joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4193e5
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0042259c
test eax, eax
je 0x41959c
mov edi, 0x105
lea eax, [ebp - 0x428]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41959c
push 0x4042ac
mov edx, edi
lea ecx, [ebp - 0x428]
call fcn.0040c075
test eax, eax
js 0x41959c
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41959c
test al, 0x10
jne 0x41959c
lea eax, [ebp - 0x428]
push eax
push 0x4030f4
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0040c0e1
add esp, 0x10
test eax, eax
js 0x41959c
test esi, esi
je 0x419588
lea eax, [ebp - 0x42c]
xor ebx, ebx
push eax
push 3
push ebx
mov esi, 0x401858
mov dword [ebp - 0x42c], ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4194ce
lea eax, [ebp - 0x42c]
push eax
push 3
push ebx
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41953e
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x218]
push eax
call fcn.0042219e
mov edi, eax
test edi, edi
je 0x419529
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
ret
jne 0x4194ef
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x41952e
mov esi, 0x80004005
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x419560
jle 0x419549
movzx esi, si
or esi, 0x80070000
push esi
push 0x403128
push 0x405020
push 2
call fcn.0041e83a
add esp, 0x10
jmp 0x41959c
cmp dword [0x442534], 0xffffffff
jne 0x419572
push ecx
push 4
pop edx
call fcn.0041e30f
push 4
mov edx, 0x405064
pop ecx
call fcn.0041e767
or dword [0x442678], 1
jmp 0x41959c
push 0xffff
push 1
lea edx, [ebp - 0x218]
xor ecx, ecx
call fcn.00421540
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret
Function at 0x4196bd
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
push edi
push 0x20006
push 1
push edi
push edi
push 0x403130
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], edi
push esi
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4197eb
lea eax, [ebp - 0x214]
push eax
push 3
push edi
push 0x403190
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4197df
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4197d3
push 0x4042ac
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.0040c075
test eax, eax
js 0x4197d3
push ecx
lea eax, [ebp - 0x21c]
mov edx, esi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c15d
test eax, eax
js 0x4197d3
mov eax, dword [ebp - 0x21c]
sub esi, eax
push ecx
push 0x4031ec
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
test eax, eax
js 0x4197d3
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4197a1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x403218
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441130
leave
ret

Function at 0x419801
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
inc edi
xor esi, esi
push edi
push esi
push 0x4036d8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4198a9
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x200
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0x403738
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41989d
cmp dword [ebp - 0x210], edi
jne 0x41989d
lea eax, [ebp - 0x208]
push 0x403750
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41989d
mov esi, edi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441130
leave
ret
Function at 0x4198b9
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x204]
mov esi, 0x80004005
push eax
push 0xc0
push dword [0x442af0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x419934
push 8
lea eax, [ebp - 0x204]
push 0x403568
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x419934
push 0xa
xor ecx, ecx
lea eax, [ebp - 0x204]
push ecx
push ecx
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb ecx, ecx
and ecx, 0x7fffbffb
add esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00441130
leave
ret
Function at 0x41999e
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0xffffffffffffffff
mov eax, ecx
xor esi, esi
push 0x4037c8
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
call fcn.0043f4a6
mov edi, eax
test edi, edi
js 0x419b5e
lea ecx, [ebp - 0x3c]
call fcn.0043f3bf
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xc], 0x7fff
call fcn.0043f3bf
push dword [ebp - 0xc]
lea ecx, [ebp - 0x30]
call fcn.0043f463
mov edi, eax
test edi, edi
jns 0x419a05
lea ecx, [ebp - 0x30]
call fcn.0043f743
lea ecx, [ebp - 0x3c]
call fcn.0043f743
jmp 0x419b5e
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x30]
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x419a36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x419a29
push 0x57
pop edi
test edi, edi
jle 0x4199f0
movzx edi, di
or edi, 0x80070000
jmp 0x4199f0
push ebx
push 0x44
pop edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x419a63
lea ecx, [ebp - 0x30]
mov edi, 0x8007000e
call fcn.0043f743
lea ecx, [ebp - 0x3c]
call fcn.0043f743
jmp 0x419b5d
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x30]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x419aaa
cmp edi, 0x7a
je 0x419aaa
test edi, edi
jle 0x419b46
movzx edi, di
or edi, 0x80070000
jmp 0x419b46
lea ecx, [ebp - 0x24]
call fcn.0043f3bf
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x24]
inc eax
push eax
call fcn.0043f463
mov edi, eax
test edi, edi
js 0x419b3e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x419afd
test edi, edi
jle 0x419b3e
movzx edi, di
or edi, 0x80070000
jmp 0x419b3e
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x419b1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x419af0
push 0x57
pop edi
jmp 0x419aee
push 0xffffffffffffffff
push dword [ebp - 4]
lea ecx, [ebp - 0x3c]
call fcn.0043f4a6
mov edi, eax
test edi, edi
js 0x419b3e
push ecx
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
call fcn.0043f66e
mov edi, eax
lea ecx, [ebp - 0x24]
call fcn.0043f743
lea ecx, [ebp - 0x30]
call fcn.0043f743
lea ecx, [ebp - 0x3c]
call fcn.0043f743
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
cmp dword [ebp - 4], 0
je 0x419b6d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x419daf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push 1
push esi
push 0x403828
push SysReAllocStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419e41
push edi
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push esi
push esi
push 0x403888
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e0b
cmp dword [ebp - 4], 1
jne 0x419e0b
and dword [0x443f78], 0xfffffffe
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x4038c8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x419e38
cmp dword [ebp - 4], 1
jne 0x419e38
and dword [0x443f78], 0xfffffffd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x41a276
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.00433f2f
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41a32d
push 0x4042ac
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.0040c075
test eax, eax
js 0x41a32d
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a32d
test al, 0x10
jne 0x41a32d
call fcn.00420610
push ecx
lea eax, [ebp - 0x214]
mov edx, esi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c15d
test eax, eax
js 0x41a32d
mov eax, dword [ebp - 0x214]
sub esi, eax
push ecx
push 0x403968
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
test eax, eax
js 0x41a32d
push 0xffff
push 1
lea edx, [ebp - 0x210]
xor ecx, ecx
call fcn.00421540
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441130
leave
ret
Function at 0x41c334
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx + 0xc]
sub esp, 0x3c
test eax, eax
jne 0x41c345
leave
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret
Function at 0x41d578
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x41d5d1
lea eax, [esi + 0x3c]
push eax
push edi
push esi
push 0x41cf70
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x41d5c0
push 0x32
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41d5ae
cmp dword [esi + 0x38], edi
je 0x41d5d1
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x38], edi
pop edi
pop esi
ret 4

Function at 0x41de64
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x443f94]
push esi
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
test eax, eax
je 0x41de9d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41de9d
push dword [ebp - 4]
push esi
push 0x5c6
push dword [0x443f94]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 8]
push eax
push 2
push esi
push 0x4017d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41dee4
cmp dword [ebp - 4], esi
jne 0x41dec4
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x401b54
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x41dee7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x443f94]
push esi
xor esi, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
test eax, eax
je 0x41df20
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41df20
push dword [ebp - 8]
push esi
push 0x5c7
push dword [0x443f94]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x4017d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41df5b
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x401b24
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
Function at 0x41f048
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
mov edx, 0x103
lea ecx, [ebp - 0x210]
call fcn.0040c040
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x41f091
xor edx, edx
jmp 0x41f137
mov word [ebx + 2], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x41f0e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41f0ca
push 0x57
pop eax
test eax, eax
jle 0x41f0d4
movzx eax, ax
or eax, 0x80070000
push eax
push 0x4043b4
push 2
call fcn.0041e83a
add esp, 0xc
xor eax, eax
jmp 0x41f08a
mov edi, dword [ebp - 0x218]
mov esi, dword [ebp - 0x214]
test edi, edi
jne 0x41f133
test esi, esi
jne 0x41f133
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41f133
mov edi, dword [ebp - 0x218]
mov esi, dword [ebp - 0x214]
mov eax, edi
mov edx, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave

Function at 0x41f198
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x20c]
xor esi, esi
call fcn.0040c040
test eax, eax
js 0x41f20f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41f1ce
sub ecx, edx
sar ecx, 1
je 0x41f1f6
cmp word [ebp + ecx*2 - 0x20e], 0x5c
jne 0x41f1f6
xor eax, eax
mov word [ebp + ecx*2 - 0x20e], ax
jmp 0x41f1c5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f20f
test al, 0x10
je 0x41f20f
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00441130
leave
ret

Function at 0x41f21e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x41f236
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f236
test al, 0x10
jne 0x41f236
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x41f239
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ecx + 2]
push 2
mov dword [ebp - 0xc], edi
xor ebx, ebx
pop esi
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x41f251
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x14]
xor ecx, ecx
mov dword [ebp - 4], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov esi, eax
pop ecx
test esi, esi
je 0x41f354
mov edx, dword [ebp - 4]
mov ecx, esi
push edi
call fcn.0040c040
push 0x4043e8
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x41f34d
add eax, 4
mov dword [ebp - 8], ebx
push 0x4043f0
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x41f345
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov ecx, esi
mov dword [ebp - 0x10], eax
call fcn.0041f198
test eax, eax
jne 0x41f312
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x41f2ed
push 0x57
pop edi
test edi, edi
jle 0x41f2f8
movzx edi, di
or edi, 0x80070000
mov ecx, esi
call fcn.0041f198
test eax, eax
je 0x41f331
push ebx
push esi
push 5
push 8
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov edi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, esi
push edi
call fcn.0040c040
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0xa
jge 0x41f345
mov eax, dword [ebp - 0x10]
jmp 0x41f2a8
push edi
push esi
push 0x4043f4
push 2
call fcn.0041e83a
mov edi, dword [ebp - 0xc]
add esp, 0x10
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00440db7
pop ecx
test edi, edi
je 0x41f361
mov ecx, edi
call fcn.0041f198
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x41f7c0
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x10]
push ebx
push eax
push 0x20008
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41f8b0
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x14]
call fcn.00440dea
mov esi, eax
pop ecx
test esi, esi
je 0x41f8a0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41f899
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41f899
push edi
mov edi, ebx
cmp dword [esi], ebx
jbe 0x41f88f
lea eax, [esi + 4]
mov dword [ebp - 0x18], eax
push dword [eax]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41f88c
mov eax, dword [ebp - 0x18]
inc edi
add eax, 8
mov dword [ebp - 0x18], eax
cmp edi, dword [esi]
jb 0x41f86d
jmp 0x41f88f
xor ebx, ebx
inc ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
push esi
call fcn.00440db7
pop ecx
cmp dword [ebp - 0x10], 0
pop esi
je 0x41f8b0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret

Function at 0x41f8bf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x404528
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f908
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push 0x40455c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x41fa97
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41fb14
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x4046a8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x41fb06
push 0x80040002
push 4
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
cmp dword [ebp - 0x18], esi
je 0x41fb14
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441130
leave
ret