joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427029
Capabilities:
Create process on windows

Disassembly:
push 0x10
mov eax, 0x475ab3
call fcn.0045be74
push str.ExecuteRetryInstall...
lea ecx, [ebp - 0x14]
call fcn.004020a6
xor edi, edi
push edi
lea eax, [ebp - 0x14]
push eax
push 2
pop esi
push esi
mov dword [ebp - 4], edi
call fcn.004152d1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push str.___file__
lea ecx, [ebp - 0x14]
call fcn.004020a6
mov dword [ebp - 4], 1
mov ebx, dword [ebp + 8]
push edi
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00414e01
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov dword [ebp - 0x14], 0xd
call fcn.0044825c
push eax
lea ecx, [ebp - 0x10]
call fcn.0041872d
push 0x5c
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.0040c420
cmp eax, 0xffffffff
je 0x4270ea
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.0040ad78
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402573
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
push str..exe
mov ecx, ebx
call fcn.0043d115
pop ecx
test eax, eax
je 0x42715f
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 0x483438
cmp dword [ebp - 0x10], edi
je 0x427127
push 5
push edi
push esi
push dword [ebp - 0x10]
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call ebx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 5
push edi
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call ebx
mov dword [ebp - 0x14], eax
cmp eax, 0x21
jae 0x4271a2
push str.ShellExecute_failed
lea ecx, [ebp + 8]
call fcn.004020a6
mov byte [ebp - 4], 4
push dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
push 2
jmp 0x4271be
push str..msi
mov ecx, ebx
call fcn.0043d115
pop ecx
test eax, eax
je 0x4271a7
mov esi, 0x483438
cmp dword [ebp - 0x10], edi
je 0x42719a
push 5
push edi
push esi
push dword [ebp - 0x10]
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push dword [ebx]
call sub.msi.dll_MsiOpenDatabaseW
mov dword [ebp - 0x14], edi
jmp 0x4271d1
push str.Not_supported_file_type
lea ecx, [ebp + 8]
call fcn.004020a6
push edi
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 5
push esi
call fcn.004152d1
mov ecx, dword [ebp + 8]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, dword [ebp - 0x14]
call fcn.0045bf4c
ret 4
Function at 0x4289ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
mov eax, dword [0x4bfd60]
xor eax, esp
mov dword [esp + 0x254], eax
test esi, esi
jne 0x4289cd
push 0xd
jmp 0x428a35
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x428a33
and dword [esp], 0
push 0x24c
lea eax, [esp + 8]
push 0
push eax
call fcn.00459cf0
add esp, 0xc
lea eax, [esp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x428a33
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0xffffffff
je 0x428a1a
cmp dword [esp + 0x20], edi
je 0x428a1a
mov eax, 0x5b6
jmp 0x428a36
push ebx
push esi
call fcn.00427d59
neg eax
sbb eax, eax
pop ecx
and eax, 0xfffffc12
pop ecx
add eax, 0x3ee
jmp 0x428a36
push 2
pop eax
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.00458e0e
mov esp, ebp
pop ebp
ret
Function at 0x42a9af
Capabilities:
Reference sql statements

Disassembly:
push 0x14
mov eax, 0x479623
call fcn.0045be74
push str.InitUpdateFromProductUpdatesTable...
lea ecx, [ebp - 0x1c]
call fcn.004020a6
xor esi, esi
push esi
lea eax, [ebp - 0x1c]
push eax
push 2
mov dword [ebp - 4], esi
call fcn.004152d1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push str.SELECT__FROM__ProductUpdates__WHERE__ProductCode_
lea ecx, [ebp - 0x18]
call fcn.004020a6
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401ec7
push str._AND__ProductVersion_
lea eax, [ebp - 0x18]
push eax
call fcn.0040aac0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.00401ec7
push 0x4a2fa0
lea eax, [ebp - 0x18]
push eax
call fcn.0040aac0
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
mov eax, dword [ebx + 4]
push ecx
push dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
push eax
call sub.msi.dll_MsiEnumClientsA
mov dword [ebp + 8], eax
cmp eax, esi
je 0x42aaaf
push 0x4a2fa4
lea ecx, [ebp + 0xc]
call fcn.004020a6
mov byte [ebp - 4], 4
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.004152d1
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
cmp dword [ebp - 0x10], esi
je 0x42aa8a
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], esi
je 0x42aa97
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, 0x3d32
call fcn.0045bf4c
ret 8
push esi
push dword [ebp - 0x14]
call sub.msi.dll_MsiViewModify
mov dword [ebp + 8], eax
cmp eax, esi
je 0x42ab19
push 0x4a2fb0
lea ecx, [ebp + 0xc]
call fcn.004020a6
mov byte [ebp - 4], 5
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.004152d1
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
cmp dword [ebp - 0x10], esi
je 0x42aaf8
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], esi
je 0x42ab05
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov esi, 0x3d32
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, esi
jmp 0x42aaa7
cmp dword [ebp - 0x10], esi
je 0x42ab26
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
neg eax
sbb eax, eax
inc eax
lea ecx, [ebp + 8]
je 0x42ab6f
push dword [ebp - 0x10]
mov dword [ebp + 8], 3
push ebx
call fcn.0042adf0
mov edi, eax
cmp dword [ebp - 0x10], esi
je 0x42ab5e
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x14], esi
je 0x42ab6b
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov esi, edi
jmp 0x42ab0a
push 0x4a2fb8
call fcn.004020a6
push esi
lea eax, [ebp + 8]
push eax
push edi
mov byte [ebp - 4], 6
call fcn.004152d1
mov ecx, dword [ebp + 8]
jmp 0x42aae0
Function at 0x42f826
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x47540f
call fcn.0045be74
push 0x4c48d4
lea ecx, [ebp - 0x1c]
call fcn.004020ea
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push str.SELECT__FileSequences__FROM__ProductUpgrades__WHERE__UpgradeMatch_
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004020a6
mov byte [ebp - 4], 3
mov ebx, dword [ebp - 0x1c]
push dword [ebx - 0xc]
lea ecx, [ebp - 0x18]
push ebx
call fcn.00401f27
push 0x4a2fa0
lea eax, [ebp - 0x18]
push eax
call fcn.0040aac0
cmp dword [ebp - 0x10], edi
je 0x42f889
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
push eax
call sub.msi.dll_MsiEnumClientsA
cmp eax, edi
je 0x42f90a
push 0x4a2fa4
lea ecx, [ebp + 8]
call fcn.004020a6
mov byte [ebp - 4], 4
mov esi, 0x3d32
push esi
lea eax, [ebp + 8]
push eax
push 1
call fcn.004152d1
mov ecx, dword [ebp + 8]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
cmp dword [ebp - 0x14], edi
je 0x42f8eb
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], edi
je 0x42f8f8
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea ecx, [ebx - 0x10]
call fcn.004025d2
mov eax, esi
call fcn.0045bf4c
ret 8
push edi
push dword [ebp - 0x10]
call sub.msi.dll_MsiViewModify
cmp eax, edi
je 0x42f92a
push 0x4a2fb0
lea ecx, [ebp + 8]
call fcn.004020a6
mov byte [ebp - 4], 5
jmp 0x42f8b4
cmp dword [ebp - 0x14], edi
je 0x42f937
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x42f95a
push dword [ebp + 0xc]
push 1
push dword [ebp - 0x14]
call fcn.00442c9b
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
cmp dword [ebp - 0x14], edi
je 0x42f972
push dword [ebp - 0x14]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x10], edi
je 0x42f97f
push dword [ebp - 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
xor esi, esi
jmp 0x42f8f8
Function at 0x431c22
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
xor ebx, ebx
push ebx
push str.Shell_TrayWnd
push ebx
push ebx
call edi
cmp eax, ebx
je 0x431c5b
push ebx
push str.TrayNotifyWnd
push ebx
push eax
call edi
cmp eax, ebx
je 0x431c5b
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x431d17
lea eax, [ebp - 0x24]
push eax
push 5
mov dword [ebp - 0x24], 0x24
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x431cbb
mov eax, dword [ebp - 0x18]
sub eax, ebx
je 0x431c9f
dec eax
je 0x431c86
dec eax
je 0x431c9f
dec eax
jne 0x431d17
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax - 0x64]
mov dword [esi], ecx
