joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd4f0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4e855a
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x53450c]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53450c]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xb4]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xbc]
mov edi, ecx
mov ecx, dword [esp + 0xb8]
push 0x100
push ecx
xor edx, edx
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x60], esi
mov dword [esp + 0x20], edx
call fcn.004c3780
push 1
lea ebp, [edi + 4]
push ebp
lea ecx, [esp + 0x34]
mov dword [esp + 0xb0], 1
call fcn.004c2f90
test eax, eax
js 0x4cd5da
push 0x2b
push 0x4fae0c
lea ecx, [esp + 0x60]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
call fcn.004013e0
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0xac], 2
call fcn.0047a400
push 0x527a40
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.Botan::Invalid_Argument.0
call fcn.0045ed14
push ebx
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + 0x18]
call fcn.004cb320
push ebx
lea eax, [esp + 0x5c]
push eax
lea ecx, [edi + 0x20]
mov byte [esp + 0xb0], 3
call fcn.004cb320
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x48]
push edx
lea ecx, [edi + 0x30]
mov byte [esp + 0xb4], 4
call fcn.004cedb0
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, edx
add edx, edx
push edx
mov edx, dword [esp + 0x5c]
push edx
mov byte [esp + 0xb0], 6
call eax
mov ecx, ebp
call fcn.004c33e0
add eax, eax
push eax
mov ecx, esi
call fcn.0047acc0
mov edi, dword [esi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 1
call fcn.004c33e0
mov ecx, ebp
sub edi, eax
call fcn.004c33e0
add eax, edi
push eax
lea ecx, [esp + 0x1c]
call fcn.004c33f0
mov ebx, dword [esi]
mov edi, dword [esi + 4]
lea ecx, [esp + 0x40]
call fcn.004c33e0
shr edi, 1
add edi, ebx
mov ecx, ebp
sub edi, eax
call fcn.004c33e0
add eax, edi
push eax
lea ecx, [esp + 0x44]
call fcn.004c33f0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
add eax, eax
push eax
mov eax, dword [esp + 0x44]
push eax
mov byte [esp + 0xb0], 3
call edx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [ecx]
mov byte [esp + 0xa8], 1
add edx, edx
mov eax, dword [eax + 4]
add edx, edx
push edx
mov edx, dword [esp + 0x1c]
push edx
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
add eax, eax
push eax
mov eax, dword [esp + 0x30]
push eax
mov byte [esp + 0xb0], 0
call edx
mov eax, esi
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.0045f14f
add esp, 0x98
ret 0x10
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x4f1b0d50
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
mov ecx, 0x459a6745
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x409a1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x409a2e
pop dword [ebp - 0x2c]
mov eax, 0x9279a58a
add eax, 0x6dc6f4a4
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3d832
push 0
mov eax, 0x3c6f852b
sub eax, 0x3c2d340b
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xcc9a984f
add ecx, 0x3365b413
xor edx, edx
add edx, eax
mov ebx, 0x1acbbe8b
sub ebx, 0x1a88908b
add ebx, dword [ebp - 0x2c]
mov esi, 0x5093b1ee
add esi, 0x88bac0fa
mov dword [ebp - 0x18], 0x65463c7e
mov edi, dword [ebx]
add dword [ebp - 0x28], edx
xor edi, esi
sub dword [ebp - 0x1c], 0xd85053c5
mov dword [edx], edi
add dword [ebp - 0x20], ecx
add edx, 0x46d971c
sub edx, 0x46d9718
add ebx, 4
loop 0x409a8f
add eax, 0x1245b
mov ebx, eax
add eax, 5
mov ecx, 0x51941a47
sub ecx, 0x51541a47
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x44fdb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x44fdc9
mov dword [ebp + 8], eax
pop ebp
jmp 0x64e6d8
pop ebp
ret
jmp 0xd7efc61
sub eax, 0x26cff1ff
pushal
jle 0x64e67f
cmp bh, byte [ebp - 0x36]
sbb dword [ecx], ebp
xor eax, 0x598f7379
cmpsb byte [esi], byte es:[edi]
dec ecx
push eax
xchg ebx, eax
sub byte [eax - 0x6533fad6], bl
jb 0x64e74b
lcall 0xd3c8, 0x16080641
in eax, 0x5d
xor dl, al
sbb cl, bh
fldenv [ebx + 0x3288338]
pop eax
xchg ebx, eax
dec eax
mov edi, 0x1371afb3
stc
ror dword [eax - 0x578b4781], cl
pop ds
stc
add dword [edx], edx
and dl, dh
xor al, dh
adc eax, dword [0xb03a4c1]
xor byte [ebx + esi*2], dl
dec edx
invalid
xor edx, dword [0x6c7e58ff]
adc eax, 0x6c7e58ff
sbb eax, 0x5d8953cb
lcall 0x8c2f, 0xef379836
cmp edi, dword [ecx - 0x4f]
push 0x45
adc cl, byte [ecx + ecx]
push ebx
jo 0x64e74a
sub al, 0x70
invalid

Function at 0x4ac506
Capabilities:
Encode data using xor

Disassembly:
pop es
mov edi, ebx
push ecx
pushal
mov dword [esi + 0x18b7910f], edx
mov dword [esi + 0x18b7910f], edx
cmp edi, ebx
stosb byte es:[edi], al
push es
dec ecx
sub esi, ecx
mov dl, 0x96
mov byte [eax + edx*8 + 0x16b3f18a], al
push ebx
mov ebx, 0x46cb0153
fld xword [esi + 0x6b]
add byte [ebx + 0x7c], 0xf0
sbb al, 0x2b
les esp, [esi - 0x40]
push esp
daa
lcall 0x21de, 0xe1b77d87
push es
xchg byte [edi], bh
sub byte [eax - 0x39d998bf], bh
jecxz 0x4ac4f0

Function at 0x5362a6
Capabilities:
Encode data using xor

Disassembly:
jne 0x5362c0
invalid
mov ah, 0x13
imul edx, dword [ebp - 0x25d40d88], 0xffffff84
sub ebx, edx
test bl, al

Function at 0x5806a6
Capabilities:
Encode data using xor

Disassembly:
pop edx
jno 0x5806c5
wait
jb 0x580712
mov byte [0xdf139564], al
lock and bl, byte [ecx]
dec edx
and eax, 0x23f17274
xor dword [edx - 0x12b62299], edx
cli
mov eax, dword [0x16ae820b]
scasb al, byte es:[edi]
push ss
mov dh, 4
mov edx, 0xe1c50e88
inc eax
invalid
xchg dword [ebx + ebx*4 + 0x2e653092], esp
fadd dword [edi]
pop ecx
invalid
Function at 0x5e2856
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xea0cfb1e
insb byte es:[edi], dx
into
dec eax
mov byte [ebp - 0x1dd3a695], bh
mov ebp, 0xe22c596b
push ecx
lea esi, [eax + 0x19]
mov ebx, dword [esi - 0x53]
js 0x5e2803
stosd dword es:[edi], eax
mov bl, 0x11
pushfd
mov esi, 0x43b04a67
fimul dword [esi + 0x17fa1c52]
fstp xword [edx + 0xc]
xor al, 8
scasd eax, dword es:[edi]
fldcw word [eax - 0x6954b152]
dec esi
stosd dword es:[edi], eax
xchg esi, eax
mov ah, byte [ebp - 0x5c]
jb 0x5e2870
psubd mm5, qword [ecx + 0x708aede6]
sti
ror dword [ebp - 0x271f12ca], cl
lea esi, [esi]
in eax, dx
loopne 0x5e2833
stosb byte es:[edi], al
add ch, byte [ecx]
sub cl, ah
cmp dl, byte [ebx]
xor eax, 0x1e8d0cf0
xor bl, ch
push ds
fsub dword [esi - 0x34]
js 0x5e2855
jle 0x5e280c
test al, 1
xchg dh, bh
cmp dh, ch
inc esi
bound eax, qword ds:[edi - 0x45]
in al, dx
fild word [esi]
invalid

Function at 0x5e2bd6
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
leave
cmp dl, byte [ecx + 0x45f23b3]
lodsd eax, dword [esi]
popal
fidivr dword [eax - 0x79522fd2]
mov esi, 0x469346fc
or eax, 0x9a25a41
mov edi, 0x2e89e222
adc eax, 0x10e4c793
adc eax, 0x10e4c793
dec edi
push 0xffeb2253
xchg esp, eax
cmp al, 0xde
xor esp, 0xffffffa8
pop ebp
jo 0x5e2bf5
push ds
pushfd
mov al, byte [0xe82d6370]
or al, 0xee
pop ds
int 0x7a
mov cl, 0xab
call 0x76ccef1
xor ch, dh
inc eax
invalid
Function at 0x617566
Capabilities:
Encode data using xor

Disassembly:
popal
mov dl, 0xd5
scasb al, byte es:[edi]
mov byte [edx], bh
call 0x3fe7416
aad 0x57
mov eax, dword [0x47ffbd66]
pop ds
inc dword [edi + 0x1f]
push cs
dec ebx
mov ch, byte [ebx - 0x11]
push ds
xor eax, dword [esi]
xor al, dl
movsd dword es:[edi], dword [esi]
mov dl, byte [edx + 0x1b]
dec ebp
sub esi, dword [edx + 0x49]
loope 0x6175d2
jno 0x617521
mov edi, 0xcae54e5b
pop ebx
dec esi
in eax, 0xca
jle 0x617595
adc edx, dword [ebx + 0x6d835892]
xor dword [ecx - 0x2d], 0x93e37499
xchg byte [esi - 0x54], dh
or eax, 0xe9890fc9
sti
loop 0x617560
xchg ebx, eax
sbb dword [0x271ee41], esp
mov dh, 0x58
loop 0x61754e
and bl, byte [eax + 0x68f3ab93]
jb 0x6175ee
stc
test byte [esi + 0x69], al
sahf
in al, 0x13
cli
loop 0x617531
add al, 0x37
inc eax
or al, bl
push 0xffffffffffffff98
arpl word [eax + 0x21101900], sp
jecxz 0x617604
cld
insd dword es:[edi], dx
invalid
sub dword [ecx - 0x2e2bf644], esi
daa
invalid
iretd
mov dword [0x23bc82f9], eax
or dword [edi + 0x1329fea3], ebx
scasb al, byte es:[edi]
pop ss
jae 0x617653
mov byte [0xe68b1695], al
pop eax
mov ebx, 0x6a613b31
test dword [ebx - 0x5c], ecx
xor dword [ebx], edi
popal
push 0xffffffffffffff85
dec ebx
movsb byte es:[edi], byte [esi]
pop es
xor al, byte [edi - 0x4f]
js 0x6175a3
mov eax, dword [0xa9274efe]
inc ebx
jns 0x61762c
cmp dword [ebx], ecx
jne 0x6175e0
sub dword [ebx], edi
jns 0x6175d8
cmp al, 0xad
test byte [ecx - 0x3f7607d7], 0xc0
fld qword [ecx + 0x33]
lds ebp, [ebx + 0x5bd954d1]
xor eax, ebp
stosd dword es:[edi], eax
rcl dword [ecx + ebx*8 + 0x5b]
cdq
ja 0x617666
inc edx
add dword [edx - 0x54], 0xb8c9aa9a
xor dword [edx], eax
je 0x617657
fdiv st(1), st(0)
and eax, 0xec46c60d
pop edx
imul edi, dword [esi - 0x721fd96d], 0x23
enter 0xffffffffffffe96e, 0x7a
wait
or dword [ecx + 0x63], esi
jmp 0x716b11d2
jno 0x6176bc
mov dword [ecx + eax*2], ecx
and ch, byte [edi + esi + 0x17]
pop esi
inc esi
pop esp
add dl, cl
pop ebx
or edx, ecx
xchg esi, eax
dec ecx
xchg esi, eax
dec ecx
lodsb al, byte [esi]
mov byte [0x233328c1], al
pop ecx
mov edx, 0x611b3f33
and byte [0xeb429e12], ah
sub al, 0x66
retf
arpl bx, ax
mov dh, 0x51
insd dword es:[edi], dx
sbb ebx, edi
sbb byte [eax + 0x3cdf68d9], bh
sbb ebx, eax
invalid
push esi
in eax, dx
mov al, 0x19
call 0x600bf1cd
cmp edi, 0xdf4508a1
loope 0x617694
inc esp
mov ebx, 0xf09a86e4
jmp 0xbed1f988

Function at 0x64fabb
Capabilities:
Encode data using xor

Disassembly:
ret 0xc86b
jl 0x64fa63
mov eax, dword [0xc5bb32ae]
sbb al, 0x97
in eax, dx
outsd dx, dword [esi]
nop
dec edx
lodsd eax, dword [esi]
xor bl, byte es:[edi]
js 0x64fac9
sub byte [esi], 0x9e
dec esi
bound ecx, qword [ebp + 0x431c739a]
dec eax
pop ds
sub al, 0xad
push esp
xchg edi, eax
mov eax, 0x5bb158f6
dec ebp
dec eax
nop
push 0x20
scasb al, byte es:[edi]
mov esi, 0x97f2d45e
xor al, 0x1c
adc byte [edi], cl
pop esp
fnstsw word [eax - 0x2acc0ebe]
cmp eax, 0x1660d93e
push 0xe309d319
cmp dword [ecx + 0x60], esp
invalid
Function at 0x4012c0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x244
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, dword [esp + 0x254]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x44a12c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401373
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [0x44ffd0]
lea edx, [esp + 0x13c]
push edx
push eax
mov ecx, 0x44ffc8
call fcn.0042f037
lea ecx, [esp + 0x110]
push ecx
push esi
call edi
test eax, eax
jne 0x40133f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
add esp, 0x244
ret

Function at 0x401380
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
push 0x104
push 0x44ffdc
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, byte [0x45053c]
mov edi, 0x44a14c
test al, al
je 0x4013ac
mov edi, 0x44a134
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x44ffdc
mov esi, edi
mov edx, ecx
mov edi, 0x44ffdc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004012c0
mov ecx, dword [0x44ffd0]
add esp, 4
xor al, al
xor ebx, ebx
test ecx, ecx
jle 0x401476
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0x44ffdc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4500e0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x44ffcc]
and ecx, 3
push 0x104
rep movsb byte es:[edi], byte [esi]
mov edi, dword [eax + ebx*4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
lea ecx, [esp + 0x10]
push ecx
call fcn.004012a0
mov ecx, dword [0x44ffd0]
add esp, 4
inc ebx
cmp ebx, ecx
jl 0x4013fa
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x4054a0
Capabilities:
Read .ini file

Disassembly:
mov edx, dword [esp + 4]
lea eax, [ecx + 4]
push eax
push 0x800
push 0x4506e0
push 0x450418
add ecx, 0x108
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x44a6d8
push 0x4506e0
call fcn.0041da10
mov ecx, eax
add esp, 8
sub ecx, 0x4506e0
inc ecx
test eax, eax
je 0x4054f2
mov byte [ecx + 0x4506df], 0xd
mov byte [ecx + 0x4506e0], 0xa
push 0x44a6d4
push 0x4506e0
call fcn.0041da10
mov ecx, eax
add esp, 8
sub ecx, 0x4506e0
inc ecx
test eax, eax
je 0x40551f
mov byte [ecx + 0x4506df], 0xd
mov byte [ecx + 0x4506e0], 0xa
push 0x44a1fc
push 0x4506e0
call fcn.0041da10
mov ecx, eax
add esp, 8
sub ecx, 0x4506e0
inc ecx
test eax, eax
je 0x40554c
mov byte [ecx + 0x4506df], 0xd
mov byte [ecx + 0x4506e0], 0xa
mov eax, 0x4506e0
ret 4

Function at 0x4055c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1cc
mov ecx, 0x32
xor eax, eax
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x1e0]
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x32
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xdc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xdc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xd8]
push 0x5c
push ecx
call fcn.0041d9e0
mov byte [eax], 0
mov edi, 0x44a288
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
mov edx, dword [esp + 0x1e8]
lea eax, [esp + 0xd8]
rep movsb byte es:[edi], byte [esi]
push eax
mov eax, dword [esp + 0x1e8]
lea ecx, [esp + 0x14]
push 0xc8
push ecx
push 0x44a6dc
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
push ecx
call fcn.0041e46c
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1cc
ret 0xc
Function at 0x4056f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x220
mov dl, byte [0x450418]
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], dl
mov byte [esp + 0x114], dl
rep stosd dword es:[edi], eax
mov ecx, 0x44
lea edi, [esp + 0x115]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x105
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jbe 0x405776
lea ecx, [esp + 0xc]
lea edx, [esp + 0x114]
push ecx
push 0x44a700
push edx
call fcn.0041dbc4
add esp, 0xc
test eax, eax
jle 0x405776
lea eax, [esp + 0x114]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x405783
push 0x44a6f0
call edi
mov esi, eax
test esi, esi
je 0x4057c4
push 0x44a6e0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4057b9
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
jne 0x4057b9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
xor eax, eax
pop esi
add esp, 0x220
ret
test esi, esi
je 0x4057c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x220
ret

Function at 0x40ae70
Capabilities:
Start service
Stop service

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x40aee3
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0x20
push str.Spooler
push edi
call ebx
mov esi, eax
test esi, esi
je 0x40aeb9
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call ebp
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10
push str.Spooler
push edi
call ebx
mov esi, eax
pop ebx
test esi, esi
je 0x40aee3
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call ebp
push edi
call ebp
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x40afb0
Capabilities:
Start service

Disassembly:
push 0xffffffffffffffff
push 0x43c318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x40b079
push 0x10
push str.Spooler
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x40b079
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40b072
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x40b072
mov ecx, dword [0x44bd9c]
push esi
push edi
mov dword [esp + 0x10], ecx
push eax
lea edx, [esp + 0x14]
push str.Start_spool_service_error__error_code___u
push edx
mov dword [esp + 0x28], 0
call fcn.0042e7df
mov edi, dword [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1c], 0xffffffff
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.0042fc20
pop edi
pop esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0xc]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b0a0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x40b108
push 4
push str.Spooler
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40b101
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x14], 4
je 0x40b100
push 0x12c
call ebx
inc esi
cmp esi, 0xa
jl 0x40b0e0
pop ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [esp + 0x10]
cmp edx, 4
je 0x40b13d
mov edi, str.StartSpoolService_error
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x450ae4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, edx
pop ebp
add esp, 0x1c
ret 4
Function at 0x40c670
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1d0
push ebx
push esi
push edi
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, 0x44a8ec
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x104
and ecx, 3
mov dword [esp + 0x10], 0
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x32
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xdc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xdc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xd8]
push 0x5c
push ecx
call fcn.0041d9e0
mov byte [eax], 0
mov edi, str.DRVCONFIG_setup.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov edx, dword [esp + 0x1e4]
and ecx, 3
lea eax, [esp + 0xd8]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x14]
push 0xc8
push ecx
push 0x44a6dc
push edx
push 0x44a900
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x1e0]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042fc4a
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1d0
ret 8

Function at 0x40c780
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1cc
mov ecx, 0x32
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, 0x44a8ec
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x32
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xd8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xd4]
push 0x5c
push ecx
call fcn.0041d9e0
mov byte [eax], 0
mov edi, str.DRVCONFIG_setup.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0xd4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov edx, dword [esp + 0x1dc]
and ecx, 3
lea eax, [esp + 0xd4]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x10]
push 0xc8
push ecx
push 0x44a6dc
push edx
push 0x44a900
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xc]
push eax
call fcn.0041e46c
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1cc
ret 4