joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409cc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x409cf1
mov eax, 0x80004003
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp ecx, 0x41
jb 0x409e0b
cmp ecx, 0x5a
jbe 0x409d0e
cmp ecx, 0x61
jb 0x409e0b
cmp ecx, 0x7a
ja 0x409e0b
mov eax, dword [0x43844c]
mov dword [ebp - 0xc], eax
mov eax, dword [0x438450]
mov dword [ebp - 8], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push eax
mov word [ebp - 0xc], cx
call fcn.00424e90
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x524], ax
lea eax, [ebp - 0x522]
push eax
call fcn.00424e90
add esp, 0x18
lea eax, [ebp - 0x524]
push 0x105
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x530]
push eax
push 0x105
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x409dc1
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
push 0xffffffffffffffff
push str.Fail:_GetVolumeName
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.004244e4
add esp, 0x10
lea eax, [ebp - 0x10c]
push 0
push 0
push 0x43ca34
push 0
push 0
push eax
push 0x43cac4
call fcn.00408180
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x80070057
pop esi
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c445
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c484
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c480
lea ebx, [ebx]
cmp esi, edx
jae 0x40c484
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c470
cmp esi, edx
jb 0x40c489
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40c4c0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x40c4f1
mov eax, 0x80004003
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp ecx, 0x41
jb 0x40c5bc
cmp ecx, 0x5a
jbe 0x40c50e
cmp ecx, 0x61
jb 0x40c5bc
cmp ecx, 0x7a
ja 0x40c5bc
mov eax, dword [0x43844c]
mov dword [ebp - 0xc], eax
mov eax, dword [0x438450]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40c572
mov eax, dword [ebp - 0x114]
mov dword [esi], eax
mov eax, dword [ebp - 0x110]
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
push 0xffffffffffffffff
push str.Fail:_get_AvailableFreeSpace
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.004244e4
add esp, 0x10
lea eax, [ebp - 0x10c]
push 0
push 0
push 0x43ca34
push 0
push 0
push eax
push 0x43cac4
call fcn.00408180
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x80070057
pop esi
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4106f0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x808]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push 0
xorps xmm0, xmm0
push 0
push 0x70050
push edi
movq qword [ebp - 0x804], xmm0
movq qword [ebp - 0x7fc], xmm0
movq qword [ebp - 0x7f4], xmm0
movq qword [ebp - 0x7ec], xmm0
movq qword [ebp - 0x7e4], xmm0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0
xorps xmm0, xmm0
push 0
push 0x70140
push edi
movq qword [ebp - 0x804], xmm0
movq qword [ebp - 0x7fc], xmm0
movq qword [ebp - 0x7f4], xmm0
movq qword [ebp - 0x7ec], xmm0
movq qword [ebp - 0x7e4], xmm0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00424839
mov esp, ebp
pop ebp
ret

Function at 0x4138a0
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea esp, [esp]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x2d4800
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x413964
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x413946
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x41395b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 1
jl 0x4138b0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [0x473b80], 1
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x103
lea eax, [ebp - 0x157]
push 0
push eax
mov byte [ebp - 0x158], 0
call fcn.00424e90
push 0x103
lea eax, [ebp - 0x25b]
push 0
push eax
mov byte [ebp - 0x25c], 0
call fcn.00424e90
push 0x4f
lea eax, [ebp - 0x53]
push 0
push eax
mov byte [ebp - 0x54], 0
call fcn.00424e90
add esp, 0x24
xorps xmm0, xmm0
push 0x104
lea eax, [ebp - 0x158]
push eax
xor bl, bl
mov dword [ebp - 0x2d0], 0
movq qword [ebp - 0x2cc], xmm0
movq qword [ebp - 0x2c4], xmm0
movq qword [ebp - 0x2bc], xmm0
movq qword [ebp - 0x2b4], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x414c52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2ac]
