joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d7e
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x47c000], 0
push ebx
push ebp
push esi
push edi
mov ebx, 0xffff
mov edi, 0x47c000
je 0x403d9d
push edi
call fcn.0040604f
jmp 0x403da3
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
mov esi, dword [0x44ba84]
mov ecx, esi
dec esi
test ecx, ecx
je 0x403df7
mov ecx, dword [0x44ba48]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x44ba80]
mov bp, word [ecx]
xor bp, ax
and ebp, ebx
test bp, bp
je 0x403dde
mov ebp, esi
dec esi
add ecx, edx
test ebp, ebp
jne 0x403dc6
jmp 0x403df7
mov edx, dword [ecx + 2]
mov dword [0x447a20], edx
mov edx, dword [ecx + 6]
mov dword [0x44bae8], edx
lea edx, [ecx + 0xa]
test edx, edx
jne 0x403e09
cmp bx, 0xffff
jne 0x403e05
mov ebx, 0x3ff
jmp 0x403da3
xor ebx, ebx
jmp 0x403da3
mov dword [0x447a1c], edx
movzx eax, word [ecx]
push eax
push edi
call fcn.00406036
push 0xfffffffffffffffe
push 0x447a40
call fcn.00406108
push eax
push dword [0x4353f0]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x44ba6c]
mov esi, dword [0x44ba68]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403e63
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403e5c
push eax
push ebx
call fcn.00406108
add esi, edi
add ebx, edi
dec ebp
jne 0x403e4f
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405909
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x43ac18], 0x44
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x40592d
test al, 0x10
jne 0x405930
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x43ac18
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40595b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x405daa
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
ret 0xc

Function at 0x405dd9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x405e1e
mov eax, edi
dec edi
test eax, eax
jne 0x405de4
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405e18
Function at 0x405e22
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call 0x4064d9
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405e4e
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405f92
mov ebx, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov dword [0x43ada0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x43ada0
je 0x405e92
push 1
push 0
push esi
call fcn.00405daa
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405f98
cmp eax, edi
jg 0x405f98
mov esi, 0x43a818
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405f98
cmp eax, edi
jg 0x405f98
push esi
push ebp
push str._s_s_r_n
push 0x43a418
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.004060f7
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405f92
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x405f7a
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x405f6e
push str._Rename__r_n
push edi
call fcn.00405d38
test eax, eax
jne 0x405f9f
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.004060d9
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x43a418
push eax
call fcn.00405d84
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [0x44bad0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9d8
push eax
call fcn.00405d38
test eax, eax
je 0x405f55
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x405fc8
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x405fbb
sub eax, edi
jmp 0x405f57
Function at 0x406aec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x406b30
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x406aff
jmp 0x406b30
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x406b20
pop esi
pop ebp
ret

Function at 0x407568
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40759d
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x4075c7
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x4075c7
test edi, edi
je 0x407594
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x407594
test edi, edi
je 0x4075cf
mov eax, edi
jmp 0x407596
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x407596
int3
Function at 0x40a140
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonSize], eax
call fcn.00407568
pop ecx
mov ecx, dword [sym.TestTemplateLib.exe_gMozillaPoisonSize]
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40a178
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x4097d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e349
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ae44c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
call dword [0x4824e8]
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
call dword [0x4824e8]
mov byte [ebp - 4], 1
lea ecx, [esi + 8]
call dword [0x4824e8]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x218]
call dword [0x4824e8]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call dword [0x4824e8]
mov byte [ebp - 4], 4
push 0x104
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer_1]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 4]
call dword [0x4824d8]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40beb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push eax
push str.Begin_opening:
push 0x484dc0
call fcn.00459000
push eax
call fcn.0045a050
add esp, 0x10
push 0xa
push 0
push 0
mov ecx, esi
call dword [sym.imp.mfc100u.dll_]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x20
jle 0x40bf13
push 0x484d88
push 0x484d84
call fcn.00459000
push eax
call fcn.0045a050
add esp, 0xc
jmp 0x40bf2c
push edi
push str.Open_was_unsuccessfull:
push 0x484d4c
call fcn.00459000
push eax
call fcn.0045a050
add esp, 0x10
cmp edi, 0x1f
je 0x40bf3b
cmp edi, 0x1b
je 0x40bf3b
cmp edi, 5
jne 0x40bf91
push str.Open_was_unsuccessfull_due_to_unknown_file_extension
push 0x484d84
call fcn.00459000
push eax
call fcn.0045a050
push 0x3c
lea ecx, [ebp - 0x3c]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
mov ecx, esi
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.mfc100u.dll_]
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], str.openas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp edi, 2
jne 0x40bfae
push str.Open_was_unsuccessfull_due_to_the_file_not_being_found
push 0x484d84
call fcn.00459000
push eax
call fcn.0045a050
add esp, 0xc
mov eax, dword [esi]
push 0x483b88
push eax
push str.End_opening:
push 0x484c3c
call fcn.00459000
push eax
call fcn.0045a050
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c712
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40c6e1
cmp eax, 2
jne 0x40c6fc
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x40c70c
test eax, eax
je 0x40c707
test al, 1
jne 0x40c6fc
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x40c70c
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40dd50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f4a3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ae44c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x482e5c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 0
call dword [0x4824d0]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov esi, eax
and eax, 0xf
shr esi, 4
inc esi
mov ebx, eax
call sub.mfc100u.dll_AfxGetModuleState
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
shl ecx, 0xa
or ecx, dword [ebp + 0x10]
movzx edx, si
push ecx
push edx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x40ddf0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ddf0
mov esi, eax
xor ecx, ecx
movzx eax, word [esi]
add esi, 2
test ax, ax
je 0x40ddea
mov edi, eax
cmp ecx, ebx
je 0x40de27
lea esi, [esi + edi*2]
inc ecx
cmp ecx, 0x10
jl 0x40ddd6
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call dword [0x4824cc]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc100u.dll_new__
push edi
mov ebx, eax
push esi
push ebx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0x10
xor eax, eax
push ebx
lea ecx, [ebp - 0x10]
mov word [ebx + edi*2], ax
call dword [0x4824f0]
push ebx
call sub.mfc100u.dll_delete__
mov esi, dword [ebp + 8]
add esp, 4
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call dword [0x4824cc]
jmp 0x40ddff
Function at 0x40df60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f4fc
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4ae44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
jmp 0x40dfb0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40dfb0
mov ecx, dword [0x4848d0]
mov eax, esi
mov dword [edi], ecx
mov edx, eax
jmp 0x40dfd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40dfd0
lea edi, [ebp - 0x218]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40dfe6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x21c]
call dword [0x4824e8]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.0040d1a0
add esp, 8
test eax, eax
jne 0x40e068
push 0x4850a0
lea ecx, [ebp - 0x218]
push ecx
push str.Could_not_register_file__
push 0x484c3c
call fcn.00459000
push eax
call fcn.0045a050
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
xor al, al
jmp 0x40e07d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b17c
mov esp, ebp
pop ebp
ret
Function at 0x40eb80
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4ae44c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
mov byte [ebp - 0x21], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40ebe4
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 4]
push eax
mov eax, dword [esi + 4]
push 0x485294
push eax
push str.Failed_to_open_service_control_manager_for_
push str.sssi
push esi
call ecx
add esp, 0x18
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b17c
mov esp, ebp
pop ebp
ret
push ebx
push 4
lea ecx, [esi + 4]
call dword [sym.imp.mfc100u.dll_]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40ec44
mov edx, dword [esi]
mov dword [ebp - 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
push eax
mov eax, dword [esi + 4]
push str..__Chances_are_it_does_not_exist.__Error:
push eax
push str.Failed_to_open_service_
push str.sssi
push esi
call edx
add esp, 0x18
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b17c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40ec66
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x40ec60
cmp eax, 2
jne 0x40ec91
mov byte [ebp - 0x21], 1
jmp 0x40ec91
mov edx, dword [esi]
mov dword [ebp - 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
push eax
mov eax, dword [esi + 4]
push 0x485294
push eax
push str.Failed_to_query_service_status_for_
push str.sssi
push esi
call edx
add esp, 0x18
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0046b17c
mov esp, ebp
pop ebp
ret
Function at 0x415850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470c82
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4ae44c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.004150c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::IsEmpty]
test al, al
jne 0x4158fc
push str.EVMoveW.exe
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.0040fbd0
mov byte [ebp - 4], 1
push 0x3c
lea eax, [ebp - 0x50]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x50], 0x3c
call dword [sym.imp.mfc100u.dll_]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
call dword [sym.imp.mfc100u.dll_]
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x415920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470cbb
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
mov eax, dword [0x4ae44c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00414fc0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.00414700
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::IsEmpty]
test al, al
jne 0x415a07
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::IsEmpty]
test al, al
jne 0x415a07
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0040fb30
mov byte [ebp - 4], 2
push 0x3c
lea eax, [ebp - 0x54]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x54], 0x3c
call dword [sym.imp.mfc100u.dll_]
push str.FTActTool.exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x44], eax
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
neg eax
sbb eax, eax
not eax
and eax, 0x4860a8
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x40], eax
call dword [sym.imp.mfc100u.dll_]
lea ecx, [ebp - 0x54]
push ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
jmp loc.005698d8
Function at 0x415ca0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470d79
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4ae44c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add dword [0x4ae580], eax
mov ecx, dword [ebp + 0xc]
adc dword [0x4ae584], ecx
call fcn.0042def0
mov ecx, eax
call fcn.00424e50
mov edi, dword [0x4ae580]
mov esi, dword [0x4ae584]
add edi, eax
adc esi, edx
push esi
push edi
call fcn.0040bcc0
fstp qword [esp]
push 0x4861e8
push 0x4ae5d4
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
lea edx, [ebp + 0xc]
push edx
call fcn.0040bb00
add esp, 0x14
mov dword [ebp - 4], 0
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::IsEmpty]
test al, al
jne 0x415d72
push 0x4ae570
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100u.dll_]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x415d72
cmp dword [0x4ae574], esi
jb 0x415d6b
ja 0x415d62
cmp dword [0x4ae570], edi
jb 0x415d6b
mov byte [0x4ad661], 1
jmp 0x415d72
mov byte [0x4ad661], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415ee0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x415f0f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call sub.mfc100u.dll_new__
mov ecx, dword [ebp - 4]
add esp, 4
mov edi, eax
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x415f6e
xor eax, eax
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x4848d0
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
push edi
mov dword [ecx], eax
call sub.mfc100u.dll_delete__
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
xor esi, esi
call sub.mfc100u.dll_delete__
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret