joyce8/EMBER2024-capa huggingface dataset:
Function at 0x727d40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
push 0x5c
push edi
call fcn.00725178
add esp, 8
add eax, 2
mov ecx, dword [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00727c20
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x727eb0
cmp dword [ebp + 0xc], 0
je 0x727dbc
cmp dword [ebp + 0x10], 0
je 0x727dbc
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00727c20
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x727eb0
push 0
mov edx, dword [ebp - 8]
push edx
call sub.kernel32.dll_CreateDirectoryW
mov ecx, dword [ebp - 8]
push ecx
call fcn.00724ba4
pop ecx
push 1
push ebx
call fcn.0072c53c
test eax, eax
jne 0x727dd1
mov dword [ebp - 4], 1
jmp 0x727de9
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
call fcn.0072c250
test eax, eax
jne 0x727de9
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jle 0x727eab
push 1
push 0
push ebx
push edi
call fcn.0072c3e4
mov esi, eax
test esi, esi
jne 0x727eab
push ebx
call fcn.007251dc
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x727eb0
push 8
push 0x798108
mov eax, dword [ebp - 0xc]
push eax
call fcn.00724c48
pop ecx
sub eax, 4
add eax, eax
add eax, dword [ebp - 0xc]
push eax
call fcn.00724bdc
add esp, 0xc
push 1
push 0
mov edx, dword [ebp - 0xc]
push edx
push edi
call fcn.0072c3e4
mov esi, eax
test esi, esi
jne 0x727e6b
call sub.kernel32.dll_GetLastError_2
mov edi, eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00724ba4
pop ecx
push edi
call sub.kernel32.dll_SetLastError
jmp 0x727eb0
push 1
push 5
push ebx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0072c45c
mov esi, eax
test esi, esi
jne 0x727e98
call sub.kernel32.dll_GetLastError_2
mov edi, eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00724ba4
pop ecx
push edi
call sub.kernel32.dll_SetLastError
jmp 0x727eb0
mov edx, dword [ebp - 0xc]
push edx
call fcn.00724ba4
pop ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 1
mov esi, 1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebx
call fcn.00724ba4
pop ecx
push edi
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x728134
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
push 0
push 0
call sub.kernel32.dll_GetTempPathW
mov esi, eax
test esi, esi
je 0x7281b0
cmp dword [ebp + 8], 0
je 0x72815f
mov eax, dword [ebp + 8]
push eax
call fcn.00724c48
pop ecx
jmp 0x728161
xor eax, eax
add esi, eax
inc esi
mov edx, esi
add edx, edx
push edx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x7281b0
push ebx
push esi
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x7281b0
cmp dword [ebp + 8], 0
je 0x728193
mov eax, dword [ebp + 8]
push eax
push ebx
call fcn.00725138
add esp, 8
push ebx
call fcn.00724c48
pop ecx
mov esi, eax
cmp word [ebx + esi*2 - 2], 0x5c
jne 0x7281ab
mov word [ebx + esi*2 - 2], 0
mov edi, 1
call sub.kernel32.dll_GetLastError_2
mov esi, eax
test edi, edi
jne 0x7281c4
push ebx
call fcn.00724ba4
pop ecx
xor ebx, ebx
push esi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x728308
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
push esi
call fcn.00724c48
pop ecx
add eax, eax
add eax, 2
push eax
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x728333
xor eax, eax
jmp 0x7283c2
push esi
push ebx
call fcn.00724fcc
add esp, 8
xor esi, esi
push 0x5c
add esi, esi
add esi, ebx
add esi, 2
push esi
call fcn.007251a8
add esp, 8
test eax, eax
jne 0x728374
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x72836d
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
jne 0x7283ac
mov edi, 1
jmp 0x7283ac
mov esi, eax
sub esi, ebx
shr esi, 1
test esi, esi
jbe 0x728386
cmp word [ebx + esi*2 - 2], 0x3a
je 0x72833f
mov word [ebx + esi*2], 0
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x7283a4
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
jne 0x7283ac
mov word [ebx + esi*2], 0x5c
jmp 0x72833f
call sub.kernel32.dll_GetLastError_2
mov esi, eax
push ebx
call fcn.00724ba4
pop ecx
push esi
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x7283cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00724c48
pop ecx
mov esi, eax
add esi, esi
mov eax, esi
shr eax, 1
cmp word [edi + eax*2 - 2], 0x5c
jne 0x7283f2
sub esi, 2
lea edx, [esi + 4]
push edx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x72844e
push esi
push edi
push ebx
call fcn.00724bdc
add esp, 0xc
add esi, ebx
push 4
push 0x7981ce
push esi
call fcn.00724bdc
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x1e
push 0
push eax
call fcn.00724bbc
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], ebx
add esp, 0xc
mov word [ebp - 0x10], 0x414
lea edx, [ebp - 0x20]
push edx
call sub.Shell32.dll_SHFileOperationW
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_2
mov esi, eax
push ebx
call fcn.00724ba4
pop ecx
push esi
call sub.kernel32.dll_SetLastError
test esi, esi
sete al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7285e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0
je 0x728602
mov eax, dword [ebp + 8]
push eax
call fcn.00724c48
pop ecx
mov esi, eax
jmp 0x728604
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x79826a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
test ebx, ebx
je 0x72865d
push ebx
call sub.kernel32.dll_SetLastError
push 1
call sub.kernel32.dll_GetLastError_2
push eax
push 0x7982e4
call fcn.0072d860
add esp, 8
push eax
push 0xbed
push 0x7982ba
push 0x7982ae
push 1
call fcn.0072d754
xor eax, eax
jmp 0x72876a
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0x3c
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x84]
push eax
mov edx, dword [ebp - 8]
inc dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.advapi32.dll_RegEnumKeyExW
mov ebx, eax
cmp ebx, 0xea
je 0x728662
cmp ebx, 0x103
jne 0x7286a3
mov ebx, 2
test ebx, ebx
je 0x7286b2
push ebx
call sub.kernel32.dll_SetLastError
jmp 0x728752
cmp esi, dword [ebp - 0xc]
ja 0x728662
test esi, esi
je 0x7286d3
push esi
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x84]
push edx
call fcn.00725214
add esp, 0xc
test eax, eax
jne 0x728662
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebp - 0x84]
push eax
call fcn.0072b37c
test eax, eax
je 0x728662
cmp dword [ebp + 0x10], 0
jbe 0x7286fb
dec dword [ebp + 0x10]
jmp 0x728662
mov edi, 1
test edi, edi
je 0x728752
lea eax, [ebp - 0x84]
push eax
call fcn.00724c48
pop ecx
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x1c], 0
je 0x728723
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0xc]
jae 0x728739
xor edi, edi
push 0xea
call sub.kernel32.dll_SetLastError
jmp 0x728752
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x84]
add eax, eax
push eax
push edx
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00724bdc
add esp, 0xc
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x728b90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
lea eax, [ebp - 0x20c]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00728ad0
add esp, 8
lea eax, [ebp - 4]
mov ebx, 0x2001f
lea edx, [ebp - 0x20c]
push 0
push eax
push 0
push ebx
push 0
push 0
push 0
push edx
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
je 0x728be2
push ebx
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x728c16
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
sete al
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x72b0c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 0xc]
push 0x20019
mov eax, dword [ebp + 8]
push eax
call fcn.0072b008
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x72b132
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
lea edx, [ebp - 4]
push eax
push edi
push edx
push 0
push 0x79978c
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x72b11a
xor ecx, ecx
mov dword [edi], ecx
push eax
call sub.kernel32.dll_SetLastError
jmp 0x72b132
cmp dword [ebp - 4], 4
je 0x72b12d
xor eax, eax
mov dword [edi], eax
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0x72b132
mov esi, 1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
test ebx, ebx
je 0x72b143
push ebx
call sub.advapi32.dll_RegCloseKey_1
push edi
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x72b154
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 0x2001f
mov eax, dword [ebp + 8]
xor esi, esi
push eax
call fcn.0072b008
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x72b1d9
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x7997b4
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x72b1a0
cmp dword [ebp - 4], 4
je 0x72b1b0
push 0x7997dc
push ebx
call sub.advapi32.dll_RegDeleteValueW
xor eax, eax
mov dword [ebp - 8], eax
inc dword [ebp - 8]
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x799804
push ebx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x72b1d4
push eax
call sub.kernel32.dll_SetLastError
jmp 0x72b1d9
mov esi, 1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
test ebx, ebx
je 0x72b1ea
push ebx
call sub.advapi32.dll_RegCloseKey_1
push edi
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72b1fc
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 0x2001f
mov eax, dword [ebp + 8]
xor esi, esi
push eax
call fcn.0072b008
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x72b2a2
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x79982c
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x72b24c
cmp dword [ebp - 4], 4
je 0x72b25e
push 0x799854
push ebx
call sub.advapi32.dll_RegDeleteValueW
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x72b261
dec dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [edx], ecx
cmp dword [ebp - 8], 0
jne 0x72b27c
push 0x79987c
push ebx
call sub.advapi32.dll_RegDeleteValueW
jmp 0x72b29d
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.InstallationCounter
push ebx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x72b29d
push eax
call sub.kernel32.dll_SetLastError
jmp 0x72b2a2
mov esi, 1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
test ebx, ebx
je 0x72b2b3
push ebx
call sub.advapi32.dll_RegCloseKey_1
push edi
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x72b2c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edi, edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x72b2f3
push 0x16a6
push 0x7998d9
push 0x7998cc
call fcn.00724ad4
add esp, 0xc
push 0
push esi
push ebx
call fcn.0072b37c
test eax, eax
je 0x72b307
mov eax, 1
jmp 0x72b373
push 0x2001f
push ebx
call fcn.0072b008
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x72b35a
lea edx, [ebp - 0x20c]
push edx
push esi
call fcn.0072afa0
add esp, 8
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push 4
push ecx
push 4
lea eax, [ebp - 0x20c]
push 0
push eax
push ebx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x72b355
push eax
call sub.kernel32.dll_SetLastError
jmp 0x72b35a
mov edi, 1
call sub.kernel32.dll_GetLastError_2
mov esi, eax
test ebx, ebx
je 0x72b36b
push ebx
call sub.advapi32.dll_RegCloseKey_1
push esi
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72b37c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
mov edx, dword [ebp + 8]
push edx
call fcn.0072b008
add esp, 8
mov esi, eax
test esi, esi
jne 0x72b3ae
xor eax, eax
jmp 0x72b49e
test edi, edi
je 0x72b3c2
lea edx, [ebp - 0x214]
push edx
push edi
call fcn.0072afa0
add esp, 8
test edi, edi
je 0x72b3f7
cmp dword [ebp + 0x10], 0
jne 0x72b3f7
push 0
lea ecx, [ebp - 4]
push 0
push ecx
lea eax, [ebp - 0x214]
push 0
push eax
push esi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x72b491
mov dword [ebp - 8], 1
jmp 0x72b491
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
push 0
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0xc]
push 0
push edx
lea ecx, [ebp - 0x41c]
push ecx
push ebx
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x72b491
push 4
lea eax, [ebp - 0x41c]
push eax
push 0x799904
call fcn.00725214
add esp, 0xc
test eax, eax
jne 0x72b48b
test edi, edi
jne 0x72b447
mov dword [ebp - 8], 1
jmp 0x72b491
test edi, edi
je 0x72b451
cmp dword [ebp + 0x10], 0
jne 0x72b468
push 0x1712
push 0x799933
push str.Guid___NULL__AnotherThanSpecified
call fcn.00724ad4
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x41c]
push ecx
call fcn.00724e48
add esp, 8
test eax, eax
je 0x72b48b
mov dword [ebp - 8], 1
jmp 0x72b491
inc ebx
jmp 0x72b3f9
test esi, esi
je 0x72b49b
push esi
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x72b4a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
push 0x20019
mov ecx, dword [ebp + 8]
push ecx
call fcn.0072b008
add esp, 8
mov esi, eax
test esi, esi
jne 0x72b4d8
xor eax, eax
jmp 0x72b54f
xor ebx, ebx
mov dword [ebp - 8], 0x104
push 0
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 8]
push 0
push edx
lea ecx, [ebp - 0x210]
push ecx
push ebx
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
je 0x72b514
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x103
jne 0x72b536
mov edi, 1
jmp 0x72b536
push 4
lea eax, [ebp - 0x210]
push eax
push str.Guid
call fcn.00725214
add esp, 0xc
test eax, eax
jne 0x72b533
mov edx, dword [ebp + 0xc]
inc dword [edx]
inc ebx
jmp 0x72b4da
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
test esi, esi
je 0x72b547
push esi
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x72b558
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jne 0x72b584
push 0x1772
push str.....DriverLibrariesDrvSupLibinstall.c
push str.Guid___NULL
call fcn.00724ad4
add esp, 0xc
push 0x2001f
mov eax, dword [ebp + 8]
push eax
call fcn.0072b008
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x72b5c9
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.0072afa0
add esp, 8
lea edx, [ebp - 0x208]
push edx
push ebx
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
je 0x72b5c4
push eax
call sub.kernel32.dll_SetLastError
jmp 0x72b5c9
mov esi, 1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
test ebx, ebx
je 0x72b5da
push ebx
call sub.advapi32.dll_RegCloseKey_1
push edi
call sub.kernel32.dll_SetLastError
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72b74c
Capabilities:
Create service
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
xor edx, edx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 0x20], 0
jne 0x72b87d
push 0x208
call fcn.00724b84
pop ecx
mov esi, eax
test esi, esi
je 0x72b945
push 0x104
push esi
call sub.kernel32.dll_GetSystemDirectoryW
mov edi, eax
test edi, edi
je 0x72b945
cmp word [esi + edi*2 - 2], 0x5c
jne 0x72b7ab
mov word [esi + edi*2 - 2], 0
push 0x5c
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00725178
add esp, 8
mov edi, eax
test edi, edi
je 0x72b81e
add edi, 2
push esi
call fcn.00724c48
pop ecx
mov ebx, eax
push 0x799aae
call fcn.00724c48
pop ecx
add ebx, eax
push edi
call fcn.00724c48
pop ecx
add ebx, eax
add ebx, ebx
add ebx, 2
push ebx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x72b945
push esi
push ebx
call fcn.00724fcc
add esp, 8
push 0x799ac2
push ebx
call fcn.00725138
add esp, 8
push edi
push ebx
call fcn.00725138
add esp, 8
jmp 0x72b8e0
push esi
call fcn.00724c48
pop ecx
mov ebx, eax
push 0x799ad6
call fcn.00724c48
pop ecx
add ebx, eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00724c48
pop ecx
add ebx, eax
add ebx, ebx
add ebx, 2
push ebx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x72b945
push esi
push ebx
call fcn.00724fcc
add esp, 8
push str.drivers_
push ebx
call fcn.00725138
add esp, 8
mov eax, dword [ebp + 0x1c]
push eax
push ebx
call fcn.00725138
add esp, 8
jmp 0x72b8e0
push 0x5c
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00725178
add esp, 8
mov edi, eax
add edi, 2
mov eax, dword [ebp + 0x20]
push eax
call fcn.00724c48
pop ecx
mov ebx, eax
push edi
call fcn.00724c48
pop ecx
add ebx, eax
add ebx, ebx
add ebx, 4
push ebx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x72b945
mov eax, dword [ebp + 0x20]
push eax
push ebx
call fcn.00724fcc
add esp, 8
push 0x799afe
push ebx
call fcn.00725138
add esp, 8
push edi
push ebx
call fcn.00725138
add esp, 8
push 1
push 0
push ebx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.0072c3e4
test eax, eax
je 0x72b945
push 2
push 0
push 0
call sub.Advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x72b945
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0x24]
push ecx
push ebx
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
push ecx
call sub.Advapi32.dll_CreateServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x72b945
mov dword [ebp - 4], 1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebx
call fcn.00724ba4
pop ecx
push esi
call fcn.00724ba4
cmp dword [ebp - 0xc], 0
pop ecx
je 0x72b969
mov eax, dword [ebp - 0xc]
push eax
call sub.Advapi32.dll_CloseServiceHandle
cmp dword [ebp - 8], 0
je 0x72b978
mov edx, dword [ebp - 8]
push edx
call sub.Advapi32.dll_CloseServiceHandle
push edi
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x72ba9c
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.Advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
je 0x72bb37
push 0x10
mov eax, dword [ebp + 8]
push eax
push esi
call sub.Advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
je 0x72bb37
push 0
push 0
push ebx
call sub.Advapi32.dll_StartServiceW
mov edi, eax
test edi, edi
jne 0x72bb37
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x420
jne 0x72baf7
mov edi, 1
jmp 0x72bb37
mov dword [ebp - 8], 0xa
jmp 0x72bb2c
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.Advapi32.dll_QueryServiceStatus
test eax, eax
je 0x72bb37
mov edx, dword [ebp - 0x20]
sub edx, 2
je 0x72bb22
sub edx, 2
jne 0x72bb37
mov edi, 1
jmp 0x72bb37
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 8]
add dword [ebp - 8], 0xffffffff
test eax, eax
jne 0x72bb00
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 4], eax
test esi, esi
je 0x72bb49
push esi
call sub.Advapi32.dll_CloseServiceHandle
test ebx, ebx
je 0x72bb53
push ebx
call sub.Advapi32.dll_CloseServiceHandle
mov edx, dword [ebp - 4]
push edx
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x72bb68
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
push 0xf003f
push 0
push 0
call sub.Advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x72bbc2
push 0x20
mov eax, dword [ebp + 8]
push eax
push ebx
call sub.Advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x72bbc2
cmp dword [ebp + 0xc], 0
je 0x72bbac
mov eax, dword [ebp + 8]
push eax
call dword [ebp + 0xc]
test eax, eax
je 0x72bbc2
lea edx, [ebp - 0x20]
push edx
push 1
push esi
call sub.Advapi32.dll_ControlService
test eax, eax
setne cl
and ecx, 1
mov edi, ecx
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 4], eax
test esi, esi
je 0x72bbd4
push esi
call sub.Advapi32.dll_CloseServiceHandle
test ebx, ebx
je 0x72bbde
push ebx
call sub.Advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetLastError
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x72be74
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
xor eax, eax
xor esi, esi
xor edi, edi
mov dword [esp + 8], eax
mov eax, dword [0x7999a0]
mov dword [esp + 0xc], eax
mov ax, word [0x7999a4]
mov word [esp + 0x10], ax
push 0
push 8
call fcn.0072be00
add esp, 8
mov dword [esp], eax
cmp dword [esp], 0
je 0x72bf8d
lea edx, [esp + 4]
push edx
push 0
push 0
push 2
mov ecx, dword [esp + 0x10]
push ecx
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
test edi, edi
je 0x72bee6
push 0x2a2
push 0x799b30
push 0x799b28
call fcn.00724ad4
add esp, 0xc
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
jne 0x72bf8d
mov eax, dword [esp + 4]
push eax
call fcn.00724b84
pop ecx
mov esi, eax
test esi, esi
je 0x72bf8d
lea eax, [esp + 4]
push eax
mov edx, dword [esp + 8]
push edx
push esi
push 2
mov ecx, dword [esp + 0x10]
push ecx
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
test edi, edi
je 0x72bf8d
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea edx, [esp + 0x34]
push edx
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
jne 0x72bf56
xor ecx, ecx
mov dword [esp + 8], ecx
jmp 0x72bf8d
xor edi, edi
xor ebp, ebp
lea ebx, [esi + 4]
jmp 0x72bf82
mov eax, dword [ebx]
push eax
mov edx, dword [esp + 0xc]
push edx
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x72bf7e
test byte [ebx + 4], 4
setne cl
and ecx, 1
mov edi, ecx
jmp 0x72bf86
inc ebp
add ebx, 8
cmp ebp, dword [esi]
jb 0x72bf5f
push 0
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp dword [esp], 0
je 0x72bfa3
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
push esi
call fcn.00724ba4
pop ecx
cmp dword [esp + 8], 0
je 0x72bfbb
mov edx, dword [esp + 8]
push edx
call sub.advapi32.dll_FreeSid
push ebx
call sub.kernel32.dll_SetLastError
mov eax, edi
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret