joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410219
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
add edx, 1
mov dword [ebp - 0x778], edx
mov eax, dword [ebp - 0x774]
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax + 0x18]
jae 0x410276
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19b8]
mov ecx, dword [ebp - 0x398]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x77c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19bc]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x19c0]
mov eax, dword [ebp - 0x398]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19c4], eax
mov dword [ebp - 0x120], 0
jmp 0x4100da
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
test eax, eax
je 0x41018c
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
test edx, edx
je 0x41018c
push ecx
push ebx
add esp, 4
or ecx, 0x5bf0
xor ecx, 0x9551
or ecx, 0x7b8f
pop ecx
push eax
add eax, 0xd230
or eax, 0x40fb
pop eax
push edi
push edx
add esp, 4
or edi, 0x15b8e
pop edi
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
cmp ecx, eax
je 0x41017e
mov ecx, dword [ebp - 0x77c]
add ecx, dword [ebp - 0x120]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x120]
movsx ecx, byte [ebp + eax - 0x890]
cmp edx, ecx
jne 0x410185
jmp 0x4100cb
jmp 0x41018c
push ecx
push eax
add esp, 4
call fcn.0041019d
add byte [ecx], bh
cmp edi, dword [esi + edi]
inc ebx
cmp eax, dword [ebx + 0x7e804c4]
add esp, 4
call 0x4101ac
add byte [esi], bh
dec esp
add esp, 4
call 0x4101ac
add byte [esi], bh
dec esp
dec esi
dec esi
inc ebp
add esp, 4
pop ecx
push eax
or eax, 0x3714
xor eax, 0xa675
pop eax
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
cmp eax, edx
jne 0x4101eb
mov dword [ebp - 0xcd4], 0
jmp 0x41025a
push edx
push eax
add esp, 4
xor edx, 0x6fdf
jmp 0x4101fb
pop edx
push eax
xor eax, 0xd245
and eax, 0xcfd2
call 0x410219
add byte [eax + 0x3c], dl
dec edi
inc edx
xor eax, 0x4c333e47
dec edx
add esp, 4
pop eax
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
or eax, 0x20
cmp ecx, eax
jge 0x410250
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x41025a
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x410271
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x44c], ecx
jmp 0x410282
jmp 0x41005b
mov edx, dword [ebp - 0x780]
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x7ac], eax
Function at 0x4105e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push edx
add esp, 4
xor eax, 0x10948
add eax, 0x14df0
call fcn.004105e0
add byte [ebx], dh
inc ecx
dec ecx
inc esi
dec esp
xor eax, 0x4c4833a
add esp, 4
add esp, 4
pop eax
push ecx
jmp 0x4105ee
jmp 0x4105f3
pop ecx
mov ecx, dword [ebp - 0xcd8]
mov dx, word [ecx]
mov word [ebp - 0x1066], dx
mov eax, dword [ebp - 0xcd8]
add eax, 2
mov dword [ebp - 0xcd8], eax
mov cx, word [ebp - 0x1066]
mov word [ebp - 0x1c8], cx
mov edx, dword [ebp - 0xcdc]
mov ax, word [edx]
mov word [ebp - 0x1068], ax
mov ecx, dword [ebp - 0xcdc]
add ecx, 2
mov dword [ebp - 0xcdc], ecx
mov dx, word [ebp - 0x1068]
mov word [ebp - 0x34], dx
push edx
push ebx
add esp, 4
or edx, 0x1754c
and edx, 0x14faf
xor edx, 0x1274b
pop edx
push edx
add edx, 0x1613f
sub edx, 0x10cc7
xor edx, 0x5a7c
and edx, 0x16907
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x41069a
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4106f4
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4105c2
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4105c2
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4106de
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x4106e8
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x41073d
push esi
push ebx
add esp, 4
xor esi, 0x14518
sub esi, 0x1737b
and esi, 0x466f
pop esi
push edx
xor edx, 0x14fd4
sub edx, 0x4647
xor edx, 0xd926
jmp 0x41072e
pop edx
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x4107a5
push esi
or esi, 0x17e
xor esi, 0x167c4
add esi, 0x15992
pop esi
push eax
push eax
add esp, 4
sub eax, 0x49b1
and eax, 0x7a55
add eax, 0x12a92
and eax, 0x17ae3
pop eax
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x41079b
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x410566
mov dword [ebp - 0x2fc], 0
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438cac
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
mov edx, 0x42aa7a3d
or edx, edi
sub edx, edi
call fcn.00438cec
add edi, 0x8b38edb1
sub edx, 0xf2e56a61
or edi, edx
xor dword [eax], esi
sub edi, 0x114622bd
or edi, edx
inc eax
add edx, edi
inc edx
cmp eax, ebx
jne fcn.00438cac
add edi, edx
or edi, edi
inc edi
ret
Function at 0x100012f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x1000efb8
call fcn.1000eecd
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x21c], esi
mov dword [edi], ebx
cmp dword [ebp + 0xc], ebx
je 0x1000131f
mov eax, 0x80040110
jmp 0x100014e8
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.10008d72
test eax, eax
je 0x1000134d
mov eax, 0x80040112
jmp 0x100014e8
mov edx, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [edx + ecx*4 + 8]
mov esi, 0x10010874
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x10001499
inc ecx
cmp ecx, 4
jne 0x10001352
call fcn.10008d72
test eax, eax
je 0x100014e3
push 4
mov ecx, ebx
pop edx
mov eax, dword [esi + ecx*4]
mov esi, 0x10010884
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100013f1
inc ecx
cmp ecx, edx
jne 0x10001382
mov ecx, dword [0x1001640c]
test ecx, ecx
jne 0x100013e5
push 0x10
pop ecx
call fcn.10001222
mov ecx, eax
mov dword [ebp - 0x220], ecx
test ecx, ecx
je 0x100013cf
inc dword [0x10016410]
mov dword [ecx], vtable.CShellExtension.0
mov byte [ecx + 4], bl
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
jmp 0x100013d1
mov ecx, ebx
mov dword [0x1001640c], ecx
test ecx, ecx
jne 0x100013e5
mov eax, 0x8007000e
jmp 0x100014e8
mov eax, dword [ecx]
push edi
push esi
push ecx
call dword [eax]
jmp 0x100014e8
mov ecx, ebx
mov eax, dword [esi + ecx*4]
mov esi, 0x1001034c
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100014e3
inc ecx
cmp ecx, edx
jne 0x100013f3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], ebx
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x224], edx
push eax
lea eax, [ebp - 0x228]
mov esi, ebx
push eax
push str.ShowCacheFolder
push str.SoftwareMicrosoftOffice16.0MS_Project
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x1000145a
cmp dword [ebp - 0x22c], eax
sete al
mov dword [ebp - 0x220], eax
mov esi, eax
push 0x58
pop ecx
call fcn.10001222
mov dword [ebp - 0x220], eax
test eax, eax
je 0x10001479
lea ecx, [esi + 1]
push ecx
mov ecx, eax
call fcn.10008d72
mov ebx, eax
test ebx, ebx
je 0x100013db
push edi
push dword [ebp - 0x21c]
mov eax, dword [ebx]
push ebx
call dword [eax]
mov ecx, dword [ebx]
mov esi, eax
push ebx
call dword [ecx + 8]
mov eax, esi
jmp 0x100014e8
mov ecx, ebx
mov eax, dword [edx + ecx*4 + 8]
mov esi, 0x10010b2c
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100014e3
inc ecx
cmp ecx, 4
jne 0x1000149b
push 0x4c
pop ecx
call fcn.10001222
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x100014d3
mov ecx, eax
call fcn.10007cce
mov ebx, eax
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100013db
push edi
push esi
jmp 0x10001488
mov eax, 0x80004002
call fcn.1000ee8c
ret 0x10
Function at 0x10008d72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10008d81
pop dword [ebp - 0x40]
mov eax, 0x65947d02
sub eax, 0x5593ef81
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb8f728c2
add dword [ebp - 0x50], 0x955b1c89
mov dword [ebp - 0x4c], 0xe7554249
add dword [ebp - 0x4c], 0x4ade09fc
mov dword [ebp - 0x48], 0xfeece5c5
add dword [ebp - 0x48], 0x4d5f5e69
mov dword [ebp - 0x44], 0x3f4efa8d
add dword [ebp - 0x44], 0xc0b10573
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xed951d6b
sub dword [ebp - 0x50], 0x7922b415
mov dword [ebp - 0x4c], 0x4608b880
add dword [ebp - 0x4c], 0xfb63a8f5
mov dword [ebp - 0x48], 0x2609c6a4
sub dword [ebp - 0x48], 0xc29a5a38
mov dword [ebp - 0x44], 0x4877a966
add dword [ebp - 0x44], 0xb788569a
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x264dc0f0
sub eax, 0x164cc0d4
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a3d9
push 0
call eax
mov ecx, 0x4e4b
mov edi, eax
mov ebx, 0xfcd70643
sub ebx, 0xecd2c043
add ebx, dword [ebp - 0x40]
mov esi, 0xb18b5ba9
sub esi, 0x8b6c85be
add dword [ebp - 0x2c], eax
mov edx, dword [ebx]
sub dword [ebp - 8], esi
sub edx, esi
add dword [ebp - 0x34], ebx
mov dword [edi], edx
xor dword [ebp - 4], 0x6fd3320b
add edi, 0xd5b8327
sub edi, 0xd5b8323
add ebx, 0xbc693810
add ebx, 0x4396c7f4
loop 0x10008e98
add eax, 0x923db2fe
sub eax, 0x923c86ff
mov ebx, eax
add eax, 5
mov ecx, 0xbe117bd5
add ecx, 0x51ee842b
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10009a7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x100150e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0xdc], eax
or edi, 0xffffffff
mov eax, dword [ecx + 0x20]
xor ebx, ebx
mov dword [ebp - 0xd4], 0x64
test eax, eax
je 0x10009ab8
mov edx, dword [eax]
jmp 0x10009aba
mov edx, ebx
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.10008d72
mov esi, eax
test esi, esi
js 0x10009b9a
lea eax, [ebp - 0xd8]
push eax
push 0x20019
push ebx
push str.MSProject.ApplicationCurVer
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10009b93
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd0]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10009b93
push 0x16
lea eax, [ebp - 0xd0]
push str.MSProject.Application.
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10009b93
mov eax, dword [ebp - 0xa4]
push 0x30
pop ecx
cmp ax, cx
jbe 0x10009b93
cmp ax, 0x39
ja 0x10009b93
movzx edi, ax
mov eax, dword [ebp - 0xa2]
sub edi, ecx
push 0x17
pop ebx
test ax, ax
je 0x10009b7f
movzx edx, ax
lea eax, [edx - 0x30]
cmp ax, 9
ja 0x10009b7f
imul ecx, edi, 0xa
movzx edi, dx
movzx edx, word [ebp + ebx*2 - 0xce]
add edi, 0xffffffd0
add edi, ecx
inc ebx
test dx, dx
jne 0x10009b5d
xor ecx, ecx
mov eax, 0x80004005
cmp word [ebp + ebx*2 - 0xd0], cx
cmovne esi, eax
jmp 0x10009b98
mov esi, 0x80004005
test esi, esi
mov eax, dword [ebp - 0xdc]
cmovns esi, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
call fcn.10001171
leave
ret 8

Function at 0x1000bc9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.1000ee3e
mov eax, dword [0x100150e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, 0x1048
mov esi, dword [eax]
lea eax, [ebp - 0x104c]
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1050], edi
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1054]
push eax
push 0
push str.Path
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
pop edi
pop esi
test ecx, ecx
jne 0x1000bd10
lea eax, [ebp - 0x104c]
push eax
call fcn.10007b7d
jmp 0x1000bd1d
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001171
leave
ret 4
Function at 0x401120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401174
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401170
lea ebx, [ebx]
cmp esi, eax
jae 0x401174
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401160
cmp esi, eax
jb 0x40117a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401230
Capabilities:
Get hostname
Get user security identifier

Disassembly:
sub esp, 0x80
mov eax, dword [0x4243c8]
xor eax, esp
mov dword [esp + 0x7c], eax
xor eax, eax
push ebp
push esi
push edi
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x28]
push ecx
mov word [esp + 0x2c], 0
mov dword [esp + 0x20], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x43
lea edx, [esp + 0x49]
push 0
push edx
mov byte [esp + 0x50], 0
call fcn.0040b3b0
mov ebp, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
add esp, 0xc
mov dword [esp + 0x14], 0x44
mov dword [esp + 0xc], 0
xor esi, esi
mov dword [esp + 0x10], 2
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
call ebp
mov edi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401307
test esi, esi
jne 0x401307
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407458
add esp, 4
mov esi, eax
sub dword [esp + 0x10], 1
jne 0x4012c0
test esi, esi
je 0x40131b
push esi
call fcn.0040b394
add esp, 4
test edi, edi
je 0x401352
mov esi, dword [esp + 0x1c]
push esi
lea eax, [esp + 0x48]
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x40133f
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x401352
mov eax, dword [esi]
test eax, eax
je 0x401352
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], 0
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040b399
add esp, 0x80
ret
Function at 0x401420
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4243c8]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push 0x118
lea eax, [esp + 0xc]
push 0
push eax
xor bl, bl
call fcn.0040b3b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x401495
mov eax, dword [esp + 8]
cmp eax, 5
ja 0x401479
jne 0x401495
mov eax, dword [esp + 0xc]
cmp eax, 1
jbe 0x401491
mov al, 1
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040b399
add esp, 0x120
ret
mov al, 1
je 0x401497
mov al, bl
mov ecx, dword [esp + 0x120]
pop ebx
xor ecx, esp
call fcn.0040b399
add esp, 0x120
ret

Function at 0x4014b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4243c8]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push 0x118
lea eax, [esp + 0xc]
push 0
push eax
xor bl, bl
call fcn.0040b3b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x401524
mov eax, dword [esp + 8]
cmp eax, 6
ja 0x401508
jne 0x401524
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x401520
mov al, 1
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040b399
add esp, 0x120
ret
mov al, 1
je 0x401526
mov al, bl
mov ecx, dword [esp + 0x120]
pop ebx
xor ecx, esp
call fcn.0040b399
add esp, 0x120
ret

Function at 0x401540
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4015b8
mov ecx, dword [esp]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push edi
push esi
push eax
push eax
push 0x41c8cc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x4015a8
mov edx, dword [edi]
mov word [esi + edx*2], ax
mov eax, dword [edi]
cmp word [esi + eax*2 - 2], 0x5c
je 0x4015a8
push 0x41c8c8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x4015c0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x1cc4
call fcn.0040b4f0
mov eax, dword [0x4243c8]
xor eax, esp
mov dword [esp + 0x1cc0], eax
push esi
xor esi, esi
push 0xa28
lea eax, [esp + 0x129e]
push esi
push eax
mov word [esp + 0x12a4], si
call fcn.0040b3b0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x12a8]
push edx
mov dword [esp + 0x18], 0x515
call fcn.00401540
add esp, 0x14
test eax, eax
jne 0x40179e
push edi
push 0x40e
lea eax, [esp + 0x672]
push esi
push eax
mov word [esp + 0x678], si
call fcn.0040b3b0
lea ecx, [esp + 0x12a8]
push ecx
lea edx, [esp + 0x67c]
push str._scomponents_ffe.dll
push edx
call fcn.0040b451
lea eax, [esp + 0x684]
push eax
call fcn.00407820
push 0x40e
lea ecx, [esp + 0xeae]
push esi
push ecx
mov word [esp + 0xeb4], si
call fcn.0040b3b0
lea edx, [esp + 0x12c4]
push edx
lea eax, [esp + 0xeb8]
push str._scomponents.dll
push eax
call fcn.0040b451
push 0x24c
lea ecx, [esp + 0x48]
push esi
push ecx
mov dword [esp + 0x4c], esi
call fcn.0040b3b0
add esp, 0x40
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xe90]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40179d
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x4016e0
push 0x40e
lea ecx, [esp + 0x26a]
push esi
push ecx
mov word [esp + 0x270], si
call fcn.0040b3b0
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x40]
mov word [esp + eax + 0x264], cx
add eax, 2
cmp cx, si
jne 0x401700
lea edx, [esp + 0x264]
push edx
call ebx
cmp eax, esi
je 0x401784
mov word [eax], si
lea eax, [esp + 0x264]
push eax
call fcn.0040b43b
add esp, 4
test eax, eax
je 0x401784
push 0x40e
lea ecx, [esp + 0xa8a]
push esi
push ecx
mov word [esp + 0xa90], si
call fcn.0040b3b0
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x12b4]
push eax
lea ecx, [esp + 0xa98]
push str._scomponents_s
push ecx
call fcn.0040b451
lea edx, [esp + 0xaa0]
push edx
call fcn.00407820
add esp, 0x20
lea eax, [esp + 0x14]
push eax
push edi
call ebp
test eax, eax
jne 0x4016e0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x1cc4]
pop esi
xor ecx, esp
call fcn.0040b399
add esp, 0x1cc4
ret