joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b20
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603fed
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x34], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
push ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0x29
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x413bf1
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x413bf1
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x654204
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005d0f26
mov edi, eax
add esp, 8
test edi, edi
je 0x413bf1
push 0
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push 0x29
push dword [ebp - 0x34]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x413c22
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
call fcn.0048deb8
add esp, 4
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040bd90
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413c27
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.0040be20
push edi
call fcn.0048deb8
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp edi, 8
push 5
cmovae ecx, dword [ebp - 0x28]
push str.Basic
push 0
call fcn.0040c360
add esp, 0x10
test eax, eax
jne 0x413c7a
mov dword [esi], 1
mov byte [ebp - 0x2d], 1
jmp 0x413bf5
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 6
cmp edi, 8
push str.Digest
cmovae ecx, dword [ebp - 0x28]
push 0
call fcn.0040c360
add esp, 0xc
test eax, eax
jne 0x413cab
mov dword [esi], 8
mov byte [ebp - 0x2d], 1
jmp 0x413bf5
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 4
cmp edi, 8
push str.NTLM
cmovae ecx, dword [ebp - 0x28]
push 0
call fcn.0040c360
add esp, 0xc
test eax, eax
jne 0x413cdc
mov dword [esi], 2
mov byte [ebp - 0x2d], 1
jmp 0x413bf5
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 8
cmp edi, 8
push str.Passport
cmovae ecx, dword [ebp - 0x28]
push 0
call fcn.0040c360
add esp, 0xc
test eax, eax
jne 0x413d0d
mov dword [esi], 4
mov byte [ebp - 0x2d], 1
jmp 0x413bf5
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push 9
cmp edi, 8
push str.Negotiate
cmovae ecx, dword [ebp - 0x28]
push 0
call fcn.0040c360
add esp, 0xc
mov byte [ebp - 0x2d], 1
neg eax
sbb eax, eax
and eax, 0xfffffff0
add eax, 0x10
mov dword [esi], eax
jmp 0x413bf5
Function at 0x416c40
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60480c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x69f000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 5
push 0
push dword [edi + 0xc0]
call fcn.005d0cf8
add esp, 8
mov dword [edi + 0xc0], 0
mov byte [ebp - 4], 4
lea ecx, [edi + 0xf4]
call fcn.0040bd90
mov byte [ebp - 4], 3
lea ecx, [edi + 0xdc]
call fcn.0040bd90
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc4]
call fcn.0040bd90
mov byte [ebp - 4], 1
lea ecx, [edi + 0x94]
call fcn.0040bd90
mov byte [ebp - 4], 0
lea ecx, [edi + 0x7c]
call fcn.0040bd90
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 9
lea ecx, [edi + 0x50]
call fcn.0040bd90
mov byte [ebp - 4], 8
lea esi, [edi + 0x48]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 8
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
push esi
call fcn.0040c930
push 0x40
push dword [esi]
call fcn.005d0cf8
add esp, 8
mov byte [ebp - 4], 7
lea ecx, [edi + 0x30]
call fcn.0040bd90
mov byte [ebp - 4], 6
lea ecx, [edi + 0x18]
call fcn.0040bd90
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.0040bd90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x604d0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x69f000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.005d3083
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x4185d1
push eax
push esi
call fcn.005d3363
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.005d3036
int3
Function at 0x419040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x605016
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0
push 0
movups xmmword [esi], xmm0
push 0x65fe6c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0040c3f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.http_shellopencommand
push SysReAllocStringLen
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4191aa
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4191a1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4191a1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049ce4b
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x4191a1
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419198
push dword [ebp - 0x14]
mov ecx, esi
push edi
call fcn.0040be20
mov edx, esi
lea ecx, [ebp - 0x3c]
call fcn.00463590
mov edi, eax
mov dword [ebp - 4], 1
cmp esi, edi
je 0x419189
mov ecx, esi
call fcn.0040bd90
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.0040bd90
mov edi, dword [ebp - 0x1c]
push edi
call fcn.0048deb8
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00408570
add eax, 0xf4
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x4191be
mov edx, dword [esi]
mov ecx, dword [eax]
push edx
push str.Default_browser_:__s
push eax
call dword [ecx + 4]
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x419600
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
test eax, eax
je 0x41966b
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x419970
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x605090
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x448], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x444]
push eax
push 0x20
mov dword [ebp - 0x444], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x419a66
lea eax, [ebp - 0x418]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x419a66
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x414]
push 0
push 0
push 0
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x428]
push eax
push 0
push dword [ebp - 0x444]
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x419a66
call fcn.00408570
mov edi, dword [eax + 0xf4]
lea esi, [eax + 0xf4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.FAILED_TO_CHANGE_TOKEN_PRIVILEGES__CODE:__lu
push str.ElevationManagerError
push esi
call dword [edi + 0x1c]
add esp, 0x10
push dword [ebp - 0x448]
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
test edi, edi
jne 0x419ab3
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.Couldnt_get_handle_of_sender_process
push str.ElevationManagerError
push eax
call dword [ecx + 0x24]
add esp, 0xc
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
jmp 0x419ba5
push 0x200
lea eax, [ebp - 0x410]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x419b05
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.Couldnt_get_image_path_of_sender_process
push str.ElevationManagerError
push eax
call dword [ecx + 0x24]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
add esp, 0xc
push dword [ebp - 0x444]
call esi
push edi
call esi
xor al, al
jmp 0x419ba5
push dword [ebp - 0x444]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push edi
call esi
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419b20
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x44c]
push eax
call fcn.0040be20
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
xor eax, eax
mov dword [ebp - 0x42c], 0
movups xmmword [ebp - 0x440], xmm0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x44c]
call fcn.00419720
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.0040bd90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x41a4b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x41a4e2
jl 0x41a4d5
test ecx, ecx
jne 0x41a4e2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x41a5a2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.0041b580
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x41a54e
jg 0x41a50d
test esi, esi
je 0x41a54e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x41a525
mov eax, dword [esp + 0x10]
jl 0x41a51f
cmp eax, esi
jae 0x41a525
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.005d4d40
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x41a56f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x41a58b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x41a4f4
jl 0x41a58b
test ecx, ecx
jne 0x41a4f4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x41a5e6
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x41a5e6
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.005d4d40
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x41a657
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x41a60c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x41a642
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.005de31f
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x41a657
cmp edi, eax
ja 0x41a620
test edi, edi
je 0x41a657
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.005de31f
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ce90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60572d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAcroRd32.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41cf02
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push str.Path
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x41cf09
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x41d042
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049ce4b
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0
push 0
push str.Path
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov esi, dword [ebp - 0x1c]
je 0x41cf5d
push esi
call fcn.0048deb8
add esp, 4
xor al, al
jmp 0x41d042
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cf62
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040be20
push esi
call fcn.0048deb8
add esp, 4
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
push 0xc
push str.AcroRd32.dll
call fcn.0040c3f0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x41d031
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41d031
add eax, ecx
mov dword [ebp - 0x1c], eax
lea eax, [eax*2 + 0x16]
push eax
call fcn.005d89b1
mov esi, eax
add esp, 4
test esi, esi
je 0x41d031
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41cfe5
mov eax, dword [edi]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0xb
push eax
push esi
call fcn.005d894d
add esp, 0xc
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
cmovae eax, dword [ebp - 0x34]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41d010
sub edx, ecx
mov ecx, edi
sar edx, 1
push edx
push esi
call fcn.0040be20
push esi
call fcn.005d8486
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040bd90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x41db60
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6058c6
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x260]
push eax
call fcn.0040bb80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x260]
push 0x19
push str.___protectedworkflowtrue
call fcn.0040ff20
push 0x38
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], 0x3c
push 0
push eax
call fcn.005d5480
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 0
movups xmmword [ebp - 0x230], xmm0
add esp, 0xc
mov dword [ebp - 0x298], 0x540
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x41dc62
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41dc40
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040be20
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0x118
cmovae eax, dword [ebp - 0x230]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.005d5480
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x41dcbb
mov edi, dword [ebp - 0x128]
mov esi, dword [ebp - 0x124]
jmp 0x41dcc7
mov esi, dword [ebp - 0x2a4]
mov edi, dword [ebp - 0x2a4]
call fcn.00419600
test al, al
je 0x41dceb
cmp edi, 5
jne 0x41dceb
cmp esi, 1
je 0x41dcdf
cmp esi, 2
jne 0x41dceb
mov dword [ebp - 0x290], str.open
jmp 0x41dcf5
mov dword [ebp - 0x290], str.runas
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x248]
cmovae eax, dword [ebp - 0x260]
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040bb80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
call fcn.0046a960
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
mov dword [ebp - 0x280], 0xa
cmovae eax, dword [ebp - 0x248]
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x29c]
push eax
mov byte [ebp - 0x29d], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
movzx ecx, byte [ebp - 0x29d]
test eax, eax
push dword [ebp - 0x264]
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x2a4], ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.0040bd90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.0040bd90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.0040bd90
mov al, byte [ebp - 0x2a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret 4
Function at 0x41e1b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ecx + 0xb0], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
je 0x41e228
cmp dword [eax + 0x14], 8
mov dword [ebp - 8], 0
jb 0x41e1df
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e215
cmp dword [esi + 0x14], 8
jb 0x41e202
mov esi, dword [esi]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret 0xc
push esi
push eax
call fcn.0041e570
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005d077b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ea10
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x605aed
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.0046d820
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push esi
call fcn.0046b840
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
xor eax, eax
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 1
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
push 0x1c
push str._registryParams_registryPath
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
call fcn.0040c3f0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x18]
call fcn.0046bbc0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.0040bd90
push 0x1d
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
push str._registryParams_registryValue
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x68], 0
movups xmmword [ebp - 0x7c], xmm0
call fcn.0040c3f0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x18]
call fcn.0046bbc0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7c]
call fcn.0040bd90
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x4c]
push ecx
push 0xf003f
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 0
cmovae eax, dword [ebp - 0x48]
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41eb82
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.0040bd90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0040bd90
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.0046d820
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret 4