joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a31
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
push ebx
push esi
lea eax, [ebp - 0x58]
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_BeginPaint]
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], ebx
je 0x404b0c
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp dword [esi + 0x24], edi
jne 0x404a79
push edi
push edi
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x24], eax
push dword [esi + 0x24]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esi + 0x20]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xfffffffffffffff0
xor ebx, ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
je 0x404aa5
push 1
jmp 0x404aab
test al, 2
je 0x404aac
push 2
pop ebx
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov word [ebp - 0x858], di
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x856]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x858]
push 0x400
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
or ebx, 0x20
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x858]
push 0xffffffffffffffff
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [ebp - 0x58]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndPaint]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40507d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [esi + 0x60]
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
push dword [ebp + 8]
lea edi, [ebp - 0x812]
mov word [ebp - 0x814], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.GDI32.dll_SetTextColor]
lea eax, [ebp - 0x814]
push 0x400
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x405168
push 1
pop edi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBkMode]
push ebx
push ebx
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp + 8]
call ebx
push 0xfffffffffffffff0
mov dword [ebp - 4], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test ah, 3
je 0x405117
push edi
jmp 0x405127
test ah, 1
je 0x405120
xor edi, edi
jmp 0x405128
test ah, 2
je 0x405128
push 2
pop edi
mov eax, dword [esi + 0x40]
and eax, 4
cmp al, 4
jne 0x405140
push 1
lea eax, [ebp - 0x14]
push 1
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esi + 0x64]
or edi, 0x24
sub dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x814]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 4]
push dword [ebp + 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4056d0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x42f990]
push esi
mov esi, ecx
push 0x823
mov dword [esi + 0x4c4], eax
mov eax, dword [0x4301b4]
mov dword [esi + 0x4dc], eax
mov eax, dword [0x4301b8]
mov dword [esi + 0x4e0], eax
mov eax, dword [0x4301bc]
mov dword [esi + 0x4e4], eax
mov eax, dword [0x4301c0]
mov dword [esi + 0x4e8], eax
push dword [0x42f97c]
lea eax, [esi + 0x4ec]
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
cmp dword [esi + 0x1534], 0
jne 0x405765
push dword [0x42f980]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405765
push edi
mov edi, dword [0x42f980]
push 0x10
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x40575c
push 0
push edi
mov ecx, eax
call fcn.0040869e
jmp 0x40575e
xor eax, eax
mov dword [esi + 0x1534], eax
pop edi
push 1
pop eax
pop esi
ret
Function at 0x4061c6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
push ebx
je 0x406266
push dword [ebp + 8]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
call ebx
test eax, eax
pop ecx
je 0x406266
and word [ebp - 0x20c], 0
push esi
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040aaeb
mov ecx, eax
call fcn.0040b243
push esi
lea eax, [ebp - 0x20c]
push 0x422aa8
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
lea eax, [ebp - 0x20c]
push eax
call ebx
add esp, 0x10
test eax, eax
pop edi
pop esi
jbe 0x406266
push 0xa
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0x42295c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
pop eax
jmp 0x406268
xor eax, eax
pop ebx
leave
ret 4

Function at 0x406755
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
and word [ebp - 0x824], 0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x822]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x824]
push 0x400
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0xa4]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x40681e
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40681e
xor eax, eax
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x24]
push eax
push 1
push 0x10102
call dword [sym.imp.GDI32.dll_ExtCreatePen]
test eax, eax
mov dword [ebp - 4], eax
je 0x406833
push eax
push ebx
call edi
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.GDI32.dll_Rectangle]
push dword [ebp - 8]
push ebx
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x406833
push 2
push ebx
call dword [sym.imp.GDI32.dll_GetCurrentObject]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push dword [esi + 0x20]
push ebx
call edi
push dword [esi + 0x80]
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xfffffffffffffff0
xor ebx, ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
je 0x40685e
push 1
jmp 0x406864
test al, 2
je 0x406865
push 2
pop ebx
or ebx, 0x20
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x824]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 4]
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x407701
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov byte [ebp - 1], 1
mov eax, dword [esi + 0x50]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x407756
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4077b0
shr eax, 2
test al, 1
je 0x40777f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
jmp 0x40774d
xor ebx, ebx
push 1
push ebx
push ebx
push dword [esi + 0x24]
push 0x42295c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x4077b0
or byte [esi + 0x54], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408d52
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x154], 0x64
mov dword [esi + 0x158], 1
jle 0x408dab
push edi
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x30]
call edi
push 0
push dword [esi + 0x58]
call edi
push 5
push dword [esi + 0x80]
call edi
push 5
push dword [esi + 0x160]
call edi
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x4098b4
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0040a35b
mov byte [esi], 0x80
pop esi
ret
Function at 0x40a38c
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x41bd34
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4c], ecx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
push 0x421244
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__wfopen]
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x30], edi
cmp edi, ebx
je 0x40a46e
push 2
push ebx
push edi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
mov dword [ebp - 0x14], eax
push ebx
push ebx
push edi
call esi
add esp, 0x1c
cmp dword [ebp + 0x14], 0xffffffff
je 0x40a3ff
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x14]
jle 0x40a3fc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea esi, [eax + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x18], edi
cmp edi, ebx
je 0x40a435
push esi
push ebx
push edi
call sub.MSVCRT.dll_memset
push dword [ebp - 0x30]
push 1
push dword [ebp - 0x14]
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov dword [ebp - 0x30], ebx
jmp 0x40a46e
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x2c], bl
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x18], ebx
je 0x40a4e8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
call fcn.004098ea
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.0040998f
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x40a4c9
xor esi, esi
movzx eax, byte [ebp + esi - 0x2c]
push eax
push 0x422c4c
push 3
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
inc esi
add edi, 4
cmp esi, 0x10
jl 0x40a4a9
cmp dword [ebp + 0x18], ebx
je 0x40a4df
push 0x10
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x18]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0x18]
call fcn.0040ebda
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40b063
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and word [ebp - 0x210], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov dword [ebp - 4], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x103
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push 0x4225b8
push 0x42aef4
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x40b135
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [ebp + eax*2 - 0x212]
lea edx, [ebp - 0x210]
xor ecx, ecx
cmp eax, edx
je 0x40b135
cmp ecx, 3
je 0x40b0fb
cmp word [eax], 0x5c
jne 0x40b0ea
inc ecx
dec eax
lea edx, [ebp - 0x210]
dec eax
cmp eax, edx
jne 0x40b0de
cmp ecx, 3
jne 0x40b135
cmp dword [ebp + 8], 0
je 0x40b135
and word [eax + 2], 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp + 0xc]
dec eax
push 0x42aed0
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b135
push 1
pop eax
jmp 0x40b137
xor eax, eax
leave
ret 8

Function at 0x40b13b
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov esi, ecx
call fcn.0040b3b8
mov ecx, esi
call fcn.0040d180
mov ecx, esi
call fcn.0040bbfa
mov ecx, esi
call fcn.0040bd30
mov ecx, esi
call fcn.0040b934
mov ecx, esi
call fcn.0040cb64
mov ecx, esi
call fcn.0040c5c4
call fcn.0040efba
cmp eax, 0xa
jne 0x40b1c9
and word [ebp - 0x410], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 0x210]
push eax
push 0x42ab7c
lea eax, [ebp - 0x410]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x410]
push eax
push 0
call fcn.004103cb
add esp, 0x18
mov ecx, esi
call fcn.0040cc7c
and word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [ebp - 0x208]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
push 0x42af90
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x40b22e
lea eax, [ebp - 0x208]
push eax
call fcn.0040ff68
pop ecx
call fcn.00401d9b
mov ecx, eax
call fcn.00401e3d
call fcn.0040fc84
leave
ret 4
Function at 0x40b243
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ecx + 0x210]
push esi
lea ecx, [ebp - 8]
push edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ecx
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0xc]
mov ebx, 0x4211e0
push eax
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push 0x42afa8
push edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x104
call esi
test eax, eax
je 0x40b2a1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push dword [ebp - 4]
push eax
push ebx
push 0x4228a4
push edi
call esi
test eax, eax
jne 0x40b2be
cmp dword [ebp + 8], 0
je 0x40b2b9
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
push 1
pop eax
jmp 0x40b2c0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40b2d5
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
lea esi, [ecx + 0x210]
push 0x1388
push esi
mov dword [ebp - 4], esi
call fcn.0040f2fe
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x42ab7c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
push 0x1f4
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b3aa
push 0x35
push dword [0x42f8a8]
push 0x42b024
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x40b3af
and word [ebp - 0x20c], 0
push dword [ebp - 4]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
push 0x42ab7c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push 0x103
push eax
call esi
add esp, 0x10
push 0x1f4
jmp 0x40b336
push 1
pop eax
jmp 0x40b3b1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40b3b8
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push edi
xor ebp, ebp
mov edi, 0x42b07c
push ebp
push edi
call esi
xor ebx, ebx
cmp eax, ebp
je 0x40b472
push ebp
push 1
push 0x401
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push edi
call esi
inc ebx
cmp ebx, 0x1e
jl 0x40b3d2
cmp eax, ebp
je 0x40b472
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0x14]
push 0x20000000
mov dword [esp + 0x14], ebp
push ebp
push ebp
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
je 0x40b472
mov esi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x20
push 0x42b06c
push ebp
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x40b44e
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call ebx
push 0x20
push 0x42b05c
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40b46f
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call ebx
push ebp
call ebx
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40b535
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40b617
mov ebx, 0x103
lea eax, [ebp - 0x210]
push ebx
push 0x42b128
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
and word [ebp - 0x418], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x42b100
push 0x42b0e0
lea eax, [ebp - 0x418]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x1c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x20a
mov dword [ebp - 8], 1
push eax
lea eax, [esi + 0x848]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x418]
push 0x42b0d8
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x210]
push eax
push 0
push 0x42b0c8
push 0x42b0b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0xa54], eax
xor ebx, ebx
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], bx
rep stosd dword es:[edi], eax
lea eax, [esi + 0x210]
mov edi, 0x104
push eax
push 0x42ab7c
lea eax, [ebp - 0x624]
push edi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esi + 0x434]
push edi
push eax
call fcn.0040fe09
lea eax, [esi + 0x63e]
push edi
push eax
call fcn.0040fec5
lea eax, [esi + 0xa64]
push eax
lea eax, [esi + 0xa60]
push eax
lea eax, [esi + 0xa5c]
push eax
lea eax, [esi + 0xa58]
push eax
lea eax, [ebp - 0x624]
push eax
call fcn.0040fd43
add esp, 0x34
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x422834
push 0x42b0b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b756
Capabilities:
Check if file exists
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
and word [ebp - 0x210], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov dword [ebp - 4], edx
stosw word es:[edi], ax
add edx, 0x210
mov edi, 0x42ab7c
push edx
mov ebx, 0x103
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b8ca
mov eax, dword [ebp - 4]
add eax, 8
push eax
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call esi
and word [ebp - 0x418], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push 0x42b1cc
lea eax, [ebp - 0x418]
push ebx
push eax
call esi
and word [ebp - 0x620], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x42b1b8
push 0x42b18c
lea eax, [ebp - 0x620]
push 0x104
push eax
call esi
and word [ebp - 0x828], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x826]
rep stosd dword es:[edi], eax
add esp, 0x30
mov dword [ebp - 8], 1
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov edi, SysReAllocString
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x620]
push 0x42eef4
push eax
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x828], 0
je 0x40b89d
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x40b8ca
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x418]
push eax
push 1
lea eax, [ebp - 0x620]
push 0x42eef4
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
and word [ebp - 0xa30], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
mov eax, 0x42b174
cmp dword [ebp + 8], edi
jne 0x40b8f4
mov eax, 0x42b15c
push eax
lea eax, [ebp - 0x210]
push eax
push 0x42b14c
lea eax, [ebp - 0xa30]
push ebx
push eax
call esi
add esp, 0x14
cmp dword [ebp + 0xc], edi
push edi
je 0x40b91b
push 0x2710
jmp 0x40b91d
push 0xffffffffffffffff
lea eax, [ebp - 0xa30]
push edi
push eax
call fcn.0040f65e
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40bbfa
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push esi
mov ebx, ecx
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], si
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40bd28
mov edx, 0x82
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], si
mov word [ebp - 0x418], si
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, edx
lea edi, [ebp - 0x416]
add ebx, 0x210
rep stosd dword es:[edi], eax
push ebx
mov edi, 0x104
push 0x42b248
lea eax, [ebp - 0x624]
push edi
push eax
call esi
push 0x42287c
push ebx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 0x18
test eax, eax
je 0x40bd28
add eax, 2
push eax
push 0x4225b0
lea eax, [ebp - 0x418]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncat]
dec edi
push edi
lea eax, [ebp - 0x20c]
push 0x42b21c
push eax
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
test eax, eax
je 0x40bd28
cmp word [ebp - 0x418], 0
je 0x40bd28
lea eax, [ebp - 0x418]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bd28
lea eax, [ebp - 0x20c]
mov dword [ebp - 4], 1
push eax
call fcn.0040ff68
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret