joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f880
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb29b
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
lea esi, [ebx + 4]
mov dword [ebx], vtable.StringStorage.0
mov dword [ebp - 0x20], ebx
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x524da8
push ecx
call fcn.0049dfe0
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x41fa4b
push ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.0041fac0
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x2c]
push esi
push edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41fa4b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x52a65c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41fa4b
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], 0x52a660
movzx edx, word [eax + 0x16]
movzx edi, word [eax + 0x12]
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x14]
cmp edx, 0x64
jbe 0x41f9a4
inc ecx
mov dword [ebp + 8], 0x52a664
add edx, 0xff9c
cmp cx, 0x64
jb 0x41f9a4
xor ecx, ecx
inc edi
test dx, dx
jne 0x41f9c6
test ax, ax
jne 0x41f9ea
movzx eax, cx
push eax
movzx eax, di
push eax
push str._d._d
push ebx
call fcn.004038c0
add esp, 0x10
jmp 0x41fa08
test ax, ax
jne 0x41f9ea
movzx eax, dx
push eax
push dword [ebp + 8]
movzx eax, cx
push eax
movzx eax, di
push eax
push str._d._d_s_d
push ebx
call fcn.004038c0
add esp, 0x18
jmp 0x41fa08
push eax
movzx eax, dx
push eax
push dword [ebp + 8]
movzx eax, cx
push eax
movzx eax, di
push eax
push str._d._d_s_d._d
push ebx
call fcn.004038c0
add esp, 0x1c
test esi, esi
je 0x41fa35
mov ecx, dword [ebp - 0x24]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x41fa2b
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa61
push ecx
push esi
call fcn.0049ade4
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x54]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x54]
push eax
call fcn.0049c518
call fcn.004a1eab
int3
Function at 0x420430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb408
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42047a
push eax
call edi
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x42048b
push eax
call edi
mov dword [esi + 0x28], 0
push dword [esi + 0x18]
push dword [esi + 8]
push 0x52a6b4
push dword [esi + 0x40]
call fcn.00405ec0
add esp, 0x10
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.0041d590
push dword [ebp - 0x50]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
push dword [ebp - 0x7c]
push str.sti:_cb___d__hStdError___p__hStdInput___p__hStdOutput___p__dwFlags___u
push dword [esi + 0x40]
call fcn.00405f20
add esp, 0x1c
mov dword [ebp - 4], 0
mov edx, dword [esi + 0x40]
mov cl, byte [esi + 0x44]
call fcn.0041f3f0
mov ebx, eax
mov ecx, esi
lea eax, [ebp - 0x24]
push eax
call fcn.0041d7a0
mov byte [ebp - 4], 1
movzx eax, byte [esi + 0x3c]
push eax
push dword [ebp - 0x20]
push ebx
push str.Try_CreateProcessAsUser__p__0___s__0__0___d__NORMAL_PRIORITY_CLASS__0__0__sti__pi_
push dword [esi + 0x40]
call fcn.00405f20
add esp, 0x14
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
movzx eax, byte [esi + 0x3c]
push 0
push 0
push 0x20
push eax
push 0
push 0
push dword [ebp - 0x20]
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x420596
push dword [ebp - 0x20]
push str.Created___s__process
push dword [esi + 0x40]
call fcn.00405ec0
add esp, 0xc
push ebx
call edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.StringStorage.0
call fcn.004039c0
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xa4]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0xa4]
push eax
call fcn.0049c518
int3
Function at 0x4205c0
Capabilities:
Migrate process to active window station

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb438
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0xc]
push str.TvnWindowsApplicationClass
mov dword [edi], vtable.WindowsApplication.0
mov dword [edi + 4], eax
mov dword [edi + 8], 0
call fcn.00403030
push 0x10000000
push 1
mov dword [ebp - 4], 0
push 0x52a8bc
mov dword [edi], vtable.LocalWindowsApplication.0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov esi, eax
test esi, esi
je 0x42067f
push esi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
test eax, eax
jne 0x420645
call dword [sym.imp.USER32.dll_CloseWindowStation]
jmp 0x42067f
call dword [sym.imp.USER32.dll_CloseWindowStation]
push 0x400001cf
push 1
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x38]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x38]
push eax
call fcn.0049c518
int3

Function at 0x4208d0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb460
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
push 0
push ecx
mov dword [ebp - 4], 0
call fcn.00420c10
jmp 0x42091d
push 0xf01ff
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x4c9448
push dword [esi + 4]
call ebx
mov edi, eax
test edi, edi
je 0x4209d2
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
test eax, eax
je 0x4209e8
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
push 0x4c9448
push dword [esi + 4]
xor edi, edi
call ebx
test eax, eax
je 0x42099d
nop
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
inc edi
cmp eax, 0xa
jg 0x4209b1
push 0xf01ff
push 0x4c9448
push dword [esi + 4]
call ebx
test eax, eax
jne 0x420970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x42e
lea ecx, [ebp - 0x90]
call fcn.0041ced0
push 0x55221c
lea eax, [ebp - 0x90]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x40]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x40]
push eax
call fcn.0049c518
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x68]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x68]
push eax
call fcn.0049c518
int3
Function at 0x420a10
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb480
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x14
push 0x4c9448
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x420ad6
push edi
mov dword [ebp - 4], 0
call fcn.00420d60
cmp eax, 4
je 0x420b20
cmp eax, 2
je 0x420b20
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x420aec
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
push edi
call fcn.00420d60
cmp eax, 4
je 0x420aa9
dec esi
test esi, esi
jle 0x420b02
push 0x3e8
call ebx
jmp 0x420a90
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x3c]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x3c]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x64]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x64]
push eax
call fcn.0049c518
push 3
lea ecx, [ebp - 0x90]
call fcn.004207a0
push 0x552270
lea eax, [ebp - 0x90]
push eax
call fcn.0049c518
push 2
lea ecx, [ebp - 0xbc]
call fcn.004207a0
push 0x552270
lea eax, [ebp - 0xbc]
push eax
call fcn.0049c518
int3

Function at 0x420c10
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb4a0
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x554008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x24
push 0x4c9448
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x34], edi
test edi, edi
je 0x420cf0
push edi
mov dword [ebp - 4], 0
call fcn.00420d60
cmp eax, 1
je 0x420d40
cmp eax, 3
je 0x420d40
lea eax, [ebp - 0x30]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x420d06
cmp byte [ebp + 0xc], 0
je 0x420cb9
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
nop
push edi
call fcn.00420d60
cmp eax, 1
je 0x420cb9
dec esi
test esi, esi
jle 0x420d22
push 0x3e8
call ebx
jmp 0x420ca0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049a89b
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x5c]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x5c]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x84]
call fcn.0041ce10
push 0x55221c
lea eax, [ebp - 0x84]
push eax
call fcn.0049c518
push 1
lea ecx, [ebp - 0xb0]
call fcn.004207a0
push 0x552270
lea eax, [ebp - 0xb0]
push eax
call fcn.0049c518
push 0
lea ecx, [ebp - 0xdc]
call fcn.004207a0
push 0x552270
lea eax, [ebp - 0xdc]
push eax
call fcn.0049c518
int3
Function at 0x420d60
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [0x554008]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 4]
push ecx
push 0x24
lea ecx, [esp + 0x38]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x420da5
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x34]
xor ecx, esp
call fcn.0049a89b
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 8]
call fcn.0041ce10
push 0x55221c
lea eax, [esp + 0xc]
push eax
call fcn.0049c518
int3

Function at 0x421810
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x554008]
xor eax, esp
mov dword [esp + 0x1a8], eax
push esi
mov esi, ecx
lea eax, [esp + 0x18]
push eax
push 0x102
mov dword [esi], vtable.WsaStartup.0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42185e
mov ecx, dword [esp + 0x1ac]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0049a89b
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 4]
push 0x52aef8
push eax
call fcn.00403f20
add esp, 8
lea eax, [esp + 4]
push 0x5520f0
push eax
call fcn.0049c518
int3

Function at 0x421a10
Capabilities:
Simulate ctrl alt del

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8168
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 9
mov ecx, eax
call fcn.00403af0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
and eax, 0xfffffffe
push eax
push 0x52afbc
push ecx
call fcn.0049dfe0
add esp, 0xc
push 0x400001cf
push 1
push 0
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
call fcn.004039c0
test edi, edi
je 0x421ae5
push str.SAS_window
push str.SAS_window_class
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x2e0003
test eax, eax
mov ecx, 0xffff
push 0
cmove eax, ecx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb848
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x30]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x38], eax
mov eax, dword [edi + 0x48]
movups xmmword [ebp - 0x48], xmm0
test eax, eax
je 0x42254f
cmp esi, eax
cmova esi, eax
mov dword [ebp + 0xc], esi
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
mov dword [ebp - 0x18], vtable.AutoLock.0
mov dword [ebp - 0x14], ecx
call dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x422693
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
lea ecx, [edi + 8]
mov dword [ebp - 4], 1
mov edx, dword [ecx]
call dword [edx + 8]
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x422618
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x422629
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4225c1
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 8]
lea esi, [edi + 8]
mov ecx, esi
mov dword [ebp - 0x18], vtable.AutoLock.0
mov dword [ebp - 0x14], esi
call dword [eax + 4]
push 0
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
mov eax, dword [ebp + 0xc]
jne 0x422600
test eax, eax
jne 0x4226ae
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 4
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x422679
push str.Unknown_pipe_error
jmp 0x4226d0
lea ecx, [ebp - 0x30]
call fcn.00402fa0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 5
push dword [ebp + 0xc]
push dword [edi + 0x3c]
push dword [edi + 0x38]
push eax
lea eax, [ebp - 0x30]
push 0x52b0d8
push eax
call fcn.004038c0
add esp, 0x18
lea ecx, [ebp - 0x20]
call fcn.00402fa0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00403150
lea edx, [ebp - 0x20]
mov ecx, eax
call fcn.0041d940
lea ecx, [ebp - 0x20]
jmp 0x4226ca
add dword [edi + 0x38], eax
adc dword [edi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.Invalid_pipe_handle
lea ecx, [ebp - 0x34]
call fcn.00453da0
push 0x552290
lea eax, [ebp - 0x34]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x30]
call fcn.00402fa0
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 3
mov ecx, str.The_Pipes_write_function_failed_after_GetOverlappedResult_calling
call fcn.0041d940
lea ecx, [ebp - 0x30]
call fcn.00403150
push eax
lea ecx, [ebp - 0x5c]
call fcn.00453da0
push 0x552290
lea eax, [ebp - 0x5c]
push eax
call fcn.0049c518
int3
Function at 0x432700
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcdda
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x20
mov dword [ebx], vtable.DesktopConfigLocal.0
call fcn.0049adb4
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.InputBlocker.0
lea esi, [edi + 4]
lea eax, [esi + 8]
mov dword [esi], vtable.Thread.0
push eax
push 4
push esi
push 0x472140
push 0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x400001cf
push 1
push 0
mov dword [esi + 4], eax
mov dword [esi], vtable.GuiThread.0
mov dword [esi + 0x10], 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, 0x555504
mov byte [ebp - 4], 2
mov dword [edi], vtable.WindowsInputBlocker.0
mov dword [esi], vtable.WindowsInputBlocker.1.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], eax
mov eax, dword [vtable.LocalMutex.0]
mov dword [ebp - 0x18], vtable.AutoLock.0
mov dword [ebp - 0x14], 0x555504
call dword [eax + 4]
mov byte [ebp - 4], 3
cmp dword [0x558f68], 0
jne 0x43281c
mov dword [0x558f68], edi
mov byte [ebp - 4], 4
mov ecx, 0x555504
mov eax, dword [vtable.LocalMutex.0]
call dword [eax + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
mov eax, ebx
mov dword [ebx + 4], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
push str.The_only_one_instance_ofWindowsInputBlocker_is_allowed
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x2c]
push 0x5520f0
push eax
call fcn.0049c518
int3
Function at 0x444af0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, ecx
movzx eax, bl
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x36c]
test eax, eax
je 0x444b32
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push str.Attach.ToDesktop
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x444b32
mov byte [esi + 0x1a], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x14]
push str.Cant_set_the_Attach.ToDesktop.
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x14]
push 0x5520f0
push eax
call fcn.0049c518
int3

Function at 0x444d00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be9e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x1060]
test eax, eax
je 0x444d5e
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push str.The_mirror_driver_device_context_released
push dword [esi + 0x10dc]
mov dword [esi + 0x1060], 0
call fcn.00405ec0
add esp, 8
cmp byte [esi + 0x1a], 0
je 0x444e21
push str.Unloading_mirror_driver...
push dword [esi + 0x10dc]
call fcn.00405ec0
add esp, 8
mov ecx, esi
push 0
call fcn.00444af0
xor edi, edi
mov dword [esi + 0x430], 0
mov dword [esi + 0x434], 0
cmp dword [0x558e38], edi
jne 0x444dc1
push 0x558e38
mov dword [0x558e38], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
neg eax
sbb eax, eax
and dword [0x558e38], eax
cmp dword [0x558e3c], 5
jne 0x444dd2
cmp dword [0x558e40], edi
je 0x444dd8
lea edi, [esi + 0x384]
push edi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00444b60
push str.Mirror_driver_is_unloaded
push dword [esi + 0x10dc]
call fcn.00405ec0
add esp, 8
jmp 0x444e21
push 0xcdc
lea eax, [esi + 0x384]
push 0
push eax
call fcn.0049c300
mov eax, 0xdc
mov byte [esi + 0x19], 0
add esp, 0xc
mov word [esi + 0x3c8], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c190
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
sub eax, edx
je 0x44c1ca
sub eax, 1
je 0x44c1c3
sub eax, 1
jne 0x44c1cf
mov edx, 0xc0000000
jmp 0x44c1cf
mov edx, 0x40000000
jmp 0x44c1cf
mov edx, bind
mov eax, dword [ebp + 0x10]
xor bl, bl
cmp eax, 5
ja case.default.0x44c1d9
jmp dword [eax*4 + 0x44c288]
mov bl, 1
mov eax, 4
jmp 0x44c209
mov eax, 2
jmp 0x44c209
mov eax, 1
jmp 0x44c209
mov eax, 3
jmp 0x44c209
mov eax, 5
jmp 0x44c209
mov eax, dword [esp + 0xc]
push 0
push 0x80
push eax
movzx eax, byte [ebp + 0x14]
push 0
push eax
push edx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x44c254
test bl, bl
je 0x44c24c
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x44c24c
test eax, eax
jne 0x44c26c
and byte [esi + 0x5b], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x10]
call fcn.0041ce10
push 0x55221c
lea eax, [esp + 0x14]
push eax
call fcn.0049c518
push eax
lea ecx, [esp + 0x14]
call fcn.0041ced0
push 0x55221c
lea eax, [esp + 0x14]
push eax
call fcn.0049c518
nop dword [eax]
loopne 0x44c24b
inc esp
add cl, ch
rol dword [eax + eax - 0x10], 0xc1
inc esp
add bh, dh
rol dword [eax + eax - 0x1e], 0xc1
inc esp
add dh, bh
rol dword [eax + eax + 0x55], 0x8b
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push esi
mov esi, ecx
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [esp + 0x14], ecx
jg 0x44c2ce
jl 0x44c301
cmp dword [esp + 0x10], eax
jb 0x44c301
push 1
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esi + 4]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x44c2fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44c322
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x18]
push str.Specified_file_pointer_position_is_more_than_file_length
push eax
call fcn.00403f20
add esp, 8
lea eax, [esp + 0x18]
push 0x5520f0
push eax
call fcn.0049c518
push str.Cannot_set_file_pointer_to_specified_position
lea ecx, [esp + 0x1c]
call fcn.0041cf90
push 0x55221c
lea eax, [esp + 0x1c]
push eax
call fcn.0049c518
int3