ecx + ebp + 0x2f], cl
xor al, 9
push es
mov dh, 0xac
adc al, ch
loopne 0x889ec6
invalid

Function at 0x88bcef
Capabilities:
Encode data using xor

Disassembly:
push ds
mov al, bh
ljmp 0xbf56
out 0x6a, al
lodsb al, byte [esi]
test byte [esi + 0x3e], cl
xchg byte [ecx], al
ja 0x88bc8c
mov ebx, 0x9f59afe0
pop ss
out dx, eax
or byte [eax], ch
sub dword [eax], reloc.MSVFW32.dll_DrawDibDraw
fld qword [eax - 0x3ca0a256]
or ecx, dword [ecx + reloc.MSVFW32.dll_DrawDibDraw]
push esi
sub bh, 0x44
xor ebp, esi
popal
adc byte [esi - 0x4f], bh
mov ebx, 0x7fbc0c4b
sub dword [edx + esi*4], ecx
adc ch, byte [ebp - 0x7533a05f]
cmpsd dword [esi], dword es:[edi]
ror edi, 1
dec esp
movsd dword es:[edi], dword [esi]
lcall 0xe29b, 0x77cbe8ac
dec ebp
pop ecx
in eax, dx
pop esi
xlatb
lodsd eax, dword [esi]
sub ebp, eax
xchg esi, eax
dec edx
scasb al, byte es:[edi]
les edx, [esi + 0xfef69be]
sub al, 0x74
loope 0x88bdb4
imul ebp, edi, 0xe1742c0f
or dh, byte [ebx - 0x7c]
or dh, byte [ebx - 0x7c]
rep insd dword es:[edi], dx
xor dh, al
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
pop ebp
jae 0x88bd47
ret 0x45c5
inc eax
push ds
lcall 0x7e2a, 0xe0400e84
cmc
mov byte [0xdab69445], al
and ah, al
mov bl, 0xbb
xchg dword [ebx + 9], edx
scasb al, byte es:[edi]
xchg ebx, eax
sbb byte [ecx + 0x64], bh
cmc
pushfd
inc esp
xchg esp, eax
ljmp 0x7c9

Function at 0x891169
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xchg byte [ecx - 0x3744ac19], ah
mov ebx, 0x21b212c3
fistp dword [edx]
mov bh, 0xb8
add al, dl
xchg dword [edx - 0x66], ebx
sbb al, 0x62
adc eax, dword [eax - reloc.MSVFW32.dll_DrawDibDraw]
mov edx, 0x5e232a31
invalid
Function at 0x93370e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9337a2
push esp
mov al, byte [esp + 0xc]
xchg dword [esp + 5], eax
mov byte [esp + 5], al
pop word [esp + 6]
rdtsc
jmp 0x933758
mov cx, word [esp + 5]
lea eax, [edi + 0xe3]
rdtsc
mov byte [esp + 0xc], cl
mov word [esp + 1], bp
push word [esp + 9]
mov dx, 0x399c
mov dh, 0xe0
xchg word [esp + 2], ax
bswap edx
xchg cx, dx
rdtsc
jmp 0x933713
Function at 0x938297
Capabilities:
Parse pe header

Disassembly:
sub esp, 0
add esp, 0
std
lea esp, [esp + 3]
std
call fcn.009322c6
pushal
lea esp, [esp + 0x59]
pushfd
setbe al
push word [esp + 2]
jmp 0x932481
mov dword [esp], ebp
ror al, cl
call fcn.00932460
lea eax, [esp + ebp]
bswap edi
add esp, 5
xchg dword [esp + 1], eax
std
setnp bh
jmp 0x932531
bt edi, ebp
mov bx, cx
xchg edi, eax
rol bl, cl
mov eax, edx
sub esp, 0x12
jmp 0x93250c
bswap ebx
mov bx, word [esp + 8]
add al, ch
push esi
pop eax
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x9324b8
xchg byte [esp + 2], ah
shr ax, 9
mov al, byte [esp]
bsf ebx, edx
push dword [esp + 3]
lea ebx, [esi*4]
jmp 0x9324ce
mov bx, dx
xchg byte [esp + 0xa], bh
xchg dword [esp + 0xe], ebx
mov dword [esp + 0x15], edx
sub esp, 9
mov eax, ebp
jmp 0x932544
setg al
cmp bx, cx
mov bl, 0x1b
mov byte [esp + 2], dl
lea ebx, [eax + 0x35]
mov ah, 0xca
jmp 0x9324f1
add esp, 0x1f
mov bx, word [esp + 7]
xchg word [esp + 3], di
lea edi, [ecx*4]
cmp bl, ch
mov eax, 0x73ad11b4
jmp 0x9325e7
inc dword [eax + 0x82f015]
pushfd
sub esp, 0x11
mov byte [esp + 0xe], dl
lea esp, [esp + 0xe]
jmp 0x932428
rol edi, cl
mov edi, ecx
pop di
inc eax
lea eax, [ebp*4]
adc edi, eax
jmp 0x9325c5
mov bx, cx
seto bh
lea edi, [esi*4]
mov dword [esp], ebx
mov word [esp + 8], sp
bsf eax, edi
jmp 0x932585
pop word [esp + 0xc]
not edi
pop eax
adc ebx, 0xd4378ddf
pop di
stc
jmp 0x932686
pop word [esp]
push word [esp + 5]
mov ax, word [esp + 6]
xchg word [esp + 5], bx
setp bl
sub esp, 0x13
jmp 0x9325ab
xchg byte [esp + 0x12], ah
sub esp, 0xa
xchg dword [esp + 0xe], ebx
mov ah, 0x7e
jmp 0x932646
xchg di, bx
xchg dword [esp + 7], ebx
push dword [esp + 0xd]
bsf di, cx
xchg byte [esp + 9], bh
bsr ebx, ebx
jmp 0x932602
clc
mov dword [esp + 0xc], ebx
push edx
add esp, 3
inc ebx
pop dword [esp + 6]
jmp 0x932660
xchg word [esp + 0xd], di
mov ah, 1
setae al
mov bl, 0xc5
lea edi, [ecx*4]
mov word [esp + 0xd], bx
jmp 0x932630
lea eax, reloc.MSVFW32.dll_DrawDibDraw
mov byte [esp + 0xf], cl
mov eax, esp
call fcn.00932831
invalid
pop word [esp + 8]
xchg byte [esp + 0xb], bl
lea eax, [esp + edi]
not di
inc edi
add bh, 0x91
jmp 0x932618
push eax
jmp 0x93303c
call 0x933041
jmp 0x9332de
je 0x93256e
jne 0x93332e
inc ecx
push esi
dec ecx
inc esi
dec ecx
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add dh, dh
pop eax
sub eax, 0x933041
cmp dword [eax + reloc.MSVFW32.dll_DrawDibDraw], 0
jmp 0x9332c8
lea esp, [esp + 8]
popal
jmp loc.0048b62a
test dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], 0x2244c88
mov byte [esi], bl
jns 0x9381cf
cpuid
and eax, 0xaa2fdcb5
aam 0x47
lea esp, [esp + 8]
cmp word [ebx], 0x4550
inc ebp
je 0x932869
jne 0x938256
je 0x93829f
or al, 0xff
xchg dword [esi - 0x1a], esp
je 0x9382c5
out dx, al
mov edx, 0xee8b1b94
sbb eax, 0x127cfa76
jne 0x938243
mov ebx, 0xb8d949cc
dec ebx
cmp eax, 0x1f78ea6e
ljmp 0x9fa

Function at 0x938d47
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x9382fa
lea esp, [esp + 0x44]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x93833d
mov dword [esp + 0x28], esi
pushal
mov dword [esp + 0x44], edi
jmp 0x938945
Function at 0x1002701
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1007398
call fcn.01002924
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100849c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002516
cmp eax, esi
jne 0x1002509
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002519
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10024f0
xor esi, esi
inc esi
mov eax, dword [0x1008498]
cmp eax, esi
jne 0x100252c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002567
mov eax, dword [0x1008498]
test eax, eax
jne 0x1002561
mov dword [0x1008498], esi
push 0x10011cc
push 0x10011c0
call fcn.0100246d
pop ecx
pop ecx
test eax, eax
je 0x1002567
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002631
mov dword [0x1008040], esi
mov eax, dword [0x1008498]
cmp eax, esi
jne 0x100258b
push 0x10011bc
push 0x10011b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1008498], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002598
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10084a0], ebx
je 0x10025b9
push 0x10084a0
call fcn.01002899
pop ecx
test eax, eax
je 0x10025b9
push ebx
push 2
push ebx
call dword [0x10084a0]
push dword [0x1008028]
push dword [0x100802c]
push dword [0x1008024]
call fcn.010023a6
add esp, 0xc
mov dword [0x100803c], eax
cmp dword [0x1008030], ebx
jne 0x1002617
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1008040], ebx
jne 0x1002625
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100803c]
call fcn.01002969
ret
call fcn.01002a71
jmp 0x10024ce
Function at 0x1004ce4
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x9e4], eax
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0xa04]
mov dword [ebp - 0xa08], esi
mov dword [ebp - 0x9e8], edx
mov dword [ebp - 0x9e0], esi
mov dword [ebp - 0x9dc], esi
rep stosd dword es:[edi], eax
mov word [ebp - 0x46], ax
cmp dword [ebp - 0x9e4], esi
je 0x1004e68
cmp ebx, esi
je 0x1004e68
mov eax, dword [ebx]
cmp eax, esi
je 0x1004d61
cmp eax, 2
jb 0x1004e68
cmp edx, esi
je 0x1004e68
cmp dword [0x100837c], esi
jne 0x1004d95
lea eax, [ebp - 0x9d8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1004d8b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
jmp 0x1004e74
mov dword [0x100837c], 1
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0xa08]
push eax
push esi
push dword [ebp - 0x9e4]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x1004e7a
mov esi, dword [ebp - 0x9dc]
xor edi, edi
jmp 0x1004e02
push 4
xor eax, eax
mov word [ebp - 0x848], ax
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x401
lea eax, [ebp - 0x848]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
cmp eax, edi
je 0x1004e08
cmp eax, 0x2afc
jne 0x1004dff
cmp word [ebp - 0x848], di
jne 0x1004e08
mov esi, dword [esi + 0x1c]
cmp esi, edi
jne 0x1004dc2
jmp 0x1004e54
lea esi, [ebp - 0x848]
cmp dword [ebp + 0x14], edi
jne 0x1004e25
mov eax, esi
push 0x1001338
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
pop ecx
pop ecx
mov esi, eax
push edi
push esi
call fcn.01003002
mov ecx, dword [ebx]
inc eax
cmp ecx, eax
jae 0x1004e41
mov dword [ebx], eax
mov dword [ebp - 0x9e0], 1
jmp 0x1004e54
push ecx
push esi
push dword [ebp - 0x9e8]
call fcn.0100390c
mov dword [ebp - 0x9e0], eax
push dword [ebp - 0x9dc]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, dword [ebp - 0x9e0]
jmp 0x1004e7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004e7a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002710
leave
ret 0x10
Function at 0x1005296
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10053f1
push esi
call fcn.0100505d
cmp eax, 1
je 0x10053f1
push esi
mov dword [ebp + 8], esi
call fcn.01004beb
cmp eax, 1
jne 0x10052d0
add esi, 4
mov dword [ebp + 8], esi
push dword [ebp + 8]
call fcn.010051c4
test eax, eax
jne 0x10052ec
call fcn.01002dd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1005425
cmp dword [ebp + 0x14], ebx
je 0x1005315
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1005315
push dword [ebp + 0x14]
push dword [ebp + 8]
push 0x1001358
push 2
call fcn.010040f3
add esp, 0x10
jmp 0x1005327
push dword [ebp + 8]
push 0x100133c
push 1
call fcn.010040f3
add esp, 0xc
test eax, eax
jne 0x100534a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100533d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01002dd3
push 8
pop eax
jmp 0x1005425
call fcn.01002d40
cmp eax, ebx
jne 0x100535c
push 0x12
call fcn.01002ccf
jmp 0x1005366
push ebx
push ebx
push eax
push 0x12
call fcn.01003e66
mov edx, eax
cmp edx, ebx
je 0x100532b
push edi
push 8
pop ecx
push ebx
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 0x10]
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
pop edi
cmp esi, ebx
je 0x10053b7
cmp esi, 0x4b8
je 0x10053b0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01002dd3
jmp 0x100541f
call fcn.01004185
jmp 0x100541f
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
call fcn.01004e92
push eax
call fcn.01002f1b
test eax, eax
jne 0x100541f
push dword [ebp + 8]
call fcn.01005279
push 0x1580
call fcn.01004b39
push eax
call fcn.01002d6c
mov esi, 0x4b8
jmp 0x100541f
cmp dword [ebp + 0xc], ebx
je 0x1005423
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1005423
push 0x157e
call fcn.01004b39
push eax
call fcn.01002d6c
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1005425
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x1005451
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
call ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x10055db
push 0
push edi
call fcn.01003002
test eax, eax
je 0x10055db
xor esi, esi
inc esi
cmp dword [ebp + 0x1c], esi
jne 0x10054ba
cmp dword [ebp + 0xc], 0
je 0x10054a0
cmp dword [ebp + 0x10], 2
jb 0x10054a0
cmp dword [ebp + 0x14], 0
je 0x10054a0
cmp dword [ebp + 0x18], 2
jae 0x10054ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10054ae
push 0x57
call ebx
call fcn.01002dd3
xor eax, eax
jmp 0x10055de
push edi
mov dword [ebp - 4], edi
call fcn.01004beb
cmp eax, esi
jne 0x10054cd
lea eax, [edi + 4]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], esi
jne 0x10054fe
cmp dword [ebp + 0x14], 0
je 0x10054fe
push 0
push esi
push 0x100121c
push dword [ebp + 0x14]
call fcn.01003023
test eax, eax
jne 0x10054fe
push dword [ebp - 4]
call fcn.010051c4
test eax, eax
jne 0x10055f2
jmp 0x10054ae
push dword [ebp - 4]
and dword [ebp - 8], 0
call fcn.010051c4
test eax, eax
je 0x10054ae
cmp dword [ebp + 0xc], 0
je 0x1005543
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1005543
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push edi
call fcn.01005430
mov edi, eax
cmp dword [ebp + 0x1c], esi
jne 0x1005552
mov dword [ebp - 8], esi
jmp 0x1005552
push 0
push 0
push edi
mov dword [ebp - 8], esi
call fcn.01005430
mov edi, eax
cmp edi, 0x55
jne 0x1005562
push 0x50010001
call ebx
mov eax, esi
jmp 0x10055de
test edi, edi
jne 0x100556e
cmp dword [ebp - 8], esi
je 0x1005557
push edi
jmp 0x100555c
mov eax, 0x4c3
cmp edi, eax
ja 0x100559b
je 0x1005598
cmp edi, 0x34
je 0x100568a
cmp edi, 0x56
je 0x10055e5
cmp edi, 0x4be
je 0x100568a
jmp 0x10054ae
push eax
jmp 0x100555c
cmp edi, 0x4cf
jb 0x10054ae
cmp edi, 0x4d1
jbe 0x100568a
cmp edi, 0x52e
je 0x10055e5
mov esi, 0xa0010001
cmp edi, esi
jne 0x10054ae
push 0x157e
call fcn.01004b39
push eax
call fcn.01002d6c
push esi
call ebx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x18
cmp dword [ebp + 0x1c], 0
je 0x10054b3
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1005615
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10054ae
push dword [ebp + 0xc]
push 0x157d
call fcn.01004b39
push eax
push esi
push esi
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.010049e6
add esp, 0x14
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01003bf7
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.01005430
mov edi, eax
test edi, edi
je 0x100555e
cmp edi, 0x34
je 0x100568a
cmp edi, 0x4be
je 0x100568a
mov eax, 0x4c3
cmp edi, eax
je 0x1005598
cmp edi, 0x4ce
jbe 0x10054ae
cmp edi, 0x4d1
ja 0x10055bb
push 0x4c6
call ebx
call fcn.01002dd3
push edi
call ebx
jmp 0x10054b3
Function at 0x4029d0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x415e30]
sub esp, 0x400
test eax, eax
je 0x402a0e
cmp dword [esp + 0x408], eax
jb 0x402a0e
mov eax, dword [esp + 0x404]
lea ecx, [esp]
push eax
push 0x4132b8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x400
ret

Function at 0x402a20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x768
push ebx
push ebp
push esi
mov esi, dword [esp + 0x77c]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x77c]
push ebp
lea eax, [esp + 0xa8]
push 0x1ec
push eax
push ebp
push ebp
push esi
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
push 0x20019
push 1
push ebp
push 1
push esi
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x10], ebx
je 0x402b6c
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x38]
push ebp
lea edx, [esp + 0x2b4]
push ecx
push edx
push ebx
mov dword [esp + 0x4c], 0x80
mov dword [esp + 0x48], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x402aab
mov eax, dword [esp + 0x18]
mov byte [esp + eax + 0x290], 0
mov edi, dword [esp + 0x788]
mov edx, dword [esp + 0x784]
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x28]
push 0
lea edx, [esp + 0x34]
push ecx
push edx
push ebp
push ebx
mov dword [esp + 0x34], 0x400
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
jne 0x402b0f
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push str.EDID
push ecx
mov dword [edi], eax
xor bl, bl
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x402b2c
mov ebx, dword [esp + 0x10]
inc ebp
cmp esi, 0x103
jne 0x402ab2
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x768
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
jbe 0x402b49
mov edx, dword [esp + 0x784]
add bl, byte [eax + edx]
inc eax
cmp eax, ecx
jb 0x402b36
test bl, bl
jne 0x402b61
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x768
ret
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x768
ret
Function at 0x4036a0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov eax, 0x12a4
call fcn.0040f710
mov edx, dword [esp + 0x12a8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x12b4]
xor ebx, ebx
cmp ecx, ebx
push edi
mov dword [esi + 4], edx
jne 0x4036c8
mov ecx, edx
mov eax, dword [esp + 0x12bc]
mov dword [esi + 8], ecx
cmp eax, ebx
jne 0x4036d8
mov eax, edx
mov dword [esi + 0xc], eax
lea eax, [esp + 0x1c]
mov edi, 1
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], 0xf01ff
mov dword [esi + 0x54], 0x10
mov dword [esi + 0x58], 2
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi], vtable.CNTService.0
mov dword [esp + 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
cmp edx, 2
sete cl
mov dword [esi + 0x48], ecx
mov dword [0x415e34], edi
mov dword [0x415e38], esi
mov eax, dword [esi + 0x48]
cmp eax, ebx
mov dword [esi + 0x1c], 0x10
mov dword [esi + 0x2c], ebx
je 0x403829
mov eax, 0xff
mov ecx, 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor eax, eax
lea edi, [esp + 0xb0]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x1b0]
rep stosd dword es:[edi], eax
mov ecx, 0x400
lea edi, [esp + 0x2b0]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0xb0]
push edx
push eax
mov dword [esp + 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x1b4]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x2bc]
push ecx
lea eax, [esp + 0xc0]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x403829
lea ecx, [esp + 0x2b0]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x403829
lea edx, [esp + 0x2b0]
push edx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x2b0]
mov dword [esi + 0x44], eax
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x12a4
ret 0xc
Function at 0x4042a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x70
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x88]
test eax, eax
mov edx, 1
mov dword [esp + 4], 0x20
mov dword [esp + 8], 5
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
pop edi
jne 0x4042f9
mov edx, 5
mov eax, dword [esp + 0x74]
push edx
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationA]
mov ecx, dword [esp + 0x88]
test eax, eax
mov dword [ecx], eax
jne 0x404342
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x24]
push str.RegisterDeviceNotification_failed:__d_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 0x70
ret
mov eax, 1
add esp, 0x70
ret