add eax, 0xfffffff0
jmp 0x431cb6
mov eax, dword [ebp - 8]
lea ecx, [eax - 0x64]
add eax, 0xfffffff0
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
jmp 0x431d17
push ebx
push str.Shell_TrayWnd
push ebx
push ebx
call edi
cmp eax, ebx
je 0x431cf9
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x431ce7
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x431d17
add eax, 0xffffffe2
jmp 0x431d14
push ebx
push esi
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop ebx
leave
ret
Function at 0x431e82
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4bfd60]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x472349
call fcn.0045be74
mov eax, dword [ebp + 0x214]
push dword [eax]
mov esi, ecx
push 0x4a5a64
push esi
call fcn.0040abaa
test eax, eax
jne 0x431f9b
call fcn.0044825c
push eax
lea ecx, [ebp - 0x10]
call fcn.0041872d
and dword [ebp - 4], 0
mov edi, str._WindowsFolder_
push edi
xor ecx, ecx
call fcn.0040ad24
or ebx, 0xffffffff
cmp eax, ebx
je 0x431eed
push 0x24
jmp 0x431f3f
mov edi, str._SystemFolder_
push edi
xor ecx, ecx
call fcn.0040ad24
cmp eax, ebx
je 0x431f02
push 0x25
jmp 0x431f3f
mov edi, str._ProgramFilesFolder_
push edi
xor ecx, ecx
call fcn.0040ad24
cmp eax, ebx
je 0x431f17
push 0x26
jmp 0x431f3f
mov edi, str._CommonFilesFolder_
push edi
xor ecx, ecx
call fcn.0040ad24
cmp eax, ebx
je 0x431f2c
push 0x2b
jmp 0x431f3f
mov edi, str._LocalAppDataFolder_
push edi
xor ecx, ecx
call fcn.0040ad24
cmp eax, ebx
je 0x431f90
push 0x1c
pop ebx
push edi
lea ecx, [ebp - 0x10]
call fcn.0040211a
xor eax, eax
push 0x206
mov word [ebp], ax
xor edi, edi
lea eax, [ebp + 2]
push edi
push eax
call fcn.00459cf0
add esp, 0xc
lea eax, [ebp]
push eax
push edi
push edi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x431f90
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x431f90
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push esi
call fcn.0040abaa
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00458e0e
add ebp, 0x20c
leave
ret
Function at 0x4322ca
Capabilities:
Enumerate gui resources

Disassembly:
push 0x29c
mov eax, 0x474fde
call fcn.0045be74
push 0x4c4854
lea ecx, [ebp - 0x20]
call fcn.004020ea
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push ebx
mov ecx, 0x4c4bdc
mov dword [ebp - 0x1c], ebx
call fcn.004493cc
cmp dword [0x4c4810], ebx
mov dword [ebp - 0x14], ebx
jle 0x43245c
push dword [ebp - 0x14]
mov ecx, 0x4c4808
call fcn.0040b035
mov esi, eax
mov eax, dword [esi]
cmp eax, ebx
je 0x432412
cmp dword [eax + 0x38], ebx
je 0x43233a
mov eax, 0x4c4c24
call fcn.00405350
test eax, eax
je 0x432412
mov eax, dword [esi]
add eax, 8
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], ebx
call fcn.004020ea
push 0x4a5cb8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040ae5c
lea ecx, [ebp - 0x10]
test eax, eax
je 0x43239f
lea eax, [ebp - 0x20]
push eax
call fcn.00431e82
pop ecx
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0040c420
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx - 0xc]
dec ecx
cmp eax, ecx
je 0x43238f
push 0x48415c
lea ecx, [ebp - 0x10]
call fcn.0040af5f
mov eax, dword [esi]
add eax, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.00401ec7
jmp 0x4323aa
mov eax, dword [esi]
add eax, 4
push eax
call fcn.00402573
mov esi, dword [esi]
mov eax, dword [esi + 0x1c]
mov edi, dword [ebp - 0x10]
cmp eax, 7
jne 0x4323d3
xor esi, esi
push ebx
inc esi
lea eax, [ebp - 0x18]
push esi
push eax
mov ecx, edi
call fcn.00432a2c
add esp, 0xc
test eax, eax
je 0x4323f4
mov dword [ebp - 0x1c], esi
jmp 0x4323f4
cmp eax, ebx
jne 0x432407
push dword [esi + 4]
lea eax, [ebp - 0x18]
push ebx
push eax
mov ecx, edi
call fcn.00432a2c
add esp, 0xc
test eax, eax
je 0x4323f4
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x18], ebx
je 0x432407
push dword [ebp - 0x18]
push 0x431de0
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.004025d2
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x4c4810]
jl 0x43230a
cmp dword [ebp - 0x1c], ebx
je 0x43245c
push dword [0x4c4c30]
lea eax, [ebp - 0x2a8]
push eax
call fcn.0042393e
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 2
call fcn.00454260
lea ecx, [ebp - 0x2a8]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.00423a53
jmp 0x43245f
xor esi, esi
inc esi
cmp esi, 4
je 0x4322eb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, esi
call fcn.0045bf4c
ret
Function at 0x432ca8
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x4bfd60]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x640], eax
cmp eax, 0xffffffff
jne 0x432ce4
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00458e0e
leave
ret
lea ecx, [ebp - 0x63c]
push ecx
push eax
mov dword [ebp - 0x63c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x432d11
xor edi, edi
push dword [ebp - 0x640]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x432cd6
push 0x48415c
push ebx
call fcn.00459d6a
pop ecx
pop ecx
push dword [ebp + 8]
mov esi, eax
neg esi
push 0
sbb esi, esi
push 0x2000000
neg esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x644], eax
test esi, esi
jne 0x432d4a
push ebx
lea eax, [ebp - 0x61c]
push eax
jmp 0x432d9a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00459cf0
add esp, 0xc
cmp dword [ebp - 0x644], 0
je 0x432da8
push 0x104
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x620]
push dword [ebp - 0x644]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jbe 0x432da8
lea eax, [ebp - 0x214]
push eax
push ebx
call fcn.0045b213
mov edi, eax
neg edi
sbb edi, edi
pop ecx
inc edi
pop ecx
lea eax, [ebp - 0x63c]
push eax
push dword [ebp - 0x640]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x432d01
test edi, edi
je 0x432d3c
jmp 0x432d01
Function at 0x434743
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x434776
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push str.iLogLevel
push dword [0x4c46b8]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043d32a
add esp, 0x10
test eax, eax
jne 0x434776
cmp dword [ebp + 8], 1
jae 0x4347ad
lea eax, [ebp + 8]
push eax
push 0xf003f
push 0
push dword [0x4c46b8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4347ad
push str.CollectData
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
ret

Function at 0x434832
Capabilities:
Shutdown system

Disassembly:
push 0x1c
mov eax, 0x474e43
call fcn.0045be74
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x434880
push str.OpenProcessToken_failed_in_RebootOS.
lea ecx, [ebp - 0x10]
call fcn.004020a6
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push eax
push 2
call fcn.004152d1
mov ecx, dword [ebp - 0x10]
jmp 0x434906
lea eax, [ebp - 0x24]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 2
pop edi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0x18]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4348d5
push str.AdjustTokenPrivileges_failed_in_RebootOS.
lea ecx, [ebp - 0x10]
call fcn.004020a6
mov dword [ebp - 4], ebx
call esi
push eax
lea eax, [ebp - 0x10]
push eax
push edi
jmp 0x434873
push SysReAllocString
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x434911
push str.ExitWindowsEx_failed_in_RebootOS.
lea ecx, [ebp - 0x14]
call fcn.004020a6
mov dword [ebp - 4], edi
call esi
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.004152d1
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
call fcn.0045bf4c
ret
Function at 0x434917
Capabilities:
Create process on windows

Disassembly:
push 0x6c
mov eax, 0x474e10
call fcn.0045be74
push str.LaunchProcessAsUser...
lea ecx, [ebp - 0x18]
call fcn.004020a6
xor esi, esi
push esi
lea eax, [ebp - 0x18]
push eax
push 2
mov dword [ebp - 4], esi
call fcn.004152d1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00459cf0
add esp, 0xc
push 0x10
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], str.winsta0default
call fcn.00459cf0
add esp, 0xc
xor ebx, ebx
inc ebx
push ebx
push dword [edi]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 0x20
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4349a4
mov dword [ebp - 0x1c], 0x420
jmp 0x4349da
push str.CreateEnvironmentBlock_failed
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], esi
call fcn.004020a6
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.004152d1
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push str._Skip
push eax
call fcn.00401e40
add esp, 0xc
push 2
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
xor ebx, ebx
inc eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.00447e91
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x434a54
push str.operator_new_failed
lea ecx, [ebp - 0x18]
call fcn.004020a6
push esi
lea eax, [ebp - 0x18]
push eax
push 1
mov byte [ebp - 4], 3
call fcn.004152d1
mov ecx, dword [ebp - 0x18]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push 8
pop esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, esi
call fcn.0045bf4c
ret
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx - 0xc]
push ecx
inc eax
push eax
push ebx
call fcn.0045a998
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push esi
push esi
push esi
push ebx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x18], esi
cmp eax, esi
jne 0x434ac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateProcessAsUser_failed:
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
call fcn.004020a6
mov byte [ebp - 4], 4
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.004152d1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
push dword [ebp - 0x10]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x28]
call esi
push ebx
call fcn.00447e9c
mov esi, dword [ebp - 0x18]
pop ecx
jmp 0x434a41