joyce8/EMBER2024-capa huggingface dataset:
Function at 0x340f12b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x34143aa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
push 1
lea ecx, [esp + 0x18]
lea eax, [edi + 0x80]
push eax
call fcn.340b51a0
mov eax, dword [esp + 0x30]
xor ebp, ebp
cmp eax, ebp
mov eax, dword [edi + 0x70]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ebp
je 0x340f13a9
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x340f1330
lea esi, [edi + 0x68]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.34130710
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
cmp dword [esp + 0x30], ebp
jne 0x340f130b
mov eax, dword [edi + 0x70]
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x340f139f
push ebx
lea ebx, [edi + 0x68]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, ebx
call fcn.34130710
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x30]
cmp ecx, ebp
je 0x340f1369
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, esi
mov dword [esi + 0x2c], ebp
call fcn.340b87b0
mov ecx, dword [esp + 0x10]
call fcn.340b8870
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
je 0x340f138a
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
je 0x340f1398
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x34], ebp
jne 0x340f1343
pop ebx
lea ecx, [edi + 0x68]
call fcn.341303e0
jmp 0x340f1421
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x340f1421
lea esi, [edi + 0x68]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.34130710
mov ecx, dword [esp + 0xc]
call fcn.340b88f0
test eax, eax
jne 0x340f141b
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x28], ebp
jne 0x340f141b
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x340f1401
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ecx, ebp
je 0x340f1413
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.34130680
cmp dword [esp + 0x30], ebp
jne 0x340f13b8
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.340b5200
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x340f2350
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x341ad120]
sub esp, 0x114
test eax, eax
jne 0x340f249d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x341aceb8
mov dword [0x341ad120], 1
mov dword [0x341aceb8], 0x114
call esi
mov edx, dword [0x341acec8]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x34196868], eax
je 0x340f2478
push ebx
push 0x341acfd0
mov dword [0x341acfd0], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x34197754
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x341ad114], eax
call edi
mov dword [0x341ad118], eax
mov eax, dword [0x341ad114]
test eax, eax
push 0x341ad0f0
je 0x340f23f4
call eax
jmp 0x340f23fa
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x341acfd4]
cmp eax, 6
jae 0x340f2412
cmp eax, 5
jne 0x340f2426
cmp dword [0x341acfd8], 2
jb 0x340f2426
cmp word [0x341ad0f0], 9
jne 0x340f2426
mov dword [0x341aceac], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x340f2444
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x341ad11c], edx
jmp 0x340f244a
mov edx, dword [0x341ad11c]
test edx, edx
je 0x340f2478
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x340f2478
mov ecx, dword [esp + 0x14]
mov dword [0x341acec4], ecx
push 0x341acec0
push 0x341acebc
call fcn.340f2840
add esp, 8
call fcn.340f24b0
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x340f36d0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x34147e70
push 0x340bebb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x341ad124]
xor ebx, ebx
cmp eax, ebx
jne 0x340f3830
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x340f382b
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x341920e8
lea edx, [ebp - 0x42c]
push edx
call fcn.340be4d8
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.340bd438
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x340f382b
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x340f3822
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x34197930
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x340f3822
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x341ad124], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x340f3822
push esi
call fcn.340bd446
add esp, 4
mov eax, dword [0x341ad124]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x340f4c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x34143e8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x38]
push esi
mov dword [esp + 4], 0
cmp word [eax], 0x4d4f
je 0x340f4cbd
mov esi, dword [esp + 0x38]
push 0
push 0
mov ecx, esi
call fcn.34132f10
mov eax, esi
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push ebp
push edi
mov ebp, dword [esp + 0x48]
mov ecx, 8
mov esi, eax
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
xor esi, esi
xor edi, edi
test ecx, ecx
jbe 0x340f4cf1
and word [esp + 0x12], 0xefff
test byte [eax + 3], 0x10
je 0x340f4ced
or byte [esp + 0x13], 0x20
mov esi, ebp
mov edi, ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], edi
call fcn.34132f00
lea eax, [esp + 0x10]
push 0x20
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x40], 1
call fcn.34133460
push edi
push esi
lea ecx, [esp + 0x4c]
call fcn.34133460
test esi, esi
je 0x340f4d32
cmp esi, ebp
je 0x340f4d32
push esi
call fcn.340bd446
add esp, 4
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x44]
push ecx
mov ecx, esi
call fcn.34133020
lea ecx, [esp + 0x44]
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 0
call fcn.34133060
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop ebp
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x340f6b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ebp, dword [esi + 4]
cmp ebp, ebx
je 0x340f6c9b
cmp dword [esi + 8], ebx
je 0x340f6c9b
cmp dword [esi + 0x10], ebx
je 0x340f6ba2
lea eax, [esp + 0x14]
lea edi, [esi + 0x1c]
push ebx
push eax
push edi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
jne 0x340f6b87
mov ecx, dword [esi + 0x2c]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x340f6b76
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push ebx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov dword [edi], ecx
cmp eax, ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
je 0x340f6c9b
mov eax, dword [esi + 8]
xor edx, edx
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
cmp edi, ebx
je 0x340f6c0c
cmp dword [esp + 0x10], ebx
je 0x340f6c0c
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x340f6c28
cmp eax, ebx
je 0x340f6c28
cmp eax, 0x3e5
je 0x340f6c28
cmp eax, 0x217
jne 0x340f6c9b
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x340f6c60
push ebp
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x340f6c9b
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x18]
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edx, dword [esi + 8]
mov edi, eax
push edx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x18]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x20
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
Function at 0x340f6cb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ebp, dword [esi + 4]
cmp ebp, ebx
je 0x340f6e3b
cmp dword [esi + 0xc], ebx
je 0x340f6e3b
cmp dword [esi + 0x10], ebx
je 0x340f6d42
lea eax, [esp + 0x14]
lea edi, [esi + 0x1c]
push ebx
push eax
push edi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp eax, ebx
jne 0x340f6d27
mov ecx, dword [esi + 0x2c]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x340f6d16
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push ebx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
mov dword [esi + 0x10], ebx
mov dword [edi], ecx
cmp eax, ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
je 0x340f6e3b
mov eax, dword [esi + 0xc]
xor edx, edx
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, ebx
je 0x340f6dac
cmp dword [esp + 0x10], ebx
jbe 0x340f6dac
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
jne 0x340f6dc8
cmp eax, ebx
je 0x340f6dc8
cmp eax, 0x3e5
je 0x340f6dc8
cmp eax, 0x217
jne 0x340f6e3b
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x340f6e00
push ebp
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp edi, 0x102
jne 0x340f6e3b
mov dword [esi + 0x14], 0xf0000003
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x18]
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edx, dword [esi + 0xc]
mov edi, eax
push edx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 0x18]
mov eax, edi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 0x20
ret 0xc
mov dword [esi + 0x14], 0xf0000001
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0xc
Function at 0x340f7b30
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x34144175
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x91c
push esi
push edi
mov esi, dword [esp + 0x938]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x126]
mov word [esp + 0x124], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x341ad174]
test esi, esi
je 0x340f7c1c
test eax, eax
jne 0x340f7bdb
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x341ad174], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x340f7bcf
cmp dword [esp + 0x14], 5
jb 0x340f7bcf
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x341ad178], ecx
jmp 0x340f7bdb
mov edx, dword [0x34197ae4]
mov dword [0x341ad178], edx
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x34197ae4]
jne 0x340f7bf0
mov eax, dword [0x341ad178]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0x134]
push str._s__s__08x__08x
push eax
call fcn.340be4d8
add esp, 0x18
jmp 0x340f7cab
test eax, eax
jne 0x340f7c70
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x341ad174], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x340f7c66
cmp dword [esp + 0x14], 5
jb 0x340f7c66
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x341ad178], edx
jmp 0x340f7c70
mov eax, dword [0x34197ae4]
mov dword [0x341ad178], eax
mov eax, dword [esp + 0x93c]
test eax, eax
mov eax, dword [0x34197ae4]
jne 0x340f7c85
mov eax, dword [0x341ad178]
mov ecx, dword [esp + 0x944]
mov edx, dword [esp + 0x940]
push ecx
push edx
push eax
lea eax, [esp + 0x130]
push str._s___08x__08x
push eax
call fcn.340be4d8
add esp, 0x14
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0xc]
call fcn.340a6b90
mov esi, dword [esp + 0x934]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x930], 1
call fcn.340a6930
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x92c], 0
call fcn.340a7330
mov ecx, dword [esp + 0x924]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x928
ret
Function at 0x340fa450
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
je 0x340fa4d8
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x340fa4b2
mov ecx, dword [esi + 0x18]
xor eax, eax
mov dword [esp + 9], eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov word [esp + 0x11], ax
push ecx
mov byte [esp + 0x10], bl
mov byte [esp + 0x17], al
call edi
push ebx
mov dword [esp + 0x10], eax
call edi
lea edx, [esp + 0xc]
push 8
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
push edx
push 0xd
push ebx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
pop edi
jge 0x340fa4b2
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0xc]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x340fa9b0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x341ad1f4]
push esi
test eax, eax
jne 0x340faa9a
mov ecx, dword [0x341ad1f0]
cmp ecx, 3
ja 0x340faa9a
mov edx, ecx
inc edx
mov dword [0x341ad1f0], edx
call fcn.340f2a20
test eax, eax
je 0x340fa9ec
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x340fa9f7
push 0x34197c54
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x340fa9ff
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetSpecialFolderLocation
push esi
call edi
push str.SHGetSpecialFolderPathW
push esi
mov dword [0x341ad1c4], eax
call edi
push str.SHGetKnownFolderPath
push esi
mov dword [0x341ad1c8], eax
call edi
push str.SHGetFolderLocation
push esi
mov dword [0x341ad1cc], eax
call edi
push str.SHFormatDrive
push esi
mov dword [0x341ad1d0], eax
call edi
push 2
push esi
mov dword [0x341ad1d4], eax
call edi
push 4
push esi
mov dword [0x341ad1d8], eax
call edi
push str.SHCreateDirectoryExW
push esi
mov dword [0x341ad1dc], eax
call edi
push str.PathRemoveFileSpecW
push esi
mov dword [0x341ad1e0], eax
call edi
push str.SHFileOperationA
push esi
mov dword [0x341ad1e4], eax
call edi
push str.SHFileOperationW
push esi
mov dword [0x341ad1e8], eax
call edi
mov dword [0x341ad1ec], eax
mov eax, 1
mov dword [0x341ad1f4], eax
pop edi
pop esi
ret
Function at 0x340fc190
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x34144888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x341480e4
mov eax, dword [esi + 8]
mov dword [esp + 0x10], 7
cmp eax, 0xffffffff
je 0x340fc1d1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
lea ecx, [esi + 0x44]
call fcn.340acc60
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.340acc60
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.340a7330
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.340a7330
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.340a7330
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 2
call fcn.340a7330
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 1
call fcn.340a7330
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 0
call fcn.340a7330
lea ecx, [esi + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.340a7330
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x340fd830
Capabilities:
Delete service

Disassembly:
sub esp, 0x20
push edi
call fcn.340f29a0
test eax, eax
je 0x340fd84e
mov dword [0x341ad488], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x340fd869
mov dword [0x341ad488], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
push esi
push 0xf003f
push edi
push edi
mov dword [0x341ad488], edi
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x340fd89e
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x340fd8a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp esi, edi
je 0x340fd8cb
mov eax, dword [esp + 0x34]
push 0xf01ff
push eax
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x340fd91e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x340fd938
jne 0x340fd91e
test esi, esi
jne 0x340fd903
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x340fd8f7
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x340fd8ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x340fd91e
mov ecx, dword [esp + 0x34]
push 0xf01ff
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x340fd91e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, eax
test ebp, ebp
jne 0x340fd95c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x341ad488], eax
jmp 0x340fd93c
mov ebp, dword [esp + 0x10]
mov eax, dword [0x341ad488]
test eax, eax
jne 0x340fd95c
test ebx, ebx
je 0x340fd951
mov dword [0x341ad488], ebx
jmp 0x340fd95c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x341ad488], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x340fd969
push edi
call ebx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x340fd978
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test esi, esi
je 0x340fd97f
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x340fd990
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.340f29a0
test eax, eax
je 0x340fd9ae
mov dword [0x341ad488], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x340fd9c9
mov dword [0x341ad488], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push esi
push 2
push edi
push edi
mov dword [0x341ad488], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x340fd9f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
je 0x340fda1a
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x340fda58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x340fda8f
jne 0x340fda58
test esi, esi
jne 0x340fda3e
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x340fda3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x340fda58
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x340fda58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
jne 0x340fdaaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x341ad488], eax
jne 0x340fda98
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x340fdaaf
mov eax, dword [0x341ad488]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x340fdaaf
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x340fdaaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x341ad488], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x340fdabc
push edi
call ebx
test esi, esi
je 0x340fdac3
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret