joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426701
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x68], ebx
jne 0x4267cb
cmp dword [esi + 0x6c], ebx
jne 0x4267cb
mov eax, dword [esi + 0x2c]
cmp eax, 1
je 0x426776
jle 0x4267cb
cmp eax, 4
jle 0x42673d
cmp eax, 6
jne 0x4267cb
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x426755
mov edx, dword [esi + 0x14]
push ecx
call fcn.0043adac
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], edx
jmp 0x4267cb
cmp dword [0x443534], 0xffffffff
jne 0x426767
push ecx
push 2
pop edx
call fcn.0041e530
push 2
mov edx, 0x405e74
pop ecx
call fcn.0041e988
jmp 0x4267cb
mov ecx, dword [esi + 0x18]
mov dword [ebp - 4], ebx
call fcn.0041fb3c
test eax, eax
je 0x4267cb
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4267cb
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x4267c4
mov edx, dword [ebp - 4]
xor ecx, ecx
or ecx, eax
or edx, ebx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x54], ebx
jne 0x42680b
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x42680b
call fcn.0041f47f
test eax, eax
jne 0x42680b
mov ecx, dword [esi + 0x1c]
call fcn.0041f47f
test eax, eax
jne 0x42680b
cmp dword [0x443534], 0xffffffff
jne 0x4267fe
push ecx
push 4
pop edx
call fcn.0041e530
push 4
mov edx, 0x405eb0
pop ecx
call fcn.0041e988
mov edx, dword [esi + 0x68]
mov edi, dword [esi + 0x6c]
cmp dword [ebp + 8], ebx
jne 0x42681c
add edx, dword [esi + 0x78]
adc edi, dword [esi + 0x7c]
mov eax, edx
mov edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4282a2
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x23c], 0
je 0x4282ca
xor eax, eax
jmp 0x42834d
push esi
push 0x208
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x428343
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x428333
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x186a0
div ecx
lea eax, [ebp - 0x20c]
push edx
push eax
push 0x4065c0
push 0x104
push esi
call fcn.0040c0f9
add esp, 0x14
test eax, eax
js 0x428333
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x428333
mov dword [edi + 0x23c], esi
cmp dword [edi + 0x23c], 0
jne 0x42834a
push esi
call fcn.00441807
pop ecx
mov eax, 0x80004005
jmp 0x42834c
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x42db03
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x414]
xor ebx, ebx
push eax
push 0x104
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42dbd9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x186a0
div ecx
push 0x408968
push edx
lea eax, [ebp - 0x414]
push eax
push 0x40766c
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.0040c0f9
add esp, 0x18
test eax, eax
js 0x42dbd9
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42dbd9
lea ecx, [ebp - 0x20c]
push 2
lea edx, [ecx + 2]
pop esi
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x42db8f
sub ecx, edx
sar ecx, 1
push edi
lea edi, [ecx + 1]
xor ecx, ecx
mov eax, edi
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x42dbd8
lea eax, [ebp - 0x20c]
mov edx, edi
push eax
mov ecx, esi
call fcn.0040c010
test eax, eax
jns 0x42dbd8
push esi
call fcn.00441807
pop ecx
mov esi, ebx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x42dbeb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x42dc2d
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, word [ebp - 4]
jne 0x42dc03
sub esi, ebx
sar esi, 1
lea eax, [esi*2 + 2]
push eax
push dword [ebp + 8]
xor eax, eax
push 1
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42df4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x42e067
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
mov ebx, 0x20019
push ebx
push esi
push 0x407688
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42dfc5
lea eax, [ebp - 0x214]
push eax
push ebx
push esi
push 0x407688
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
jmp 0x42dfcb
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x42e04b
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], esi
push ecx
xor ebx, ebx
inc ebx
push ebx
push esi
push dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e03f
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], ebx
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x4076e4
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e033
cmp dword [ebp - 0x21c], ebx
jne 0x42e033
mov esi, ebx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi]
test esi, esi
je 0x42e058
push 0x407714
jmp 0x42e05d
push 0x407740
push 4
call fcn.0041ea5f
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x42e08a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor esi, esi
push eax
inc esi
xor ebx, ebx
push esi
push ebx
push 0x407788
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e125
push 4
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
pop ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], ebx
push eax
push 0
push 0x4077fc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e11c
cmp dword [ebp - 0xc], ebx
jne 0x42e11c
cmp dword [ebp - 0x10], eax
jne 0x42e11c
cmp dword [0x443534], 0xffffffff
jne 0x42e10a
push ecx
mov edx, ebx
call fcn.0041e530
mov edx, 0x407830
mov ecx, ebx
call fcn.0041e988
mov esi, dword [edi + 0x98]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x42e212
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, 0x80004005
cmp dword [edi], 0
je 0x42e3f2
push dword [edi]
lea eax, [ebp - 0x20c]
push 0x4078d8
push 0x104
push eax
call fcn.0040c0b5
add esp, 0x10
test eax, eax
js 0x42e3f2
push ebx
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42e2c3
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x210]
mov dword [ebp - 0x210], eax
jmp 0x42e2c9
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x42e3f1
push dword [edi + 0xc]
mov edx, 0x407930
mov ecx, eax
call fcn.0042dbeb
push dword [edi + 0x64]
mov ecx, dword [ebp - 0x210]
mov edx, 0x40794c
call fcn.0042dbeb
push dword [edi + 0x68]
mov ecx, dword [ebp - 0x210]
mov edx, 0x407964
call fcn.0041fb3c
push dword [edi + 0x5c]
mov ecx, dword [ebp - 0x210]
mov edx, 0x407984
call fcn.0042dbeb
push dword [edi + 0x54]
mov ecx, dword [ebp - 0x210]
mov edx, 0x4079a0
call fcn.0042dbeb
push dword [edi + 0x50]
mov ecx, dword [ebp - 0x210]
mov edx, 0x4079bc
call fcn.0042dbeb
push dword [edi + 0x58]
mov ecx, dword [ebp - 0x210]
mov edx, 0x4079dc
call fcn.0042dbeb
push dword [edi + 0x6c]
mov ecx, dword [ebp - 0x210]
mov esi, 0x4079f8
mov edx, esi
call fcn.0042dbeb
push dword [edi + 0x70]
mov ecx, dword [ebp - 0x210]
mov edx, esi
call fcn.0042dbeb
push dword [edi + 0x74]
mov ecx, dword [ebp - 0x210]
mov edx, 0x407a18
call fcn.0042dbeb
push dword [edi + 0x78]
mov ecx, dword [ebp - 0x210]
mov esi, 0x407a38
mov edx, esi
call fcn.0042dbeb
push dword [edi + 0x7c]
mov ecx, dword [ebp - 0x210]
mov edx, esi
call fcn.0042dbeb
push dword [edi + 0x80]
mov ecx, dword [ebp - 0x210]
mov edx, 0x407a58
call fcn.0042dbeb
add edi, 0x4c
cmp dword [edi], ebx
je 0x42e3e3
push 4
push edi
push 4
push ebx
push 0x407a78
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
mov esi, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x42e46a
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi], edi
je 0x42e5c1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], edi
push eax
push 2
push edi
push 0x401680
mov ebx, SysReAllocStringLen
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e4e5
mov ecx, dword [esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42e4b8
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [esi]
push 1
push edi
push 0x401f7c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x214]
push eax
push 0x20006
push edi
push 0x407688
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e562
push 0x407aac
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x407ac8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42e529
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [esi]
push 1
push edi
push 0x407ac8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
lea eax, [ebp - 0x210]
push 0x4078d8
push 0x104
push eax
call fcn.0040c0b5
add esp, 0x10
test eax, eax
js 0x42e5b0
push edi
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42e5b0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
push 0x407aec
push 3
call fcn.0041ea5f
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x431a7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x91c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x918], eax
mov ecx, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 0x914], ecx
cmp dword [edi + 0x34], edx
je 0x431abb
mov eax, 0x800704c7
jmp 0x431c17
test eax, eax
je 0x431bfc
test ecx, ecx
je 0x431bfc
lea ebx, [edi + 0x2c]
cmp dword [ebx], edx
jne 0x431b12
cmp dword [edi + 0x38], edx
je 0x431aef
call fcn.004227fd
xor edx, edx
test eax, eax
je 0x431aef
mov ecx, ebx
call fcn.0043bf92
mov esi, eax
xor edx, edx
jmp 0x431af4
mov esi, 0xc00d0bca
cmp dword [ebx], edx
jne 0x431b0c
test esi, esi
js 0x431b01
mov esi, 0x80004005
push esi
push 0x408180
jmp 0x431c0b
mov ecx, dword [ebp - 0x914]
push edx
push edx
push 0x105
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
push ecx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
lea eax, [ebp - 0x910]
push ecx
push ecx
push 0x800
push eax
push 0xffffffffffffffff
push dword [ebp - 0x918]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x64
pop ecx
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], 1
call fcn.0041de27
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [edi + 0x24], eax
cmp dword [edi + 0x28], ecx
je 0x431c01
mov eax, dword [ebx]
push ecx
push ecx
push ecx
mov esi, dword [eax]
lea ecx, [ebp - 0x110]
push 0x8000080
push 2
push ecx
lea ecx, [ebp - 0x910]
push ecx
mov ecx, dword [esi + 0x14]
push eax
call dword [0x446624]
call dword [esi + 0x14]
mov esi, eax
test esi, esi
js 0x431bd7
jmp 0x431bd0
push 0x258
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x431bd7
cmp dword [edi + 0x30], 0
je 0x431bd7
mov ecx, edi
call fcn.0043167d
mov esi, eax
mov eax, dword [edi + 0x28]
test eax, eax
jne 0x431bae
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431bf1
test al, 0x10
jne 0x431bf1
test esi, esi
jns 0x431c15
test esi, esi
js 0x431c05
mov esi, 0x80070002
jmp 0x431c05
mov esi, 0x80070057
test esi, esi
jns 0x431c15
push esi
push 0x4081a8
push 4
call fcn.0041ea5f
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb3c
mov esp, ebp
pop ebp
ret 8
Function at 0x432e9a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x2d8]
xor ebx, ebx
push eax
push 3
push ebx
push 0x401680
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 0x2d8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433001
mov ecx, dword [ebp - 0x2d8]
mov edx, 0x401f7c
push edi
push dword [esi + 0x10]
call fcn.0042dbeb
cmp dword [esi + 0x18], ebx
jne 0x432f51
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x432ff4
mov edx, 0x4015c0
mov eax, ecx
mov di, word [eax]
cmp di, word [edx]
jne 0x432f2e
test di, di
je 0x432f2a
mov di, word [eax + 2]
cmp di, word [edx + 2]
jne 0x432f2e
add eax, 4
add edx, 4
test di, di
jne 0x432f08
mov eax, ebx
jmp 0x432f33
sbb eax, eax
or eax, 1
test eax, eax
je 0x432ff4
push ecx
mov ecx, dword [ebp - 0x2d8]
mov edx, 0x4080cc
call fcn.0042dbeb
jmp 0x432ff4
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], 0xc8
push eax
lea eax, [ebp - 0xcc]
xor edi, edi
push eax
lea eax, [ebp - 0x2dc]
inc edi
push eax
push ebx
push 0x4080cc
push dword [ebp - 0x2d8]
mov dword [ebp - 0x2dc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432ff4
cmp dword [ebp - 0x2dc], edi
jne 0x432ff4
lea eax, [ebp - 0xcc]
push eax
push 0x4078d8
lea eax, [ebp - 0x2d4]
push 0x208
push eax
call fcn.0040c0f9
add esp, 0x10
test eax, eax
js 0x432ff4
push ebx
lea eax, [ebp - 0x2e0]
mov dword [ebp - 0x2e0], ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2d4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x432ff4
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push ebx
lea eax, [ebp - 0x2d8]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x4021d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x433042
push dword [esi + 0x20]
mov ecx, dword [ebp - 0x2d8]
mov edx, 0x402220
call fcn.0042dbeb
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x433407
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
push 0x408ae0
push 4
inc ebx
call fcn.0041ea5f
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x43346c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x433454
push 0x57
pop eax
push eax
push esi
push 0x408b00
push 2
call fcn.0041ea5f
add esp, 0x10
xor eax, eax
jmp 0x4335d6
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x4334ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43348f
push 0x57
pop eax
push eax
push esi
push 0x408b34
push 2
call fcn.0041ea5f
add esp, 0x10
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x433465
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4334f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x4334c9
push 0x57
pop edi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x420
je 0x4335d4
push edi
push esi
push 0x408b6c
jmp 0x43345b
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x20]
push eax
push edi
mov dword [ebp - 0x2c], 0x927c0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x433518
push esi
push 0x408ba4
jmp 0x433599
mov ecx, dword [ebp - 0x1c]
cmp ecx, 4
je 0x4335a5
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
add eax, 0x7530
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x2c]
jle 0x433540
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x433581
cmp ecx, 4
je 0x43357e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4335e9
mov eax, dword [ebp - 0x28]
mov ecx, 0x1f4
add dword [ebp - 0x24], ecx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
test eax, eax
jg 0x433544
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x2c]
jg 0x433593
cmp ecx, 4
je 0x4335a5
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0xc]
jne 0x433527
push esi
push 0x408bec
push 2
call fcn.0041ea5f
add esp, 0xc
xor ebx, ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x408aa0
test ebx, ebx
jne 0x4335c3
mov eax, 0x408ab4
push eax
push esi
push 0x408c04
push 4
call fcn.0041ea5f
add esp, 0x10
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 4
push esi
push 0x408bc8
jmp 0x433599
Function at 0x433d02
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push esi
push 0x408dc0
push 4
mov dword [ebp - 0x24], esi
inc edi
mov dword [ebp - 0x30], eax
call fcn.0041ea5f
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x433d58
xor edi, edi
jmp 0x433e24
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x433d72
xor edi, edi
jmp 0x433e07
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x433d6b
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
push 2
push 0x40
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x433e04
lea eax, [ebp - 0x28]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x433df9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x433df9
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x28]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x433e04
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x433de4
xor edi, edi
jmp 0x433df9
mov ecx, dword [ebp - 0x30]
mov eax, dword [esi + 4]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
neg eax
sbb eax, eax
and esi, eax
test esi, esi
je 0x433e04
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x24]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x433e1b
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x408aa0
test edi, edi
jne 0x433e29
mov eax, 0x408ab4
push eax
push esi
push 0x408ddc
push 4
call fcn.0041ea5f
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 8