joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x14
push esi
test eax, eax
je 0x435b26
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x435b26
xor ecx, ecx
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x435ab4
call edi
cmp eax, 0x3e5
jne 0x435b06
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x435af2
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
test eax, eax
je 0x435ae5
push 1
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, 0x800705b4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
push 0
push dword [ebp + 0x18]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x435b1c
call edi
test eax, eax
jle 0x435aea
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 0x14
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4362a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
call fcn.00436770
cmp eax, 3
jne 0x4362c4
push dword [ebp + 8]
mov ecx, esi
call fcn.00436240
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00436aa0
test al, al
jne 0x4362dd
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
inc eax
jmp 0x436397
cmp dword [esi], 0
je 0x436322
call fcn.00436aa0
test al, al
je 0x436322
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
push 4
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
push 0x12
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x436322
mov eax, dword [ebp - 8]
cmp eax, 2
je 0x43639f
cmp eax, 3
je 0x43639f
call fcn.00436aa0
test al, al
jne 0x436338
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
inc eax
jmp 0x436397
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43638f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.EnableLUA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0xc], eax
setne al
test eax, eax
je 0x43641f
mov ecx, esi
call fcn.00436770
cmp eax, 2
jne 0x43641f
mov eax, dword [esi]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x43641f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
push 1
push 2
push 0
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x43641f
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push 0x2000
mov dword [ebp - 0x18], eax
call fcn.004372c0
test eax, eax
je 0x436411
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x436400
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43641f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x436510
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccc36
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x50e3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 4], edi
test eax, eax
je 0x4366f7
cmp word [eax], di
je 0x4366f7
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push edi
push eax
call fcn.0048fe50
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x254], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x4365ca
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00435b40
jmp 0x4365f4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x43663a
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00435b40
test esi, esi
je 0x4365f4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x248]
test edx, edx
je 0x43670b
mov ecx, dword [ebp - 0x240]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x43662b
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436729
push ecx
push edx
call fcn.0048d64e
add esp, 8
jmp 0x43670b
mov ebx, dword [ebp - 0x240]
push dword [ebp - 0x24c]
lea eax, [ebp - 0x218]
push eax
call fcn.00499139
add esp, 8
test eax, eax
jne 0x43668f
cmp edi, ebx
je 0x436670
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x244], edi
jmp 0x43668f
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x248]
call fcn.00402ec0
mov edi, dword [ebp - 0x244]
mov ebx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x436640
mov ebx, dword [ebp - 0x250]
lea eax, [ebp - 0x248]
push eax
mov ecx, ebx
call fcn.00435b40
test esi, esi
je 0x4366bf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x248]
test edx, edx
je 0x43670b
mov ecx, dword [ebp - 0x240]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x43662b
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436729
jmp 0x43662b
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d65c
mov esp, ebp
pop ebp
ret
call fcn.00498fa9
int3
Function at 0x436770
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50e3e0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [edi]
test ecx, ecx
jne 0x43679a
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d65c
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
test eax, eax
jne 0x4368cb
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
push ecx
call esi
push dword [ebp - 0x10]
call fcn.0048d7a5
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 1
push dword [edi]
call esi
test eax, eax
je 0x43686c
mov esi, dword [ebx]
test esi, esi
je 0x43686c
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x43686c
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x43686c
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push ebx
call fcn.0048d7ae
add esp, 4
test esi, esi
je 0x436875
pop esi
pop ebx
mov dword [edi + 4], 1
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d65c
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0048d7ae
add esp, 4
push 0x220
mov ecx, edi
call fcn.004368e0
test eax, eax
je 0x4368bd
mov ecx, edi
call fcn.00436430
cmp eax, 3
je 0x4368a4
mov ecx, edi
call fcn.00436480
cmp eax, 0x2000
mov eax, 2
jne 0x4368a9
mov eax, 3
pop esi
pop ebx
mov dword [edi + 4], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d65c
mov esp, ebp
pop ebp
ret
pop esi
mov dword [edi + 4], 4
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0048d65c
mov esp, ebp
pop ebp
ret
Function at 0x4368e0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x50e3e0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x436a8b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push 0x20
push 2
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x436a8b
push esi
mov ecx, edi
xor esi, esi
call fcn.00436430
cmp eax, 3
jne 0x436a10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
mov ecx, edi
mov dword [ebp - 0x18], esi
call fcn.004361a0
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x436a63
mov esi, dword [ebp - 0x14]
test edi, edi
je 0x4369a2
test esi, esi
je 0x4369a2
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4369a2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
jne 0x436a63
jmp 0x4369a4
xor esi, esi
test edi, edi
je 0x436a6e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x436a63
mov esi, dword [ebp - 0x14]
push ebx
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x436a00
test esi, esi
je 0x436a00
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x436a00
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x18]
jmp 0x436a02
xor esi, esi
test ebx, ebx
je 0x436a0d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
jmp 0x436a63
mov eax, dword [edi]
test eax, eax
je 0x436a6e
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x436a6e
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
test edi, edi
je 0x436a61
test esi, esi
je 0x436a61
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x436a61
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
jmp 0x436a63
xor esi, esi
test edi, edi
je 0x436a6e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d65c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0048d65c
mov esp, ebp
pop ebp
ret 4
Function at 0x4371e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.00436aa0
test al, al
jne 0x437202
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
pop esi
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0
je 0x43724d
call fcn.00436aa0
test al, al
je 0x43724d
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
push 4
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x12
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43724d
mov eax, dword [ebp - 4]
cmp eax, 2
je 0x437243
cmp eax, 3
jne 0x43724d
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00436aa0
test al, al
je 0x4371f2
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4372ad
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.EnableLUA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x437fe0
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x50e3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
call fcn.00437420
test eax, eax
je 0x43801b
call dword [sym.imp.KERNEL32.dll_GetLastError]
shl eax, 0x10
or eax, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d65c
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
push edi
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x438188
cmp edi, 0xffffffff
je 0x438188
push 0x34
push str.wpscloudsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x438166
cmp esi, 0xffffffff
je 0x438166
xor eax, eax
mov ebx, 0x12c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4380ea
nop
test ebx, ebx
jle 0x4380ea
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 6
ja case.0x4380a4.3
movzx eax, byte [eax + 0x4381cc]
jmp dword [eax*4 + 0x4381c0]
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp case.0x4380a4.3
push dword [ebp - 0x24]
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x43815d
push 0xc8
dec ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x438090
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl ebx, 0x10
or ebx, 6
test bx, bx
jne 0x438174
xor eax, eax
mov dword [ebp - 0x24], 0x12c
mov dword [ebp - 0x20], eax
mov ebx, 0x16
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x438174
nop
mov eax, dword [ebp - 0x24]
test eax, eax
jle 0x438174
cmp dword [ebp - 0x1c], 1
je 0x438161
dec eax
push 0xc8
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x438130
jmp 0x438174
xor ebx, ebx
jmp 0x4380f8
mov ebx, dword [ebp - 0x14]
jmp 0x438174
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl ebx, 0x10
or ebx, 8
test esi, esi
je 0x438198
cmp esi, 0xffffffff
je 0x438198
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x43819e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl ebx, 0x10
or ebx, 8
jmp 0x43819e
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4381aa
cmp edi, 0xffffffff
je 0x4381aa
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048d65c
mov esp, ebp
pop ebp
ret 8
Function at 0x438e60
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x50e3e0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x20], eax
xor esi, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x438ecf
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 1
je 0x438ed2
cmp esi, edi
ja 0x438ed2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
add eax, 0xa
add esi, eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x438ea3
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, 1
mov ecx, dword [ebp - 4]
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0048d65c
mov esp, ebp
pop ebp
ret 8
Function at 0x4393d0
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x43946b
cmp edi, 0xffffffff
je 0x43946b
push 0xf01ff
push str.wpscloudsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x439449
cmp esi, 0xffffffff
je 0x439449
push 0x1388
push esi
mov ecx, ebx
call fcn.00438e60
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, eax
test ecx, ecx
jne 0x43943b
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x430
sete cl
xor eax, eax
mov ebx, 0x50005
test ecx, ecx
cmovne ebx, eax
jmp 0x439457
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl ebx, 0x10
or ebx, 5
test esi, esi
je 0x43947b
cmp esi, 0xffffffff
je 0x43947b
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x439481
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl ebx, 0x10
or ebx, 5
jmp 0x439481
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x43948d
cmp edi, 0xffffffff
je 0x43948d
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x439560
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x50e3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5145c8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x439597
push 0x3e9
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x5145c8]
inc eax
mov dword [0x5145c8], eax
call fcn.004115e0
test eax, eax
je 0x439714
mov eax, dword [0x514630]
test al, 1
jne 0x4395cb
or eax, 1
mov dword [0x514630], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [0x51462c], eax
jmp 0x4395d0
mov eax, dword [0x51462c]
push edi
push 0xa
push 0x10
push 0x5145cc
push eax
call fcn.0049a496
push 0xa
push 0x10
push 0x51460c
push esi
call fcn.0049a496
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xa
push 0x10
push 0x5145ec
push eax
call fcn.0049a496
push str.crash_handle
push str.exitsource
mov dword [0x51463c], 1
mov dword [0x514638], 0
mov dword [0x514634], 0xc
call fcn.0044abb0
push str.crash
push str.exitreason
call fcn.0044abb0
add esp, 0x20
call fcn.0044ac10
mov ecx, 8
lea edi, [ebp - 0x28]
mov esi, str.kcrashdumper.exe
lea eax, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call fcn.004115e0
push eax
push 0x4df054
push 0x514640
call fcn.004394a0
call fcn.00411890
push eax
push 0x51460c
push 0x5145ec
push 0x5145cc
push 0x514640
push str._s__pid_s__tid_s__exp_s__callfrom1__module_s
push 0x514e40
call fcn.004394d0
add esp, 0x2c
mov dword [0x515f40], 0x44
mov eax, 0xa
mov dword [0x515f6c], 1
mov word [0x515f70], ax
push 0x515f84
push 0x515f40
push 0
push 0
push 0
push 1
push 0
push 0
push 0x514e40
push 0x514640
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [0x515f94], eax
pop edi
test eax, eax
je 0x439714
push 0xffffffffffffffff
push dword [0x515f84]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x515f88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x515f84]
call esi
push 0x3e9
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048d65c
mov esp, ebp
pop ebp
ret
Function at 0x439d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccfe0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50e3e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
push edi
call fcn.00439f50
mov dword [ebx], vtable.KClientHostSplashShow.0
mov dword [ebx + 0x48], 0
cmp byte [0x5163a4], 0
mov dword [ebp - 4], 0
je 0x439dc8
mov eax, 1
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1e]
push eax
push 0x4df0f5
push str.KClientHostSplashShow
push 1
call fcn.00449a50
add esp, 0x14
mov esi, dword [ebp + 8]
mov dword [ebx + 0x20], 0
mov byte [ebp - 4], 1
mov al, byte [esi + 0x80]
mov byte [ebx + 0x4c], al
cmp byte [esi], 0
je 0x439f19
cmp byte [esi + 0x83], 0
jne 0x439f19
push 0
mov dword [ebx + 0x20], 1
call fcn.00475f40
add esp, 4
test al, al
je 0x439e23
test edi, edi
je 0x439e1d
cmp edi, 1
je 0x439e1d
cmp edi, 2
je 0x439e1d
cmp edi, 3
jne 0x439e23
test byte [esi + 8], 0x1f
jmp 0x439e27
cmp dword [esi + 8], 0
je 0x439e30
mov dword [ebx + 0x20], 0
cmp dword [esi + 0xd0], 0
je 0x439e40
mov dword [ebx + 0x20], 0
cmp dword [esi + 4], 0
jne 0x439e58
cmp dword [esi + 0x28], 1
je 0x439e58
cmp dword [esi + 0x10], 1
je 0x439e58
cmp byte [esi + 0x7e], 0
je 0x439e5f
mov dword [ebx + 0x20], 0
cmp dword [ebx + 0x24], 1
jne 0x439ead
cmp dword [esi + 0x30], 1
jne 0x439ead
mov edi, dword [esi + 0x2c]
mov esi, dword [edi]
cmp esi, edi
je 0x439eaa
push 0xffffffffffffffff
lea ecx, [esi + 8]
push str..pps
call fcn.0043b0a0
cmp eax, 0xffffffff
jne 0x439ea3
push eax
push str..ppsx
lea ecx, [esi + 8]
call fcn.0043b0a0
cmp eax, 0xffffffff
jne 0x439ea3
mov esi, dword [esi]
cmp esi, edi
jne 0x439e74
jmp 0x439eaa
mov dword [ebx + 0x20], 0
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 1
jne 0x439f19
test byte [esi + 8], 0x1f
je 0x439f19
lea eax, [ebp + 8]
xor esi, esi
push eax
push 1
push esi
push str.SoftwarekingsoftOffice6.0CommonApplication_Settings
push 0x80000001
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439f13
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], esi
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 4
push eax
push esi
push esi
push str.oleForceShowSplash
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x439f0a
cmp dword [ebp + 0xc], eax
setne al
mov dword [ebp - 0x14], eax
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebx + 0x48], esi
mov dword [ebx + 0x20], esi
cmp byte [0x5163a4], 0
mov byte [ebp - 4], 2
je 0x439f37
push dword [ebp - 0x1c]
push dword [ebp - 0x1e]
push dword [ebp - 0x20]
call fcn.00449ab0
add esp, 0xc
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8