joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10124920
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x101249d0
lea edi, [esi + 0x18]
cmp dword [edi + 0x18], 0x70000
jne 0x10124983
cmp dword [edi - 4], 8
mov eax, esi
jb 0x10124963
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [edi + 0x14], 8
mov ebx, edi
mov dword [ebp - 4], eax
jb 0x10124977
mov ebx, dword [edi]
cmp dword [edi - 4], 8
mov edx, esi
jb 0x1012499d
mov edx, dword [esi]
jmp 0x1012499d
cmp dword [edi + 0x14], 8
mov ebx, edi
jb 0x1012498d
mov ebx, dword [edi]
cmp dword [edi - 4], 8
mov edx, esi
jb 0x10124997
mov edx, dword [esi]
mov eax, dword [edi + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x24]
push eax
mov eax, dword [edi + 0x1c]
push ecx
push dword [ebp - 4]
push eax
push dword [edi + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push edx
push str._s__s__u__u__u__u__u_
push ebx
call fcn.10123b20
mov eax, dword [ebp - 8]
add esi, 0x44
add esp, 0x24
add edi, 0x44
cmp esi, dword [eax + 4]
jne 0x10124950
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1012da90
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], 0x104
call fcn.101f9fcf
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x210]
push eax
call fcn.10023e80
test al, al
jne 0x1012db25
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1012db07
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003740
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10145320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x410
lea eax, [ebp - 0x414]
mov edi, ecx
push 0
push eax
call fcn.101f9fcf
add esp, 0xc
mov dword [ebp - 0x420], 1
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x40e
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1014544f
mov eax, dword [ebp - 0x418]
and eax, 0xfffffffe
cmp eax, 0x410
jae 0x10145559
xor ecx, ecx
lea esi, [edi + 4]
mov word [ebp + eax - 0x414], cx
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x101453c0
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003740
push str.doctor.dll
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.10007f40
add esp, 0xc
mov ecx, esi
push eax
call fcn.10002790
mov edx, dword [ebp - 0x41c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10145419
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
cmp dword [eax - 4], 1
jle 0x1014542d
push dword [eax - 0xc]
mov ecx, esi
call fcn.10002c20
mov eax, dword [esi]
push eax
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x10145452
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
lea esi, [edi + 4]
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x40e
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_5.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10145547
mov eax, dword [ebp - 0x418]
and eax, 0xfffffffe
cmp eax, 0x410
jae 0x10145559
xor ecx, ecx
mov word [ebp + eax - 0x414], cx
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x101454b5
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003740
push str.doctor.dll
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.10007f40
add esp, 0xc
mov ecx, esi
push eax
call fcn.10002790
mov edx, dword [ebp - 0x41c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1014550e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 4]
cmp dword [eax - 4], 1
jle 0x10145525
push dword [eax - 0xc]
lea ecx, [edi + 4]
call fcn.10002c20
mov eax, dword [edi + 4]
push eax
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x10145547
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
call fcn.101c8260
int3
Function at 0x10145670
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x102568bc], 0
jne 0x101456d9
lea eax, [ebp - 0x118]
mov byte [0x102568bc], 1
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x101456d9
mov eax, dword [ebp - 0x110]
sub eax, 2
neg eax
sbb eax, eax
and eax, dword [section..data]
mov dword [section..data], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [section..data]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1014cc50
Capabilities:
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1014cc6a
push eax
call ebx
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1014cc74
push eax
call ebx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1014cc7e
push eax
call ebx
cmp dword [esi + 0x44], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
je 0x1014cca6
mov ecx, esi
call fcn.1014cdf0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x48], 0
je 0x1014cccc
cmp dword [esi + 0x18], 0
je 0x1014cccc
cmp dword [esi + 0x30], 0
je 0x1014cccc
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 8]
push eax
call fcn.1002d9f0
add esp, 8
test al, al
je 0x1014cc99
push edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push 0
mov dword [ebp - 0xc], 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x1014cd72
cmp dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jbe 0x1014cd60
xor edi, edi
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + edi]
cmp eax, dword [esi]
jne 0x1014cd51
push str.explorer.exe
push dword [ecx + edi + 8]
call fcn.101f9fb7
add esp, 8
test eax, eax
jne 0x1014cd51
mov eax, dword [ebp - 8]
push dword [edi + eax + 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x1014cd51
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x10]
add edi, 0x10
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 0xc]
jb 0x1014cd05
push dword [ebp - 8]
call sub.WTSAPI32.dll_WTSFreeMemory
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 4
jmp 0x1014cd80
push str.Program_Manager
push str.Progman
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x1014cde3
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x10], 0
jbe 0x1014cdde
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
je 0x1014cdde
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1014cdde
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov byte [ebp - 1], 1
sub edi, 1
jne 0x1014cd80
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1014d060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x464], 0
mov word [ebp - 0x426], ax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov eax, 5
push 0x208
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x436], 0
mov dword [ebp - 0x432], 0
mov dword [ebp - 0x42e], 0
mov dword [ebp - 0x42a], 0
mov dword [ebp - 0x468], 0x44
mov dword [ebp - 0x43c], 1
call fcn.101f9fcf
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.101f9fcf
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
push str.__sexplorer.exe_
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.101fa3aa
add esp, 0x10
lea eax, [ebp - 0x424]
mov ecx, 0x1024ee30
push eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0
call fcn.101b14f0
test eax, eax
je 0x1014d205
push 0x3e8
push dword [ebp - 0x424]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1014d220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x414]
mov esi, ecx
push 0
push eax
call fcn.101f9fcf
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.101f9fcf
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
push str.__sexplorer.exe_
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.101fa3aa
add esp, 0x10
mov dword [ebp - 0x464], 0
xor eax, eax
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x45c], 0
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x414]
mov dword [ebp - 0x458], 0
push eax
mov eax, dword [esi + 0x44]
push 0
push 1
push dword [esi + 0x40]
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x468], 0x44
call eax
test eax, eax
je 0x1014d3b8
push 0x3e8
push dword [ebp - 0x424]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x420]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x424]
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp + 8], 0
jne 0x1014d3dd
mov ecx, esi
call fcn.1014d060
test al, al
jne 0x1014d3dd
mov ecx, esi
call fcn.1014d6a0
test al, al
je 0x1014d3dd
push 1
mov ecx, esi
call fcn.1014d220
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x1014d3f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
jmp 0x1014d410
push dword [ebx + 0x40]
mov byte [ebp - 0x615], 0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1014d60f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x66c], 0
push 0x1e0
push eax
mov word [ebp - 0x62e], ax
lea edi, [ebp - 0x204]
mov dword [ebp - 0x62c], eax
mov ecx, 8
mov dword [ebp - 0x628], eax
mov esi, str.WinSta0Default
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x1e4]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x63e], 0
mov dword [ebp - 0x63a], 0
mov dword [ebp - 0x636], 0
mov dword [ebp - 0x632], 0
mov dword [ebp - 0x670], 0x44
call fcn.101f9fcf
add esp, 0xc
mov dword [ebp - 0x644], 1
lea eax, [ebp - 0x204]
mov dword [ebp - 0x61c], 0
mov dword [ebp - 0x668], eax
mov eax, 5
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x61c]
push 0
push dword [ebx + 0x40]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push 0x208
lea eax, [ebp - 0x614]
push 0
push eax
call fcn.101f9fcf
push 0x208
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.101f9fcf
add esp, 0x18
lea eax, [ebp - 0x40c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x40c]
push eax
push str.__sexplorer.exe_
lea eax, [ebp - 0x614]
push 0x103
push eax
call fcn.101fa3aa
add esp, 0x10
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push 0
push dword [ebp - 0x61c]
lea eax, [ebp - 0x614]
push 0x410
push 0
push 0
push 0
push eax
push 0
push dword [ebx + 0x40]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1014d5f0
push dword [ebp - 0x62c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x615], 1
call esi
push dword [ebp - 0x628]
call esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x61c]
test eax, eax
je 0x1014d606
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
cmp byte [ebp - 0x615], 0
jne 0x1014d634
cmp byte [ebp + 8], 0
jne 0x1014d634
mov ecx, ebx
call fcn.1014d060
test al, al
jne 0x1014d634
mov ecx, ebx
call fcn.1014d6a0
test al, al
je 0x1014d634
mov byte [ebp + 8], 1
jmp 0x1014d410
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x1014d6a0
Capabilities:
Check for time delay via gettickcount
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x20
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1014d76d
push esi
push 0x16
push str.seclogon
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1014d765
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1014d75e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1014d754
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jne 0x1014d757
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x24]
cmp eax, 0x3a98
ja 0x1014d754
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1014d725
mov eax, dword [ebp - 0x1c]
cmp eax, 4
jne 0x1014d75e
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x1014ddd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x1450
mov esi, ecx
call fcn.101f9fe1
add esp, 4
mov ebx, eax
xor eax, eax
mov ecx, 0x514
mov edi, ebx
rep stosd dword es:[edi], eax
push dword [esi + 4]
push 0xa28
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
push ebx
call fcn.10002490
push ebx
call fcn.101f9fe7
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1014de30
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1014de84
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push dword [esi + 4]
mov dword [ebp - 8], 0xfeff
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1014de90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x401c
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1014e01e
test eax, 0x400
je 0x1014e01e
lea eax, [ebp - 0x4018]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x4010]
push eax
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x4014]
mov dword [ebp - 0x4014], 1
push eax
push 0
push dword [ebp - 0x4018]
mov dword [ebp - 0x4008], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x4018]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push 0x2200000
push 3
push 0
push 0
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1014e01e
push 0
lea eax, [ebp - 0x401c]
push eax
push 0x4000
lea eax, [ebp - 0x4004]
push eax
push 0
push 0
push 0x900a8
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1014e008
mov eax, dword [ebp - 0x4004]
test eax, 0x1fff0000
jne 0x1014e008
cmp eax, 1
jbe 0x1014e008
push esi
call edi
lea eax, [ebp - 0x3ff4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jle 0x1014dfe0
cmp word [ebp - 0x3ff4], 0x5c
jne 0x1014dfe0
mov eax, dword [ebp - 0x3ff2]
cmp ax, 0x3f
je 0x1014dfc6
cmp ax, 0x5c
jne 0x1014dfe0
cmp word [ebp - 0x3ff0], 0x3f
jne 0x1014dfe0
cmp word [ebp - 0x3fee], 0x5c
lea eax, [ebp - 0x3fec]
je 0x1014dfe6
lea eax, [ebp - 0x3ff4]
push eax
mov ecx, ebx
call fcn.10008170
movzx eax, word [ebp - 0x3ffa]
pop edi
pop esi
shr eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1014f520
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1014f5d2
lea ecx, [ebp - 0x214]
mov esi, str._SYSTEMROOT__system32
mov eax, ecx
mov edx, 0x105
sub esi, eax
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x1014f57d
mov al, byte [esi + ecx]
test al, al
je 0x1014f57d
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1014f562
jmp 0x1014f581
test edx, edx
jne 0x1014f582
dec ecx
mov eax, edx
mov byte [ecx], 0
neg eax
sbb eax, eax
and eax, 0x7ff8ff86
add eax, 0x8007007a
test edx, edx
jne 0x1014f5a4
push eax
push str.LoadUpdateProviderFunctions:_StringCchCopyA_failed:_0x_x_n
jmp 0x1014f6d5
push 0x105
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1014f5d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUpdateProviderFunctions:_Unable_to_expand_environment_string:__d_n
jmp 0x1014f6d5
mov edx, 0x105
lea eax, [ebp - 0x10c]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x1014f5eb
inc eax
sub edx, 1
jne 0x1014f5e0
mov ecx, 0x105
mov esi, edx
mov eax, ecx
sub eax, edx
neg esi
sbb esi, esi
and esi, eax
mov eax, edx
neg eax
sbb eax, eax
and eax, 0x7ff8ffa9
add eax, 0x80070057
test edx, edx
je 0x1014f6cf
lea eax, [ebp - 0x10c]
lea eax, [eax + esi]
push ebx
sub ecx, esi
je 0x1014f64a
mov esi, str.ws2_32.dll
mov edx, SysReAllocString
sub esi, eax
mov edi, edi
test edx, edx
je 0x1014f646
mov bl, byte [esi + eax]
test bl, bl
je 0x1014f646
mov byte [eax], bl
dec edx
inc eax
sub ecx, 1
jne 0x1014f630
jmp 0x1014f64a
test ecx, ecx
jne 0x1014f64b
dec eax
mov byte [eax], 0
mov eax, ecx
neg eax
pop ebx
sbb eax, eax
and eax, 0x7ff8ff86
add eax, 0x8007007a
test ecx, ecx
je 0x1014f6cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1014f6ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10c]
push eax
push str.LoadUpdateProviderFunctions:_Unable_to_load__s:__d_n
push 2
call fcn.101eb5c0
add esp, 4
push eax
call fcn.101fa3e9
add esp, 0x10
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push str.WSCUpdateProvider
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1025a9fc], eax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push eax
push str.LoadUpdateProviderFunctions:_StringCchCatA_failed:_0x_x_n
push 2
call fcn.101eb5c0
add esp, 4
push eax
call fcn.101fa3e9
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret