joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d2d2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x28]
xor ebx, ebx
push dword [esi + 0x14]
push 0x406bc0
push 0x10
push eax
call fcn.0041d6f4
add esp, 0x10
test eax, eax
js 0x41d340
lea eax, [ebp - 0x2c]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
push eax
push 2
push ecx
push 0x406950
call fcn.0043fa36
test eax, eax
jne 0x41d340
push 0x14
push esi
push 3
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x41d337
mov bl, 1
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b590
leave
ret 4
Function at 0x41d352
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x146c
call fcn.00447ce0
mov eax, dword [0x4a0cb8]
xor eax, esp
mov dword [esp + 0x1468], eax
cmp byte [0x4a1838], 0
push ebx
push esi
push edi
jne 0x41d38a
call fcn.0041b795
mov byte [0x4a1838], 1
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 3
push ecx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
push 0x406950
mov edx, esi
mov dword [esp + 0x24], ebx
call fcn.0043fa36
test eax, eax
jne 0x41d540
lea eax, [esp + 0x14]
mov edx, esi
push eax
push 3
push ecx
push 0x40a8c0
call fcn.0043fa36
test eax, eax
jne 0x41d540
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x41d540
mov eax, dword [esp + 0x10]
cmp eax, 0x400
ja 0x41d540
mov edi, ebx
test eax, eax
je 0x41d4ee
lea esi, [esp + 0x54]
lea eax, [esp + 0x18]
mov byte [esi], bl
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x20], 0x10
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x44], ebx
push eax
push ebx
lea eax, [esp + 0x2c]
mov dword [esp + 0x50], ebx
push eax
lea eax, [esp + 0x1468]
mov dword [esp + 0x58], ebx
push eax
push edi
push dword [esp + 0x28]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x38], 0x14
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x41d4de
cmp dword [esp + 0x38], 3
jne 0x41d4de
cmp dword [esp + 0x18], 0x14
jne 0x41d4de
mov eax, dword [esp + 0x1c]
add eax, eax
cmp eax, 0x20
jae 0x41d577
xor ecx, ecx
lea edx, [esi - 4]
mov word [esp + eax + 0x1454], cx
lea ecx, [esp + 0x1454]
call fcn.0041d681
test al, al
je 0x41d4dc
xor eax, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esi - 4]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041d5e5
lea ecx, [esp + 0x20]
call fcn.0041d57d
xor ebx, ebx
cmp dword [esp + 0x20], ebx
jne 0x41d4de
mov byte [esi], 1
jmp 0x41d4de
xor ebx, ebx
mov eax, dword [esp + 0x10]
inc edi
add esi, 5
cmp edi, eax
jb 0x41d40f
mov edi, ebx
test eax, eax
je 0x41d540
lea esi, [esp + 0x50]
cmp byte [esi + 4], 0
je 0x41d538
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push 0x406950
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
call fcn.0041a7a9
push 0x40a8c0
lea ecx, [esp + 0x24]
call fcn.0041a7a9
mov eax, dword [esp + 0x10]
inc edi
add esi, 5
cmp edi, eax
jb 0x41d4f8
cmp dword [esp + 0xc], 0
je 0x41d551
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [esp + 0x14], 0
je 0x41d562
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [esp + 0x1474]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043b590
mov esp, ebp
pop ebp
ret
call fcn.0043b6d8
int3
Function at 0x41d90e
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x210], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [ebp - 0x20c]
call fcn.00422867
push 0x406bf4
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00420c07
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
mov dword [ebp - 0x214], esi
test esi, esi
je 0x4519ce
lea edx, [ebp - 0x218]
mov dword [ebp - 0x218], edi
mov ecx, esi
call fcn.0041d9e5
mov ebx, eax
test ebx, ebx
js 0x4519f3
mov ecx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x218]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x41d9d2
lea edx, [ebp - 0x210]
mov dword [ebp - 0x210], esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x436df0
call fcn.0043d568
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b590
leave
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x41d9ad
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x4094e8
call fcn.0045d93a
mov edi, eax
jmp 0x451a08
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x4094e8
call fcn.0045d953
mov edi, ebx
mov esi, dword [ebp - 0x214]
jmp 0x41d9ad
Function at 0x41e096
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
push 0x7cf
mov dword [ebp - 0xc], ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
mov edi, 0x4a18c0
mov edx, 0x7d0
push eax
mov ecx, edi
call fcn.00420c5b
test eax, eax
js 0x41e2a7
xor eax, eax
mov esi, edi
push 0x22
mov dword [ebx], eax
pop ecx
cmp word [esi], ax
je 0x41e163
mov edi, esi
sub edi, 0x4a18c0
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jae 0x41e10b
movzx eax, word [esi]
test ax, ax
je 0x41e108
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x41e28d
push 0x22
pop ecx
mov eax, esi
mov edi, 0x4a18c0
sub eax, edi
and eax, 0xfffffffe
cmp eax, 0xfa0
je 0x41e163
movzx eax, word [esi]
test ax, ax
je 0x41e163
cmp ax, cx
je 0x451bff
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x41e14a
xor eax, eax
cmp word [esi], ax
je 0x41e14c
add esi, 2
movzx eax, word [esi]
jmp 0x41e12f
xor eax, eax
inc dword [ebx]
mov ecx, esi
sub ecx, edi
sar ecx, 1
push 0x22
cmp ecx, 0x7d0
pop ecx
jb 0x41e0d4
mov eax, dword [ebx]
test eax, eax
je 0x41e2a7
mov esi, dword [0x402f5c]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, esi
call dword [0x4a3670]
call esi
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x41e2a7
xor eax, eax
mov esi, edi
mov ecx, eax
mov dword [ebp - 4], eax
cmp word [esi], ax
je 0x41e285
cmp ecx, dword [ebx]
jge 0x41e285
mov edi, esi
sub edi, 0x4a18c0
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jae 0x41e1de
movzx eax, word [esi]
test ax, ax
je 0x41e1de
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x451c21
mov edi, esi
sub edi, 0x4a18c0
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
je 0x41e285
movzx ecx, word [esi]
test cx, cx
je 0x41e285
push 0x22
pop ebx
cmp cx, bx
lea ecx, [esi + 2]
je 0x41e20e
mov ecx, esi
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push 0x22
mov dword [ebx + edx*4], ecx
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
inc ecx
pop edx
cmp word [esi], dx
lea edx, [esi + 2]
mov dword [ebp - 4], ecx
je 0x451c2c
cmp eax, 0x7d0
jae 0x41e261
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x41e25e
xor ecx, ecx
cmp word [esi], cx
je 0x41e25e
add edi, 2
add esi, 2
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jb 0x41e237
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [esi], ax
je 0x41e26e
mov word [esi], ax
add esi, 2
mov eax, esi
sub eax, 0x4a18c0
sar eax, 1
push 0
cmp eax, 0x7d0
pop eax
jb 0x41e1a2
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
add edi, 2
add esi, 2
mov eax, edi
sar eax, 1
cmp eax, 0x7d0
jb 0x41e0f0
jmp 0x41e108
xor eax, eax
jmp 0x41e288
lea eax, [esi + 2]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x451c1a
add esi, 2
jmp 0x41e14a
inc dword [ebx]
jmp 0x41e163
add esi, 2
add edi, 2
jmp 0x41e1bb
push 0x22
pop eax
push eax
push edx
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41e285
jmp 0x41e25e
Function at 0x41e6c4
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.0043ecb8
push eax
push 0x88
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x41e752
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 6
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x41e802
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x41e758
push ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
mov esi, dword [ebp - 0xc]
add esi, 0xc
add esi, eax
mov eax, esi
mov dword [ebp - 0xc], esi
call fcn.00447bf0
mov ebx, esp
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 6
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x41e76d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x41e807
movzx eax, ax
or eax, 0x80070000
jmp 0x41e807
cmp dword [ebx], edi
je 0x41e802
push dword [ebp - 0x10]
mov esi, dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
add eax, 8
add word [esi + 2], ax
lea eax, [ebp - 0x14]
push eax
mov esi, edi
push edi
jmp 0x41e7aa
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x41e809
lea eax, [ebp - 0x14]
inc esi
push eax
push esi
push dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
jne 0x41e790
push dword [ebp - 0x10]
push 0x10000000
push 2
push dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAce]
test eax, eax
je 0x41e7eb
push dword [ebx]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidAcl]
mov eax, dword [ebx]
movzx eax, word [eax + 2]
push eax
push ebx
push 6
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
test eax, eax
jne 0x41e809
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41e809
movzx edi, di
or edi, 0x80070000
jmp 0x41e809
mov eax, 0x80004005
mov edi, eax
lea ecx, [ebp - 8]
call fcn.0041e825
mov eax, edi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b590
leave
ret
Function at 0x41ee9f
Capabilities:
Get disk information

Disassembly:
push 8
mov eax, 0x4487a1
call fcn.0043bc2e
mov eax, edx
mov dword [ebp - 0x14], eax
mov ebx, ecx
and dword [eax], 0
push 0x4084c8
push 0x208
call fcn.0043b996
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x104
push esi
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x451f85
xor edi, edi
mov ecx, dword [ebp - 0x14]
mov eax, esi
xor esi, esi
mov dword [ecx], eax
mov dword [ebp - 4], 1
push esi
mov esi, dword [0x402f60]
mov ecx, esi
call dword [0x4a3670]
call esi
mov eax, edi
call fcn.0043bbfc
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x451f9c
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x451feb
cmp edi, 0x800700ea
jne 0x452025
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 0x4084c8
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043b996
pop ecx
pop ecx
mov edi, eax
and dword [ebp - 4], 0
push esi
mov esi, dword [0x402f60]
mov ecx, esi
call dword [0x4a3670]
call esi
mov esi, edi
test edi, edi
jne 0x451ff5
mov edi, 0x8007000e
jmp 0x41eeec
mov edi, 0x80004005
jmp 0x41eeec
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x41eee1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x452023
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x451feb
test edi, edi
js 0x41eeec
jmp 0x41eee3
Function at 0x42485c
Capabilities:
Read file via mapping

Disassembly:
push 0xa0
mov eax, 0x449162
call fcn.0043bc61
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x424a55
mov dword [ebp - 0x94], ebx
mov byte [ebp - 0x90], bl
mov dword [ebp - 0x8c], 2
mov dword [ebp - 0x98], 0x401404
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x70]
xor ebx, ebx
mov esi, 0x406f60
inc ebx
push ebx
push esi
push eax
call fcn.00425a07
add esp, 0xc
mov byte [ebp - 4], bl
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x98]
push 0xf001f
push eax
call fcn.00424b4b
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00425b4f
push ebx
push ebx
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.00425a07
add esp, 0xc
mov byte [ebp - 4], 2
mov esi, 0xf001f
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x98]
push esi
push eax
call fcn.00424b4b
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00425b4f
push 0x12
push ebx
lea eax, [ebp - 0x70]
push 0x406f58
push eax
call fcn.00425a07
add esp, 0xc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x98]
push esi
push eax
call fcn.00424b4b
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.00425b4f
push 0
push ebx
lea eax, [ebp - 0x70]
push 0x406f50
push eax
call fcn.00425a07
add esp, 0xc
mov byte [ebp - 4], 4
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x98]
push 4
push eax
call fcn.00424b4b
lea ecx, [ebp - 0x70]
call fcn.00425b4f
xor ebx, ebx
mov dword [ebp - 0x78], 0x401470
mov dword [ebp - 0x74], ebx
push ecx
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x78]
call fcn.00422bf0
push ecx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0xac]
call fcn.00422b0a
push 0x406f10
push 4
push ebx
push 4
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 6
push eax
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov ecx, dword [edi + 0xc]
mov esi, eax
test ecx, ecx
jne 0x453158
mov dword [edi + 0xc], esi
lea ecx, [ebp - 0xa0]
mov esi, 0x401470
mov dword [ebp - 0xa0], esi
call fcn.004359d0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], esi
call fcn.004359d0
lea ecx, [ebp - 0x98]
call fcn.00422aa0
cmp dword [edi + 0xc], 0
mov esi, ebx
je 0x45316b
cmp dword [edi + 0xc], 0xffffffff
je 0x45316b
cmp dword [edi + 8], ebx
jne 0x424a41
push 4
push ebx
push ebx
push 0xf001f
push dword [edi + 0xc]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
je 0x45318d
test esi, esi
js 0x424a4d
mov edx, dword [edi + 8]
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov eax, esi
call fcn.0043bc10
ret
cmp dword [edi + 0xc], 0xffffffff
jne 0x424a09
jmp 0x424878
cmp ecx, 0xffffffff
je 0x4249da
call fcn.0045e7d4
jmp 0x4249da
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x453182
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x424a4d
jmp 0x424a1f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x424a43
movzx esi, si
or esi, 0x80070000
jmp 0x424a41
Function at 0x4302d6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x210]
mov ecx, 0x105
xor ebx, ebx
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push ebx
push ecx
lea eax, [ebp - 0x41c]
push eax
push dword [esi + 0x10]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
jne 0x43032a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov byte [esi + 0x20], bl
jmp 0x4303d6
lea edx, [ebp - 0x41c]
push edi
cmp byte [esi + 0x21], bl
je 0x430385
mov ecx, dword [esi + 0x10]
call fcn.0043fa8d
test al, al
je 0x43037e
mov edx, 0x409654
lea eax, [ebp - 0x210]
mov di, word [eax]
xor ecx, ecx
inc ecx
cmp di, word [edx]
jne 0x430376
test di, di
je 0x430372
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x430376
add eax, 4
add edx, 4
test di, di
jne 0x43034d
mov eax, ebx
jmp 0x43037a
sbb eax, eax
or eax, ecx
test eax, eax
jne 0x430380
mov cl, bl
mov edx, dword [esi + 0x10]
jmp 0x4303be
mov ecx, 0x409654
lea eax, [ebp - 0x210]
mov di, word [eax]
cmp di, word [ecx]
jne 0x4303b4
test di, di
je 0x4303b9
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x4303b4
add eax, 4
add ecx, 4
test di, di
jne 0x430390
jmp 0x4303b9
sbb ebx, ebx
or ebx, 1
test ebx, ebx
setne cl
mov byte [esi + 0x20], cl
movzx eax, byte [esi + 0x21]
mov ecx, dword [esi + 0x1c]
push eax
push edx
lea edx, [ebp - 0x210]
call fcn.0043e1b0
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b590
leave
ret
Function at 0x4331c1
Capabilities:
Create directory

Disassembly:
push 0x148
mov eax, 0x44a685
call fcn.0043bccd
mov ebx, dword [ebp + 0x9c]
mov dword [ebp - 0x144], ebx
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4331e7
mov byte [ebx], al
push ecx
mov ecx, dword [ecx + 4]
push 2
call fcn.0041b9f0
sub esp, 0x94
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.004312b5
lea ecx, [ebp - 0xa8]
call fcn.00432aa1
mov byte [ebp - 4], 1
xor esi, esi
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x140], esi
call fcn.00433293
test al, al
je 0x4577d6
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa4]
call fcn.00433293
test al, al
je 0x4578e4
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0x401028
test eax, eax
je 0x433266
lea ecx, [ebp - 0x98]
cmp eax, ecx
jne 0x457948
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xa8], 0x401558
mov dword [ebp + 8], 0x401028
test ecx, ecx
je 0x433289
lea eax, [ebp + 0x18]
cmp ecx, eax
jne 0x457955
mov eax, esi
call fcn.0043bc1f
ret 0x98
push dword [ebp - 0xa4]
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathSkipRootW]
mov ebx, eax
mov eax, ebx
lea ecx, [ebp - 0xa8]
sub eax, dword [ebp - 0xa4]
sar eax, 1
push eax
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.0042c701
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x41
lea ecx, [ebp - 0x13c]
call fcn.00429fc3
mov ecx, dword [ebp - 0x138]
mov dword [ebp - fcn.0042be10], 0x401028
call fcn.00433293
test al, al
jne 0x457891
push 0
push dword [ebp - 0x138]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x457891
test esi, esi
js 0x457891
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jg 0x457861
mov dword [ebp - 0x140], eax
jmp 0x457870
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x140], esi
push dword [ebp - 0x138]
push 0x40f980
push esi
push 0x40f850
push 0x187
push dword [ebp + 4]
call fcn.00464a06
add esp, 0x18
push ebx
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindNextComponentW]
mov ebx, eax
mov dword [ebp - fcn.0042be10], 0x401028
mov eax, dword [ebp - 0x138]
test eax, eax
je 0x4578c0
lea ecx, [ebp - 0x12c]
cmp eax, ecx
je 0x4578c0
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [ebp - fcn.00437280], 0x401558
test ebx, ebx
je 0x4578d9
xor eax, eax
cmp word [ebx], ax
jne 0x4577e4
mov ebx, dword [ebp - 0x144]
jmp 0x43322d
test ebx, ebx
je 0x4578eb
mov byte [ebx], 1
push ecx
mov ecx, dword [ebp - 0xa4]
call fcn.0043f698
jmp 0x433244
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x433266
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x433289
Function at 0x433293
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor bl, bl
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsUNCServerW]
test eax, eax
jne 0x4332c3
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsUNCServerShareW]
test eax, eax
jne 0x4332c3
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4332c3
test al, 0x10
je 0x4332c3
inc bl
pop esi
mov al, bl
pop ebx
ret
Function at 0x4339ae
Capabilities:
Get common file path

Disassembly:
push 0x2ec
mov eax, 0x44a764
call fcn.0043bccd
mov esi, ecx
mov edi, 0x104
lea eax, [ebp - 0x21c]
push edi
xor ebx, ebx
push eax
mov byte [ebp - 0x2e1], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
mov ecx, dword [ebp + 4]
neg eax
sbb al, al
add al, 1
jne 0x45799f
push 0x407670
mov edx, edi
lea ecx, [ebp - 0x21c]
call fcn.00420c07
mov ecx, dword [ebp + 4]
test eax, eax
js 0x4579ba
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
mov ecx, dword [ebp + 4]
test eax, eax
je 0x4579ab
push ecx
push 0x20019
push 0x407210
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2e0]
call fcn.00431e7e
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2ec], ebx
push eax
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2e8], ebx
push eax
push 0x407638
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x2f0], 8
call fcn.00436f9c
test eax, eax
je 0x4579ca
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CompareFileTime]
test eax, eax
jne 0x4579ca
lea ecx, [ebp - 0x2e0]
call fcn.0042535f
mov al, bl
call fcn.0043bc1f
ret
push 0x40b6c8
mov edx, 0xdd
jmp 0x4579b5
push 0x40b6c8
mov edx, 0xe1
call fcn.0046f19f
push eax
push 0x40b6c8
mov edx, 0xde
call fcn.0043f81b
mov eax, dword [ebp - 0x22c]
mov bl, 1
mov dword [esi], eax
mov eax, dword [ebp - 0x228]
mov dword [esi + 4], eax
jmp 0x433ab4

Function at 0x433f85
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [0x4a0618]
mov ecx, ebx
push esi
call fcn.0041bb18
test eax, eax
jne 0x434061
push ecx
mov ecx, dword [0x4a0618]
push 2
call fcn.0041b9f0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov ecx, eax
call fcn.0041e5af
mov esi, eax
test esi, esi
js 0x457c1f
push ecx
push ecx
call fcn.00430d9c
mov esi, eax
test esi, esi
js 0x457c40
push edi
mov edi, dword [0x4a0618]
mov eax, dword [edi]
mov dword [edi + 0x88], 1
mov esi, dword [eax + 0x34]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov esi, eax
pop edi
test esi, esi
js 0x457c47
push ecx
mov ecx, dword [0x4a0618]
push 4
call fcn.0041b9f0
mov eax, dword [ebx]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4a3670]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x457c26
push ecx
push 0x12
push 0x407800
lea ecx, [ebp - 8]
call fcn.0043420c
mov esi, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 4
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test esi, esi
je 0x434061
push esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
xor eax, eax
pop esi
pop ebx
leave
ret
mov edx, 0x220
jmp 0x457c2b
mov edx, 0x22a
mov ecx, dword [ebp + 4]
push esi
push 0x40aaf4
call fcn.0045d953
mov eax, esi
jmp 0x434063
mov edx, 0x222
jmp 0x457c2b
mov edx, 0x226
jmp 0x457c2b