joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410bc5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 0x401680
push SysReAllocStringLen
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x410c34
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push ebx
push 0x401b9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410c2a
cmp dword [ebp - 8], esi
jne 0x410c2a
cmp dword [ebp - 0xc], 1
sete bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410fed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 1
push ebx
push 0x4025a8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411079
push 4
pop esi
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
push eax
push ebx
push 0x4015c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411070
cmp dword [ebp - 8], esi
jne 0x411070
mov eax, dword [ebp - 0xc]
test eax, eax
sete bl
test eax, eax
jne 0x411070
cmp dword [0x443534], 0xffffffff
jne 0x411064
push ecx
mov edx, esi
call fcn.0041e530
mov edx, 0x402628
mov ecx, esi
call fcn.0041e988
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4153c4
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
mov esi, 0x401680
mov dword [ebp - 4], edi
cmp dword [0x443a4c], edi
jne 0x415443
push edi
push eax
push edi
push 2
push edi
push edi
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x415411
push edi
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
push edi
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], edi
je 0x41549b
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push edi
push 0x402ca8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41549b
push ebx
push eax
push 2
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 0x402ca8
test eax, eax
jne 0x415470
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 2
push edi
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41549a
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4156b2
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ebp - 0x14]
mov dword [ebp - 0x28], edx
stosd dword es:[edi], eax
mov esi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x415773
push ebx
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x415729
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x24]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebp + 0xc], 0
je 0x415729
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 0x28]
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x415773
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x14]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x20]
push 1
push 0
push 0
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push ebx
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 8
Function at 0x415786
Capabilities:
Check if file exists
Get file attributes
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
test edi, edi
je 0x415947
mov eax, dword [edi + 0xc]
mov ebx, 0x4015c0
test eax, eax
jne 0x4157b8
mov eax, ebx
push ecx
push eax
push ecx
mov edx, 0x200
lea ecx, [ebp - 0x408]
call fcn.0040c197
test eax, eax
js 0x4157e6
lea eax, [ebp - 0x408]
push eax
push 0
push 0xc
push 0x47c
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x4157ef
mov eax, ebx
push ecx
push eax
push ecx
mov edx, 0x200
lea ecx, [ebp - 0x408]
call fcn.0040c197
test eax, eax
js 0x41581d
lea eax, [ebp - 0x408]
push eax
push 0
push 0xc
push 0x46e
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0x46d
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x415947
mov eax, dword [0x444f20]
test eax, eax
je 0x41584a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [0x444f20], 0
cmp dword [edi + 0x34], 0
je 0x415853
mov ebx, dword [edi + 0x34]
push ecx
push ebx
push ecx
mov edx, 0x200
lea ecx, [ebp - 0x408]
call fcn.0040c197
xor ebx, ebx
inc ebx
test eax, eax
js 0x415920
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415920
test al, 0x10
jne 0x415920
cmp dword [0x443a60], 0
jne 0x4158d0
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x41c]
and dword [ebp - 0x414], 0
and dword [ebp - 0x410], 0
push 0
push eax
push 0x443a60
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
cmp dword [0x443a60], 0
je 0x415920
and dword [ebp - 0x40c], 0
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov edi, dword [ebp - 0x40c]
push 0xff000000
push 0x444f20
push edi
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
jne 0x415919
push dword [0x444f20]
push eax
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
cmp dword [0x444f20], 0
jne 0x415936
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
jmp 0x415940
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 8
Function at 0x418466
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [str.6ij]
push esi
push edi
cmp ecx, 0x4430b0
jne 0x4184bd
cmp dword [0x443ae8], 0xd2af9
je 0x4185b3
call fcn.004183ca
test eax, eax
je 0x4184ae
call fcn.00418413
jmp 0x4185b3
mov dword [0x443a84], 1
jmp 0x4185b3
xor esi, esi
inc esi
cmp ecx, str.K
jne 0x418509
cmp dword [0x443ae8], 0xd2af9
je 0x4184da
mov dword [0x443a84], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x401cd4
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x4185b3
and dword [0x443a84], 0
mov ecx, esi
call fcn.0041a4bf
jmp 0x4185b3
mov eax, dword [0x443ae8]
cmp eax, 0xd2af8
jne 0x418560
mov edi, 0x104
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x418555
push 0x40429c
mov edx, edi
lea ecx, [ebp - 0x210]
call fcn.0040c045
test eax, eax
js 0x418555
push 0xffff
push esi
lea edx, [ebp - 0x210]
xor ecx, ecx
call fcn.00421804
mov eax, dword [0x443ae8]
mov ecx, dword [str.6ij]
test eax, eax
js 0x41858b
cmp ecx, str.6ij
jne 0x41858b
cmp dword [0x443ab0], 0
jne 0x418581
call fcn.0040f1f9
call fcn.0040f120
jmp 0x418586
call fcn.0040f1f9
mov eax, dword [0x443ae8]
cmp eax, 0xd2af9
je 0x4185ae
cmp eax, 0xc00d2afb
je 0x4185ae
test eax, eax
js 0x4185b3
cmp dword [0x443a4c], 0
jne 0x4185b3
mov dword [0x443a84], esi
jmp 0x4185b3
call fcn.004197fe
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x419522
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00422882
test eax, eax
je 0x4196d9
mov edi, 0x105
lea eax, [ebp - 0x428]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4196d9
push 0x40429c
mov edx, edi
lea ecx, [ebp - 0x428]
call fcn.0040c045
test eax, eax
js 0x4196d9
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4196d9
test al, 0x10
jne 0x4196d9
lea eax, [ebp - 0x428]
push eax
push 0x4030e4
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0040c0b5
add esp, 0x10
test eax, eax
js 0x4196d9
test esi, esi
je 0x4196c5
lea eax, [ebp - 0x42c]
xor ebx, ebx
push eax
push 3
push ebx
mov esi, 0x401848
mov dword [ebp - 0x42c], ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41960b
lea eax, [ebp - 0x42c]
push eax
push 3
push ebx
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41967b
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x218]
push eax
call fcn.0042246a
mov edi, eax
test edi, edi
je 0x419666
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41962c
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x41966b
mov esi, 0x80004005
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41969d
jle 0x419686
movzx esi, si
or esi, 0x80070000
push esi
push 0x403118
push 0x405010
push 2
call fcn.0041ea5f
add esp, 0x10
jmp 0x4196d9
cmp dword [0x443534], 0xffffffff
jne 0x4196af
push ecx
push 4
pop edx
call fcn.0041e530
push 4
mov edx, 0x405054
pop ecx
call fcn.0041e988
or dword [0x443678], 1
jmp 0x4196d9
push 0xffff
push 1
lea edx, [ebp - 0x218]
xor ecx, ecx
call fcn.00421804
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x4196ea
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 3
push ebx
push 0x4017c0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov esi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4197f6
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push ebx
push 0x40180c
push dword [ebp - 4]
inc edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4197c4
cmp dword [ebp - 0xc], 0xd2af9
je 0x41975c
cmp dword [ebp - 0xc], 0xc00d2afb
jne 0x4197c4
lea ecx, [ebp - 0x18]
call fcn.0040d45a
test eax, eax
jne 0x4197b5
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
lea eax, [ebp - 0x20]
mov esi, 0x401828
push eax
push ebx
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4197b5
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jb 0x4197b3
ja 0x41979e
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jbe 0x4197b3
push 8
lea eax, [ebp - 0x18]
push eax
push 3
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4197b5
mov edi, ebx
call fcn.0041fb3a
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jne 0x4197ec
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push 0x40180c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x401828
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4197fe
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
push edi
push 0x20006
push 1
push edi
push edi
push 0x403120
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], edi
push esi
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41992c
lea eax, [ebp - 0x214]
push eax
push 3
push edi
push 0x403180
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419920
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x419914
push 0x40429c
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.0040c045
test eax, eax
js 0x419914
push ecx
lea eax, [ebp - 0x21c]
mov edx, esi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c131
test eax, eax
js 0x419914
mov eax, dword [ebp - 0x21c]
sub esi, eax
push ecx
push 0x4031dc
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x419914
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4198e2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x403208
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x419944
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
inc edi
xor esi, esi
push edi
push esi
push 0x4036c8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4199ec
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x200
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0x403728
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4199e0
cmp dword [ebp - 0x210], edi
jne 0x4199e0
lea eax, [ebp - 0x208]
push 0x403740
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4199e0
mov esi, edi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x4199fe
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x204]
mov esi, 0x80004005
push eax
push 0xc0
push dword [0x443af0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x419a79
push 8
lea eax, [ebp - 0x204]
push 0x403558
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x419a79
push 0xa
xor ecx, ecx
lea eax, [ebp - 0x204]
push ecx
push ecx
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb ecx, ecx
and ecx, 0x7fffbffb
add esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x419aff
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0xffffffffffffffff
mov eax, ecx
xor esi, esi
push 0x4037b8
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
call fcn.0043feb3
mov edi, eax
test edi, edi
js 0x419cbf
lea ecx, [ebp - 0x3c]
call fcn.0043fdcb
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], 0x7fff
call fcn.0043fdcb
push dword [ebp - 0xc]
lea ecx, [ebp - 0x24]
call fcn.0043fe70
mov edi, eax
test edi, edi
jns 0x419b66
lea ecx, [ebp - 0x24]
call fcn.00440156
lea ecx, [ebp - 0x3c]
call fcn.00440156
jmp 0x419cbf
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x24]
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x419b97
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x419b8a
push 0x57
pop edi
test edi, edi
jle 0x419b51
movzx edi, di
or edi, 0x80070000
jmp 0x419b51
push ebx
push 0x44
pop edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x419bc4
lea ecx, [ebp - 0x24]
mov edi, 0x8007000e
call fcn.00440156
lea ecx, [ebp - 0x3c]
call fcn.00440156
jmp 0x419cbe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x24]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x419c0b
cmp edi, 0x7a
je 0x419c0b
test edi, edi
jle 0x419ca7
movzx edi, di
or edi, 0x80070000
jmp 0x419ca7
lea ecx, [ebp - 0x30]
call fcn.0043fdcb
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x30]
inc eax
push eax
call fcn.0043fe70
mov edi, eax
test edi, edi
js 0x419c9f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x24]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x419c5e
test edi, edi
jle 0x419c9f
movzx edi, di
or edi, 0x80070000
jmp 0x419c9f
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x419c7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x419c51
push 0x57
pop edi
jmp 0x419c4f
push 0xffffffffffffffff
push dword [ebp - 4]
lea ecx, [ebp - 0x3c]
call fcn.0043feb3
mov edi, eax
test edi, edi
js 0x419c9f
push ecx
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
call fcn.0044007f
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.00440156
lea ecx, [ebp - 0x24]
call fcn.00440156
lea ecx, [ebp - 0x3c]
call fcn.00440156
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
cmp dword [ebp - 4], 0
je 0x419cce
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419f17
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push 1
push esi
push 0x403818
push SysReAllocStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419fa9
push edi
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push esi
push esi
push 0x403878
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419f73
cmp dword [ebp - 4], 1
jne 0x419f73
and dword [0x444f78], 0xfffffffe
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x4038b8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x419fa0
cmp dword [ebp - 4], 1
jne 0x419fa0
and dword [0x444f78], 0xfffffffd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a3f9
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.00434570
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41a4b0
push 0x40429c
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.0040c045
test eax, eax
js 0x41a4b0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a4b0
test al, 0x10
jne 0x41a4b0
call fcn.0042089d
push ecx
lea eax, [ebp - 0x214]
mov edx, esi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c131
test eax, eax
js 0x41a4b0
mov eax, dword [ebp - 0x214]
sub esi, eax
push ecx
push 0x403958
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x41a4b0
push 0xffff
push 1
lea edx, [ebp - 0x210]
xor ecx, ecx
call fcn.00421804
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x41c4d2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
test edi, edi
jne 0x41c4e9
xor eax, eax
jmp 0x41c528
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x10]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], ecx
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret