joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033f0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x618
push ebx
push ebp
push esi
mov esi, dword [esp + 0x62c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov edi, eax
cmp edi, 0xffffffff
je 0x40349d
push 0
lea eax, [esp + 0x42c]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
call fcn.0041274a
lea edx, [esp + 0x24]
lea eax, [esp + 0x234]
push edx
push eax
call fcn.0041223d
lea ecx, [esp + 0x444]
lea edx, [esp + 0x23c]
push ecx
push edx
call fcn.00412213
add esp, 0x24
lea eax, [esp + 0x18]
lea ecx, [esp + 0x220]
push eax
push 0
push 0x43d160
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [esp + 0x18]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x403491
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x618
ret
lea eax, [esp + 0x18]
push eax
push esi
push 5
push 1
call ebp
mov ebx, dword [esp + 0x62c]
push 1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4034e2
cmp edi, 0xffffffff
je 0x4034d5
push 1
lea ecx, [esp + 0x1c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4034d5
lea edx, [esp + 0x18]
push esi
push edx
push 5
push 1
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x618
ret
push esi
push ebx
push 5
push 1
call ebp
cmp edi, 0xffffffff
je 0x4034fc
lea eax, [esp + 0x18]
push eax
call fcn.004033a0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x618
ret

Function at 0x403510
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
push 0
push 0x8000000
push 3
push 0
push 0
push SysReAllocStringLen
push esi
call ebx
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x4035a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x40357b
mov eax, dword [esp + 0x14]
test eax, eax
je 0x403560
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403596
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 4
jl 0x403524
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
pop edi
neg eax
sbb eax, eax
pop esi
and eax, 0x16ffe
pop ebp
add eax, 0x30001002
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
cmp ebp, 4
jl 0x4035af
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x403600
Capabilities:
Get file attributes
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
push esi
push edi
push eax
call fcn.00403510
add esp, 0xc
test eax, eax
jne 0x403724
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x40364c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x50008000
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x403675
jl 0x403660
cmp dword [esp + 0xc], 0x800
ja 0x403675
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x50011000
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test bl, 6
jne 0x403716
mov edx, dword [esp + 0x24]
mov ecx, 0xe
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx + 0x10], 0x38
mov ecx, dword [str.MV_VE_FORMAT1.00]
mov eax, edx
mov dword [eax], ecx
mov ecx, dword [0x4319d8]
mov dword [eax + 4], ecx
mov ecx, dword [0x4319dc]
mov dword [eax + 8], ecx
mov ecx, dword [0x4319e0]
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [edx + 0x20], eax
lea eax, [edx + 0x30]
mov dword [edx + 0x24], ecx
mov dword [edx + 0x1c], ebx
mov ecx, dword [esi]
push eax
add edx, 0x28
push 0
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x40370d
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x50038001
pop ebx
add esp, 8
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x50021001
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x403730
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 0
push eax
mov ecx, dword [esi + 0x10]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403769
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x70
pop esi
neg eax
sbb eax, eax
and eax, 0xe002
add eax, 0x6000a000
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
sub eax, ecx
pop esi
neg eax
sbb eax, eax
and eax, 0x60028002
ret

Function at 0x403780
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 0
push eax
push 0x38
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4037a5
mov eax, 0x70008001
pop esi
ret
cmp dword [esp + 0xc], 0x38
je 0x4037b3
mov eax, 0x70011001
pop esi
ret
push edi
mov ecx, 4
mov edi, str.MV_VE_FORMAT1.00
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
mov eax, edx
pop edi
sete al
dec eax
pop esi
and eax, 0x70021001
ret
Function at 0x405340
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x42f5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x43dac8]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], eax
xor ebx, ebx
push 0xef16
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x6c8], 1
call fcn.00425d4e
mov edi, dword [eax]
push 0xef37
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.00425d4e
mov eax, dword [eax]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x21
push edi
push eax
push ecx
call ebp
cmp eax, 1
lea ecx, [esp + 0x18]
setne byte [esp + 0x13]
call fcn.00425d24
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.00425d24
cmp byte [esp + 0x13], bl
je 0x4053df
mov dword [esi + 0x6c8], ebx
jmp 0x405535
push 0x14
call fcn.004124ad
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x40545b
push 0xef2d
lea ecx, [esp + 0x38]
call fcn.00425d4e
mov edx, dword [eax]
push 0x10001
push edx
lea eax, [esp + 0x1c]
push str._s___08X_
push eax
mov byte [esp + 0x3c], 2
call fcn.0042127e
add esp, 0x10
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], bl
call fcn.00425d24
push 0xef16
lea ecx, [esp + 0x38]
call fcn.00425d4e
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x1c]
push 0x10
push eax
push ecx
push edx
call ebp
lea ecx, [esp + 0x34]
call fcn.00425d24
mov dword [esi + 0x6c8], ebx
jmp 0x405535
mov ecx, edi
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi + 0x1c]
mov dword [edi], edx
mov eax, dword [esi + 0x6c4]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esi + 0x6bc]
lea edx, [edi + 0xc]
push edx
push eax
mov dword [edi + 8], ecx
call fcn.00401b20
mov ecx, dword [esi + 0x6c4]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edx, [esp + 0x20]
push edx
push ebx
push edi
push 0x4020c0
push ebx
push ebx
call fcn.004125e7
add esp, 0x18
cmp eax, ebx
jne 0x40552e
push edi
call fcn.004123c4
add esp, 4
lea ecx, [esp + 0x34]
push 0xef2d
call fcn.00425d4e
mov eax, dword [eax]
push 0x10002
push eax
lea ecx, [esp + 0x1c]
push str._s___08X_
push ecx
mov byte [esp + 0x3c], 3
call fcn.0042127e
add esp, 0x10
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], bl
call fcn.00425d24
push 0xef16
lea ecx, [esp + 0x20]
call fcn.00425d4e
mov eax, dword [eax]
mov edx, dword [esp + 0x14]
push 0x10
push eax
mov eax, dword [esi + 0x1c]
push edx
push eax
call ebp
lea ecx, [esp + 0x1c]
call fcn.00425d24
mov dword [esi + 0x6c8], ebx
jmp 0x405535
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00425d24
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x405fb0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder

Disassembly:
mov ecx, dword [ecx + 0x1c]
sub esp, 0x20c
lea eax, [esp + 4]
push 1
push 7
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov edx, 0x104
lea ecx, [esp + 4]
cmp word [ecx], 0
je 0x405fe2
add ecx, 2
dec edx
jne 0x405fd4
jmp 0x40602b
test edx, edx
je 0x40602b
lea ecx, [esp]
test ecx, ecx
je 0x405ff5
mov eax, 0x104
sub eax, edx
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax*2 + 4]
je 0x40602b
push esi
mov esi, str.VirtualExpander.lnk
sub esi, eax
mov cx, word [esi + eax]
test cx, cx
je 0x40601e
mov word [eax], cx
add eax, 2
dec edx
jne 0x40600a
jmp 0x406022
test edx, edx
jne 0x406025
sub eax, 2
mov word [eax], 0
pop esi
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add esp, 0x20c
ret

Function at 0x406050
Capabilities:
Get common file path
Get startup folder

Disassembly:
sub esp, 0x20c
lea eax, [esp + 4]
push edi
mov edi, ecx
push 1
push 7
mov ecx, dword [edi + 0x1c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov edx, 0x104
lea ecx, [esp + 8]
cmp word [ecx], 0
je 0x406085
add ecx, 2
dec edx
jne 0x406077
jmp 0x4060ce
test edx, edx
je 0x4060ce
lea ecx, [esp + 4]
test ecx, ecx
je 0x406098
mov eax, 0x104
sub eax, edx
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax*2 + 8]
je 0x4060ce
push esi
mov esi, str.VirtualExpander.lnk
sub esi, eax
mov cx, word [esi + eax]
test cx, cx
je 0x4060c1
mov word [eax], cx
add eax, 2
dec edx
jne 0x4060ad
jmp 0x4060c5
test edx, edx
jne 0x4060c8
sub eax, 2
mov word [eax], 0
pop esi
push 0x4319e8
lea edx, [esp + 0xc]
push 0x4416f8
push edx
mov ecx, edi
call fcn.00406190
pop edi
add esp, 0x20c
ret

Function at 0x4060f0
Capabilities:
Delete file
Get common file path
Get startup folder
Set file attributes

Disassembly:
mov ecx, dword [ecx + 0x1c]
sub esp, 0x20c
lea eax, [esp + 4]
push 1
push 7
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov edx, 0x104
lea ecx, [esp + 4]
cmp word [ecx], 0
je 0x406122
add ecx, 2
dec edx
jne 0x406114
jmp 0x40616b
test edx, edx
je 0x40616b
lea ecx, [esp]
test ecx, ecx
je 0x406135
mov eax, 0x104
sub eax, edx
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax*2 + 4]
je 0x40616b
push esi
mov esi, str.VirtualExpander.lnk
sub esi, eax
mov cx, word [esi + eax]
test cx, cx
je 0x40615e
mov word [eax], cx
add eax, 2
dec edx
jne 0x40614a
jmp 0x406162
test edx, edx
jne 0x406165
sub eax, 2
mov word [eax], 0
pop esi
lea edx, [esp + 4]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x20c
ret
Function at 0x406190
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push esi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x435868
push 1
push esi
push 0x435878
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x406224
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x435938
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x40621a
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
jl 0x406210
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jl 0x406210
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x406210
mov esi, 1
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
add esp, 8
ret 0xc
Function at 0x4076f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 8]
push edi
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x407735
mov ecx, dword [esp + 0xc]
push str.VirtualExpanderFile.1
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.CLSIDE4000AC4_5E5F_4956_807A_C5854405D64F
push SysReAllocStringLen
call esi
test eax, eax
jne 0x407770
mov ecx, dword [esp + 0xc]
push str.InProcServer32
push ecx
call edi
mov edx, dword [esp + 0xc]
push str.ProgID
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push str.CLSID
push SysReAllocStringLen
call esi
test eax, eax
jne 0x40779f
mov edx, dword [esp + 0xc]
push str.E4000AC4_5E5F_4956_807A_C5854405D64F
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4077d2
mov edx, dword [esp + 0xc]
push str.VirtualExpanderFile.1
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
push eax
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4077e0
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 8]
push edi
push eax
push 0xf003f
push 0
push str.VirtualExpanderFile.1Shellopen
push SysReAllocStringLen
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x407825
mov ecx, dword [esp + 0xc]
push str.command
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.VirtualExpanderFile.1Shell
push SysReAllocStringLen
call esi
test eax, eax
jne 0x407854
mov ecx, dword [esp + 0xc]
push str.open
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.VirtualExpanderFile.1ShellEx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x407883
mov ecx, dword [esp + 0xc]
push str.IconHandler
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.VirtualExpanderFile.1
push SysReAllocStringLen
call esi
test eax, eax
jne 0x4078d6
mov ecx, dword [esp + 0xc]
push str.CLSID
push ecx
call edi
mov edx, dword [esp + 0xc]
push str.DefaultIcon
push edx
call edi
mov eax, dword [esp + 0xc]
push str.Shell
push eax
call edi
mov ecx, dword [esp + 0xc]
push str.ShellEx
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push 0
push SysReAllocStringLen
call esi
test eax, eax
jne 0x40790e
mov ecx, dword [esp + 0xc]
push str.VirtualExpanderFile.1
push ecx
call edi
mov edx, dword [esp + 0xc]
push str..vem
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push str._shellexContextMenuHandlers
push SysReAllocStringLen
call esi
test eax, eax
jne 0x40793d
mov edx, dword [esp + 0xc]
push str.VirtualExpander
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x408500
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push edi
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x408546
cmp dword [esp + 0x10], 2
jne 0x408546
cmp dword [esp + 4], 5
jb 0x408546
mov eax, 1
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret

Function at 0x408550
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
xor ebp, ebp
push eax
push 0x28
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40860b
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [esp + 0x18]
push ecx
push ebp
push ebp
push 2
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
mov ebx, eax
call fcn.004124ad
mov esi, eax
add esp, 4
cmp esi, ebp
jne 0x4085b9
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push ebx
push esi
push 2
push edx
call edi
test eax, eax
jne 0x4085d4
mov eax, dword [esp + 0x10]
push eax
jmp 0x4085fc
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x220
push 0x20
push 2
push 0x43d734
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x408615
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004123c4
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, ebp
mov dword [esp + 0x1c], ebp
jbe 0x40864c
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ebx, [esi + 4]
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
push eax
push ecx
call ebp
test eax, eax
jne 0x408644
mov eax, dword [esi]
inc edi
add ebx, 8
cmp edi, eax
jb 0x40862a
jmp 0x40864c
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.004123c4
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x408680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x208
push ebx
push edi
mov edi, ecx
push 3
push 0x43d7b0
mov eax, dword [edi + 0x70]
push eax
call fcn.00412b0b
add esp, 0xc
test eax, eax
jne 0x4086a8
mov ebx, 0x63
jmp 0x4086e6
mov ecx, dword [edi + 0x70]
push 3
push 0x43d7a8
push ecx
call fcn.00412b0b
add esp, 0xc
test eax, eax
jne 0x4086c6
mov ebx, 0x64
jmp 0x4086e6
mov edx, dword [edi + 0x70]
push 3
push 0x43d7a0
push edx
call fcn.00412b0b
add esp, 0xc
test eax, eax
jne 0x40879b
mov ebx, 0x6f
push esi
mov esi, dword [edi + 0x70]
cmp word [esi + 6], 0x22
jne 0x408726
push esi
call fcn.004121f6
add esp, 4
cmp word [esi + eax*2 - 2], 0x22
jne 0x408726
add esi, 8
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0041223d
lea ecx, [esp + 0x14]
push ecx
call fcn.004121f6
add esp, 0xc
mov word [esp + eax*2 + 0xa], 0
jmp 0x408737
add esi, 6
lea edx, [esp + 0xc]
push esi
push edx
call fcn.0041223d
add esp, 8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop esi
je 0x40879b
test al, 0x10
jne 0x40879b
and ebx, 0xffff
mov eax, ebx
sub eax, 0x63
je 0x40878f
dec eax
je 0x408778
sub eax, 0xb
jne 0x40879b
lea ecx, [esp + 8]
push 1
push ecx
mov ecx, edi
call fcn.00408950
pop edi
pop ebx
add esp, 0x208
ret
lea edx, [esp + 8]
push 0
push edx
mov ecx, edi
call fcn.00408950
pop edi
pop ebx
add esp, 0x208
ret
lea eax, [esp + 8]
mov ecx, edi
push eax
call fcn.004087b0
pop edi
pop ebx
add esp, 0x208
ret
Function at 0x408950
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x42fbaa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x708
mov eax, dword [0x43dac8]
push ebx
push esi
mov dword [esp + 8], eax
xor ebx, ebx
lea ecx, [esp + 0xc]
push ebx
mov dword [esp + 0x71c], ebx
call fcn.004064a0
mov esi, dword [esp + 0x720]
mov byte [esp + 0x718], 1
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..vem
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4089e1
lea ecx, [esp + 0x504]
mov byte [esp + 0x718], 4
call fcn.00425d24
lea ecx, [esp + 0x4c8]
mov byte [esp + 0x718], 3
call fcn.00429a26
mov byte [esp + 0x718], 2
jmp 0x408a4d
lea ecx, [esp + 0x508]
push esi
push ecx
call fcn.0041223d
lea edx, [esp + 0x510]
push edx
call fcn.004121f6
add esp, 0xc
dec eax
js 0x408a1d
lea ecx, [esp + eax*2 + 0x508]
cmp word [ecx], 0x2e
je 0x408a19
dec eax
sub ecx, 2
cmp eax, ebx
jge 0x408a09
jmp 0x408a1d
cmp eax, ebx
jge 0x408a79
lea ecx, [esp + 0x504]
mov byte [esp + 0x718], 7
call fcn.00425d24
lea ecx, [esp + 0x4c8]
mov byte [esp + 0x718], 6
call fcn.00429a26
mov byte [esp + 0x718], 5
lea ecx, [esp + 0x48c]
call fcn.0042143e
lea ecx, [esp + 0xc]
mov byte [esp + 0x718], bl
call fcn.004252e6
mov dword [esp + 0x718], 0xffffffff
jmp 0x408b5d
mov word [esp + eax*2 + 0x508], bx
lea eax, [esp + 0x280]
push esi
push eax
call fcn.0041223d
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x488], ebx
call fcn.004256a5
or esi, 0xffffffff
cmp eax, esi
jne 0x408ae8
push esi
push 0x10
push 0xef2c
call fcn.00429435
lea ecx, [esp + 0x504]
mov byte [esp + 0x718], 0xa
call fcn.00425d24
lea ecx, [esp + 0x4c8]
mov byte [esp + 0x718], 9
call fcn.00429a26
mov byte [esp + 0x718], 8
jmp 0x408b3a
cmp eax, 1
jne 0x408b0a
cmp dword [esp + 0x724], ebx
je 0x408b0a
push 1
push ebx
lea ecx, [esp + 0x510]
push ebx
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x504]
mov byte [esp + 0x718], 0xd
call fcn.00425d24
lea ecx, [esp + 0x4c8]
mov byte [esp + 0x718], 0xc
call fcn.00429a26
mov byte [esp + 0x718], 0xb
lea ecx, [esp + 0x48c]
call fcn.0042143e
lea ecx, [esp + 0xc]
mov byte [esp + 0x718], bl
call fcn.004252e6
mov dword [esp + 0x718], esi
lea ecx, [esp + 8]
call fcn.00425d24
mov ecx, dword [esp + 0x710]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x714
ret 8
Function at 0x4208b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00412360
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42097b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42097b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42092e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x420939
or bh, 8
and edi, 0x8000000
je 0x420954
mov eax, dword [0x595b9c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42097b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret