joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403500
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1270
call fcn.00415030
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.INFOEM.INF
lea ecx, [ebp - 0x110]
push ecx
call fcn.00414370
add esp, 8
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x403653
lea ecx, [ebp - 0x258]
push ecx
push 2
push 0
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x403594
jmp 0x403622
lea eax, [ebp - 0x1270]
push eax
push str.CatalogFile
push str.Version
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x403615
push 0
push 0x1000
lea edx, [ebp - 0x1260]
push edx
push 1
lea eax, [ebp - 0x1270]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x403615
push str.nvstusb.cat
lea ecx, [ebp - 0x1260]
push ecx
call fcn.004064e0
add esp, 8
test eax, eax
jne 0x403615
lea edx, [ebp - 0x1270]
push edx
push str.nvstusb.sys
push str.SourceDisksFiles.x86
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x403615
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x403646
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403568
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret

Function at 0x403720
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x2021f
push 0
push 0
push 0
push 0x42c84c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4037ae
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 4
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x42c884
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4037a4
cmp dword [ebp - 0x10], 0
je 0x4037a4
push str._install2
call fcn.00403670
add esp, 4
push str.FinishLinkInstall
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4037c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00403500
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40384b
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWARENVIDIA_CorporationGlobalStereo3DPersistent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40384b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push str.3D_Vision
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403841
cmp dword [ebp - 0x10], 0
jne 0x403841
push str._update
call fcn.00403670
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4041d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00414b50
add esp, 0xc
mov byte [ebp - 0x135], 0
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x40422e
jmp 0x4042fd
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4042e1
push str.SDManifoldsComEx.exe
lea eax, [ebp - 0x10c]
push eax
call fcn.00415519
add esp, 8
test eax, eax
jne 0x4042c6
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x13c], 0
je 0x4042c6
push 0
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x135], 1
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404253
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp - 0x135]
test ecx, ecx
jne 0x40420a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret
Function at 0x404310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x436edc], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x436ee0], ecx
mov edx, dword [ebp + 8]
mov dword [0x436ef0], edx
mov eax, dword [ebp + 0x10]
mov dword [0x436ef4], eax
mov ecx, 0x436f78
call fcn.00406590
mov ecx, 0x436f78
call fcn.00406590
push 0x436ef8
push 0
push 0x436edc
push 0x404470
push 0
push 0
call fcn.0041566c
add esp, 0x18
mov dword [0x436ee4], eax
push 0x436eec
push 0
push 0x436ef0
push 0x4043c0
push 0
push 0
call fcn.0041566c
add esp, 0x18
mov dword [0x436ee8], eax
cmp dword [0x436ee4], 0
je 0x4043a9
cmp dword [0x436ee8], 0
je 0x4043a9
mov dword [ebp - 4], 1
jmp 0x4043b0
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404c40
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov dword [ebp - 7], ecx
mov word [ebp - 3], cx
mov byte [ebp - 1], cl
mov dword [ebp - 0x40], 0
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x40], 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x30], 0
call fcn.00404a20
mov dword [ebp - 0x30], eax
push 1
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
mov edx, dword [ebp - 0x30]
push edx
push 1
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404dbd
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [ebp - 0x40]
push ecx
push 0x4e20
push 0x2000
push 0x2000
push 0xff
push 8
push 0x80000003
push str..pipe_stereosvrpipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x404d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x48], eax
jmp 0x404dbd
push 0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x404d65
jmp 0x404dbd
mov ecx, 0x436f78
call fcn.00406590
lea edx, [ebp - 0x44]
push edx
push 0
mov eax, dword [ebp - 0x2c]
push eax
push 0x4049b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x404d9d
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404db1
mov ecx, 0x436f78
call fcn.004065c0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 0
jmp 0x404cdf
cmp dword [ebp - 0x2c], 0
je 0x404dcd
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0
je 0x404ddd
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret
Function at 0x405360
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
cmp eax, dword [ebp + 0xc]
je 0x405429
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e8
jae 0x4053ae
mov dword [ebp - 8], 0x3e8
jmp 0x4053be
cmp dword [ebp - 8], 0x2710
jbe 0x4053be
mov dword [ebp - 8], 0x2710
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4053e1
xor al, al
jmp 0x40542b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4053f0
mov al, 1
jmp 0x40542b
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
cmp eax, dword [ebp - 4]
jbe 0x40540f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
jmp 0x405424
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x18]
jbe 0x405424
xor al, al
jmp 0x40542b
jmp 0x40537b
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x405440
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x405462
xor eax, eax
jmp 0x405492
cmp dword [ebp - 0x18], 2
jne 0x405485
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1d], al
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x405485
xor eax, eax
jmp 0x405492
xor eax, eax
cmp dword [ebp - 0x18], 4
setne al
lea eax, [eax + eax + 1]
mov esp, ebp
pop ebp
ret
Function at 0x4054a0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4054c5
xor eax, eax
jmp 0x405571
cmp dword [ebp - 0x18], 2
jne 0x4054ed
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1d], al
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x4054eb
xor eax, eax
jmp 0x405571
jmp 0x405510
cmp dword [ebp - 0x18], 3
jne 0x405510
push 1
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1e], al
movzx eax, byte [ebp - 0x1e]
test eax, eax
jne 0x405510
xor eax, eax
jmp 0x405571
cmp dword [ebp - 0x18], 1
jne 0x405565
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40552f
xor eax, eax
jmp 0x405571
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x405548
xor eax, eax
jmp 0x405571
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1f], al
movzx ecx, byte [ebp - 0x1f]
test ecx, ecx
jne 0x405565
xor eax, eax
jmp 0x405571
xor eax, eax
cmp dword [ebp - 0x18], 4
setne al
add eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x405580
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4055a5
xor eax, eax
jmp 0x40563f
cmp dword [ebp - 0x18], 2
jne 0x4055ca
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1d], al
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x4055c8
xor eax, eax
jmp 0x40563f
jmp 0x4055ed
cmp dword [ebp - 0x18], 3
jne 0x4055ed
push 1
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1e], al
movzx eax, byte [ebp - 0x1e]
test eax, eax
jne 0x4055ed
xor eax, eax
jmp 0x40563f
cmp dword [ebp - 0x18], 4
jne 0x405633
mov ecx, dword [ebp - 0x14]
and ecx, 1
je 0x405633
lea edx, [ebp - 0x1c]
push edx
push 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x405616
xor eax, eax
jmp 0x40563f
push 1
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00405360
mov byte [ebp - 0x1f], al
movzx eax, byte [ebp - 0x1f]
test eax, eax
jne 0x405633
xor eax, eax
jmp 0x40563f
xor eax, eax
cmp dword [ebp - 0x18], 1
setne al
add eax, 3
mov esp, ebp
pop ebp
ret
Function at 0x4056c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
mov ecx, 0x436f48
call fcn.00406480
push 0x437fa8
call fcn.00401000
add esp, 4
mov eax, dword [0x437fa8]
sub eax, dword [0x437fa0]
mov ecx, dword [0x437fac]
sbb ecx, dword [0x437fa4]
push 0
push 0x989680
push ecx
push eax
call fcn.00415aa0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x21
jle 0x405726
mov dword [0x437f98], 0
mov edx, dword [0x437f98]
add edx, 1
mov dword [0x437f98], edx
cmp dword [0x437f98], 7
jl 0x405763
cmp dword [ebp - 4], 0x21
jg 0x405759
mov eax, 0x21
sub eax, dword [ebp - 4]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x437f98], 1
cmp dword [0x436f40], 0
jne 0x405771
call fcn.00405650
cmp dword [0x436f40], 0
je 0x40578c
push 0x1388
mov ecx, dword [0x436f40]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
lea edx, [ebp - 0x118]
push edx
push str._SystemRoot_System32_taskkill.exe__F__IM_dwm.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x118]
push eax
call fcn.00415298
add esp, 4
push 0x437fa0
call fcn.00401000
add esp, 4
mov ecx, dword [0x436f40]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, 0x436f48
call fcn.004064a0
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret

Function at 0x406410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0x20219
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallNVIDIAStereo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40646e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406464
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x406830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
push 0x105
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40689e
mov ecx, dword [ebp + 8]
push ecx
push 0x42cb60
lea edx, [ebp - 0x110]
push edx
call fcn.00415380
add esp, 4
lea eax, [ebp + eax - 0x110]
push eax
call fcn.00414291
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret
Function at 0x408cc0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408cec
xor al, al
jmp 0x408d8e
push 0xf01ff
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x408d77
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x408d5b
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x2c], 0
je 0x408d5b
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x408d5b
cmp dword [ebp - 0x24], 1
je 0x408d5b
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408d39
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x408d6d
mov byte [ebp - 5], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x409040
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.00414b50
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 6
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret

Function at 0x413d9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435b3c]
jne 0x413da7
repz ret
jmp fcn.00419b79

Function at 0x420e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x420e71
call fcn.00416911
mov dword [eax], esi
call fcn.004168fe
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00415dee
add esp, 0x14
push 0x16
pop eax
jmp 0x420ec6
test dword [ebp + 0xc], 0xfffffff9
jne 0x420e4d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x420e9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00416924
pop ecx
call fcn.004168fe
mov eax, dword [eax]
jmp 0x420ec6
test al, 0x10
jne 0x420ec4
test al, 1
je 0x420ec4
test byte [ebp + 0xc], 2
je 0x420ec4
call fcn.00416911
mov dword [eax], 5
call fcn.004168fe
mov dword [eax], 0xd
jmp 0x420e95
xor eax, eax
pop esi
pop ebp
ret
Function at 0x423f20
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418b7e
and dword [ebp - 4], 0
cmp dword [0x43a7d8], 0
mov ebx, eax
jne 0x423fd1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424082
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42ec54
push edi
call esi
test eax, eax
je 0x424082
push eax
call fcn.00418b0c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43a7d8], eax
call esi
push eax
call fcn.00418b0c
mov dword [esp], 0x42ec30
push edi
mov dword [0x43a7dc], eax
call esi
push eax
call fcn.00418b0c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43a7e0], eax
call esi
push eax
call fcn.00418b0c
pop ecx
mov dword [0x43a7e8], eax
test eax, eax
je 0x423fd1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418b0c
pop ecx
mov dword [0x43a7e4], eax
mov eax, dword [0x43a7e4]
cmp eax, ebx
je 0x424029
cmp dword [0x43a7e8], ebx
je 0x424029
push eax
call fcn.00418b87
push dword [0x43a7e8]
mov esi, eax
call fcn.00418b87
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424029
test edi, edi
je 0x424029
call esi
test eax, eax
je 0x424020
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424020
test byte [ebp - 0xc], 1
jne 0x424029
or dword [ebp + 0x10], 0x200000
jmp 0x424062
mov eax, dword [0x43a7dc]
cmp eax, ebx
je 0x424062
push eax
call fcn.00418b87
pop ecx
test eax, eax
je 0x424062
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424062
mov eax, dword [0x43a7e0]
cmp eax, ebx
je 0x424062
push eax
call fcn.00418b87
pop ecx
test eax, eax
je 0x424062
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43a7d8]
call fcn.00418b87
pop ecx
test eax, eax
je 0x424082
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424084
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret