joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c62e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x153000]
push edi
jmp 0x5c62fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c6301
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c62f0
mov eax, 1
add ebx, ebx
jne 0x5c6313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c6324
jne 0x5c6343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6343
dec eax
add ebx, ebx
jne 0x5c6330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c6308
add ebx, ebx
jne 0x5c633f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c6395
xor ecx, ecx
sub eax, 3
jb 0x5c635b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c63ca
sar eax, 1
mov ebp, eax
jmp 0x5c6366
add ebx, ebx
jne 0x5c6366
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6334
inc ecx
add ebx, ebx
jne 0x5c6374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6334
add ebx, ebx
jne 0x5c6381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c6376
jne 0x5c6392
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c6376
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c63b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c63a6
jmp 0x5c62f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c63b4
add edi, ecx
jmp 0x5c62f6
pop esi
mov edi, esi
mov ecx, 0x3abd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c63d2
cmp byte [edi], 0x12
jne 0x5c63d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c63d7
lea edi, [esi + 0x1c0000]
mov eax, dword [edi]
or eax, eax
je 0x5c6446
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23f1ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23f240]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c6404
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23f248]
or eax, eax
je 0x5c6440
mov dword [ebx], eax
add ebx, 4
jmp 0x5c6421
call dword [esi + 0x23f244]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5c6477
cmp al, 0xef
ja 0x5c646a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5c644c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5c6459
mov ebp, dword [esi + 0x23f24c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c64ab
sub esp, 0xffffff80
jmp 0x433f03
Function at 0x40144a
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x401437
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401467
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x4018ba
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10018
call fcn.0041b390
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push ecx
mov dword [ebp - 0x10010], edx
mov dword [ebp - 0x10018], eax
mov dword [eax], ebx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x401acc
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp - 0x10010]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x401ab1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
call ebx
push 0
push esi
mov dword [ebp - 0x1000c], eax
call ebx
mov ecx, eax
xor ebx, ebx
mov eax, dword [ebp - 0x1000c]
cmp eax, 0xffffffff
je 0x401ab1
cmp ecx, 0xffffffff
je 0x401ab1
cmp eax, ecx
jne 0x401aa1
mov ecx, eax
mov dword [ebp - 0x10010], ebx
shr ecx, 0xf
and eax, 0x7fff
mov dword [ebp - 0x10014], ecx
mov dword [ebp - 0x1000c], eax
test ecx, ecx
je 0x401a2e
push ebx
lea eax, [ebp - 0x10008]
push eax
push 0x8000
lea eax, [ebp - 0x8004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401ab1
mov ecx, 0x8000
cmp dword [ebp - 0x10008], ecx
jne 0x401ab1
push ebx
lea eax, [ebp - 0x10008]
push eax
push ecx
lea eax, [ebp - 0x10004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401ab1
cmp dword [ebp - 0x10008], 0x8000
jne 0x401ab1
lea edx, [ebp - 0x8004]
mov ecx, ebx
mov eax, dword [edx + ecx*4]
lea edx, [ebp - 0x10004]
cmp eax, dword [edx + ecx*4]
lea edx, [ebp - 0x8004]
jne 0x401a9f
inc ecx
cmp ecx, 0x2000
jne 0x4019ee
mov eax, dword [ebp - 0x10010]
inc eax
mov dword [ebp - 0x10010], eax
cmp eax, dword [ebp - 0x10014]
jb 0x401983
mov eax, dword [ebp - 0x1000c]
test eax, eax
je 0x401aa4
push ebx
lea ecx, [ebp - 0x10008]
push ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401ab1
mov eax, dword [ebp - 0x1000c]
cmp dword [ebp - 0x10008], eax
jne 0x401ab1
push ebx
lea ecx, [ebp - 0x10008]
push ecx
push eax
lea eax, [ebp - 0x10004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401ab1
mov eax, dword [ebp - 0x1000c]
cmp dword [ebp - 0x10008], eax
jne 0x401ab1
push eax
lea eax, [ebp - 0x10004]
push eax
lea eax, [ebp - 0x8004]
push eax
call fcn.0041b70b
add esp, 0xc
test eax, eax
je 0x401aa4
xor ebx, ebx
inc ebx
jmp 0x401ab1
mov eax, dword [ebp - 0x10018]
xor ecx, ecx
inc ecx
mov ebx, ecx
mov dword [eax], ecx
test esi, esi
je 0x401ac1
cmp esi, 0xffffffff
je 0x401ac1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x401acc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x401adf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20206
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallMozillaMaintenanceService
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401b0b
xor eax, eax
jmp 0x401b4b
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x401b10
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push edi
push str.DisplayVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b51
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
push esi
call fcn.00405902
pop ecx
mov ebx, eax
push ebx
push esi
xor esi, esi
push esi
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x401b8a
mov edi, str.Could_not_obtain_file_info_of_old_service.____d_
jmp 0x401baa
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
push eax
push 0x423df4
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x401bc7
mov edi, str.Could_not_query_file_version_info_of_old_service.____d_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.00401034
push dword [ebp - 4]
push edi
push eax
call fcn.004049e5
add esp, 0xc
jmp 0x401bf1
mov edx, dword [ebp - 8]
xor esi, esi
mov ecx, dword [ebp - 4]
inc esi
movzx eax, word [edx + 0xa]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
movzx ecx, word [edx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [edx + 0xe]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 0xc]
mov dword [eax], ecx
push ebx
call fcn.00405932
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401c01
Capabilities:
Check if file exists
Get file attributes
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb80
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x105
lea eax, [ebp - 0x218]
mov edi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401c4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_obtain_module_filename_when_attempting_to_modify_service_description.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
jmp 0x401da9
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x401c6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_remove_file_spec_when_attempting_to_modify_service_description.____d_
jmp 0x401c3c
mov edx, str.updater.ini
lea ecx, [ebp - 0x218]
call fcn.00404dfc
test eax, eax
jne 0x401c90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_append_updater.ini_filename_when_attempting_to_modify_service_description.____d_
jmp 0x401c3c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.updater.ini_file_does_not_exist__will_not_modify_service_description.____d_
jmp 0x401c3c
push ecx
lea eax, [ebp - 0x470]
push eax
push ecx
lea ecx, [ebp - 0x218]
call fcn.00404390
movzx ecx, byte [ebp - 0x470]
mov esi, eax
xor eax, eax
test esi, esi
push 0x257
cmovne ecx, eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0xb78]
mov byte [ebp - 0x470], cl
push eax
call fcn.0040ad60
add esp, 0x18
mov byte [ebp - 0x921], 0
test esi, esi
jne 0x401d97
lea ecx, [ebp - 0xb78]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d0d
sub ecx, edx
je 0x401d97
push 0x258
lea eax, [ebp - 0x920]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xb78]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x401d4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_convert_description_to_wide_string_format.____d_
jmp 0x401c3c
lea eax, [ebp - 0x920]
mov dword [ebp - 0xb7c], eax
lea eax, [ebp - 0xb7c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x401d80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_change_service_config.____d_
jmp 0x401c3c
push str.The_service_description_was_updated_successfully.
call fcn.00401034
push eax
call fcn.004049ad
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x401dab
push str.updater.ini_file_does_not_contain_a_maintenance_service_description.
call fcn.00401034
push eax
call fcn.004049e5
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x401dbb
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x218], ecx
mov esi, edi
mov dword [ebp - 0x214], eax
xor ebx, ebx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x401de9
sub esi, edx
sar esi, 1
cmp esi, 2
jbe 0x401e1f
push str.maintenanceservice_tmp.exe
push edi
call fcn.00406195
pop ecx
pop ecx
test eax, eax
jne 0x401e1f
push 0x22
pop eax
cmp word [edi], ax
jne 0x401e1f
cmp word [edi + esi*2 - 2], ax
jne 0x401e1f
mov bl, 1
call fcn.00401034
test bl, bl
je 0x401e43
push str.The_MozillaMaintenance_service_path_is_correct.
push eax
call fcn.004049ad
pop ecx
pop ecx
mov ecx, dword [ebp - 0x214]
and dword [ecx], 0
jmp 0x401f3a
push edi
push str.The_MozillaMaintenance_path_is_NOT_correct._It_was:__ls
push eax
call fcn.004049ad
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push 0x20a
xor ebx, ebx
push ebx
push eax
mov dword [ecx], 1
call fcn.00406960
push 0x104
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.00407e9a
add esp, 0x24
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x401ec0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_remove_file_spec.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
xor eax, eax
jmp 0x401f3d
mov edx, 0x424144
lea ecx, [ebp - 0x210]
call fcn.00404dfc
test eax, eax
jne 0x401ee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_append_file_spec.____d_
jmp 0x401eae
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x401f20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_fix_service_path.____d_
jmp 0x401eae
lea eax, [ebp - 0x210]
push eax
push str.Fixed_service_path_to:__ls.
call fcn.00401034
push eax
call fcn.004049ad
add esp, 0xc
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x402563
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4025aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service_manager.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
jmp 0x402696
push 0xf01ff
push str.MozillaMaintenance
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4025e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402696
push str.Sending_stop_request...
call fcn.00401034
push eax
call fcn.004049ad
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x402638
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x402638
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_sending_stop_request.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str.Waiting_for_service_stop...
call fcn.00401034
push eax
call fcn.004049ad
pop ecx
pop ecx
call fcn.00404f83
mov esi, eax
call fcn.00405121
cmp eax, 0x490
je 0x40267a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1e
jb 0x40265d
push esi
push str.Done_waiting_for_service_stop__last_service_state:__d
call fcn.00401034
push eax
call fcn.004049ad
xor ebx, ebx
add esp, 0xc
cmp esi, 1
sete bl
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x4026a9
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4026f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service_manager.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
jmp 0x40278c
push 0xf01ff
push str.MozillaMaintenance
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x402723
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
jmp 0x402785
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x40275c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
add eax, 0xa
add ebx, eax
cmp dword [ebp - 0x1c], 1
je 0x402760
cmp ebx, 0xea60
ja 0x402760
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x402732
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test ebx, ebx
jne 0x40277e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax - 0x430]
neg ebx
sbb ebx, ebx
inc ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x402afe
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
xor ebx, ebx
push edi
push 0x20a
mov dword [ebp - 0x240], eax
mov esi, ecx
mov dword [eax], ebx
lea eax, [ebp - 0x23c]
push ebx
push eax
call fcn.00406960
push 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call fcn.00407e9a
add esp, 0x18
lea ecx, [ebp - 0x23c]
mov edx, str.update.status
call fcn.00404dfc
test eax, eax
jne 0x402b76
push str.Could_not_append_path_for_update.status_file
call fcn.00401034
push eax
call fcn.004049e5
pop ecx
pop ecx
xor eax, eax
jmp 0x402c20
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x244], esi
cmp esi, 0xffffffff
jne 0x402ba3
mov edi, str.Could_not_open_update.status_file
jmp 0x402bcb
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
push 0x20
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402bdb
mov edi, str.Could_not_read_from_update.status_file
call fcn.00401034
push edi
push eax
call fcn.004049e5
pop ecx
pop ecx
jmp 0x402c0e
mov esi, str.applying
lea edi, [ebp - 0x10]
push 8
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x30]
push eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0040b180
mov ecx, dword [ebp - 0x240]
add esp, 0xc
mov esi, dword [ebp - 0x244]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
inc ebx
mov dword [ecx], eax
test esi, esi
je 0x402c1e
cmp esi, 0xffffffff
je 0x402c1e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x40355b
Capabilities:
Create directory

Disassembly:
push esi
push 0x104
mov esi, ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40358e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_obtain_module_filename_when_attempting_to_use_a_secure_updater_path.____d_
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x4035a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_remove_file_spec_when_attempting_to_use_a_secure_updater_path.____d_
jmp 0x40357c
mov edx, str.update
mov ecx, esi
call fcn.00404dfc
test eax, eax
jne 0x4035c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_append_file_spec_when_attempting_to_use_a_secure_updater_path.____d_
jmp 0x40357c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, str.updater.exe
mov ecx, esi
call fcn.00404dfc
test eax, eax
je 0x4035b7
xor eax, eax
inc eax
pop esi
ret

Function at 0x4035e3
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x429010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor eax, eax
push esi
mov esi, eax
cmp word [ebx], ax
je 0x4036a5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x40363d
call edi
cmp eax, 3
je 0x40363d
call edi
cmp eax, 2
je 0x40363d
push ebx
push str.Could_not_delete_service_updater_path:__ls.
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00406960
push str.updater.ini
mov edx, ebx
lea ecx, [ebp - 0x210]
call fcn.00404b58
add esp, 0x10
test eax, eax
je 0x4036a4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x4036a4
call edi
cmp eax, 3
je 0x4036a4
call edi
cmp eax, 2
je 0x4036a4
lea eax, [ebp - 0x210]
push eax
push str.Could_not_delete_service_updater_INI_path:__ls.
call fcn.00401034
push eax
call fcn.004049e5
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053fc
mov esp, ebp
pop ebp
ret
Function at 0x4040cf
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
xor eax, eax
push edi
push 0xf0000000
push 1
push eax
push eax
mov dword [ebp - 8], eax
mov edi, edx
mov dword [ebp - 4], eax
mov ebx, ecx
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x404126
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x404111
xor eax, eax
jmp 0x4041c0
push 0xf0000008
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
je 0x40410a
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40410a
push esi
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40410a
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop ecx
push esi
push eax
push edi
push ecx
push dword [ebp - 4]
mov dword [ebp - 0xc], ecx
call ebx
test eax, eax
je 0x40410a
push dword [edi]
call fcn.00405902
push dword [edi]
mov esi, eax
mov eax, dword [ebp + 8]
push 0
push esi
mov dword [eax], esi
call fcn.00406960
add esp, 0x10
push 0
push edi
push esi
push 2
push dword [ebp - 4]
call ebx
test eax, eax
je 0x40410a
cmp dword [ebp - 4], 0
je 0x4041ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], 0
je 0x4041bd
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret