joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fcd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x42f8f0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428190
lea ecx, [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 8], 0xffffffff
push eax
mov dword [ebp - 4], 0
call fcn.0042a1a0
add esp, 0x18
cmp dword [0x587f54], 6
jl 0x42fd2c
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x515f10
push 0x550006
call fcn.0042ab50
add esp, 0xc
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.0042fe40
add esp, 4
test eax, eax
jns 0x42fd66
cmp dword [0x587f54], 6
jl 0x42fe20
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x515f20
push 0x550006
call fcn.0042ab50
add esp, 0xc
jmp 0x42fe20
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.0042efe0
mov edi, dword [sym.imp.x_WaitForSingleObjectEx]
mov ebx, eax
mov eax, edx
mov ecx, ebx
mov dword [ebp - 0x10], eax
mov esi, eax
mov eax, dword [0x583a60]
test eax, eax
je 0x42fdb7
imul eax, eax, 0x3e8
cdq
sub eax, ecx
sbb edx, esi
add eax, ebx
adc edx, dword [ebp - 0x10]
test edx, edx
ja 0x42fdb2
jb 0x42fda5
test eax, eax
jne 0x42fdb2
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x18]
jmp 0x42fdc1
mov dword [ebp - 0x14], edx
jmp 0x42fdc1
or eax, 0xffffffff
mov dword [ebp - 0x14], 0
push 1
push eax
push dword [ebp - 4]
call edi
cmp eax, 0xc0
jne 0x42fddb
call fcn.0042efe0
mov ecx, eax
mov esi, edx
jmp 0x42fd82
pop edi
pop esi
pop ebx
test eax, eax
je 0x42fdf6
push 0x16
push dword [ebp - 4]
call dword [sym.imp.x_TerminateProcess]
mov dword [ebp - 8], 0xfffffff7
jmp 0x42fe14
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.x_GetExitCodeProcess]
mov eax, dword [ebp - 8]
mov ecx, 0xffffffea
cmp eax, 3
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.00431d60
add esp, 4
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x1d08], eax
mov esp, ebp
pop ebp
ret

Function at 0x4300e0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
mov dword [ebp - 4], eax
je 0x430162
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0xea60
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1d4c0
mov dword [ebp - 0x14], 0x2a300
mov dword [ebp - 8], 3
lea eax, [ebp - 0x14]
push eax
push 2
push dword [ebp + 8]
call dword [0x510050]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430194
push str.Failed_changing_service_failure_action:__m
push 0x670003
call fcn.0042ab50
add esp, 8
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4301a0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
or esi, 0xffffffff
cmp dword [0x583a64], 0
push edi
mov edi, dword [ebp + 8]
je 0x43025a
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00428840
add esp, 8
push 2
push dword [eax]
push dword [0x583a64]
call dword [0x510068]
push eax
call fcn.004f5de0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x43025a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push dword [ebp + 0xc]
push esi
push eax
call dword [0x51004c]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430228
push dword [ebp + 0xc]
push edi
push str.Error_changing_service__s_startup_mode_to__d:__m
push 0x670003
call fcn.0042ab50
add esp, 0x10
jmp 0x43022a
xor esi, esi
push dword [ebp - 4]
call dword [0x510054]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x43026d
push 0x515f38
push 0x670003
call fcn.0042ab50
add esp, 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push str.Service__s_doesnt_exist
push 0x670005
call fcn.0042ab50
add esp, 0xc
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4302c0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x56fcdc]
push ebx
push edi
or edi, 0xffffffff
cmp eax, edi
jne 0x4302d7
call fcn.0042ca30
mov ebx, dword [ebp + 0x14]
xor edx, edx
cmp eax, 2
mov ecx, 0x100
cmovg ecx, edx
or ecx, 0x10
neg ebx
mov dword [ebp - 4], ecx
sbb ebx, ebx
add ebx, 3
cmp dword [0x583a64], edx
je 0x4303ca
push esi
push dword [ebp + 8]
lea esi, [ebp + 4]
add esi, 0xfffffffc
push esi
call fcn.00428840
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x583a64]
call dword [0x510068]
push eax
call fcn.004f5de0
add esp, 4
mov dword [ebp + 0x14], eax
test eax, eax
je 0x4303c1
push dword [ebp + 0xc]
push esi
call fcn.00428840
push dword [ebp + 0x10]
mov esi, eax
lea eax, [ebp + 4]
add eax, 0xfffffffc
push eax
call fcn.00428840
add esp, 0x10
push dword [esi]
mov esi, dword [ebp + 0x14]
push 0
push 0
push 0
push 0
push 0
push dword [eax]
push 1
push ebx
push dword [ebp - 4]
push esi
call dword [0x51004c]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430399
push dword [ebp + 8]
push str.Failed_changing_service_config__s:__m
push 0x670003
call fcn.0042ab50
add esp, 0xc
jmp 0x43039b
xor edi, edi
push esi
call dword [0x510054]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x4303c1
push 0x515f38
push 0x670003
call fcn.0042ab50
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430540
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
or esi, 0xffffffff
cmp dword [0x583a64], 0
push edi
jne 0x430555
xor eax, eax
jmp 0x430583
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428840
add esp, 8
push 0x10000
push dword [eax]
push dword [0x583a64]
call dword [0x510068]
push eax
call fcn.004f5de0
add esp, 4
push eax
call fcn.004f5de0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4305b7
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b38]
test eax, eax
jne 0x4305a9
call fcn.004f7685
cmp dword [eax], 0x424
jne 0x43060a
pop edi
xor eax, eax
pop esi
pop ebp
ret
push edi
call dword [0x510060]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x4305e2
push dword [ebp + 8]
push str.Failed_deleting_service__s:__m
push 0x670003
call fcn.0042ab50
add esp, 0xc
jmp 0x4305e4
xor esi, esi
push edi
call dword [0x510054]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x43060a
push 0x515f38
push 0x670003
call fcn.0042ab50
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x430610
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
or esi, 0xffffffff
cmp dword [0x583a64], 0
push edi
mov edi, dword [ebp + 8]
je 0x4306c7
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00428840
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x583a64]
call dword [0x510068]
push eax
call fcn.004f5de0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4306c7
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push ebx
call dword [0x51006c]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430695
push edi
push 0x516134
push 0x670003
call fcn.0042ab50
add esp, 0xc
test eax, eax
jne 0x430698
mov esi, dword [ebp - 0x24]
push ebx
call dword [0x510054]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x4306da
push 0x515f38
push 0x670003
call fcn.0042ab50
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x516158
push 0x670005
call fcn.0042ab50
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4307f0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x583a64], 0
push esi
push edi
jne 0x430805
xor esi, esi
jmp 0x430835
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428840
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x583a64]
call dword [0x510068]
push eax
call fcn.004f5de0
add esp, 4
mov esi, eax
push dword [ebp + 0xc]
lea ecx, [ebp + 4]
or edi, 0xffffffff
sub ecx, 4
push ecx
call fcn.00428840
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [0x510050]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x43087f
push str.Failed_changing_service_description:__m
push 0x670003
call fcn.0042ab50
add esp, 8
test eax, eax
jne 0x4308cb
push dword [ebp + 0x10]
push esi
call fcn.004300e0
add esp, 8
test eax, eax
jne 0x4308cb
push 1
lea eax, [ebp - 0x18]
push eax
call dword [0x510024]
lea eax, [ebp - 0x18]
push eax
push 4
push esi
call dword [0x510070]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x4308c9
push str.failed_SetServiceObjectSecurity____m
push 0x670003
call fcn.0042ab50
add esp, 8
jmp 0x4308cb
xor edi, edi
test esi, esi
je 0x4308f5
push esi
call dword [0x510054]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x4308f5
push 0x515f38
push 0x670003
call fcn.0042ab50
add esp, 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430900
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
or esi, 0xffffffff
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
call fcn.00429110
mov eax, dword [ebp - 4]
add esp, 8
test eax, eax
je 0x430943
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00429700
add esp, 8
cmp dword [0x583a64], 0
mov ebx, dword [ebp + 8]
je 0x430ae7
lea eax, [ebp + 4]
sub eax, 4
push ebx
push eax
call fcn.00428840
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x583a64]
call dword [0x510068]
push eax
call fcn.004f5de0
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x430ae7
mov ecx, dword [ebp - 0x10]
push edi
push ecx
push ecx
call fcn.004296a0
mov edi, dword [ebp - 8]
add esp, 4
push eax
push edi
call dword [0x510074]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430a18
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b38]
test eax, eax
jne 0x4309c7
call fcn.004f7685
cmp dword [eax], 0x420
jne 0x4309f2
cmp dword [0x587f9c], 6
jl 0x4309eb
push ebx
push 0x516170
push 0x670006
call fcn.0042ab50
add esp, 0xc
xor esi, esi
jmp 0x430abc
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
call fcn.00429680
push dword [eax]
push ebx
push 0x51618c
push 0x670003
call fcn.0042ab50
add esp, 0x18
jmp 0x430abc
lea eax, [ebp - 0x14]
push eax
push 0x24
lea eax, [ebp - 0x38]
push eax
push 0
push edi
call dword [0x51006c]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430a4f
push ebx
push 0x516134
push 0x670003
call fcn.0042ab50
add esp, 0xc
test eax, eax
jne 0x430abc
mov eax, dword [ebp - 0x24]
xor esi, esi
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [ebp - 0x34]
cmp eax, 4
je 0x4309eb
cmp esi, 0xea60
jge 0x430ab0
cmp edi, 0x1d4c0
jge 0x430ab0
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
call fcn.00430b50
add esp, 0xc
test eax, eax
jne 0x430ab9
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jbe 0x430a92
xor esi, esi
mov dword [ebp - 0x14], eax
push 0
push 0x64
call fcn.0042bd20
mov eax, dword [ebp - 0x34]
add esp, 8
add esi, 0x64
add edi, 0x64
cmp eax, 4
jne 0x430a61
xor esi, esi
jmp 0x430abc
cmp eax, 4
jne 0x430ab9
xor esi, esi
jmp 0x430abc
or esi, 0xffffffff
push dword [ebp - 8]
call dword [0x510054]
push eax
call fcn.004f5db0
add esp, 4
pop edi
test eax, eax
jne 0x430afa
push 0x515f38
push 0x670003
call fcn.0042ab50
add esp, 8
jmp 0x430afa
push ebx
push 0x516158
push 0x670005
call fcn.0042ab50
add esp, 0xc
lea eax, [ebp - 4]
push eax
call fcn.00429230
mov eax, dword [ebp - 0xc]
add esp, 4
test eax, eax
je 0x430b1d
push eax
call fcn.004f7492
add esp, 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004296c0
add esp, 4
test esi, esi
je 0x430b40
push ebx
push 0x5161ac
push 0x670003
call fcn.0042ab50
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430b50
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x24
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call dword [0x51006c]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x430b8e
push dword [ebp + 0x10]
push 0x516134
push 0x670003
call fcn.0042ab50
add esp, 0xc
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430e30
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x1c]
lea esi, [ebp + 4]
add esi, 0xfffffffc
push esi
call fcn.00428840
push dword [ebp + 0xc]
mov edi, eax
push esi
call fcn.00428840
push dword [ebp + 8]
mov ebx, eax
push esi
call fcn.00428840
add esp, 0x18
push 0
push 0
push 0
push 0
push 0
push dword [edi]
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebx]
push dword [eax]
push dword [0x583a64]
call dword [0x51005c]
push eax
call fcn.004f5de0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x430f10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x4311e0
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428190
mov ebx, dword [ebp + 0xc]
xor edi, edi
push 0x5162a4
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.004314a0
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x430f55
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push 0
push esi
call fcn.004313d0
add esp, 0xc
test eax, eax
jne 0x430fa4
mov eax, dword [ebp - 4]
push dword [eax]
push esi
call fcn.00430f10
add esp, 8
test eax, eax
je 0x430f92
mov eax, dword [ebp - 4]
push dword [eax]
push str.failed_delete_key_recursive:__s
push 0x660003
call fcn.0042ab50
add esp, 0xc
mov edi, eax
push dword [ebp - 4]
push 0
push esi
call fcn.004313d0
add esp, 0xc
test eax, eax
je 0x430f67
push esi
call dword [0x510028]
mov eax, dword fs:[0x2c]
push ebx
mov eax, dword [eax]
add eax, 0x1f2c
push eax
call fcn.0042a900
add esp, 8
push dword [eax]
push dword [ebp + 8]
call dword [0x51007c]
test eax, eax
je 0x430fe6
push ebx
push str.failed_delete_key_recursive:__s
push 0x660003
call fcn.0042ab50
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4310b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
push 0x80000006
push 0x80000005
push 0x80000060
push 0x80000050
push 0x80000004
push 0x80000003
push 0x80000002
push 0x80000001
push 0x80000000
push 0
push 0xa
push esi
call fcn.00430ed0
mov edi, eax
add esp, 0x30
test edi, edi
je 0x43111d
push dword [ebp + 0x20]
test esi, esi
push dword [ebp + 0xc]
cmove esi, dword [0x56fd60]
push esi
call fcn.004314a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x43111d
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, dword fs:[0x2c]
push ebx
push dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 0x1f28
push eax
call fcn.0042a900
add esp, 8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push dword [eax]
push esi
call dword [0x510094]
mov ebx, eax
test ebx, ebx
je 0x431166
push dword [ebp + 0x10]
push 0x5162e0
push 0x660003
call fcn.0042ab50
add esp, 0xc
test edi, edi
je 0x431175
test esi, esi
je 0x431175
push esi
call dword [0x510028]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4312d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
push dword [ebp + 0xc]
cmove esi, dword [0x56fd60]
cmp dword [ebp + 0x10], 0
je 0x4312f5
push esi
call fcn.00430f10
add esp, 8
pop esi
pop ebp
ret
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
add eax, 0x1f2c
push eax
call fcn.0042a900
add esp, 8
push dword [eax]
push esi
call dword [0x51007c]
pop esi
pop ebp
ret

Function at 0x431320
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
push 0x80000006
push 0x80000005
push 0x80000060
push 0x80000050
push 0x80000004
push 0x80000003
push 0x80000002
push 0x80000001
push 0x80000000
push 0
push 0xa
push esi
call fcn.00430ed0
mov edi, eax
add esp, 0x30
test edi, edi
je 0x43138f
push 0x5112a4
push dword [ebp + 0xc]
test esi, esi
cmove esi, dword [0x56fd60]
push esi
call fcn.004314a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x43138f
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, dword fs:[0x2c]
push ebx
push dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 0x1f28
push eax
call fcn.0042a900
add esp, 8
push dword [eax]
push esi
call dword [0x510080]
mov ebx, eax
test edi, edi
je 0x4313c3
test esi, esi
je 0x4313c3
push esi
call dword [0x510028]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4313d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push fcn.0042a8d0
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428190
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call fcn.0042a290
add esp, 0x10
lea eax, [ebp - 8]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
call dword [0x51008c]
test eax, eax
je 0x431427
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp - 0xc], esi
ja 0x43143a
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
inc eax
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.0042a960
add esp, 8
lea eax, [ebp - 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax]
push esi
push dword [ebp + 8]
call dword [0x510084]
test eax, eax
je 0x431484
push esi
push 0x5162c8
push 0x660003
call fcn.0042ab50
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp + 0x10]
call fcn.0042a270
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4315f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
or edi, 0xffffffff
push 0x80000006
push 0x80000005
push 0x80000060
push 0x80000050
push 0x80000004
push 0x80000003
push 0x80000002
push 0x80000001
push 0x80000000
push 0
push 0xa
push esi
call fcn.00430ed0
mov ebx, dword [ebp + 0x18]
add esp, 0x30
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebx]
test eax, eax
je 0x431662
push eax
call fcn.004f7492
add esp, 4
mov dword [ebx], 0
cmp dword [ebp - 0xc], 0
je 0x43168c
push 0x510980
push dword [ebp + 0xc]
test esi, esi
cmove esi, dword [0x56fd60]
push esi
call fcn.004314a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x431723
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
call fcn.0042a900
add esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push dword [ebp - 8]
push esi
call dword [0x510090]
mov edi, eax
test edi, edi
jne 0x431723
mov eax, dword [ebp - 4]
add eax, 2
push eax
call fcn.004f88b4
mov dword [ebp + 0x18], eax
add esp, 4
mov dword [ebx], eax
mov byte [eax], 0
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
mov byte [ecx + eax], 0
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
mov byte [eax + ecx + 1], 0
lea eax, [ebp - 4]
push eax
push dword [ebx]
push dword [ebp + 0x14]
push edi
push dword [ebp - 8]
push esi
call dword [0x510090]
mov edi, eax
test edi, edi
je 0x43170d
push 0x5162fc
push 0x660003
call fcn.0042ab50
add esp, 8
cmp dword [ebx], 0
jne 0x431723
lea eax, [ebp + 0x18]
push 0x51095b
push eax
call fcn.0042a0a0
add esp, 8
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x43172f
mov eax, dword [ebp - 4]
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.0042a8d0
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x43174c
test esi, esi
je 0x43174c
push esi
call dword [0x510028]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431900
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [0x510008]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x431947
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
call dword [0x510004]
push eax
call fcn.004f5db0
add esp, 4
test eax, eax
jne 0x43197c
push str.failed_CheckTokenMembership__:__m
push 0x610003
call fcn.0042ab50
add esp, 8
mov dword [ebp - 8], 0
push dword [ebp - 4]
call dword [0x510098]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x431b00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push fcn.0042a8d0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428190
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [esi]
test eax, eax
je 0x431b41
push eax
call fcn.004f7492
add esp, 4
mov dword [esi], 0
lea eax, [ebp - 4]
push eax
push 0
push 1
call dword [sym.imp.x_GetComputerNameExW]
push eax
call fcn.004f5db0
mov ecx, dword [ebp - 4]
add esp, 4
test ecx, ecx
je 0x431bb5
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2b38]
test eax, eax
jne 0x431b79
call fcn.004f7685
mov ecx, dword [ebp - 4]
cmp dword [eax], 0xea
jne 0x431bb5
push ecx
push dword [ebp - 8]
call fcn.0042a960
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
push 1
call dword [sym.imp.x_GetComputerNameExW]
test eax, eax
je 0x431bb5
mov eax, dword [ebp - 8]
push dword [eax]
push esi
call fcn.0042a270
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push 0x51637c
push 0x610003
call fcn.0042ab50
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x431de0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428840
add esp, 8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.x_CreateNamedPipeW]
push eax
call fcn.004f5de0
xor ecx, ecx
add esp, 4
cmp eax, 0xffffffff
cmove eax, ecx
pop ebp
ret

Function at 0x431e30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428840
add esp, 8
push 0
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.x_GetDiskFreeSpaceExW]
push eax
call fcn.004f5db0
add esp, 4
neg eax
sbb eax, eax
neg eax
dec eax
pop ebp
ret