push str.Failed_to_get_system_directory__d
push eax
call fcn.0042762f
add esp, 0xc
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp byte [ebp + eax - 0x158], 0x5c
je 0x414c6a
inc bl
movzx eax, bl
cmp eax, 0x104
jl 0x414c54
push esi
movzx esi, bl
cmp esi, 0x104
je 0x414d19
push esi
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00426090
add esp, 0xc
cmp esi, 0x104
jae 0x414dc1
push 0x104
lea eax, [ebp - 0x158]
push 0
push eax
mov byte [ebp + esi - 0x25c], 0
call fcn.00424e90
lea eax, [ebp - 0x25c]
push eax
push str.._
lea eax, [ebp - 0x158]
push str._s_s
push eax
mov byte [edi], 0
call fcn.0042762f
add esp, 0x1c
lea eax, [ebp - 0x158]
push 0
push 0x10080
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414d2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x54]
push str.OpenDrive:_Unable_to_open_device____u
push eax
call fcn.0042762f
add esp, 0xc
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x2d0]
push eax
push 0x20
lea eax, [ebp - 0x2cc]
push eax
push 0
push 0
push 0x560000
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x414d84
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x54]
push str.IOCTL_SCSI_PASS_THROUGH_DIRECT_failed._Last_error____u
push eax
call fcn.0042762f
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x2cc]
test ecx, ecx
je 0x414da4
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x2c4]
cmp edx, dword [eax]
jne 0x414d9e
mov byte [edi], 1
add eax, 0x18
dec ecx
jne 0x414d97
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00424839
mov esp, ebp
pop ebp
ret
call fcn.004240f4
int3
Function at 0x414dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 3
push 6
call fcn.00414e40
add esp, 0x10
test eax, eax
je 0x414df3
mov eax, 1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x43b394
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 0xa
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret

Function at 0x415f30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
movzx esi, word [ebp + 8]
push esi
lea eax, [ebp - 0x10]
push str._c:_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 1
ja 0x415fa5
push esi
lea eax, [ebp - 0x20]
push str.._c:
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x20]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
push str.Cannot_eject.__Drive_type_is_incorrect._r_n
call fcn.00427477
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
or eax, 0xffffffff
pop esi
call fcn.00424839
mov esp, ebp
pop ebp
ret
Function at 0x41c7c0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43844c]
mov dword [ebp - 0xc], eax
mov eax, dword [0x438450]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 1
jne 0x41c89d
cmp dword [ebp - 0x118], 0
jne 0x41c89d
mov eax, 0x3e8
cmp word [ebp - 0x114], ax
jbe 0x41c89d
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x41c901
mov edx, dword [ebp - 0x12c]
push esi
mov esi, dword [ebp - 0x138]
mov eax, edx
imul edx, dword [ebp - 0x124]
imul eax, esi
imul esi, esi, 0x64
shr eax, 0xb
mov dword [ebx], eax
shr edx, 0xb
mov eax, esi
mov dword [edi], edx
pop esi
xor edx, edx
div dword [ebp - 0x124]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41c901
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
shrd ecx, eax, 0x14
mov dword [edi], ecx
mov ecx, dword [ebp - 0x124]
shr eax, 0x14
mov eax, dword [ebp - 0x128]
shrd eax, ecx, 0x14
mov dword [ebx], eax
imul eax, eax, 0x64
xor edx, edx
shr ecx, 0x14
div dword [edi]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.00424839
mov esp, ebp
pop ebp
ret
Function at 0x41e1c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x473b70]
sub esp, 0xc
push edi
xor edi, edi
cmp dword [eax + 0x10], edi
jle 0x41e2de
push ebx
push esi
xor esi, esi
jmp 0x41e1e0
push dword [esi + eax + 0x7a030]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [0x473b78]
mov dword [ebp - 8], eax
mov eax, dword [0x473b70]
mov byte [ebp - 1], 0
lea ebx, [eax + 0x79618]
add ebx, esi
cmp dword [esi + eax + 0x7a028], 0
jne 0x41e2ba
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebx + 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x41e2b5
push eax
push 7
call fcn.00413120
mov eax, dword [ebp - 8]
add esp, 8
lea eax, [eax*4 + 0x473a70]
push eax
push 0
push ebx
push 0x41e4f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov ecx, dword [0x473b70]
movzx ebx, byte [ebp - 1]
push dword [ebp - 0xc]
mov dword [edx*4 + 0x473970], eax
mov dword [esi + ecx + 0x7a028], eax
cmp dword [edx*4 + 0x473970], 0
mov eax, 1
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 7
call fcn.00413120
add esp, 8
test bl, bl
je 0x41e2b5
inc dword [0x473b78]
inc dword [0x473b7c]
jmp 0x41e2c7
mov eax, dword [0x473b70]
push dword [esi + eax + 0x7a030]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x473b70]
inc edi
add esi, 0xa1c
cmp edi, dword [eax + 0x10]
jl 0x41e1e0
pop esi
pop ebx
push 5
call fcn.00418930
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41f070
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push dword [0x473b90]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x473b90]
mov dword [0x473b8c], 1
mov dword [0x473968], 1
mov dword [0x473b8c], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp fcn.0041ef30
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x218
jne 0x41f118
mov eax, dword [ebp + 0xc]
cmp eax, 7
je 0x41f0d5
cmp eax, 6
je 0x41f0d5
cmp eax, 0x12
je 0x41f0d5
cmp eax, 4
jne 0x41f136
push 0xffffffffffffffff
push dword [0x473b90]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x473b8c], 1
call fcn.0041d750
push dword [0x473b90]
mov dword [0x473b8c], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebp
jmp 0x41e2f0
push 0xffffffffffffffff
push dword [0x473b90]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x473b90]
mov dword [0x473b8c], 1
mov dword [0x473968], 1
mov dword [0x473b8c], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0041ef30
pop ebp
jmp fcn.0041e080
cmp eax, 0x219
jne 0x41f136
mov eax, dword [ebp + 0xc]
cmp eax, 0x8000
je 0x41f130
cmp eax, 0x8004
jne 0x41f136
pop ebp
jmp fcn.0041da40
pop ebp
ret
Function at 0x4215d0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
mov dword [ebp - 0xa14], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x42163b
push 1
lea ecx, [ebx + 0x40]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x42162b
push eax
mov dword [ebp - 0xa14], 1
call esi
push edi
call esi
cmp dword [ebp - 0xa14], 0
jne 0x421785
push 0x104
lea eax, [ebp - 0x20e]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4216f6
cmp eax, 0x104
je 0x4216f6
mov ecx, 0x22
mov word [ebp - 0x210], cx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [eax*2 + 4]
cmp eax, 0x20c
jae 0x42179b
xor ecx, ecx
push 0xf003f
push ecx
push ecx
mov word [ebp + eax - 0x210], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x421709
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.0041fb00
add esp, 0xc
test eax, eax
jne 0x4216e1
push str.Could_not_open_Service_Manager
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.00424fb7
push eax
call fcn.00402a90
add esp, 0x10
push 0
lea eax, [ebx + 0x40]
push eax
lea eax, [ebp - 0xa10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x10
push 0xf01ff
add ebx, 0x40
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x42177f
push edi
call esi
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80b
call fcn.0041fb00
add esp, 0xc
test eax, eax
jne 0x421777
push str.Could_not_start_service
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.00424fb7
push eax
call fcn.00402a90
add esp, 0x10
push 0
push ebx
jmp 0x4216e7
push eax
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00424839
mov esp, ebp
pop ebp
ret
call fcn.004240f4
int3

Function at 0x422140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4221b1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x42217f
cmp eax, 2
jne 0x42219b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4221ab
test ecx, ecx
je 0x4221a6
test cl, 1
jne 0x42219b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4221ab
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4221c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
call fcn.00423370
test eax, eax
jne 0x4221de
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
push 1
push 0x65
push dword [0x44ac88]
mov dword [ebp - 0x10], 0x43be94
mov dword [ebp - 0xc], str.1CBF4820_F5C1_4F72_AFBC_6D1BE589FD05
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00406ca0
test eax, eax
js 0x4222fd
push ebx
push edi
push 0x20006
push str.AppID
push SysReAllocString
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00405400
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xc]
test eax, eax
je 0x422260
push eax
call fcn.00402b50
add esp, 4
mov esi, eax
jmp 0x4222f2
push 0
push 0
push 0x2001f
push 0
push 0
push str.1CBF4820_F5C1_4F72_AFBC_6D1BE589FD05
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00403170
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x4222a4
push eax
call fcn.00402b50
add esp, 4
mov esi, eax
jmp 0x4222dd
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [ebp + 8], 0
je 0x4222db
push 1
lea eax, [esi + 0x40]
push eax
push str.LocalService
lea ecx, [ebp - 0xc]
call fcn.00406a00
mov ecx, esi
call fcn.004215d0
test eax, eax
jne 0x4222db
mov esi, 0x80004005
jmp 0x4222dd
xor esi, esi
test edi, edi
je 0x4222ec
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x4222f2
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4222f9
push ebx
call edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x422a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x473908
call esi
push 0x473920
call esi
push 4
push 4
lea eax, [ebp - 4]
push eax
push 4
push str.DeviceHackFlags
push str.SYSTEMCurrentControlSetControlusbstor1058xxxx
mov dword [ebp - 4], 8
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push 0
push 0x423840
push 0x43bf94
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov ecx, eax
mov dword [0x473bb0], ecx
test ecx, ecx
je 0x422b9f
cmp dword [0x473bd4], 0
mov dword [0x473bb4], 0x10
mov dword [0x473bc4], 0
jne 0x422ad0
mov eax, dword [0x4497b0]
mov dword [0x473bc8], eax
push 0x473bb4
inc eax
push ecx
mov dword [0x473bbc], 0
mov dword [0x473bb8], 2
mov dword [0x473bc0], 0
mov dword [0x473bcc], 0xbb8
mov dword [0x4497b0], eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x422ad0
push 0x43bfcc
call fcn.0041f760
add esp, 4
jmp 0x422b3d
call fcn.0041d730
test al, al
je 0x422b3d
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [ebp + 8]
test eax, eax
jns 0x422b09
cmp eax, 0x80010106
jne 0x422b9f
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x422b0d
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov byte [esi + 0x3e], 1
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
mov byte [esi + 0x3c], 0
call fcn.00422bb0
cmp dword [esi + 0x260], 0
je 0x422b33
cmp byte [esi + 0x3e], 0
je 0x422b33
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00412fb0
call fcn.00413000
mov ecx, dword [0x473bb0]
test ecx, ecx
je 0x422b9f
cmp dword [0x473bd4], 0
jne 0x422b9f
mov eax, dword [0x473bd0]
push 0x473bb4
push ecx
mov dword [0x473bbc], 1
mov dword [0x473bb8], 1
mov dword [0x473bc0], eax
mov dword [0x473bcc], 0
mov dword [0x473bc8], 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x422b9f
push 0x43bfcc
call fcn.0041f760
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4232c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x4232e1
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x421860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x42330a
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], edi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423650
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00423370
test eax, eax
jne 0x423668
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0x20006
push str.AppID
push SysReAllocString
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00405400
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xc]
test eax, eax
je 0x4236b1
push eax
call fcn.00402b50
add esp, 4
mov esi, eax
jmp 0x423715
push 0x20006
push str.1CBF4820_F5C1_4F72_AFBC_6D1BE589FD05
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00405400
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x4236eb
push eax
call fcn.00402b50
add esp, 4
jmp 0x4236fe
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.00423730
mov esi, eax
test edi, edi
je 0x42370f
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x423715
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x42371c
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret