joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401020
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
xor edi, edi
mov esi, ecx
push edi
push edi
push 0x43c340
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x40104c
mov edx, dword [ebp - 4]
mov eax, edx
jmp 0x401058
mov edx, eax
mov ecx, ebx
call fcn.0041b5e0
mov edx, dword [ebp - 4]
test eax, eax
je 0x4011c5
test edx, edx
jne 0x401068
xor ecx, ecx
jmp 0x401080
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401070
sub ecx, dword [ebp - 8]
sar ecx, 1
mov eax, dword [esi + 0xc]
add ecx, ecx
add eax, 4
mov dword [ebp - 0xc], edx
add eax, ecx
mov dword [ebp - 8], ecx
cmp eax, dword [esi + 8]
jae 0x401099
mov eax, esi
jmp 0x4010b0
push ebx
push eax
mov edx, 0x4478b4
mov ecx, esi
call fcn.0041db40
mov edx, dword [ebp - 4]
add esp, 8
mov ecx, dword [ebp - 8]
test eax, eax
jne 0x4010c4
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
add eax, dword [esi + 0xc]
push ecx
push dword [ebp - 0xc]
push eax
call fcn.00426ea0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi + 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
je 0x4011c5
mov eax, dword [esi + 0xc]
add eax, 0x1c
cmp eax, dword [esi + 8]
jb 0x401112
push ebx
push eax
mov edx, 0x4478b4
mov ecx, esi
call fcn.0041db40
add esp, 8
test eax, eax
je 0x4011c5
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
movups xmm0, xmmword [str._CleverFiles]
movups xmmword [eax], xmm0
movq xmm0, qword [0x442e88]
movq qword [eax + 0x10], xmm0
add dword [esi + 0xc], 0x18
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, dword [esi + 8]
cmp eax, 2
jae 0x401147
mov ebx, 0x442f94
jmp 0x401153
mov eax, dword [esi + 4]
xor edx, edx
mov word [ecx + eax], dx
mov ebx, dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40117b
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401190
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401190
jmp 0x401184
test al, 0x10
jne 0x401190
mov eax, 0x52
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0041b5e0
mov ebx, eax
test ebx, ebx
je 0x4011c5
mov ebx, dword [ebp + 8]
mov edx, str._Disk_Drill
push ebx
push ecx
push esi
mov ecx, 0xb
call fcn.004194f0
add esp, 0xc
test eax, eax
je 0x4011c5
mov ecx, esi
call fcn.00419550
mov edx, ebx
mov ecx, eax
call fcn.00419990
test eax, eax
cmovne edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401260
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
push 0x20019
push 0
mov edi, ecx
xorps xmm0, xmm0
push str.SoftwareCleverFilesDisk_Drill
push 0x80000002
movlpd qword [ebp - 0x234], xmm0
mov dword [edi + 8], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4012c0
mov ecx, eax
call fcn.0041b480
mov esi, eax
jmp 0x40131f
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 4
test eax, eax
je 0x40133c
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0
push str.debug
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401319
cmp dword [ebp - 0x228], 4
jne 0x401319
cmp dword [ebp - 0x218], eax
je 0x401319
mov dword [edi + 8], eax
mov esi, dword [ebp - 0x230]
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x401342
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], 0
jmp 0x401342
mov esi, dword [ebp - 0x230]
test esi, esi
je 0x401355
mov ecx, dword [esi]
mov eax, dword [ecx]
add eax, esi
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x21c], 0
push eax
lea eax, [ebp - 0x210]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x224], xmm0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edx, eax
mov dword [ebp - 0x218], edx
test edx, edx
je 0x40143e
mov ecx, dword [ebp - 0x220]
cmp edx, ecx
jbe 0x4013d4
mov ecx, dword [0x4478b4]
lea esi, [ebp - 0x224]
push esi
push edx
mov eax, dword [ecx]
add eax, 0x4478b4
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 0xc
test eax, eax
je 0x40143e
mov ecx, dword [ebp - 0x220]
push dword [ebp - 0x224]
lea eax, [ebp - 0x210]
push ecx
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40143e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x443830
push dword [ebp - 0x224]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40143e
mov ecx, dword [ebp - 0x21c]
movzx eax, word [ecx + 0xc]
mov word [edi + 0x158], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 0x15a], ax
movzx eax, word [ecx + 8]
mov word [edi + 0x15c], ax
movzx eax, word [ecx + 0xa]
jmp 0x40144d
xor eax, eax
mov dword [edi + 0x15a], eax
mov word [edi + 0x158], ax
mov word [edi + 0x15e], ax
lea eax, [ebp - 0x224]
mov ecx, dword [0x4478b4]
push eax
push 0
mov eax, dword [ecx]
add eax, 0x4478b4
push eax
mov eax, dword [ecx + 4]
call eax
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x4030f0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x403153
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, 0xa0
test edi, edi
cmove edi, eax
test esi, esi
je 0x40314a
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40313a
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, edi
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x16
push str.cfbackd
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4031c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x403188
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea esi, [eax + 1]
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4031b2
mov edx, dword [esi + 4]
test edx, edx
je 0x4031a2
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, edi
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x403229
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0xa0
cmove eax, ecx
mov dword [ebp - 4], eax
test esi, esi
je 0x403225
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x403215
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 4]
add esp, 4
mov ecx, eax
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
xor esi, esi
jmp 0x403242
mov edx, esi
mov ecx, edi
call fcn.00403260
mov esi, eax
test esi, esi
je 0x403242
mov ecx, 1
call fcn.00403640
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403260
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
mov esi, edx
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40333a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4032e4
nop dword [eax]
cmp dword [ebp - 0x28], 4
je 0x4032e4
call ebx
sub eax, dword [ebp - 0x30]
cmp eax, 0x3a98
ja 0x4032fa
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x4032b0
mov eax, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x403327
mov edx, dword [esi + 4]
test edx, edx
je 0x403314
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, 0x5b4
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x420
jne 0x40335f
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40334a
test esi, esi
je 0x40338d
mov edx, dword [esi + 4]
test edx, edx
je 0x40337d
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, edi
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x4033a0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x403403
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, 0xa0
test edi, edi
cmove edi, eax
test esi, esi
je 0x4033fa
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4033ea
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, edi
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x26
push str.cfbackd
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x403476
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x403438
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea esi, [eax + 1]
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x403462
mov edx, dword [esi + 4]
test edx, edx
je 0x403452
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, edi
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x4034d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0xa0
cmove eax, ecx
mov dword [ebp - 4], eax
test esi, esi
je 0x4034d5
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4034c5
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 4]
add esp, 4
mov ecx, eax
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
xor esi, esi
jmp 0x4034eb
mov edx, esi
mov ecx, edi
call fcn.00403500
xor ecx, ecx
mov esi, eax
call fcn.00403640
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403500
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov ebx, ecx
push eax
push 1
push ebx
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x403546
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x426
je 0x40359c
cmp edi, 0x425
jne 0x4035b2
cmp dword [ebp - 0x20], 3
jne 0x4035b6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40359c
cmp dword [ebp - 0x28], 1
je 0x40359c
call edi
sub eax, dword [ebp - 0x30]
cmp eax, 0x3a98
ja 0x4035f3
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x403568
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40359c
test esi, esi
je 0x403620
mov edx, dword [esi + 4]
test edx, edx
je 0x4035d0
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, edi
mov dword [esi], 0x19
call fcn.0041b480
pop edi
mov dword [esi + 4], eax
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x403620
mov edx, dword [esi + 4]
test edx, edx
je 0x40360d
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, 0x5b4
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x403640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x10]
mov edi, ecx
push eax
push 0
push 0x2021f
push 0
push 0
push 0
push str.SoftwareCleverFilesDisk_Drill
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x4036ba
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 8]
xor ecx, ecx
xor edx, edx
test esi, esi
cmove eax, ecx
test eax, eax
je 0x403709
mov dword [ebp - 0x10], edi
test esi, esi
je 0x40371c
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ecx
push str.switchedOn
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
jmp 0x40371e
mov ecx, dword [0x4478b4]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push edx
mov eax, dword [ecx]
add eax, 0x4478b4
push 0xc
push eax
mov eax, dword [ecx + 4]
call eax
xor edx, edx
add esp, 0xc
test eax, eax
cmovne edx, dword [ebp - 0xc]
test edx, edx
jne 0x4036f7
mov edx, 0x4479a8
jmp 0x403707
mov dword [edx + 8], 0
mov dword [edx + 4], esi
mov dword [edx], 0x4479f4
xor esi, esi
test edx, edx
je 0x40371c
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
xor ebx, ebx
test esi, esi
je 0x403729
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x404480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edx + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
lea ecx, [edi + 8]
mov dword [ecx], eax
lea eax, [edx + 0x78]
push 0
mov dword [edi + 4], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareCleverFilesDisk_Drill
push 0x80000002
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [ebp - 8]
jne 0x40451a
mov dword [ebp - 0x10], 0
mov esi, 1
mov dword [ebp - 0x14], 4
test eax, eax
je 0x404517
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x4434a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp - 8]
jne 0x404517
cmp dword [ebp - 0x10], 4
cmove esi, dword [ebp - 0xc]
mov dword [edi + 0x1c], esi
test eax, eax
je 0x404525
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
xor esi, esi
push eax
lea ebx, [edi + 0xc]
mov dword [ebp - 8], esi
push ebx
push 1
push str.D:PAI_A_OICI_FA___SY__A_OICI_FA___BA__A_OICI_0x1200a9___BU_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x40459d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x18], esi
mov eax, dword [0x4478b4]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
push edx
push 0xc
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, 0x4478b4
push ecx
call eax
add esp, 0xc
test eax, eax
cmovne esi, dword [ebp - 0x18]
test esi, esi
jne 0x404581
mov esi, 0x4479a8
jmp 0x40460f
test edi, edi
mov dword [esi + 8], 0
mov eax, 0xa0
mov dword [esi], 0x4479f4
cmove edi, eax
mov dword [esi + 4], edi
jmp 0x40460f
lea ecx, [ebp - 0x10]
push ecx
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x4045d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0xa0
cmove eax, ecx
lea ecx, [ebp - 8]
mov edx, eax
call fcn.0041b5e0
mov esi, dword [ebp - 8]
mov edi, eax
test edi, edi
je 0x404601
cmp dword [ebp - 0xc], 0
je 0x4045e9
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jne 0x404637
push str.SD_does_not_contain_DACL.
mov edx, 0x19
lea ecx, [ebp - 8]
call fcn.0041baf0
mov esi, dword [ebp - 8]
add esp, 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebx], 0
mov ecx, dword [ebp - 0x1c]
push esi
push 0x1d
push str.Cant_prebuild_ACL_from_sddl.
mov ecx, dword [ecx]
call fcn.00419b30
add esp, 0xc
test esi, esi
je 0x404637
mov ecx, dword [esi]
mov eax, dword [ecx]
add eax, esi
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret
Function at 0x407880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
lea ebx, [eax + 0x14]
add eax, 0x10
mov dword [ebp - 8], ebx
mov ecx, dword [edi + 0x430]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x4078ba
push dword [eax]
push dword [ebx]
push dword [edi + 0x434]
call ecx
add esp, 0xc
jmp 0x4078c0
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x41c]
xorps xmm0, xmm0
mov eax, dword [ebx]
imul eax, ecx
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
cdq
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], edx
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push ecx
push dword [eax]
push dword [edi + 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407906
mov ebx, 1
jmp 0x407944
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, 0xa0
test ebx, ebx
cmove ebx, eax
test esi, esi
je 0x407942
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x407932
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, ebx
mov dword [esi], 0x19
call fcn.0041b480
mov dword [esi + 4], eax
xor ebx, ebx
mov ecx, dword [edi + 0x42c]
test ecx, ecx
je 0x407971
cmp dword [ebp + 8], 0
jne 0x40795c
test ebx, ebx
jne 0x407a16
mov eax, dword [ebp - 4]
push dword [eax]
mov eax, dword [ebp - 8]
push dword [eax]
push dword [edi + 0x434]
call ecx
add esp, 0xc
test ebx, ebx
jne 0x407a16
mov dword [edi + 0x428], 0x3e8
test esi, esi
je 0x407a0d
mov edi, dword [esi + 4]
lea edx, [ebp - 0x14]
mov dword [esi], 0x19
mov ecx, dword [0x4478b4]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push edx
mov eax, dword [ecx]
add eax, 0x4478b4
push 0x10
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 0xc
test eax, eax
jne 0x4079c3
mov ecx, 0x4479a8
mov ebx, ecx
jmp 0x4079d0
xor eax, eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
test eax, eax
jne 0x4079f1
test edi, edi
je 0x407a0a
mov ecx, dword [edi]
mov eax, dword [ecx]
add eax, edi
push eax
mov eax, dword [ecx + 4]
call eax
mov ecx, ebx
add esp, 4
mov dword [esi + 4], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [eax + 0xc]
mov dword [eax], edi
mov dword [eax + 4], 0x4478c4
mov dword [eax + 8], 0x3e8
mov dword [ecx], 0x447a8c
mov dword [esi + 4], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
and dword [eax + 0x18], 0xfffffffe
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4081c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 2
push eax
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edx
push eax
push dword [ecx + 0x438]
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408233
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xa0
test esi, esi
cmove esi, eax
test edi, edi
je 0x408270
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x408260
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, esi
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.00425576
mov esp, ebp
pop ebp
ret