joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ad30
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.004c8d00
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ad50
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
push esi
call fcn.004c9ae9
push str.SVCHOST.EXE
push esi
call fcn.004c580a
add esp, 0x10
test eax, eax
je 0x47ae47
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ad87
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x2e]
mov dword [ebp - 0xc], eax
add eax, eax
push eax
call fcn.004c8d7a
push esi
push str.SystemCurrentControlSetServices_s
push dword [ebp - 0xc]
mov ebx, eax
push ebx
call fcn.00415290
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47aec6
push str.ServiceDll
push dword [ebp - 4]
call fcn.00478d80
mov edi, eax
add esp, 8
test edi, edi
jne 0x47aec6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str.SystemCurrentControlSetServices_sParameters
push dword [ebp - 0xc]
push ebx
call fcn.00415290
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47aec6
push str.ServiceDll
push dword [ebp - 4]
call fcn.00478d80
add esp, 8
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47aec6
push 5
push dword [ebp + 0xc]
push dword [0x550aa0]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x47ae66
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push eax
call esi
push dword [ebp - 8]
call fcn.004c8d7a
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x47aec6
lea ecx, [esi + esi]
push ecx
call fcn.004c8d7a
add esp, 4
mov edi, eax
push esi
push edi
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
call fcn.004c8d5f
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47af23
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
mov ebx, eax
test ebx, ebx
je 0x47af23
lea ecx, [ebx + ebx]
push ecx
call fcn.004c8d7a
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebx
push esi
call fcn.004c98b5
push edi
call fcn.004c8d5f
add esp, 0xc
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x418]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47ba88
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x4ff9a4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47ba7c
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004c9ae9
add esp, 8
lea eax, [ebp - 0x20a]
push 0x102
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x22
push 0x500150
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d6355
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c9ae9
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.004c5767
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004c5767
add esp, 0x24
test eax, eax
je 0x47ba7c
test esi, esi
je 0x47ba7c
nop dword [eax]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x47ba56
test cx, cx
je 0x47ba52
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x47ba56
add esi, 4
add eax, 4
test cx, cx
jne 0x47ba30
xor eax, eax
jmp 0x47ba5b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47ba7c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004c34b7
mov esp, ebp
pop ebp
ret

Function at 0x47baa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [0x54fc8d], 1
pop ebp
ret
Function at 0x47bbd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x80c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareSysinternalsProcess_ExplorerProcessComments
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47bd22
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x810]
push eax
push esi
lea eax, [ebp - 0x814]
mov dword [ebp - 0x808], 0x400
push eax
push esi
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call edi
test eax, eax
jne 0x47bd15
nop dword [eax + eax]
lea eax, [esi*8 + 0x10]
push eax
push dword [0x54f9f0]
call fcn.004c8d85
mov dword [0x54f9f0], eax
lea eax, [ebp - 0x804]
push eax
call fcn.004c8d00
mov ecx, dword [0x54f9f0]
mov dword [ecx + esi*8], eax
push dword [ebp - 0x810]
call fcn.004c8d7a
mov ecx, dword [0x54f9f0]
add esp, 0x10
mov dword [ecx + esi*8 + 4], eax
lea eax, [ebp - 0x810]
add dword [ebp - 0x808], 2
push eax
mov eax, dword [0x54f9f0]
push dword [eax + esi*8 + 4]
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call edi
mov eax, dword [0x54f9f0]
mov dword [eax + esi*8 + 8], 0
lea eax, [ebp - 0x810]
push eax
push 0
lea eax, [ebp - 0x814]
mov dword [ebp - 0x808], 0x400
push eax
push 0
lea eax, [ebp - 0x808]
inc esi
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call edi
test eax, eax
je 0x47bc50
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
Function at 0x47bd40
Capabilities:
Persist via image file execution options registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c53a0
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00478cc0
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x47bdff
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47bda0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x4ff9a4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x47bdee
cmp byte [ebp + 0xc], 0
je 0x47be1f
push esi
jmp 0x47be06
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x47be1f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x54fea0]
push str.Error_replacing_Task_Manager
call fcn.004aae60
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
Function at 0x47be30
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x418]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47bfdd
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x4ff9a4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47bfd1
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004c9ae9
add esp, 8
lea eax, [ebp - 0x20a]
push 0x102
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x22
push 0x500150
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d6355
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c9ae9
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.004c5767
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004c5767
add esp, 0x24
test eax, eax
je 0x47bfd1
test esi, esi
je 0x47bfd1
mov cx, word [esi]
cmp cx, word [eax]
jne 0x47bf4a
test cx, cx
je 0x47bf46
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x47bf4a
add esi, 4
add eax, 4
test cx, cx
jne 0x47bf24
xor eax, eax
jmp 0x47bf4f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47bfd1
push dword [ebp - 0x418]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x41c]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47bfa6
push 0x4ff9a4
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x41c]
call esi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x54fea0]
push str.Error_restoring_Task_Manager
call fcn.004aae60
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
Function at 0x47c2b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00478cc0
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [ebp - 0x434], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x450]
push eax
movlpd qword [ebp - 0x430], xmm0
movlpd qword [ebp - 0x428], xmm0
movlpd qword [ebp - 0x420], xmm0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x44c], 0x40
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], str.Runas
mov dword [ebp - 0x43c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
test eax, eax
jne 0x47c373
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x47c387
push 0xffffffffffffffff
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
Function at 0x47c3e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x24
push ebx
mov ebx, dword [eax + 0xb4]
push esi
push edi
xor edi, edi
test ebx, ebx
jne 0x47c3fe
mov ebx, dword [eax + 0xe4]
mov esi, dword [0x54af14]
test esi, esi
je 0x47c4c8
mov ecx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0xc], ecx
cmp dword [eax + 0xb4], 0
je 0x47c442
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x47c442
push ebx
push eax
call fcn.004c9460
add esp, 8
test eax, eax
je 0x47c45a
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x47c4b5
push ebx
push eax
call fcn.004c9460
add esp, 8
test eax, eax
jne 0x47c4b5
push dword [esi + 0x338]
call fcn.004c8d5f
add esp, 4
cmp word [edi], 0
je 0x47c479
push edi
call fcn.004c8d00
add esp, 4
jmp 0x47c47b
xor eax, eax
mov dword [esi + 0x338], eax
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push 0x1053
push dword [0x54fea4]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, 0xffffffff
je 0x47c4b5
push 0xffffffffffffffff
push eax
push 0x7eb
push dword [0x54fea0]
call dword [ebp - 0xc]
mov esi, dword [esi + 0x5c0]
mov eax, dword [ebp + 8]
test esi, esi
jne 0x47c421
xor edi, edi
mov ecx, dword [0x54f9f0]
test ecx, ecx
je 0x47c508
cmp dword [ecx], 0
je 0x47c508
xor eax, eax
nop dword [eax]
push ebx
push dword [eax + ecx]
call fcn.004c9460
add esp, 8
test eax, eax
je 0x47c59d
mov ecx, dword [0x54f9f0]
inc edi
lea eax, [edi*8]
cmp dword [eax + ecx], 0
jne 0x47c4e0
mov esi, dword [ebp + 0xc]
shl edi, 3
test ecx, ecx
je 0x47c518
cmp dword [edi + ecx], 0
jne 0x47c556
lea eax, [edi + 0x10]
push eax
push ecx
call fcn.004c8d85
push ebx
mov dword [0x54f9f0], eax
call fcn.004c8d00
mov ecx, dword [0x54f9f0]
push esi
mov dword [edi + ecx], eax
call fcn.004c8d00
mov ecx, dword [0x54f9f0]
add esp, 0x10
mov dword [edi + ecx + 4], eax
mov eax, dword [0x54f9f0]
mov dword [edi + eax + 8], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareSysinternalsProcess_ExplorerProcessComments
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x47c601
mov edx, dword [0x54f9f0]
add edx, edi
mov esi, dword [edx + 4]
cmp word [esi], ax
jne 0x47c5cc
push dword [edx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x54f9f0]
push dword [eax + edi*8 + 4]
call fcn.004c8d5f
mov esi, dword [ebp + 0xc]
push esi
call fcn.004c8d00
mov ecx, dword [0x54f9f0]
add esp, 8
mov dword [ecx + edi*8 + 4], eax
mov ecx, dword [0x54f9f0]
jmp 0x47c50b
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47c5d1
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [edx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c610
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10050
call fcn.004c39f0
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47c69b
lea eax, [ebp - 0x10050]
mov dword [ebp - 0x10050], 5
push eax
push 0
push 0x104d
push edi
mov dword [ebp - 0x1004c], SysReAllocStringLen
mov dword [ebp - 0x1003c], str._Error_opening_file_
mov dword [ebp - 0x10030], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
mov eax, dword [0x54ff44]
test eax, eax
jne 0x47c6b5
push 0x7f02
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x54ff44], eax
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
mov dword [ebp - 0x10014], eax
lea eax, [ebp - 0x10010]
push eax
push 0x10008
lea eax, [ebp - 0x1000c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47c743
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [eax]
mov eax, dword [ebp - 0x10010]
test eax, eax
je 0x47c742
push eax
lea eax, [ebp - 0x1000c]
push eax
push 3
push edi
call fcn.00479080
add esp, 0x10
cmp dword [ebp - 0x10010], 0x10008
jne 0x47c722
push 1
push 0
push 0xfffffffffffffffe
push esi
call ebx
push 0
lea eax, [ebp - 0x10010]
push eax
push 0x10008
lea eax, [ebp - 0x1000c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47c6f0
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10014]
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
Function at 0x47d390
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x54fbfc], 0
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x500
mov dword [ebp - 0x14], 0
jne 0x47d499
push ebx
push esi
lea eax, [ebp - 0x18]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x10]
call fcn.004c8d7a
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 2
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x47d475
push edi
xor edi, edi
cmp edi, dword [ebx]
jae 0x47d46d
lea esi, [ebx + 8]
nop dword [eax + eax]
push dword [esi - 4]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x47d463
mov eax, dword [esi]
test eax, 0xffffffef
setne cl
test al, 4
setne al
test al, cl
jne 0x47d46b
inc edi
add esi, 8
cmp edi, dword [ebx]
jb 0x47d440
cmp edi, dword [ebx]
setne byte [0x54fbfd]
pop edi
push ebx
call fcn.004c8d5f
add esp, 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov byte [0x54fbfc], 1
pop ebx
mov ecx, dword [ebp - 4]
mov al, byte [0x54fbfd]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
Function at 0x47e350
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6295
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x535a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.c:_no_fod.exe
push str.COMPLUS_FodPath
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.0045a940
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x18]
call fcn.00482080
push str..NET_CLR_Memory
push 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004820e0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
call fcn.00481a70
push str..NET_CLR_Memory
lea ecx, [ebp - 0x34]
call fcn.00481a90
test eax, eax
setne byte [0x54fc00]
test eax, eax
je 0x47e43b
push 1
push str.psapi.dll
call fcn.0042f970
add esp, 8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x54fc00], 0
je 0x47e43b
mov eax, dword [0x54fc08]
mov ecx, dword [0x54fc0c]
push 0x54fc08
mov dword [0x54fc10], eax
mov dword [0x54fc14], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push str..NET_CLR_Memory_.NET_CLR_Exceptions_.NET_CLR_Remoting_.NET_CLR_LocksAndThreads_.NET_CLR_Security_.NET_CLR_Jit_.NET_CLR_Loading_.NET_CLR_Interop_.NET_CLR_Data
push 0
mov ecx, 0x54fc2c
call fcn.004820e0
lea ecx, [ebp - 0x18]
call fcn.004820a0
lea ecx, [ebp - 0x24]
call fcn.0045aae0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4820e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push 0x58
push dword [edi]
call fcn.004c34a9
add esp, 8
mov dword [edi], 0
test esi, esi
je 0x482131
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push esi
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x4822bc
jmp 0x48213b
mov dword [ebp - 0x20c], reloc.OLEAUT32.dll_SysReAllocStringLen
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne 0x4822bc
push ebx
call fcn.004c8d00
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
push ecx
push 0x501b1c
push eax
lea esi, [ebp - 0x204]
mov dword [ebp - 0x210], 0
call fcn.004d8d90
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4821da
mov ecx, dword [edi + 4]
push ebx
call fcn.0045ab10
lea ecx, [ebp - 4]
sub ecx, esi
sar ecx, 1
test eax, eax
je 0x48219f
push eax
push 0x50ec74
jmp 0x4821a5
push ebx
push 0x50ec7c
push ecx
push esi
call fcn.00415290
add esp, 0x10
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push eax
push 0x501b1c
push 0
call fcn.004d8d90
mov ebx, eax
add esp, 0xc
mov eax, dword [ebp - 0x214]
lea esi, [esi + eax*2]
test ebx, ebx
jne 0x482183
push dword [ebp - 0x218]
call fcn.004c8d5f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x208]
add esp, 4
mov dword [ebp - 0x208], 0
xor esi, esi
mov dword [edi], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call ebx
test eax, eax
je 0x482281
nop dword [eax]
cmp eax, 0xea
jne 0x4822ac
push dword [edi]
call fcn.004c3683
mov eax, dword [ebp - 0x208]
add esp, 4
cmp eax, esi
jbe 0x482247
lea esi, [eax + 0x1000]
jmp 0x48224d
add esi, 0x1000
push esi
call fcn.004c3a3e
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x4822ac
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], esi
push ecx
push eax
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call ebx
test eax, eax
jne 0x482220
mov eax, dword [edi]
cmp dword [eax], 0x450050
jne 0x4822ac
cmp dword [eax + 4], 0x460052
jne 0x4822ac
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret 8
push dword [edi]
call fcn.004c3683
add esp, 4
mov dword [edi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret 8