joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e840
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x448410
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
push 0x44dbd0
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x58], ebp
call fcn.00405890
push str.Service
push str.__s_
push 0x4575d0
xor eax, eax
mov byte [esp + 0x58], 1
call fcn.00419220
add dword [0x4575f0], 1
mov eax, dword [esp + 0x34]
add esp, 0xc
cmp dword [esp + 0x3c], 8
jae 0x40e8d0
lea eax, [esp + 0x28]
push eax
push str.Deleting_service:__s
push 0x4575d0
xor eax, eax
call fcn.00419220
add esp, 0xc
push 0xf003f
push ebp
push ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x14], ebx
jne 0x40e906
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebp
mov edi, esi
jne 0x40e981
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x40e91b
lea eax, [esp + 0x28]
push 4
push eax
push ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebp
jne 0x40e935
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebp
jne 0x40e95d
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40e955
cmp esi, ebp
je 0x40e951
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x40e95d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebp
je 0x40e968
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, ebp
mov dword [esp + 0x18], ebp
je 0x40e977
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
cmp edi, ebp
mov dword [esp + 0x14], ebx
je 0x40e999
push edi
push str.Error_removing_service__0x_X_
push 0x4575d0
mov eax, 2
call fcn.00419220
add esp, 0xc
sub dword [0x4575f0], 1
cmp dword [esp + 0x3c], 8
jb 0x40e9b4
mov edx, dword [esp + 0x28]
push edx
call fcn.00422ece
add esp, 4
cmp ebx, ebp
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], bp
je 0x40e9d0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00422834
add esp, 0x3c
ret 4
Function at 0x40ede0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x448368
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.Unregister_COM
push str.__s_
push 0x4575d0
xor eax, eax
mov esi, ecx
call fcn.00419220
add dword [0x4575f0], 1
add esp, 0xc
push 0x44dc2c
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00405890
mov dword [esp + 0x30], 0
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x40ee58
lea eax, [esp + 0xc]
push eax
push str.Unregistering_DLL__s
push 0x4575d0
xor eax, eax
call fcn.00419220
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x40ee7c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x40eeac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [edi + 0x38], eax
push str.__Unable_to_load_DLL__0x_8X_
push 0x4575d0
mov eax, 2
call fcn.00419220
add esp, 0xc
jmp 0x40ef04
push str.DllUnregisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40eedc
push str.__Unable_to_find_entry_point
push 0x4575d0
mov eax, 2
mov dword [edi + 0x38], 0x65b
call fcn.00419220
add esp, 8
jmp 0x40eefd
call eax
test eax, eax
jge 0x40eefd
push eax
mov dword [edi + 0x38], eax
push str.__Error_while_attempting_to_unregister__0x_8X_
push 0x4575d0
mov eax, 2
call fcn.00419220
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub dword [0x4575f0], 1
cmp dword [esp + 0x20], 8
jb 0x40ef1f
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00422ece
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00422834
add esp, 0x2c
ret
Function at 0x416210
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x448218
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00403570
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x416264
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00413b50
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00403570
cmp dword [esp + 0x24], 8
jb 0x4162aa
mov eax, dword [esp + 0x10]
push eax
call fcn.00422ece
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x417e50
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Get file attributes

Disassembly:
sub esp, 0x220
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
mov ebx, edx
lea edx, [esp + 0x20]
push 0x104
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call fcn.00422e62
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418003
test al, 0x10
jne 0x418003
push edi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x417f07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x417f07
test edi, edi
jle 0x417eed
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00422834
add esp, 0x220
ret
lea edx, [esp + 0xc]
push edx
push 0x44a3cc
push 1
push 0
push 0x44a3dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jl 0x417eed
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test eax, eax
jl 0x417eef
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417f40
sub eax, edx
sar eax, 1
jne 0x417f73
push esi
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.00422e62
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ebx, [esp + 0x20]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push ebx
push eax
mov eax, dword [edx + 0x24]
call eax
test eax, eax
jl 0x417eef
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jl 0x417eef
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
test eax, eax
jl 0x417eef
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x44a3ec
push eax
mov eax, dword [ecx]
call eax
mov edi, eax
test edi, edi
jl 0x417ff2
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x417eed
mov ecx, dword [esp + 0x224]
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.00422834
add esp, 0x220
ret
Function at 0x418020
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41804b
xor eax, eax
pop edi
add esp, 8
ret
push ebx
push ebp
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ebp, [esi + 2]
push ebp
call fcn.00422540
push ebp
mov ebx, eax
push 0
push ebx
call fcn.0042b5d0
add esp, 0x10
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xfe
jbe 0x418096
mov esi, 0xfe
jmp 0x418099
and esi, 0xfffffffe
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4180ef
cmp byte [ebx], 0xff
jne 0x4180c4
cmp byte [ebx + 1], 0xfe
jne 0x4180c4
mov eax, dword [esp + 0x1c]
lea edx, [ebx + 2]
push eax
call fcn.00402090
jmp 0x418186
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4180d0
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
push ebx
call fcn.004031d0
jmp 0x418186
cmp byte [ebx], 0xef
mov dword [esp + 0x10], ebx
jne 0x41810b
cmp byte [ebx + 1], 0xbb
jne 0x41810b
cmp byte [ebx + 2], 0xbf
jne 0x41810b
lea ecx, [ebx + 3]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
push 0
push 0
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
xor ecx, ecx
lea esi, [ebp + 2]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422540
push esi
mov edi, eax
push 0
push edi
call fcn.0042b5d0
mov eax, dword [esp + 0x20]
add esp, 0x10
push ebp
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418163
mov esi, dword [esp + 0x1c]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.004031d0
push edi
call fcn.00422ece
add esp, 4
push ebx
call fcn.00422ece
add esp, 4
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 8
ret
Function at 0x418570
Capabilities:
Get file version info

Disassembly:
sub esp, 0x220
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, ecx
test ebx, ebx
push esi
push edi
jne 0x4185a2
push 0x208
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ebx, [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x4185cd
xor edx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00422834
add esp, 0x220
ret
push edi
call fcn.00422540
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x44d9b0
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov ebx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
xor edx, edx
xor edi, edi
push esi
or edi, ecx
or ebx, edx
call fcn.00422ece
mov ecx, dword [esp + 0x228]
add esp, 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
xor ecx, esp
call fcn.00422834
add esp, 0x220
ret
Function at 0x418630
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x668
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x664], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x67c]
push edi
lea eax, [esp + 0x46c]
push 0x104
push eax
xor esi, esi
call fcn.00422e62
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
push 0x44e908
lea ecx, [esp + 0x46c]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4186a0
xor eax, eax
jmp 0x4187a0
mov ecx, 0x44e960
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4186d6
test dx, dx
je 0x4186d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4186d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4186b0
xor eax, eax
jmp 0x4186db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41876b
mov ecx, 0x44e964
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418716
test dx, dx
je 0x418712
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418716
add eax, 4
add ecx, 4
test dx, dx
jne 0x4186f0
xor eax, eax
jmp 0x41871b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41876b
push edi
lea ecx, [esp + 0x264]
push 0x104
push ecx
call fcn.00422e62
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x264]
push eax
call ebx
test byte [esp + 0x10], 0x10
je 0x41875d
lea ecx, [esp + 0x260]
push ecx
call fcn.00418630
add esp, 4
jmp 0x41876b
lea edx, [esp + 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x418787
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x418790
cmp esi, 0x12
jne 0x4186a0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, esi
mov ecx, dword [esp + 0x674]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422834
add esp, 0x668
ret

Function at 0x4187c0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.temp
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
push 0
push 0x44eb20
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00422834
add esp, 0x20c
ret
Function at 0x418830
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x670
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x66c], eax
mov eax, dword [esp + 0x674]
push ebx
mov ebx, dword [esp + 0x67c]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x474]
push 0x104
push eax
mov esi, ecx
xor edi, edi
call fcn.00422e62
add esp, 0xc
lea ecx, [esp + 0x470]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ebx
lea edx, [esp + 0x474]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4188b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4189ea
mov ebp, dword [esp + 0x68c]
nop
mov ecx, 0x44e960
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4188f6
test dx, dx
je 0x4188f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4188f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4188d0
xor eax, eax
jmp 0x4188fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4189ae
mov ecx, 0x44e964
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418936
test dx, dx
je 0x418932
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418936
add eax, 4
add ecx, 4
test dx, dx
jne 0x418910
xor eax, eax
jmp 0x41893b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4189ae
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x26c]
push 0x104
push eax
call fcn.00422e62
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x26c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [esp + 0x18], 0x10
push ebp
je 0x418996
push ebx
lea eax, [esp + 0x270]
push eax
mov ecx, esi
call fcn.00418830
mov edx, dword [esi]
mov edx, dword [edx + 4]
mov edi, eax
push ebp
lea eax, [esp + 0x26c]
push eax
jmp 0x4189a2
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [esp + 0x26c]
push ecx
mov ecx, esi
call edx
test al, al
jne 0x418a05
test edi, edi
jne 0x4189d6
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4188c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x4188c0
cmp edi, 0x12
jne 0x4189dd
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00422834
add esp, 0x670
ret 0xc
mov edi, 0x4c7
jmp 0x4189dd
Function at 0x419220
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x1c], 8
mov esi, eax
jb 0x419235
mov eax, dword [edi + 8]
jmp 0x419238
lea eax, [edi + 8]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41939e
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, 1
jne 0x419275
mov esi, 0x44f628
jmp 0x419284
cmp esi, 2
mov esi, str._
je 0x419284
mov esi, 0x44cf1c
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419290
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebp
call ebx
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4192c0
sub eax, edx
mov edx, dword [edi + 0x20]
sar eax, 1
add edx, edx
test edx, edx
mov esi, eax
mov eax, 0x45a228
jle 0x4192ff
mov ecx, edx
shr ecx, 1
mov eax, 0x200020
mov edi, 0x45a228
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
lea eax, [edx*2 + 0x45a228]
mov word [eax], 0
mov ecx, dword [edi + 0x20]
push 0
add ecx, ecx
lea eax, [esp + 0x14]
push eax
sub ecx, esi
add ecx, ecx
push ecx
push 0x45a228
push ebp
call ebx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00424b56
mov esi, eax
add esi, 3
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422540
mov ecx, dword [esp + 0x28]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
push edi
call fcn.00424ceb
push 0x44f63c
push esi
push edi
call fcn.00424d06
mov eax, edi
add esp, 0x28
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419370
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push ebp
call ebx
push edi
call fcn.00422ece
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x419dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4493de
mov eax, dword fs:[0]
push eax
push ebx
push edi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea eax, [edi + 0x248]
mov dword [esp + 0x14], 2
call fcn.00412030
cmp dword [edi + 0x30], 8
jb 0x419e1b
mov eax, dword [edi + 0x1c]
push eax
call fcn.00422ece
add esp, 4
xor ebx, ebx
mov dword [edi + 0x30], 7
mov dword [edi + 0x2c], ebx
lea eax, [edi + 0xc]
mov word [edi + 0x1c], bx
mov byte [esp + 0x14], bl
call fcn.004024e0
mov dword [esp + 0x14], 0xffffffff
call fcn.00410b30
mov eax, dword [edi + 4]
push eax
call fcn.00422ece
add esp, 4
mov dword [edi + 4], ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0xc
ret 4
Function at 0x41a5c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov edx, esi
call fcn.00401220
mov esi, eax
neg esi
sbb esi, esi
mov edx, str.report
add esi, 1
call fcn.004015c0
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x41a626
mov ecx, str.report
call fcn.00401690
push eax
push 0x104
lea eax, [esp + 0x30]
push eax
jmp 0x41a65c
push 0x104
push 0x459e18
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x459e18
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.IntelLogs
push 0x459e18
call ebx
push 0x459e18
push 0x104
lea ecx, [esp + 0x30]
push ecx
call fcn.00422e62
add esp, 0xc
push str.IntelControlCenter.log
lea edx, [esp + 0x2c]
push edx
call ebx
lea ecx, [esp + 0x28]
call fcn.00418ee0
test esi, esi
je 0x41a6d2
lea esi, [esp + 0xc]
call fcn.00419470
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x41a695
mov eax, dword [eax + 4]
jmp 0x41a698
add eax, 4
push eax
push str.Error_in_command_line:__s
push 0x4575d0
mov eax, 2
call fcn.00419220
add esp, 0xc
cmp dword [esp + 0x24], esi
jb 0x41a6c3
mov eax, dword [esp + 0x10]
push eax
call fcn.00422ece
add esp, 4
mov dword [0x4575f4], 0xffffffff
jmp 0x41a771
mov edx, str.noinstall
call fcn.004015c0
test eax, eax
je 0x41a6ec
mov ecx, edi
call fcn.0041a270
jmp 0x41a771
mov edx, str.install
call fcn.004015c0
test eax, eax
je 0x41a703
mov ecx, edi
call fcn.004195f0
jmp 0x41a771
mov edx, str.uninstall
call fcn.004015c0
test eax, eax
je 0x41a747
push 0x104
lea ecx, [esp + 0x234]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [esp + 0x230]
call fcn.0041db80
call fcn.00419e70
jmp 0x41a771
mov edx, str.pack
call fcn.004015c0
test eax, eax
je 0x41a75c
call fcn.004194b0
jmp 0x41a771
mov edx, str.unpack
call fcn.004015c0
test eax, eax
je 0x41a771
mov ecx, edi
call fcn.00419550
call fcn.004191a0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x43c]
mov eax, dword [0x4575f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422834
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41b6d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44702b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00421b36
push 4
mov dword [esp + 0x20], 0
call fcn.00423026
mov edi, eax
add esp, 4
test edi, edi
je 0x41b750
call fcn.00421d9c
mov dword [edi], eax
call fcn.00421bd0
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00422508
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x41b745
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00422529
jmp 0x41b752
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4