joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4533cd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x46a180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00430dd5
mov edi, eax
add esp, 4
test edi, edi
je 0x40a5cd
push 1
mov dword [ebp - 4], 0
call fcn.004199fc
add esp, 4
mov dword [edi + 4], eax
jmp 0x40a5cf
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.004039e0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x40a62a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x40a62a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x40a646
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40a669
cmp byte [ebp + 0xc], 0
je 0x40a655
push esi
call fcn.00419f91
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40a675
mov esi, str.ios_base::badbit_set
jmp 0x40a685
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0040a6b0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.004046e0
push 0x465284
lea eax, [ebp - 0x28]
push eax
call fcn.00432540
int3
Function at 0x40cc60
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453560
mov eax, dword fs:[0]
push eax
mov eax, 0x1214
call fcn.004312e0
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0xf003f
push 0
push 0
mov dword [ebp - 0x1220], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x40cce7
push 1
lea ecx, [ebx + 0x40]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40ccd7
push eax
mov dword [ebp - 0x1220], 1
call esi
push edi
call esi
cmp dword [ebp - 0x1220], 0
jne 0x40ce42
push 0x104
lea eax, [ebp - 0x21a]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40cda2
cmp eax, 0x104
je 0x40cda2
mov ecx, 0x22
mov word [ebp - 0x21c], cx
mov word [ebp + eax*2 - 0x21a], cx
lea eax, [eax*2 + 4]
cmp eax, 0x20c
jae 0x40ce4c
xor ecx, ecx
push 0xf003f
push ecx
push ecx
mov word [ebp + eax - 0x21c], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40cdc0
push 0x400
lea eax, [ebp - 0xa1c]
push eax
push 0xd80a
call fcn.0040bb30
add esp, 0xc
test eax, eax
jne 0x40cd8d
push str.Could_not_open_Service_Manager
lea eax, [ebp - 0xa1c]
push 0x400
push eax
call fcn.00438a66
push eax
call fcn.004061d0
add esp, 0x10
lea eax, [ebx + 0x40]
push 0
push eax
lea eax, [ebp - 0xa1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x21c]
add ebx, 0x40
push eax
push 1
push 3
push 0x10
push 0xf01ff
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x40ce3c
push edi
call esi
push 0x400
lea eax, [ebp - 0x121c]
push eax
push 0xd80b
call fcn.0040bb30
add esp, 0xc
test eax, eax
jne 0x40ce2e
push str.Could_not_start_service
lea eax, [ebp - 0x121c]
push 0x400
push eax
call fcn.00438a66
push eax
call fcn.004061d0
add esp, 0x10
push 0
push ebx
lea eax, [ebp - 0x121c]
jmp 0x40cd99
push eax
call esi
push edi
call esi
mov eax, 1
jmp 0x40cda4
call fcn.00431199
int3
Function at 0x40ce60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
call fcn.0040b1f0
push dword [eax + 4]
push dword [eax]
call fcn.00438720
xor eax, eax
add esp, 0x20
cmp dword [esi + 0x260], 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
jne 0x40cec7
push eax
call fcn.00438baf
add esp, 4
lea eax, [esi + 0x40]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40cefc
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004312d2
mov esp, ebp
pop ebp
ret
Function at 0x40dd60
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453670
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x46a180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0040e470
test eax, eax
je 0x40de98
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], str.APPID
push eax
push 1
push 0x65
push dword [0x46c3c8]
mov dword [ebp - 0x24], str.89882228_a307_4697_b190_aef836059fc7
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.004084e0
test eax, eax
js 0x40de9d
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40df07
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.89882228_a307_4697_b190_aef836059fc7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dedb
mov edi, dword [ebp - 0x14]
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [ebp + 8], 0
je 0x40deb1
lea edx, [ebx + 0x40]
test edx, edx
je 0x40de79
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40de50
sub ecx, dword [ebp + 8]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, ebx
call fcn.0040cc60
test eax, eax
jne 0x40deb1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40de91
push edi
call ebx
test esi, esi
je 0x40de98
push esi
call ebx
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40debe
push edi
call ebx
test esi, esi
je 0x40dec5
push esi
call ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.00406290
add esp, 4
mov edi, eax
test esi, esi
je 0x40def1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.00406290
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453690
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
push str.AppID
push SysReAllocString
mov dword [ebp - 0x220], 0
call ebx
test eax, eax
jne 0x40e328
mov esi, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
push str.89882228_a307_4697_b190_aef836059fc7
push esi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x40e313
mov ebx, dword [ebp - 0x224]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x228], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.LocalService
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e214
mov eax, dword [ebp - 0x21c]
cmp eax, 1
je 0x40e1f5
cmp eax, 2
jne 0x40e214
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x40e28a
test al, 1
jne 0x40e214
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x40e293
push 0
push 0
mov dword [edi + 0x260], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x21c], eax
test eax, eax
jns 0x40e251
cmp eax, 0x80010106
jne 0x40e2f7
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40e255
jmp 0x40e2f7
mov byte [edi + 0x3e], 1
push dword [ebp + 8]
mov ecx, edi
call fcn.0040e0a0
mov dword [edi + 0x250], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], eax
test ebx, ebx
je 0x40e278
push ebx
call edi
test esi, esi
je 0x40e27f
push esi
call edi
mov eax, dword [ebp - 0x21c]
jmp 0x40e32e
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [edi + 0x40]
mov dword [edi + 0x260], 0
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push eax
mov dword [edi + 0x260], 1
mov dword [ebp - 0x234], 0x40ec00
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x40e2eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x250], eax
mov eax, dword [edi + 0x250]
mov dword [ebp - 0x21c], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x40e304
push ebx
call edi
test esi, esi
je 0x40e30b
push esi
call edi
mov eax, dword [ebp - 0x21c]
jmp 0x40e32e
mov dword [edi + 0x250], ebx
test esi, esi
je 0x40e324
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40e32e
mov dword [edi + 0x250], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret 4
Function at 0x40e470
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4536c0
mov eax, dword fs:[0]
push eax
mov eax, 0x1828
call fcn.004312e0
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
add edi, 0x40
mov dword [ebp - 0x1830], eax
test eax, eax
je 0x40e6c6
push 1
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40e4e2
push eax
mov esi, 1
call ebx
jmp 0x40e4e4
xor esi, esi
push dword [ebp - 0x1830]
call ebx
test esi, esi
je 0x40e6c6
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x1834], esi
test esi, esi
jne 0x40e564
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0xd80a
call fcn.0040bb30
add esp, 0xc
test eax, eax
jne 0x40e54b
push str.Could_not_open_Service_Manager
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00438a66
push eax
call fcn.004061d0
add esp, 0x10
push 0
push edi
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40e6cb
push 0x10020
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x1830], eax
test eax, eax
jne 0x40e5d3
push esi
call ebx
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0xd80c
call fcn.0040bb30
add esp, 0xc
test eax, eax
jne 0x40e5ba
push str.Could_not_open_service
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00438a66
push eax
call fcn.004061d0
add esp, 0x10
push 0
push edi
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40e6cb
lea ecx, [ebp - 0x182c]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40e652
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x40e652
cmp eax, 0x425
jne 0x40e604
cmp dword [ebp - 0x1828], 3
je 0x40e652
push 0x400
lea eax, [ebp - 0x1010]
push eax
push 0xd80e
call fcn.0040bb30
add esp, 0xc
test eax, eax
jne 0x40e640
push str.Could_not_stop_service
lea eax, [ebp - 0x1010]
push 0x400
push eax
call fcn.00438a66
push eax
call fcn.004061d0
add esp, 0x10
push 0
push edi
lea eax, [ebp - 0x1010]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x1830]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [ebp - 0x1830]
mov esi, eax
call ebx
push dword [ebp - 0x1834]
call ebx
test esi, esi
jne 0x40e6c6
push 0x400
lea eax, [ebp - 0x1810]
push eax
push 0xd80d
call fcn.0040bb30
add esp, 0xc
test eax, eax
jne 0x40e6b0
push str.Could_not_delete_service
lea eax, [ebp - 0x1810]
push 0x400
push eax
call fcn.00438a66
push eax
call fcn.004061d0
add esp, 0x10
push 0
push edi
lea eax, [ebp - 0x1810]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40e6cb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret
Function at 0x40e6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4536f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x46a180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040e470
test eax, eax
jne 0x40e736
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
mov dword [ebp - 0x10], 0
call edi
test eax, eax
jne 0x40e7eb
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push str.89882228_a307_4697_b190_aef836059fc7
push esi
call edi
test eax, eax
jne 0x40e7c2
mov edi, dword [ebp - 0x14]
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.0040e810
mov dword [ebp - 0x18], eax
test edi, edi
je 0x40e7a3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40e7ae
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.00406290
add esp, 4
mov edi, eax
test esi, esi
je 0x40e7d8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.00406290
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e850
Capabilities:
Accept command line arguments
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453710
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x46c3b8], 0
je 0x40e890
or eax, 0xffffffff
jmp 0x40ea96
mov dword [ebp - 0x12c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x12c]
push ecx
push eax
mov ecx, edi
call fcn.0040d7e0
cmp al, 1
jne 0x40ea79
lea eax, [ebp - 0x154]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x164], 0
push eax
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
call fcn.0040c510
xor ecx, ecx
test eax, eax
push str.GlobalWeMeet_b6449d97_7d64_eccb_a751_b5f633d4f376
sete cl
xor edx, edx
mov dword [ebp - 0x164], ecx
test eax, eax
lea ecx, [ebp - 0x160]
push 1
cmove ecx, edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.wemeet_update_service_start.
mov dword [edi + 0x268], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], 0
push eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x134], 0
push eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x138], 0
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x12c], 0
push eax
call fcn.00411f60
add esp, 0x14
call fcn.004102f0
cmp eax, 6
jl 0x40ea1d
push str.CWemeetUpdateSvcModule::Start
push 0x41
push str.D:qci_workspace_root_workspaces__qci_pipeline_10854701_1_appWindows_serviceupdate_servicewemeet_update_service.cc
push 6
lea ecx, [ebp - 0x128]
call fcn.00404330
push str.wemeet_update_service_start._version:
lea esi, [eax + 0x10]
push esi
call fcn.00402c00
add esp, 8
mov ecx, esi
push dword [ebp - 0x130]
call fcn.0040b980
push 0x457f4c
push esi
call fcn.00402c00
add esp, 8
mov ecx, esi
push dword [ebp - 0x134]
call fcn.0040b980
push 0x457f4c
push esi
call fcn.00402c00
add esp, 8
mov ecx, esi
push dword [ebp - 0x138]
call fcn.0040b980
push 0x457f4c
push esi
call fcn.00402c00
add esp, 8
mov ecx, esi
push dword [ebp - 0x12c]
call fcn.0040b980
lea ecx, [ebp - 0x128]
call fcn.00404f70
lea eax, [ebp - 0x40]
push eax
call fcn.004068d0
add esp, 4
mov ecx, eax
push 0
push 0x4e20
call fcn.00415660
lea ecx, [ebp - 0x40]
call fcn.004154c0
push dword [ebp + 8]
mov ecx, edi
call fcn.0040e120
mov esi, eax
mov eax, dword [ebp - 0x140]
test eax, eax
je 0x40ea66
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x40ea7f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40ea7f
mov esi, dword [ebp - 0x12c]
cmp dword [edi + 0x260], 0
jne 0x40ea94
cmp byte [edi + 0x3e], 0
je 0x40ea94
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret 4
Function at 0x40fd30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453940
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
mov eax, dword [0x46a180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
lea ecx, [ebp - 0xc0]
call fcn.0040f180
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
shr eax, 0x10
movzx ecx, bl
xor ecx, 0x811c9dc5
movzx eax, al
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
shr ebx, 0x18
xor edx, ecx
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul ecx, eax, 0x1000193
mov eax, 0xd1b71759
mul ecx
shr edx, 0xd
imul eax, edx, 0x2710
sub ecx, eax
push ecx
lea ecx, [ebp - 0xb0]
call fcn.00405220
push dword [ebp + 8]
lea ecx, [ebp - 0xa8]
call fcn.0040ae30
lea ecx, [ebp - 0xc0]
call fcn.004053d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4116d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x324], eax
xor eax, eax
movups xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push eax
call fcn.00412180
add esp, 4
test al, al
je 0x41182a
lea eax, [ebp - 0x234]
push eax
call fcn.004118c0
add esp, 4
test al, al
je 0x41182a
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00432ee0
cmp dword [ebp - 0x220], 7
lea eax, [ebp - 0x234]
cmova eax, dword [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00438a66
add esp, 0x18
cmp dword [edi + 0x14], 7
jbe 0x4117a8
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [esi + 0x14], 7
jbe 0x4117be
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x411865
call fcn.004102f0
cmp eax, 3
jl 0x41182a
push str.WemeetFileUtil::CopyFileToWemeetServiceTempPath
push 0xf8
push str.D:qci_workspace_root_workspaces__qci_pipeline_10854701_1_appWindows_serviceupdate_serviceutilwemeet_file_util.cc
push 3
lea ecx, [ebp - 0x31c]
call fcn.00404330
lea esi, [eax + 0x10]
mov byte [ebp - 4], 1
push str.copy_file_error:
push esi
call fcn.00402c00
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00405220
lea ecx, [ebp - 0x31c]
call fcn.00404f70
mov byte [ebp - 0x31d], 0
mov ecx, dword [ebp - 0x220]
cmp ecx, 7
jbe 0x41188a
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411880
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118ab
jmp 0x411880
mov ecx, dword [ebp - 0x324]
lea eax, [ebp - 0x21c]
push eax
call fcn.004115b0
mov byte [ebp - 0x31d], 1
jmp 0x411831
push ecx
push edx
call fcn.00430e05
add esp, 8
mov al, byte [ebp - 0x31d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret
call fcn.00435fbe
int3
Function at 0x411db0
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push 0x20a
xorps xmm0, xmm0
push 0
push eax
movlpd qword [ebp - 0x218], xmm0
call fcn.00432ee0
add esp, 0xc
test esi, esi
je 0x411e0b
cmp word [esi], 0
je 0x411e0b
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00438a66
add esp, 0xc
jmp 0x411e1f
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411f33
push 0
lea eax, [ebp - 0x210]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x411f33
add eax, 2
push 0x4596b0
push eax
call fcn.004312c9
mov ebx, eax
add esp, 8
mov dword [ebp - 0x224], ebx
test ebx, ebx
je 0x411f33
push ebx
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x411f2a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], 0
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0x34
push eax
push 0x45894c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x411f2a
mov edi, dword [ebp - 0x220]
test edi, edi
je 0x411f2a
mov ecx, dword [edi + 0x10]
mov edi, dword [edi + 0x14]
push dword [ebp - 0x224]
movzx esi, cx
shr ecx, 0x10
movzx ebx, di
mov dword [ebp - 0x214], ecx
shr edi, 0x10
call fcn.00430e13
mov ecx, dword [ebp - 0x214]
xor eax, eax
shld eax, ecx, 0x10
add esp, 4
mov dword [ebp - 0x214], eax
mov eax, esi
mov esi, dword [ebp - 0x214]
shl ecx, 0x10
cdq
or ecx, eax
or esi, edx
shld esi, ecx, 0x10
mov eax, ebx
shl ecx, 0x10
or ecx, edi
cdq
shld esi, ecx, 0x10
shl ecx, 0x10
or ecx, eax
or esi, edx
jmp 0x411f3f
push ebx
call fcn.00430e13
add esp, 4
mov ecx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x214]
mov eax, ecx
mov edx, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004312d2
mov esp, ebp
pop ebp
ret