joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e55c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004653c0
add esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
push 1
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
setne al
pop ebp
ret
Function at 0x45e589
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
push 0x34
mov eax, 0x481bd3
call fcn.00463021
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push 0x4939f8
push 1
push ebx
push 0x493ac8
call dword [sym.imp.ole32.dll_CoCreateInstance]
push str.ROOTCIMV2
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.0045e4ff
mov eax, dword [eax]
mov byte [ebp - 4], 1
test eax, eax
je 0x45e5eb
mov edx, dword [eax]
jmp 0x45e5ed
mov edx, ebx
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
push esi
push ebx
push ebx
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push ebx
push edx
push eax
call dword [ecx + 0xc]
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x45e610
call fcn.0045e78f
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
push str.SELECT__FROM_Win32_OperatingSystem
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
call fcn.0045e4b5
mov esi, eax
push 0x48d11c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0045e4b5
mov ecx, eax
mov eax, dword [esi]
mov byte [ebp - 4], 3
test eax, eax
je 0x45e656
mov esi, dword [eax]
jmp 0x45e658
mov esi, ebx
mov eax, dword [ecx]
test eax, eax
je 0x45e662
mov edx, dword [eax]
jmp 0x45e664
mov edx, ebx
mov eax, dword [ebp - 0x14]
lea edi, [ebp - 0x1c]
push edi
push ebx
push 0x30
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x50]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x45e685
call fcn.0045e78f
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x45e697
call fcn.0045e78f
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
push edx
mov ecx, dword [eax]
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x40]
push ebx
push ebx
push edx
mov ecx, dword [eax]
push ebx
push 0x48d120
push eax
call dword [ecx + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.004653c0
add esp, 0xc
push dword [ebp - 0x38]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
jmp 0x45e71f
call fcn.00462f86
ret
Function at 0x45e725
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.004653c0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
jne 0x45e751
xor al, al
pop ebp
ret
cmp dword [ebp + 0xc], 0
seta al
pop ebp
ret

Function at 0x45e75a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.004653c0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x45e786
xor al, al
pop ebp
ret
cmp dword [ebp + 0xc], 0
seta al
pop ebp
ret

Function at 0x45e7ff
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
lea eax, [esi + 4]
mov dword [esi + 0xc], edx
push eax
push 4
push edx
push dword [esi + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x45e838
push eax
mov byte [esi + 0x11], 1
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [esi + 0x11]
pop esi
pop ebp
ret 4

Function at 0x45ed50
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x481443
call fcn.00462fb8
mov esi, ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x45ed79
push dword [ebp + 8]
mov ecx, esi
call fcn.00460172
jmp 0x45edb1
lea ecx, [ebp - 0x14]
call fcn.0045c6ec
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push 2
call fcn.0045c7e9
push 0xb
lea ecx, [ebp - 0x14]
call fcn.0045c7e9
mov ecx, dword [esi + 0x58]
lea eax, [ebp - 0x14]
push eax
call fcn.00403510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0045c702
call fcn.00462f86
ret 4
Function at 0x4017c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00407890
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00407890
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401820
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40e270]
test esi, esi
jle 0x401940
mov eax, dword [0x40e274]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401854
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401840
mov dword [esp], ebx
call fcn.00402210
mov edi, eax
test eax, eax
je 0x401967
mov eax, dword [0x40e274]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402350
mov edx, dword [0x40e274]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401947
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018e0
add dword [0x40e270], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40e274]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004017c0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40185e
mov eax, dword [0x40e274]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004017c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004017c0
lea esi, [esi]
nop
Function at 0x401e80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40e28c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40e284]
sub esp, 4
test ebx, ebx
je 0x401ed5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401ece
test esi, esi
je 0x401ece
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401eb0
mov dword [esp], 0x40e28c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402210
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402235
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402240
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402235
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402288
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40227e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40228a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402270
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40a0c0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f81c
push eax
mov dword fs:[0], esp
sub esp, 0x4e0
push ebp
push edi
call fcn.004161e0
test eax, eax
jne 0x40a2f9
lea eax, [esp + 8]
push ebx
push eax
call fcn.00415a90
add esp, 4
mov edx, eax
mov edi, 0x4385e8
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x4f4], ebp
push ecx
mov ecx, dword [edx + 8]
push 0x4385e8
push ecx
push ebp
mov ecx, edx
call fcn.0040c0c0
cmp eax, ebp
je 0x40a17c
lea edx, [esp + 0x1c]
push edx
call fcn.00415a90
add esp, 4
mov edx, eax
mov edi, 0x4385e4
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x4f4], 1
repne scasb al, byte es:[edi]
mov eax, dword [edx + 8]
not ecx
dec ecx
push ecx
push 0x4385e4
push eax
push ebp
mov ecx, edx
call fcn.0040c0c0
cmp eax, ebp
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x4f8], 0
sete bl
call fcn.0040aae0
test bl, bl
je 0x40a17e
mov bl, 1
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x4f8], 0xffffffff
call fcn.0040aae0
test bl, bl
pop ebx
je 0x40a2f9
mov eax, dword [0x43d8b4]
cmp eax, ebp
jne 0x40a1ab
mov eax, 0x4313b4
push esi
push eax
call fcn.004185a0
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
test eax, eax
je 0x40a23c
mov ecx, dword [0x43d884]
cmp ecx, ebp
jne 0x40a1d4
mov ecx, 0x4313b4
mov eax, dword [0x43d8b4]
cmp eax, ebp
jne 0x40a1e2
mov eax, 0x4313b4
push ecx
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebp
call fcn.00415140
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4f4], 2
call fcn.00415270
lea ecx, [esp + 0x2c]
call fcn.004152d0
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x4f4], 0xffffffff
push ecx
call esi
mov edx, dword [esp + 0x2c]
push edx
call esi
mov eax, dword [0x43d8b4]
cmp eax, ebp
jne 0x40a239
mov eax, 0x4313b4
push eax
call edi
mov eax, dword [0x43d300]
cmp eax, ebp
jne 0x40a24a
mov eax, 0x4313b4
push eax
call fcn.004185a0
add esp, 4
test eax, eax
je 0x40a2dc
mov ecx, dword [0x43d2d0]
cmp ecx, ebp
jne 0x40a26a
mov ecx, 0x4313b4
mov eax, dword [0x43d300]
cmp eax, ebp
jne 0x40a278
mov eax, 0x4313b4
push ecx
push eax
lea ecx, [esp + 0x294]
mov dword [esp + 0x298], ebp
mov dword [esp + 0x294], ebp
call fcn.00415140
lea ecx, [esp + 0x28c]
mov dword [esp + 0x4f4], 3
call fcn.00415270
lea ecx, [esp + 0x28c]
call fcn.004152d0
mov eax, dword [esp + 0x290]
push eax
call esi
mov ecx, dword [esp + 0x28c]
push ecx
call esi
mov eax, dword [0x43d300]
cmp eax, ebp
jne 0x40a2d9
mov eax, 0x4313b4
push eax
call edi
pop esi
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x4e0]
mov dword fs:[0], ecx
add esp, 0x4ec
ret
mov ecx, dword [esp + 0x4e8]
pop edi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x4ec
ret
Function at 0x413e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430166
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
push str.WindowsTab2
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x2c]
push str.Softwareuninstall__s
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ecx
mov cl, byte [esp + 0x1a]
mov edx, esp
mov edi, 0x43e7b0
xor eax, eax
mov dword [esp + 0x34], esp
mov byte [edx], cl
or ecx, 0xffffffff
mov dword [edx + 4], ebx
mov dword [edx + 8], ebx
mov dword [edx + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x43e7b0
mov ecx, edx
call fcn.0040ad80
sub esp, 0x10
lea edx, [esp + 0x2a]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
push str.uninstall
mov dword [esp + 0x260], ebx
call fcn.0040a5a0
sub esp, 0x10
lea eax, [esp + 0x3b]
mov ecx, esp
mov dword [esp + 0x40], esp
lea edx, [esp + 0x58]
push eax
push edx
mov byte [esp + 0x270], 1
call fcn.0040a5a0
lea eax, [esp + 0x44]
push SysReAllocStringLen
push eax
mov dword [esp + 0x270], 0xffffffff
call fcn.00417b60
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
add esp, 0x38
cmp eax, ebx
jbe 0x413f85
cmp ecx, ebx
je 0x413f69
mov al, byte [ecx - 1]
cmp al, bl
je 0x413f5f
cmp al, 0xff
je 0x413f5f
dec al
mov byte [ecx - 1], al
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop edi
pop ebx
add esp, 0x234
ret
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop edi
pop ebx
add esp, 0x234
ret
cmp ecx, ebx
je 0x413fa5
mov al, byte [ecx - 1]
cmp al, bl
je 0x413f9b
cmp al, 0xff
je 0x413f9b
dec al
mov byte [ecx - 1], al
jmp 0x413fa5
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0x230]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x234
ret
Function at 0x414da0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xd40
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x414dc0
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xd40
ret 8
mov esi, dword [esp + 0xd50]
test esi, esi
jne 0x414dce
lea esi, [edi + 8]
push esi
call fcn.00414fa0
add esp, 4
test al, al
jne 0x414de7
pop edi
pop esi
pop ebp
add esp, 0xd40
ret 8
lea eax, [esp + 0x218]
mov ecx, edi
push eax
call fcn.00414c90
mov al, byte [esp + 0x448]
test al, al
je 0x414e34
lea ecx, [esp + 0x218]
push 0
add edi, 8
push ecx
push edi
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00423cc5
lea eax, [esp + 0x24]
push eax
call fcn.00414fa0
add esp, 0x18
pop edi
pop esi
pop ebp
add esp, 0xd40
ret 8
mov al, byte [esp + 0xd54]
test al, al
je 0x414e7e
lea ecx, [esp + 0x44c]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
lea eax, [esp + 0x224]
push 0
push eax
call fcn.00423d56
lea ecx, [esp + 0x460]
lea edx, [esp + 0x24]
push ecx
push edx
push 0
lea eax, [esp + 0x238]
push 0
push eax
call fcn.00423cc5
add esp, 0x28
lea ecx, [esp + 0x218]
push 0
push ecx
push esi
lea edx, [esp + 0x120]
push 0
push edx
call fcn.00423cc5
lea eax, [esp + 0x128]
push eax
call fcn.00415020
add esp, 0x18
test al, al
jne 0x414eb8
pop edi
pop esi
pop ebp
add esp, 0xd40
ret 8
push 0
push 0x80
push 2
push 0
push 0
lea ecx, [esp + 0x128]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x414eed
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xd40
ret 8
mov edx, dword [edi + 4]
push edx
call fcn.0041df60
test eax, eax
je 0x414f08
pop edi
pop esi
xor al, al
pop ebp
add esp, 0xd40
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [edi + 4]
lea eax, [esp + 0x550]
push 0x800
push eax
push ecx
call fcn.0041d8d0
mov esi, eax
test esi, esi
jle 0x414f53
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x558]
push esi
push eax
push ebp
mov dword [esp + 0x24], 0
call ebx
test eax, eax
je 0x414f50
cmp dword [esp + 0x10], esi
je 0x414f0f
or esi, 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi + 4]
push ecx
call fcn.0041dad0
test esi, esi
pop ebx
jne 0x414f80
mov edx, dword [esp + 0x430]
lea eax, [esp + 0x114]
push edx
push eax
call fcn.00415060
add esp, 8
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
sete al
add esp, 0xd40
ret 8
Function at 0x414fa0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x415000
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
je 0x415000
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x414fd0
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
pop edi
sete cl
mov al, cl
pop esi
ret
push edi
call fcn.00423f37
mov esi, eax
push 0x5c
push esi
call fcn.00423f10
add esp, 0xc
test eax, eax
je 0x41501a
push esi
mov byte [eax], 0
call fcn.00414fa0
add esp, 4
test al, al
push esi
jne 0x415005
call fcn.00423e9d
add esp, 4
pop edi
xor al, al
pop esi
ret
call fcn.00423e9d
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
je 0x415000
pop edi
mov al, 1
pop esi
ret

Function at 0x415060
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
jne 0x41508b
xor al, al
pop esi
add esp, 0x28
ret
lea ecx, [esp + 0x1c]
push ebx
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x415100
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_DosDateTimeToFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x415100
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFileTimeToFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x415100
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
cmp eax, 1
sete bl
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop ebx
pop esi
add esp, 0x28
ret

Function at 0x415270
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x415280
call fcn.004151d0
mov eax, dword [esi + 4]
test eax, eax
jne 0x41529f
mov ecx, dword [esi]
lea eax, [esi + 0x1fc]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esi + 4], eax
mov esi, dword [esi + 4]
test esi, esi
jne 0x4152ad
xor al, al
pop esi
add esp, 0x1c
ret
lea edx, [esp + 4]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esp + 8]
pop esi
cmp eax, 1
sete al
add esp, 0x1c
ret
Function at 0x415580
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x430260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc08
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc2c]
mov dword [esp + 0xc18], 3
cmp eax, ebx
je 0x41575b
cmp dword [esp + 0xc3c], ebx
je 0x41575b
cmp dword [esp + 0xc4c], ebx
je 0x41575b
push edi
mov ecx, 0x2ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
mov esi, 0x4313b4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0xc2c]
cmp eax, ebx
je 0x4155fe
mov esi, eax
mov edx, dword [esp + 0xc5c]
cmp edx, ebx
jne 0x41560e
mov edx, 0x4313b4
mov ecx, dword [esp + 0xc4c]
cmp ecx, ebx
jne 0x41561e
mov ecx, 0x4313b4
mov eax, dword [esp + 0xc3c]
cmp eax, ebx
jne 0x41562e
mov eax, 0x4313b4
push esi
lea esi, [esp + 0x18]
push 0xc00
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov esi, dword [esp + 0xc24]
mov al, byte [esp + 0xf]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
mov byte [esi], al
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esi + 4], ebx
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0040ad80
mov ecx, dword [esp + 0xc2c]
pop edi
cmp ecx, ebx
je 0x41569b
mov al, byte [ecx - 1]
cmp al, bl
je 0x415691
cmp al, 0xff
je 0x415691
dec al
mov byte [ecx - 1], al
jmp 0x41569b
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0xc38]
mov dword [esp + 0xc28], ebx
cmp ecx, ebx
mov dword [esp + 0xc2c], ebx
mov dword [esp + 0xc30], ebx
je 0x4156d7
mov al, byte [ecx - 1]
cmp al, bl
je 0x4156cd
cmp al, 0xff
je 0x4156cd
dec al
mov byte [ecx - 1], al
jmp 0x4156d7
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0xc48]
mov dword [esp + 0xc38], ebx
cmp ecx, ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
je 0x415713
mov al, byte [ecx - 1]
cmp al, bl
je 0x415709
cmp al, 0xff
je 0x415709
dec al
mov byte [ecx - 1], al
jmp 0x415713
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0xc58]
mov dword [esp + 0xc48], ebx
cmp ecx, ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
je 0x4157e3
mov al, byte [ecx - 1]
cmp al, bl
je 0x41574c
cmp al, 0xff
je 0x41574c
dec al
mov byte [ecx - 1], al
jmp 0x4157e3
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
jmp 0x4157e3
mov esi, dword [esp + 0xc20]
mov dl, byte [esp + 0xc54]
push ebx
mov ecx, esi
mov byte [esi], dl
call fcn.0040aae0
mov eax, dword [0x4313b0]
lea ecx, [esp + 0xc54]
push eax
push ebx
push ecx
mov ecx, esi
call fcn.0040a8e0
push 1
lea ecx, [esp + 0xc28]
mov byte [esp + 0xc1c], 2
call fcn.0040aae0
push 1
lea ecx, [esp + 0xc38]
mov byte [esp + 0xc1c], 1
call fcn.0040aae0
push 1
lea ecx, [esp + 0xc48]
mov byte [esp + 0xc1c], bl
call fcn.0040aae0
push 1
lea ecx, [esp + 0xc58]
mov dword [esp + 0xc1c], 0xffffffff
call fcn.0040aae0
mov ecx, dword [esp + 0xc10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc14
ret