joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e740
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x4488c0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
push 0x44dbe8
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x58], ebp
call fcn.004057e0
push str.Service
push str.__s_
push 0x4575e0
xor eax, eax
mov byte [esp + 0x58], 1
call fcn.00419140
add dword [0x457600], 1
mov eax, dword [esp + 0x34]
add esp, 0xc
cmp dword [esp + 0x3c], 8
jae 0x40e7d0
lea eax, [esp + 0x28]
push eax
push str.Deleting_service:__s
push 0x4575e0
xor eax, eax
call fcn.00419140
add esp, 0xc
push 0xf003f
push ebp
push ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x14], ebx
jne 0x40e806
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebp
mov edi, esi
jne 0x40e881
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x40e81b
lea eax, [esp + 0x28]
push 4
push eax
push ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebp
jne 0x40e835
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebp
jne 0x40e85d
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40e855
cmp esi, ebp
je 0x40e851
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x40e85d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebp
je 0x40e868
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, ebp
mov dword [esp + 0x18], ebp
je 0x40e877
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
cmp edi, ebp
mov dword [esp + 0x14], ebx
je 0x40e899
push edi
push str.Error_removing_service__0x_X_
push 0x4575e0
mov eax, 2
call fcn.00419140
add esp, 0xc
sub dword [0x457600], 1
cmp dword [esp + 0x3c], 8
jb 0x40e8b4
mov edx, dword [esp + 0x28]
push edx
call fcn.00422b32
add esp, 4
cmp ebx, ebp
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
je 0x40e8d0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00422b23
add esp, 0x3c
ret 4
Function at 0x40ece0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x448818
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.Unregister_COM
push str.__s_
push 0x4575e0
xor eax, eax
mov esi, ecx
call fcn.00419140
add dword [0x457600], 1
add esp, 0xc
push 0x44dc44
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004057e0
mov dword [esp + 0x30], 0
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x40ed58
lea eax, [esp + 0xc]
push eax
push str.Unregistering_DLL__s
push 0x4575e0
xor eax, eax
call fcn.00419140
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x40ed7c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x40edaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [edi + 0x38], eax
push str.__Unable_to_load_DLL__0x_8X_
push 0x4575e0
lea eax, [esi + 2]
call fcn.00419140
add esp, 0xc
jmp 0x40ee02
push str.DllUnregisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40edda
push str.__Unable_to_find_entry_point
push 0x4575e0
mov eax, 2
mov dword [edi + 0x38], 0x65b
call fcn.00419140
add esp, 8
jmp 0x40edfb
call eax
test eax, eax
jge 0x40edfb
push eax
mov dword [edi + 0x38], eax
push str.__Error_while_attempting_to_unregister__0x_8X_
push 0x4575e0
mov eax, 2
call fcn.00419140
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub dword [0x457600], 1
cmp dword [esp + 0x20], 8
jb 0x40ee1d
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00422b32
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00422b23
add esp, 0x2c
ret
Function at 0x416100
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x448058
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00403460
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416154
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00413ae0
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00403460
cmp dword [esp + 0x24], 8
jb 0x41619a
mov eax, dword [esp + 0x10]
push eax
call fcn.00422b32
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x417d40
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Get file attributes

Disassembly:
sub esp, 0x220
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
mov ebx, edx
lea edx, [esp + 0x20]
push 0x104
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call fcn.004231e5
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417ef3
test al, 0x10
jne 0x417ef3
push edi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x417df7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x417df7
test edi, edi
jle 0x417ddd
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00422b23
add esp, 0x220
ret
lea edx, [esp + 0xc]
push edx
push 0x44a3cc
push 1
push 0
push 0x44a3dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jl 0x417ddd
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test eax, eax
jl 0x417ddf
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417e30
sub eax, edx
sar eax, 1
jne 0x417e63
push esi
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.004231e5
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ebx, [esp + 0x20]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push ebx
push eax
mov eax, dword [edx + 0x24]
call eax
test eax, eax
jl 0x417ddf
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jl 0x417ddf
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
test eax, eax
jl 0x417ddf
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x44a3ec
push eax
mov eax, dword [ecx]
call eax
mov edi, eax
test edi, edi
jl 0x417ee2
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x417ddd
mov ecx, dword [esp + 0x224]
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.00422b23
add esp, 0x220
ret
Function at 0x417f10
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x417f3b
xor eax, eax
pop edi
add esp, 8
ret
push ebx
push ebp
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ebp, [esi + 2]
push ebp
call fcn.0042260a
push ebp
mov ebx, eax
push 0
push ebx
call fcn.0042a660
add esp, 0x10
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xfe
jbe 0x417f86
mov esi, 0xfe
jmp 0x417f89
and esi, 0xfffffffe
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x417fdf
cmp byte [ebx], 0xff
jne 0x417fb4
cmp byte [ebx + 1], 0xfe
jne 0x417fb4
mov eax, dword [esp + 0x1c]
lea edx, [ebx + 2]
push eax
call fcn.00402090
jmp 0x418076
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417fc0
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.004030c0
jmp 0x418076
cmp byte [ebx], 0xef
mov dword [esp + 0x10], ebx
jne 0x417ffb
cmp byte [ebx + 1], 0xbb
jne 0x417ffb
cmp byte [ebx + 2], 0xbf
jne 0x417ffb
lea ecx, [ebx + 3]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
push 0
push 0
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
xor ecx, ecx
lea esi, [ebp + 2]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042260a
push esi
mov edi, eax
push 0
push edi
call fcn.0042a660
mov eax, dword [esp + 0x20]
add esp, 0x10
push ebp
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418053
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.004030c0
push edi
call fcn.00422b32
add esp, 4
push ebx
call fcn.00422b32
add esp, 4
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 8
ret
Function at 0x418460
Capabilities:
Get file version info

Disassembly:
sub esp, 0x220
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, ecx
test ebx, ebx
push esi
push edi
jne 0x418492
push 0x208
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ebx, [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x4184bd
xor edx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00422b23
add esp, 0x220
ret
push edi
call fcn.0042260a
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x44d9c8
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov ebx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
xor edx, edx
xor edi, edi
push esi
or edi, ecx
or ebx, edx
call fcn.00422b32
mov ecx, dword [esp + 0x228]
add esp, 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
xor ecx, esp
call fcn.00422b23
add esp, 0x220
ret
Function at 0x418520
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x668
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x664], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x67c]
push edi
lea eax, [esp + 0x46c]
push 0x104
push eax
xor esi, esi
call fcn.004231e5
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
push 0x44e920
lea ecx, [esp + 0x46c]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x418590
xor eax, eax
jmp 0x418690
mov ecx, 0x44e978
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4185c6
test dx, dx
je 0x4185c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4185c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4185a0
xor eax, eax
jmp 0x4185cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41865b
mov ecx, 0x44e97c
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418606
test dx, dx
je 0x418602
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418606
add eax, 4
add ecx, 4
test dx, dx
jne 0x4185e0
xor eax, eax
jmp 0x41860b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41865b
push edi
lea ecx, [esp + 0x264]
push 0x104
push ecx
call fcn.004231e5
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x264]
push eax
call ebx
test byte [esp + 0x10], 0x10
je 0x41864d
lea ecx, [esp + 0x260]
push ecx
call fcn.00418520
add esp, 4
jmp 0x41865b
lea edx, [esp + 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x418677
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x418680
cmp esi, 0x12
jne 0x418590
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, esi
mov ecx, dword [esp + 0x674]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422b23
add esp, 0x668
ret

Function at 0x4186b0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.temp
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
push 0
push 0x44eb38
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00422b23
add esp, 0x20c
ret
Function at 0x418720
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x670
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x66c], eax
mov eax, dword [esp + 0x674]
push ebx
mov ebx, dword [esp + 0x67c]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x474]
push 0x104
push eax
mov esi, ecx
xor edi, edi
call fcn.004231e5
add esp, 0xc
lea ecx, [esp + 0x470]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ebx
lea edx, [esp + 0x474]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4187a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4188da
mov ebp, dword [esp + 0x68c]
nop
mov ecx, 0x44e978
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4187e6
test dx, dx
je 0x4187e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4187e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4187c0
xor eax, eax
jmp 0x4187eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41889e
mov ecx, 0x44e97c
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418826
test dx, dx
je 0x418822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418826
add eax, 4
add ecx, 4
test dx, dx
jne 0x418800
xor eax, eax
jmp 0x41882b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41889e
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x26c]
push 0x104
push eax
call fcn.004231e5
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x26c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [esp + 0x18], 0x10
push ebp
je 0x418886
push ebx
lea eax, [esp + 0x270]
push eax
mov ecx, esi
call fcn.00418720
mov edx, dword [esi]
mov edx, dword [edx + 4]
mov edi, eax
push ebp
lea eax, [esp + 0x26c]
push eax
jmp 0x418892
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [esp + 0x26c]
push ecx
mov ecx, esi
call edx
test al, al
jne 0x4188f5
test edi, edi
jne 0x4188c6
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4187b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x4187b0
cmp edi, 0x12
jne 0x4188cd
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422b23
add esp, 0x670
ret 0xc
mov edi, 0x4c7
jmp 0x4188cd
Function at 0x419140
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x1c], 8
mov esi, eax
jb 0x419155
mov eax, dword [edi + 8]
jmp 0x419158
lea eax, [edi + 8]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4192be
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, 1
jne 0x419195
mov esi, 0x44f648
jmp 0x4191a4
cmp esi, 2
mov esi, str._
je 0x4191a4
mov esi, 0x44cf34
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4191b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebp
call ebx
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4191e0
sub eax, edx
mov edx, dword [edi + 0x20]
sar eax, 1
add edx, edx
test edx, edx
mov esi, eax
mov eax, 0x45a228
jle 0x41921f
mov ecx, edx
shr ecx, 1
mov eax, 0x200020
mov edi, 0x45a228
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
lea eax, [edx*2 + 0x45a228]
mov word [eax], 0
mov ecx, dword [edi + 0x20]
push 0
add ecx, ecx
lea eax, [esp + 0x14]
push eax
sub ecx, esi
add ecx, ecx
push ecx
push 0x45a228
push ebp
call ebx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00424af9
mov esi, eax
add esi, 3
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042260a
mov ecx, dword [esp + 0x28]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
push edi
call fcn.00424c8e
push 0x44f65c
push esi
push edi
call fcn.00424ca9
mov eax, edi
add esp, 0x28
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419290
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push ebp
call ebx
push edi
call fcn.00422b32
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x419cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44988e
mov eax, dword fs:[0]
push eax
push ebx
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea eax, [edi + 0x248]
mov dword [esp + 0x14], 2
call fcn.00411fc0
cmp dword [edi + 0x30], 8
jb 0x419d3b
mov eax, dword [edi + 0x1c]
push eax
call fcn.00422b32
add esp, 4
xor ebx, ebx
mov dword [edi + 0x30], 7
mov dword [edi + 0x2c], ebx
lea eax, [edi + 0xc]
mov word [edi + 0x1c], bx
mov byte [esp + 0x14], bl
call fcn.004024e0
mov dword [esp + 0x14], 0xffffffff
call fcn.00410a30
mov eax, dword [edi + 4]
push eax
call fcn.00422b32
add esp, 4
mov dword [edi + 4], ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0xc
ret 4
Function at 0x41a4d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edx, esi
call fcn.00401220
mov esi, eax
neg esi
sbb esi, esi
mov edx, str.report
add esi, 1
call fcn.004015c0
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x41a536
mov ecx, str.report
call fcn.00401690
push eax
push 0x104
lea eax, [esp + 0x30]
push eax
jmp 0x41a56c
push 0x104
push 0x459e18
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x459e18
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.IntelLogs
push 0x459e18
call ebx
push 0x459e18
push 0x104
lea ecx, [esp + 0x30]
push ecx
call fcn.004231e5
add esp, 0xc
push str.IntelControlCenter.log
lea edx, [esp + 0x2c]
push edx
call ebx
lea ecx, [esp + 0x28]
call fcn.00418e00
test esi, esi
je 0x41a5e2
lea esi, [esp + 0xc]
call fcn.00419390
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x41a5a5
mov eax, dword [eax + 4]
jmp 0x41a5a8
add eax, 4
push eax
push str.Error_in_command_line:__s
push 0x4575e0
mov eax, 2
call fcn.00419140
add esp, 0xc
cmp dword [esp + 0x24], esi
jb 0x41a5d3
mov eax, dword [esp + 0x10]
push eax
call fcn.00422b32
add esp, 4
mov dword [0x457604], 0xffffffff
jmp 0x41a681
mov edx, str.noinstall
call fcn.004015c0
test eax, eax
je 0x41a5fc
mov ecx, edi
call fcn.0041a190
jmp 0x41a681
mov edx, str.install
call fcn.004015c0
test eax, eax
je 0x41a613
mov ecx, edi
call fcn.00419510
jmp 0x41a681
mov edx, str.uninstall
call fcn.004015c0
test eax, eax
je 0x41a657
push 0x104
lea ecx, [esp + 0x234]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [esp + 0x230]
call fcn.0041d9f0
call fcn.00419d90
jmp 0x41a681
mov edx, str.pack
call fcn.004015c0
test eax, eax
je 0x41a66c
call fcn.004193d0
jmp 0x41a681
mov edx, str.unpack
call fcn.004015c0
test eax, eax
je 0x41a681
mov ecx, edi
call fcn.00419470
call fcn.004190c0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x43c]
mov eax, dword [0x457604]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422b23
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41b5c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4474db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042200d
push 4
mov dword [esp + 0x20], 0
call fcn.00422ea8
mov edi, eax
add esp, 4
test edi, edi
je 0x41b640
call fcn.00421f29
mov dword [edi], eax
call fcn.00421d5d
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0042246d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x41b635
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0042248e
jmp 0x41b642
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4