joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c417
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40c41f
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c432
test al, 0x10
je 0x40c432
mov al, 1
ret
xor al, al
ret

Function at 0x40c6f3
Capabilities:
Create directory

Disassembly:
push 0x16c
mov eax, 0x429360
call fcn.00413ec1
mov esi, edx
mov dword [ebp - 0x174], ecx
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x178], ebx
call fcn.004103f9
cmp dword [esi + 0x14], 8
jb 0x40c729
mov eax, dword [esi]
jmp 0x40c72b
mov eax, esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c772
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x170], eax
sub eax, 3
je 0x40c884
dec eax
dec eax
mov edi, str.WT::System::IO::CDirectory::CreateDirectory
mov esi, str.SourceWtSystemIoDirectory.cpp
je 0x40c797
sub eax, 0x52
je 0x40c7e6
sub eax, 0x60
jne 0x40c835
mov esi, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x174]
push esi
call fcn.0040c2b3
mov dword [ebp - 4], ebx
mov dword [ebp - 0x178], 1
mov eax, dword [ebp - 0x174]
call fcn.00413f44
ret
push dword [ebp - 0x16c]
mov edx, str.CreateDirectory_Failed.__Access_Denied_:
lea ecx, [ebp - 0xcc]
call fcn.004073de
mov dword [ebp - 4], 3
push edi
push 0x4d
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.0040b2ea
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0xcc]
call fcn.004012a0
lea ecx, [ebp - 0x78]
call fcn.0040b585
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
call fcn.0040b043
push dword [ebp - 0x16c]
mov edx, str.CreateDirectory_Failed.__Invalid_Parameter_:
lea ecx, [ebp - 0x94]
call fcn.004073de
mov dword [ebp - 4], 6
push edi
push 0x4f
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.0040b2ea
mov byte [ebp - 4], 8
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004012a0
lea ecx, [ebp - 0x78]
call fcn.0040b585
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
call fcn.0040b043
mov edx, dword [ebp - 0x170]
lea ecx, [ebp - 0xb0]
call fcn.004094d5
mov dword [ebp - 4], 9
push edi
push 0x52
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.0040b36d
mov byte [ebp - 4], 0xb
push ebx
push 1
lea ecx, [ebp - 0xb0]
call fcn.00401250
lea ecx, [ebp - 0x78]
call fcn.0040b585
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
call fcn.0040b043
jmp 0x40c76c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x170], esp
push esi
call fcn.00406d1b
mov dword [ebp - 4], 1
mov byte [ebp - 4], bl
lea edi, [ebp - 0xe8]
call fcn.0040c48b
mov dword [ebp - 4], 2
mov edx, eax
lea ecx, [ebp - 0x168]
call fcn.0040c6f3
lea ecx, [ebp - 0x168]
call fcn.0040c19f
mov byte [ebp - 4], bl
push ebx
push 1
mov ecx, edi
call fcn.004012a0
mov edx, esi
lea ecx, [ebp - 0x128]
call fcn.0040c6f3
lea ecx, [ebp - 0x128]
call fcn.0040c19f
jmp 0x40c772
Function at 0x40e303
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429652
mov eax, dword fs:[0]
push eax
mov eax, 0x2998
call fcn.00416fe0
mov eax, dword [0x442b40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2998], edx
lea eax, [ebp - 0x299c]
push eax
lea eax, [ebp - 0x2990]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x2994], ebx
push eax
mov dword [ebp - 0x29a0], esi
mov dword [ebp - 0x299c], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
je 0x40e389
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x4333b4
mov ecx, esi
mov byte [esi], bl
call fcn.00401ec0
jmp 0x40e44e
lea eax, [ebp - 0x2990]
xor ecx, ecx
movzx edx, byte [eax + 0x196]
movzx edi, byte [eax + 0x197]
shl edx, 8
add edx, edi
movzx edi, byte [eax + 0x198]
shl edx, 8
add edx, edi
movzx edi, byte [eax + 0x199]
shl edx, 8
add edx, edi
je 0x40e423
cmp dword [ebp - 0x2998], ebx
jl 0x40e3ce
cmp dword [ebp - 0x2998], ecx
jne 0x40e42b
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.00417634
add esp, 0x24
lea eax, [ebp - 0x110]
mov byte [ebp - 0x11], bl
push eax
jmp 0x40e43b
cmp dword [ebp - 0x2998], ecx
je 0x40e436
mov eax, dword [eax]
inc ecx
cmp eax, ebx
jne 0x40e391
push 0x4333b4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], bl
call fcn.00401ec0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2994], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004138fe
leave
ret

Function at 0x40e477
Capabilities:
Get disk information

Disassembly:
push 0x12c
mov eax, 0x429685
call fcn.00413ec1
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x138], eax
mov dword [edi], ebx
cmp cl, bl
jne 0x40e4aa
call fcn.0040dbc2
mov byte [ebp - 0x134], al
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
mov dword [ebp - 4], ebx
push dword [ebp - 0x134]
lea ecx, [ebp - 0x130]
push 1
call fcn.00402d9a
push 2
push 0x438848
lea ecx, [ebp - 0x130]
call fcn.0040360f
mov esi, 0x104
push esi
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.004134a0
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp dword [ebp - 0x11c], 0x10
jae 0x40e513
lea eax, [ebp - 0x130]
push ebx
push ebx
push ebx
push ebx
push edi
push esi
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40e53d
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x114]
push eax
call fcn.00401ec0
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.00401250
mov al, 1
call fcn.00413f44
ret 4
Function at 0x40ef4f
Capabilities:
Check os version

Disassembly:
push 0x1f0
mov eax, 0x429963
call fcn.00413ec1
lea eax, [ebp - 0x1f8]
push eax
mov edi, ecx
mov dword [ebp - 0x1f8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 4
mov ecx, edi
call fcn.0040eedb
push 0xf
xor ebx, ebx
pop esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 0xac], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb8], ebx
mov byte [ebp - 0xc8], bl
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1f4], 5
jb 0x40f009
lea eax, [ebp - 0xc8]
push eax
lea edx, [ebp - 0xac]
xor cl, cl
call fcn.0040dfd6
test al, al
je 0x40f009
lea eax, [ebp - 0xc8]
push eax
lea edx, [ebp - 0xac]
lea ecx, [ebp - 0x90]
call fcn.0040da12
mov byte [ebp - 4], 2
push eax
xor edx, edx
mov ecx, edi
call fcn.0040e559
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.00401250
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xd4], ebx
mov byte [ebp - 0xe4], bl
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe4]
push eax
lea edx, [ebp - 0x1fc]
xor cl, cl
call fcn.0040e477
test al, al
je 0x40f0a0
push dword [ebp - 0x1fc]
lea eax, [ebp - 0x74]
push 0x43893c
push eax
call fcn.00414dbd
lea eax, [ebp - 0x74]
mov dword [ebp - 0x7c], esi
add esp, 0xc
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f060
sub eax, esi
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
call fcn.00401be0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x90]
xor edx, edx
push eax
inc edx
mov ecx, edi
call fcn.0040e559
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.00401250
or edx, 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.0040e303
mov byte [ebp - 4], 5
push eax
push 2
pop edx
mov ecx, edi
call fcn.0040e559
mov byte [ebp - 4], 3
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x90]
call fcn.00401250
cmp dword [ebp - 0x1f4], 5
jb 0x40f0e1
mov ecx, edi
call fcn.0040ea34
mov byte [ebp - 4], 1
push ebx
push esi
lea ecx, [ebp - 0xe4]
call fcn.00401250
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0xc8]
call fcn.00401250
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.00401250
call fcn.00413f44
ret
Function at 0x410e12
Capabilities:
Check mutex on windows

Disassembly:
push 0xe8
mov eax, 0x429eb5
call fcn.00413ec1
mov al, byte [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0xf4], edi
mov byte [ebp - 0xe9], al
call fcn.00410da2
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [edi], 0x438ad8
cmp dword [esi + 0x14], 0x10
jb 0x410e4f
mov eax, dword [esi]
jmp 0x410e51
mov eax, esi
push eax
movzx eax, byte [ebp - 0xe9]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 8], eax
cmp eax, ebx
jne 0x410f2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.004094d5
mov dword [ebp - 0xf0], eax
mov byte [ebp - 4], 1
push esi
mov edx, str.Failed_to_create_mutex:
lea ecx, [ebp - 0x64]
call fcn.0040cbf1
mov byte [ebp - 4], 2
push 0x438b38
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00404086
mov byte [ebp - 4], 3
push dword [ebp - 0xf0]
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.00404019
mov byte [ebp - 4], 4
push str.WT::System::Win32::CMutex::CMutex
push 0x21
push str.SourceWtSystemWin32Mutex.cpp
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040b36d
mov byte [ebp - 4], 6
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.00401250
mov byte [ebp - 4], 7
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.00401250
mov byte [ebp - 4], 8
push ebx
push esi
lea ecx, [ebp - 0x64]
call fcn.00401250
mov byte [ebp - 4], 9
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.00401250
lea ecx, [ebp - 0xe8]
call fcn.0040b585
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xe8]
call fcn.0040b043
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00413f44
ret 8

Function at 0x41153d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], edx
mov edx, ecx
push esi
mov esi, dword [edx + 0x3c]
mov eax, dword [esi + edx + 0x78]
mov ecx, 0x10b
add eax, edx
mov dword [ebp - 8], edx
cmp word [esi + edx + 0x18], cx
je 0x411565
xor eax, eax
jmp 0x411589
mov ecx, dword [eax + 0x24]
push ebx
mov ebx, dword [eax + 0x1c]
push edi
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
xor esi, esi
add ebx, edx
add ecx, edx
add edi, edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x41158f
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
mov edx, dword [ebp - 8]
mov esi, dword [edi + esi*4]
mov eax, dword [ebp - 0xc]
add esi, edx
mov dl, byte [esi]
cmp dl, byte [eax]
jne 0x4115b7
test dl, dl
je 0x4115b3
mov dl, byte [esi + 1]
cmp dl, byte [eax + 1]
jne 0x4115b7
add esi, 2
add eax, 2
test dl, dl
jne 0x411597
xor eax, eax
jmp 0x4115bc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4115ce
mov esi, dword [ebp - 4]
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [ebp - 0x10]
jb 0x41158c
jmp 0x411585
mov eax, dword [ebp - 4]
movzx eax, word [ecx + eax*2]
mov eax, dword [ebx + eax*4]
jmp 0x411587
Function at 0x4115da
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edx
mov edx, ecx
mov eax, dword [edx + 0x3c]
push esi
mov esi, dword [eax + edx + 0x78]
mov ecx, 0x10b
add esi, edx
mov dword [ebp - 4], edx
cmp word [eax + edx + 0x18], cx
je 0x411605
xor eax, eax
jmp 0x41169d
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
push ebx
mov ebx, dword [esi + 0x1c]
add eax, edx
add ebx, edx
add ecx, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [esi + 0x18], edx
jbe 0x411699
push edi
jmp 0x411628
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + edx*4]
movzx eax, word [ecx + edx*2]
mov eax, dword [ebx + eax*4]
add edi, dword [ebp - 4]
add eax, dword [ebp - 4]
cmp dword [0x4444f8], 0
jne 0x411652
cmp byte [eax], 0xb8
jne 0x41168c
cmp byte [eax + 9], 0xcd
jne 0x41168c
cmp byte [eax + 0xa], 0x2e
jmp 0x41167c
cmp dword [0x4444f8], 1
jne 0x41168c
cmp byte [eax], 0xb8
jne 0x41168c
cmp byte [eax + 5], 0xba
jne 0x41168c
cmp byte [eax + 6], 0
jne 0x41168c
cmp byte [eax + 7], 3
jne 0x41168c
cmp byte [eax + 8], 0xfe
jne 0x41168c
cmp byte [eax + 9], 0x7f
jne 0x41168c
mov eax, dword [eax + 1]
cmp eax, dword [ebp + 8]
jae 0x41168c
mov edx, dword [ebp - 8]
mov dword [edx + eax*4], edi
mov edx, dword [ebp - 0xc]
inc edx
mov dword [ebp - 0xc], edx
cmp edx, dword [esi + 0x18]
jb 0x411625
pop edi
xor eax, eax
inc eax
pop ebx
pop esi
leave
ret 4

Function at 0x4116a2
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.RtlAnsiStringToUnicodeString
push edi
call esi
push str.RtlInitAnsiString
push edi
mov dword [0x4444f4], eax
call esi
push str.RtlInitUnicodeString
push edi
mov dword [0x4444f0], eax
call esi
push str.RtlFreeUnicodeString
push edi
mov dword [0x4444ec], eax
call esi
push str.NtOpenSection
push edi
mov dword [0x4444e8], eax
call esi
push str.NtMapViewOfSection
push edi
mov dword [0x4444e4], eax
call esi
push str.NtUnmapViewOfSection
push edi
mov dword [0x4444e0], eax
call esi
push str.ZwQuerySystemInformation
push edi
mov dword [0x4444dc], eax
call esi
xor ecx, ecx
pop edi
mov dword [0x4444d8], eax
pop esi
cmp dword [0x4444f4], ecx
je 0x411763
cmp dword [0x4444f0], ecx
je 0x411763
cmp dword [0x4444ec], ecx
je 0x411763
cmp dword [0x4444e8], ecx
je 0x411763
cmp dword [0x4444e4], ecx
je 0x411763
cmp dword [0x4444e0], ecx
je 0x411763
cmp dword [0x4444dc], ecx
je 0x411763
cmp eax, ecx
je 0x411763
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x412160
Capabilities:
Check os version

Disassembly:
push 0x150
mov eax, 0x42a137
call fcn.00413ec1
xor ebx, ebx
mov dword [ebp - 0x14c], edx
cmp byte [0x4444fc], bl
je 0x412186
xor al, al
jmp 0x4122fd
cmp edx, ebx
je 0x41218c
mov byte [edx], bl
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 0x140], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x13c], 5
je 0x4121b5
mov byte [0x4444fc], 1
jmp 0x41217f
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x15c]
call fcn.0041203a
test al, al
je 0x4122ec
mov eax, dword [ebp - 0x158]
mov edi, dword [ebp - 0x15c]
sub eax, edi
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x148], eax
cmp eax, ebx
jle 0x4122ec
mov edx, edi
lea ecx, [ebp - 0x2c]
call fcn.00411981
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00411944
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
jbe 0x412237
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41222e
lea eax, [ebp - 0x2c]
inc byte [eax + ecx]
inc ecx
cmp ecx, dword [ebp - 0x1c]
jb 0x412222
xor esi, esi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x412245
lea eax, [ebp - 0x2c]
push dword [esi + 0x442984]
push eax
call fcn.00416bd0
pop ecx
pop ecx
test eax, eax
je 0x412281
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x412263
lea eax, [ebp - 0x2c]
push str._tzt
push eax
call fcn.00416bd0
pop ecx
pop ecx
test eax, eax
je 0x412281
mov eax, dword [ebp - 0x14c]
cmp eax, ebx
je 0x412281
mov byte [eax], 1
add esi, 4
cmp esi, 8
jb 0x412239
xor esi, esi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x412297
lea eax, [ebp - 0x2c]
push dword [esi + 0x44297c]
push eax
call fcn.00424a81
pop ecx
pop ecx
test eax, eax
je 0x4122dc
add esi, 4
cmp esi, 8
jb 0x41228b
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401250
inc dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
add edi, 0x1c
cmp eax, dword [ebp - 0x148]
jl 0x412205
jmp 0x4122ec
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401250
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.004042a4
mov al, bl
call fcn.00413f44
ret

Function at 0x41236a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, edx
mov edi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4123d4
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push str.ProgramFilesDir
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4123cb
cmp esi, ebx
jbe 0x4123c4
mov byte [edi + esi - 1], bl
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4124d5
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x110
mov eax, 0x427d45
call fcn.00413ec1
xor eax, eax
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [ebp - 0x118], eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov dword [ebp - 0x11c], esi
mov byte [esi], al
mov dword [ebp - 4], eax
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 0x118], ecx
push 0x26
lea ecx, [ebp - 0x114]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x41254e
mov edx, 0x104
lea ecx, [ebp - 0x114]
call fcn.0041236a
test eax, eax
lea eax, [ebp - 0x114]
jne 0x412554
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x41255c
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call fcn.00401ec0
mov eax, esi
call fcn.00413f44
ret

Function at 0x4138fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442b40]
jne 0x413908
repz ret
jmp fcn.0041932c
Function at 0x421d2e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442b40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00418dd6
and dword [ebp - 0x14], 0
cmp dword [0x44542c], 0
mov dword [ebp - 0x18], eax
jne 0x421de1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x421e89
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43b464
push ebx
call edi
test eax, eax
je 0x421e89
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44542c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x445430], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x445434], eax
call edi
push eax
call esi
mov dword [0x44543c], eax
test eax, eax
je 0x421de1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x445438], eax
mov eax, dword [0x445438]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x421e3a
cmp dword [0x44543c], ecx
je 0x421e3a
push eax
call esi
push dword [0x44543c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x421e3a
test ebx, ebx
je 0x421e3a
call edi
test eax, eax
je 0x421e31
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x421e31
test byte [ebp - 8], 1
jne 0x421e3a
or dword [ebp + 0x10], 0x200000
jmp 0x421e6d
mov eax, dword [0x445430]
cmp eax, dword [ebp - 0x18]
je 0x421e6d
push eax
call esi
test eax, eax
je 0x421e6d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x421e6d
mov eax, dword [0x445434]
cmp eax, dword [ebp - 0x18]
je 0x421e6d
push eax
call esi
test eax, eax
je 0x421e6d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44542c]
call esi
test eax, eax
je 0x421e89
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x421e8b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004138fe
leave
ret
Function at 0x42de60
Capabilities:
Get session user name

Disassembly:
push 0x118
mov eax, 0x431e2a
call fcn.00413ec1
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], ecx
test byte [0x4443e0], bl
jne 0x42deb7
or dword [0x4443e0], ebx
mov dword [ebp - 4], ebx
push 0x42e3e6
mov dword [0x4443d8], 0xf
mov dword [0x4443d4], edi
mov byte [0x4443c4], 0
call fcn.00414da6
pop ecx
mov byte [ebp - 4], 0
cmp dword [0x4443d4], edi
je 0x42ded4
mov ecx, dword [ebp - 0x118]
push 0x4443c4
call fcn.00402b01
jmp 0x42dfab
push str.SECUR32.DLL
mov dword [ebp - 0x120], 0x104
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x124], eax
mov esi, 0x4443c4
cmp eax, edi
je 0x42df4b
push str.GetUserNameExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x42df3f
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x114]
push ecx
push 2
call eax
test eax, eax
je 0x42df3f
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42df27
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call fcn.00401be0
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x4443d4], edi
jne 0x42df9f
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x120], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x42df91
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42df7e
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
jmp 0x42df98
push 5
push str.R8cx5
mov ecx, esi
call fcn.00401be0
mov ecx, dword [ebp - 0x118]
push esi
call fcn.00402b01
mov dword [ebp - 4], edi
mov dword [ebp - 0x11c], ebx
mov eax, dword [ebp - 0x118]
call fcn.00413f44
ret

Function at 0x42e467
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x442b40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
call fcn.0042e3f5
test al, al
jne 0x42e4d0
push 0x114
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.004134a0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jb 0x42e4ce
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
setne al
mov byte [edi + 0x2a], al
mov bl, 1
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004138fe
leave
ret

Function at 0x42e4f5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [edx + 0x14], 0x10
mov dword [ebp - 4], ebx
jb 0x42e507
mov edx, dword [edx]
lea eax, [ebp - 4]
push eax
push 2
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e549
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x42e525
mov eax, dword [eax]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret 0xc