joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408320
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, 0x400
mov byte [ebp - 0xc], 1
push ebx
push 4
push dword [0x453afc]
mov esi, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
push dword ds:[ebp - 0xc]
lea eax, [ebp - 0x18]
push 0
push 0
push 1
push ebx
push edi
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov esi, eax
cmp esi, 0x103
jne 0x408385
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov esi, eax
test esi, esi
cmovns esi, dword [ebp - 0x18]
cmp esi, 0x80000005
je 0x408395
cmp esi, 0xc0000004
jne 0x4083bc
push edi
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
push ebx
push 4
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, dword [ebp - 4]
jmp 0x408346
mov dword ds:[ebp - 0x10], ebx
cmp esi, 0x80000006
je 0x408415
test esi, esi
js 0x408417
push dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ebx, edi
push edi
call fcn.00409940
mov edi, edi
test al, al
je 0x408417
mov eax, dword [ebx]
test eax, eax
je 0x408406
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
add ecx, eax
mov dword [ebp - 8], ecx
lea ebx, [ecx + edi]
push ebx
call fcn.00409940
mov edi, edi
test al, al
jne 0x4083e4
jmp 0x408417
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
mov byte [ebp - 0xc], 0
jmp 0x408348
xor esi, esi
push edi
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4093e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
push ebx
mov ebx, 0x10
push esi
push edi
test edx, edx
je 0x40941f
movzx eax, word [edx]
mov word [ebp - 0x10], ax
add eax, 2
cmp dword [edx], 0xfffe
mov word [ebp - 0xe], ax
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
jbe 0x40942b
mov eax, 0xc0000106
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
push 0x100
push 4
push dword [0x453afc]
mov dword [ebp - 4], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push edi
push 2
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test esi, esi
jns 0x409494
push edi
push 0
cmp esi, 0x80000005
jne 0x4094a4
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 4]
push 4
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
sub ebx, 1
jne 0x409448
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lfence
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409940
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x409ab0
lea eax, [esi + 0x40]
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x40]
mov eax, dword [esi + 0x3c]
lea ecx, [ebp - 0x38]
push 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0x4349bc
call fcn.0040a140
test al, al
jne 0x409ab0
push 1
lea edx, [ebp - 0x40]
mov dword [ebp - 0x40], 4
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x4349c0
call fcn.0040a140
test al, al
jne 0x409ab0
lea eax, [ebp - 0x38]
mov edx, 0x452b28
push eax
mov ecx, edi
call fcn.0040a8d0
mov edi, eax
mov eax, dword [esi + 0x38]
test al, 0x10
je 0x409a1a
test edi, edi
je 0x4099dc
mov edx, dword [edi + 4]
jmp 0x4099de
xor edx, edx
push 0x21
push 1
push 5
push 0x10
push 0x130089
lea ecx, [ebp - 0x34]
call fcn.004094c0
test eax, eax
js 0x409a9d
mov esi, dword [ebp - 0x34]
push edi
push ecx
mov ecx, esi
call fcn.00408320
mov ecx, esi
call fcn.00408160
push esi
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x409a9d
test al, 1
je 0x409a8d
mov edi, edi
test edi, edi
je 0x409a29
mov edx, dword [edi + 4]
jmp 0x409a2b
xor edx, edx
push 0x60
push 1
push 2
push 0x80
push 0x120189
lea ecx, [ebp - 0x34]
call fcn.004094c0
test eax, eax
js 0x409a8d
and dword [esi + 0x38], 0xfffffffe
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x38]
mov esi, dword [ebp - 0x34]
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push 0x28
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
je 0x409a96
mov ecx, dword [edi + 4]
jmp 0x409a98
xor ecx, ecx
call fcn.00409620
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x409ab0
call fcn.00409ce0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00413aae
mov esp, ebp
pop ebp
ret 8
Function at 0x409ae0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x409af7
mov eax, dword [esi + 4]
jmp 0x409af9
xor eax, eax
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, eax
test edi, edi
js 0x409bcd
push 0
push 0
push 0x21
push 1
push 5
push 0x10
lea eax, [esp + 0x30]
mov dword [esp + 0x48], 0x18
mov dword [esp + 0x50], eax
lea eax, [esp + 0x38]
push 0
push eax
lea eax, [esp + 0x50]
mov dword [esp + 0x54], 0
push eax
push 0x130089
lea eax, [esp + 0x38]
mov dword [esp + 0x64], 0x40
push eax
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov edi, eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test edi, edi
js 0x409bcd
mov ebx, dword [esp + 0x10]
push esi
push ecx
mov ecx, ebx
call fcn.00408320
cmp dword [0x452a50], 0x6a
mov edi, eax
jb 0x409ba6
push 0x40
mov dword [esp + 0x18], 0x11
lea eax, [esp + 0x18]
push 4
jmp 0x409bb3
push 0xd
mov byte [esp + 0x13], 1
lea eax, [esp + 0x13]
push 1
push eax
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push ebx
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x409bd6
mov ecx, dword [esi + 4]
jmp 0x409bd8
xor ecx, ecx
call fcn.00409560
xor ecx, ecx
test al, al
cmove edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409d80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x453c5c]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x409d9b
pop edi
xor eax, eax
pop esi
ret
mov eax, dword ds:[esi]
cmp eax, 0x40
jae 0x409db0
mov dword [esi + eax*4 + 4], edi
mov eax, edi
inc dword [esi]
pop edi
pop esi
ret
cmp dword [esi + 0x10c], 0
jne 0x409ddc
push 0x100
push 4
push dword [0x453afc]
mov dword [esi + 0x108], 0x40
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 0x10c], eax
mov ecx, dword [esi + 0x104]
mov eax, dword [esi + 0x108]
cmp ecx, eax
jne 0x409e18
add eax, eax
mov dword [esi + 0x108], eax
shl eax, 2
push eax
push dword [esi + 0x10c]
push 4
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [esi + 0x104]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0x10c]
mov dword [eax + ecx*4], edi
mov eax, edi
inc dword [esi + 0x104]
pop edi
pop esi
ret

Function at 0x40b820
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [0x453da0]
test ecx, ecx
je 0x40b841
mov eax, dword [0x453d9c]
mov dword ds:[esi], eax
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x7ffe0030
call fcn.0040a0a0
add eax, eax
cmp word [eax + 0x7ffe002e], 0x5c
jne 0x40b85a
add eax, 0xfffffffe
mov dword [esi], eax
xor ecx, ecx
mov dword [0x453d9c], eax
lea eax, [ebp - 4]
mov dword [esi + 4], 0x7ffe0030
lock or dword [eax], ecx
mov dword [0x453da0], 0x7ffe0030
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c600
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x452ba0], 1
push ebx
push esi
push edi
jne 0x40c7a8
mov eax, 0x452ba0
lock bts dword [eax], 0x1f
jae 0x40c64b
test byte [0x452ba0], 1
jne 0x40c7a8
mov ecx, eax
call fcn.00410f80
jmp 0x40c7a8
push 2
push 0x452ba8
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitializeSid]
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
push 1
mov dword [eax], 0x20
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov dword [eax], 0x220
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
push 0x452a60
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
push 0x452a54
add esi, eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
add eax, 0x40
add esi, eax
push esi
push 4
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
push 1
push ebx
lea edi, [ebx + 0x14]
call dword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
push 2
lea ecx, [esi - 0x14]
push ecx
push edi
call dword [sym.imp.ntdll.dll_RtlCreateAcl]
push 0x452a54
push 0xf000f
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea eax, [ebp - 0x14]
push eax
push 0xf000f
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0x452a60
push 7
push 2
push edi
call dword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
push 0
push edi
push 1
push ebx
call dword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x18
push eax
push 0x2000000
push 0x453d94
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x80
mov dword [ebp - 0x24], 0x452bb0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0
call dword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
push ebx
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, 0x452ba0
lock bts dword [edi], 0
jb 0x40c7a8
mov esi, dword [0x452ba4]
test esi, esi
je 0x40c77e
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x40c7a8
test esi, esi
je 0x40c7a8
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x452ba4], 0
mov ecx, dword [ebp - 4]
mov eax, dword [0x453d94]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00413aae
mov esp, ebp
pop ebp
ret
Function at 0x40c7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x453ac8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xa
push eax
push edi
mov dword [ebp - 0xc], 0x66
mov dword [ebp - 8], 0
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x40c86d
lea eax, ds:[ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lfence
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x40c86d
push ebx
mov ebx, dword [ebp - 0x18]
test esi, esi
je 0x40c834
mov dword [esi], ebx
mov edi, dword [ebp - 0x1c]
push ebx
push 4
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push ebx
mov esi, eax
push edi
push esi
call fcn.00415e30
mov eax, dword [ebp - 0x20]
add esp, 0xc
pop ebx
mov dword [eax], esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413aae
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00413aae
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40c8a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
push ebx
push esi
mov esi, dword [0x453ac8]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
add ecx, 0xc
cmp eax, ecx
je 0x40c8ef
lea esp, [esp]
test esi, esi
je 0x40c913
cmp dword [eax + 0x18], esi
je 0x40c913
mov eax, dword [eax]
cmp eax, ecx
jne 0x40c8e0
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test esi, esi
jne 0x40c96a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40c8ef
movzx ecx, word ds:[eax + 0x24]
test cx, cx
jne 0x40c92e
call fcn.0040a520
mov esi, eax
jmp 0x40c8f1
mov edx, dword [0x453ac4]
mov edi, ecx
mov ebx, dword [eax + 0x28]
lea ecx, [edi + 0xa]
call fcn.00409c00
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi], edi
mov dword [esi + 4], eax
mov word [eax + edi], cx
test ebx, ebx
je 0x40c8f1
push edi
push ebx
push dword [esi + 4]
call fcn.00415e30
add esp, 0xc
jmp 0x40c8f1
mov ecx, esi
call fcn.00408d60
lea ecx, [esi - 8]
mov edi, eax
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40c988
call fcn.00409ce0
mov ecx, dword [edi + 4]
xor edx, edx
call fcn.0040b460
test eax, eax
je 0x40c9ae
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x40c9ae
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x40c9ae
call fcn.00409ce0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c9c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040a0a0
add eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
xor ebx, ebx
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
cmp esi, edi
je 0x40ca2e
movzx eax, word [esi + 0x2c]
lea edx, [ebp - 8]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 0x30]
push 1
mov dword [ebp - 0xc], eax
call fcn.0040a140
mov edi, edi
test al, al
jne 0x40ca2c
mov esi, dword [esi]
cmp esi, edi
jne 0x40ca04
jmp 0x40ca2e
mov ebx, esi
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test ebx, ebx
je 0x40ca54
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ca60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, 0x5a4d
push esi
mov esi, edx
cmp word [ecx], ax
jne 0x40cab6
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x40cab6
jmp 0x40ca80
cmp eax, 0x7fffffff
jae 0x40cab6
cmp dword [eax + ecx], 0x4550
jne 0x40cab6
lea edx, [ecx + 0x78]
add edx, eax
mov eax, dword [edx]
test eax, eax
je 0x40cab6
cmp dword ds:[edx + 4], 0
je 0x40cab6
push dword [ebp + 8]
add eax, ecx
push esi
push eax
push edx
call fcn.0040cac0
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40cce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov ecx, str.comdlg32.dll
push esi
push edi
call fcn.0040c9c0
mov ecx, eax
test ecx, ecx
jne 0x40cd17
push str.comdlg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
test ecx, ecx
jne 0x40cd17
lea eax, [ecx + 0x7e]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40cdd2
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x40cdd2
cmp eax, 0x7fffffff
jae 0x40cdd2
cmp dword [eax + ecx], 0x4550
jne 0x40cdd2
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x40cdd2
cmp dword [edx + 4], 0
je 0x40cdd2
push 0
push str.DllGetClassObject
add eax, ecx
push eax
push edx
call fcn.0040cac0
mov esi, eax
test esi, esi
je 0x40cdd2
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0x42b58c
push 0x42b57c
call dword [0x42b26c]
call esi
mov edi, eax
test edi, edi
js 0x40cdd7
mov eax, dword [esp + 0xc]
push dword [ebp + 0xc]
push 0x42b55c
mov esi, dword [eax]
push 0
push eax
mov esi, dword [esi + 0xc]
mov ecx, esi
call dword [0x42b26c]
call esi
mov edi, eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x42b26c]
call esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edi, 0x7f
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x410060
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
xor eax, eax
mov dword [ebp - 8], 0
push esi
mov esi, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x1b], al
test esi, esi
je 0x41008d
mov dword [ebp - 8], esi
jmp 0x41011f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
cmp byte [0x453c24], al
jne 0x4100d8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x18
push eax
push 0x1000
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x41011f
cmp byte [0x453c24], 0
je 0x41011f
lea eax, [ebp - 8]
mov dword [ebp - 0x34], 0x1000
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], eax
call fcn.00410d60
push 0
push 0
push 0x10
lea eax, [ebp - 0x38]
push eax
push 0x999920cb
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push dword [0x453c1c]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov eax, dword [ebp - 8]
test eax, eax
je 0x410142
cmp dword [0x452a50], 0x3e
jb 0x410142
cmp dword [sym.imp.USER32.dll_IsImmersiveProcess], 0
je 0x410142
push eax
call dword [sym.imp.USER32.dll_IsImmersiveProcess]
mov byte [ebp - 0x1c], al
lea eax, [ebp - 0x28]
push eax
push 0x40ff80
call dword [sym.imp.USER32.dll_EnumWindows]
test esi, esi
jne 0x410166
mov eax, dword [ebp - 8]
test eax, eax
je 0x410166
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 0x24]
test ecx, ecx
mov eax, dword [ebp - 0x28]
cmovne eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x411080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
test byte [0x452c24], 1
push ebx
push esi
push edi
jne 0x4111fa
mov edi, 0x452c24
lock bts dword [edi], 0x1f
jae 0x4110bc
test byte [0x452c24], 1
jne 0x4111fa
mov ecx, edi
call fcn.00410f80
jmp 0x4111fa
mov ecx, 0x4347f4
call fcn.0040c9c0
mov ecx, eax
test ecx, ecx
jne 0x4110e8
push 0x4347f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
test ecx, ecx
je 0x4111b0
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4111b0
mov eax, dword ds:[ecx + 0x3c]
test eax, eax
je 0x4111b0
cmp eax, 0x7fffffff
jae 0x4111b0
cmp dword ds:[eax + ecx], 0x4550
jne 0x4111b0
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x4111b0
cmp dword [edx + 4], 0
je 0x4111b0
push 0
push str.NtQueryDefaultLocale
add eax, ecx
push eax
push edx
call fcn.0040cac0
mov ebx, eax
test ebx, ebx
je 0x4111b0
mov eax, dword ds:[0x7ffe0324]
mov edi, dword [0x7ffe0320]
cmp eax, dword [0x7ffe0328]
je 0x411184
mov ecx, 0x7ffe0324
mov edx, 0x7ffe0320
mov esi, 0x7ffe0328
pause
mov eax, dword [ecx]
mov edi, dword [edx]
cmp eax, dword [esi]
jne 0x411177
mov ecx, dword [0x7ffe0004]
mul ecx
mov esi, eax
mov eax, edi
shld edx, esi, 8
mul ecx
shl esi, 8
mov edi, 0x452c24
shrd eax, edx, 0x18
add eax, esi
mov dword [0x453e14], eax
xor eax, ebx
mov dword [0x453dd8], eax
lock bts dword [edi], 0
jb 0x4111fa
mov esi, dword [0x452c28]
lea ecx, [ecx]
test esi, esi
je 0x4111cd
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4111fa
test esi, esi
je 0x4111fa
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x452c28], 0
mov eax, dword [0x453dd8]
nop
test eax, eax
je 0x411217
mov ecx, dword [0x453e14]
test ecx, ecx
je 0x411217
xor eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424bb3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424830
Function at 0x407c90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x828
mov eax, dword [ebp + 8]
mov ecx, dword [0x431014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea esi, [ebp - 0x21a]
push esi
push eax
call fcn.004013f0
add esp, 8
test eax, eax
je 0x407e44
lea edi, [ebp - 0x81c]
push edi
push 0x20119
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407dbe
mov esi, eax
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x408247
push esi
push str.Could_not_open_key.____ld_
push 0x4327cc
call fcn.00408750
add esp, 0xc
push edi
push 0x20119
push 0
push str.SOFTWAREMozillaMaintenanceService3932ecacee736d366d6436db0f55bce4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407d71
mov esi, eax
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40828a
push esi
push str.Could_not_open_fallback_key.____ld_
push 0x4327cc
call fcn.00408750
add esp, 0xc
jmp 0x407e44
cmp dword [ebp + 0x10], 0
je 0x407dbe
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x408310
push str.Fallback_key_present__skipping_VerifyCertificateTrustForFile_check_and_the_certificate_attribute_registry_matching_check.
push 0x4327cc
call fcn.00408750
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x820]
mov dword [ecx], eax
mov edx, dword [ebp - 0x81c]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x407e5d
mov esi, eax
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4082cd
push esi
push str.Could_not_query_info_key.____ld_
cmp dword [ebp - 0x820], 0
je 0x407e38
lea edi, [ebp - 0x824]
lea esi, [ebp - 0x418]
xor ebx, ebx
push 0x4329d8
call fcn.0040a5e7
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x407d07
mov dword [0x4327cc], 0
push 0x402500
call fcn.0040a7ac
add esp, 4
push 0x4329d8
call fcn.0040a639
add esp, 4
jmp 0x407d07
push 0x4329d8
call fcn.0040a5e7
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x407d59
mov dword [0x4327cc], 0
push 0x402500
call fcn.0040a7ac
add esp, 4
push 0x4329d8
call fcn.0040a639
add esp, 4
jmp 0x407d59
push 0x4329d8
call fcn.0040a5e7
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x407e25
mov dword [0x4327cc], 0
push 0x402500
call fcn.0040a7ac
add esp, 4
push 0x4329d8
call fcn.0040a639
add esp, 4
jmp 0x407e25
push 0x4329d8
call fcn.0040a5e7
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x407d98
mov dword [0x4327cc], 0
push 0x402500
call fcn.0040a7ac
add esp, 4
push 0x4329d8
call fcn.0040a639
add esp, 4
jmp 0x407d98