joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dbf0
Capabilities:
Access the windows event log
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5818b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5eb770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
push str.BaseInstaller
push esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
lea ebx, [esi + 4]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x44dc54
push 0x5db2b0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x80004005
call fcn.0055b426
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x44dc9f
lea edx, [ebp - 0x18]
push edx
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x44dc9f
push 0x5db2b0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x80004005
call fcn.0055b426
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x14]
push ecx
push edx
push esi
push 1
push eax
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00461caa
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x44dce0
push 0x5db2b0
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], 0x80004005
call fcn.0055b426
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push ecx
push esi
push 1
push edx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x44dcfe
jmp dword [eax*4 + 0x44dd80]
mov ebx, 4
jmp case.default.0x44dcfe
mov ebx, 2
jmp case.default.0x44dcfe
mov ebx, 1
mov edi, dword [ebp - 0x20]
push 0
lea eax, [ebp + 0xc]
push eax
push 0
push 1
push ecx
push 0x99999999
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x44dd43
test edi, edi
je 0x44dd4e
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test esi, esi
je 0x44dd5b
push esi
call fcn.00461cb5
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x44dd69
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44e220
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5819e0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [0x5b7b60]
mov ebx, ecx
xor eax, eax
mov ecx, 0x104
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov ecx, dword [str.Canon]
mov dword [ebp - 0x64], ecx
mov ecx, dword [0x5b7b64]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], ecx
lea edx, [ebp - 0x68]
push edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov ecx, 7
mov esi, str.BaseInstaller
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
push 8
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x44e2de
push 0x5db2b0
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], 0x80004005
call fcn.0055b426
mov edx, dword [ebp - 0x68]
lea ecx, [ebp - 0x70]
push ecx
push ebx
push edx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x44e340
push 0x5db2b0
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x80004005
call fcn.0055b426
mov dword [ebp - 0x6c], 0
mov eax, 0x44e313
ret
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x44e321
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor esi, esi
cmp esi, 2
jge 0x44e313
lea ecx, [esi + esi*4]
lea edx, [ebp + ecx*8 - 0x64]
mov ecx, dword [ebp - 0x74]
push edx
push ebx
push str._s_s
call fcn.0044c970
add esp, 0xc
push 0
push ebx
call edi
inc esi
jmp 0x44e348
Function at 0x44e550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583296
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov esi, edx
mov dword [ebp - 0x238], esi
cmp ebx, edi
jne 0x44e596
lea eax, [edi + 0x57]
jmp 0x44e737
push str.GetMonitorFile___Start
call fcn.0045c120
add esp, 4
or eax, 0xffffffff
xor ecx, ecx
call fcn.00401e80
xor eax, eax
mov word [ebp - 0x234], ax
push 0x2f
mov eax, str.SystemCurrentControlSetControlPrintMonitors
lea esi, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
call fcn.00401d90
mov dword [ebp - 4], edi
push 0x5c
mov eax, 1
mov edi, esi
call fcn.00446c20
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e5f0
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [ebp - 0x234]
call fcn.004293d0
xor esi, esi
mov dword [ebp - 0x240], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x44e62e
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x23c]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x23c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44e662
mov esi, dword [ebp - 0x23c]
mov dword [ebp - 0x240], esi
mov ebx, eax
test eax, eax
jne 0x44e704
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
push ecx
push ebx
push str.Driver
push esi
mov dword [ebp - 0x248], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44e6aa
mov eax, dword [ebp - 0x244]
dec eax
neg eax
sbb eax, eax
and eax, 0xd
mov ebx, eax
test eax, eax
jne 0x44e704
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e6c0
mov esi, dword [ebp - 0x238]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.00401d90
push esi
lea edi, [ebp - 0x238]
mov dword [ebp - 0x238], 0x5c
call fcn.0044e3a0
cmp eax, 0xffffffff
je 0x44e704
inc eax
xor ecx, ecx
call fcn.00401e80
push ebx
push str.GetMonitorFile___End__d_
call fcn.0045c120
add esp, 8
lea esi, [ebp - 0x240]
call fcn.0044e440
cmp dword [ebp - 0x220], 8
jb 0x44e735
mov edx, dword [ebp - 0x234]
push edx
call fcn.00461cb5
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x456190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582178
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4562b1
cmp byte [edi + 0x49], bl
je 0x4562b1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x4562a5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x456204
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x45621c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x456245
dec eax
je 0x456249
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x4562a0
jmp 0x4562ac
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x456259
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x456282
cmp ebx, 0x10
jae 0x456268
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0055a2b5
add esp, 0x10
cmp esi, eax
jne 0x45629d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4562a9
test esi, esi
jne 0x456210
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.004469b0
jmp 0x45620a
lea ecx, [ebp - 0x2c]
call fcn.00442ff0
xor al, al
jmp 0x4562b3
lea ecx, [ebp - 0x2c]
call fcn.00442ff0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x456440
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581b8b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5eb770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057521a
push 4
mov dword [ebp - 4], 0
call fcn.00461c7b
mov edi, eax
add esp, 4
test edi, edi
je 0x4564bc
call fcn.005750f2
mov dword [edi], eax
call fcn.00574eb1
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.005751db
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4564b2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00575203
jmp 0x4564be
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x457f90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582f60
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 0x34], eax
xor eax, eax
lea edx, [ebp - 0x2d]
push edx
mov edi, 0x7fff
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x2d], al
call fcn.00451d70
xor esi, esi
mov ecx, 8
mov dword [ebp - 4], esi
cmp dword [ebx + 0x14], ecx
jb 0x457ff6
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x14], ecx
jb 0x458000
mov eax, dword [eax]
mov edi, dword [ebp - 0x4c]
push ebx
push 0x7fff
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x4580b4
mov dword [ebp - 0x34], esi
cmp word [edi], si
je 0x4580af
jmp 0x458029
xor esi, esi
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, edi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x458040
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [ebp - 0x2c]
call fcn.00401d90
mov ebx, dword [ebp - 0x38]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401ab0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 8
jb 0x45807e
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00461cb5
add esp, 4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x458083
mov ecx, dword [ebp - 0x4c]
sub eax, edx
mov edx, dword [ebp - 0x34]
sar eax, 1
lea eax, [edx + eax + 1]
cmp word [ecx + eax*2], 0
lea edi, [ecx + eax*2]
mov dword [ebp - 0x34], eax
jne 0x458027
mov edi, ecx
mov esi, 1
test edi, edi
je 0x4580c1
push edi
call fcn.00461cb5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x458920
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x26
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x45897e
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push esi
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov esi, eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x458974
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp esi, edi
pop esi
mov eax, 1
jne 0x458980
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x458990
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push esi
call fcn.00458920
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005579b2
push str.Canon_
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.00559142
push 0x5c08f0
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.00559142
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x458a5b
push ebx
push str.Canon_
push 0x104
push esi
call fcn.00559142
add esp, 0xc
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x458a2b
push 0
push esi
call ebx
push 0x5c08f0
push 0x104
push esi
call fcn.00559142
add esp, 0xc
push esi
call edi
test eax, eax
jne 0x458a49
push eax
push esi
call ebx
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
push str.Canon_
push 0x104
push esi
call fcn.00559142
push 0x5c08f0
push 0x104
push esi
call fcn.00559142
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x458be0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x588b08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5eb770]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0
push str.COsVersionInfo::ParseProcessor
push 0
lea ecx, [esp + 0x18]
call fcn.0044ca70
add esp, 0xc
xor eax, eax
mov dword [esp + 0x20], 0
push 0x60ad9c
mov dword [0x60ad9c], eax
mov dword [0x60ada0], eax
mov dword [0x60ada4], eax
mov dword [0x60ada8], eax
mov dword [0x60adac], eax
mov dword [0x60adb0], eax
mov dword [0x60adb4], eax
mov dword [0x60adb8], eax
mov dword [0x60adbc], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x60adb4]
cmp eax, 0x24a
ja 0x458c7f
je 0x458c7b
sub eax, 0x182
je 0x458c7b
sub eax, 0x64
jne 0x458c86
xor esi, esi
jmp 0x458cce
cmp eax, 0x21d8
je 0x458ca5
push 0xe
mov eax, str.Windows_NT_x86
mov esi, 0x60adc0
mov dword [0x60ac70], 0
call fcn.00401d90
xor esi, esi
jmp 0x458cce
mov eax, dword [0x60ac84]
imul eax, eax, 0x64
add eax, dword [0x60ac88]
push 0xb
mov dword [0x60ac70], eax
mov eax, str.Windows_x64
mov esi, 0x60adc0
call fcn.00401d90
mov esi, 0x20000000
push esi
push str.return___d
lea ecx, [esp + 0x14]
push 2
push ecx
call fcn.0044cd10
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0044cc70
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x458d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5859c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5eb770]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push edi
push str.COsVersionInfo::CheckCoreEdition
push edi
lea ecx, [esp + 0x24]
call fcn.0044ca70
add esp, 0xc
mov dword [esp + 0x38], edi
mov eax, dword [esi + 0x1c]
xor ebx, ebx
cmp eax, 6
jbe 0x458d6d
cmp byte [esi + 0x132], 1
jne 0x458d8a
cmp eax, 6
jne 0x458e10
cmp dword [esi + 0x20], 2
jb 0x458e10
cmp byte [esi + 0x132], 1
je 0x458e10
push str.Win2012_2016
lea eax, [esp + 0x1c]
push 7
push eax
call fcn.0044cd10
add esp, 0xc
push 0x20019
push str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.00458f90
mov esi, dword [esp + 0x20]
test eax, eax
jne 0x458dfc
push edi
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.ServerCoreExtended
push esi
call edi
cmp eax, 2
je 0x458df5
push 0
push 0
push 0
push 0
push 0x5c0914
push esi
call edi
test eax, eax
jne 0x458dfa
mov ebx, 1
xor edi, edi
cmp esi, edi
je case.0x458e97.15
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x458e97.15
test dword [esi + 0x14], 0x800
je case.0x458e97.15
cmp byte [esi + 0x132], 1
je case.0x458e97.15
push str.Win2008
lea ecx, [esp + 0x1c]
push 7
push ecx
call fcn.0044cd10
add esp, 0xc
push str.kernel32.dll
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je case.0x458e97.15
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je case.0x458e97.15
movzx ecx, word [esi + 0x12e]
lea edx, [esp + 0x14]
push edx
movzx edx, word [esi + 0x12c]
push ecx
mov ecx, dword [esi + 0x20]
push edx
mov edx, dword [esi + 0x1c]
push ecx
push edx
call eax
test eax, eax
je case.0x458e97.15
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
cmp eax, 0x1d
ja case.0x458e97.15
movzx eax, byte [eax + 0x458efc]
jmp dword [eax*4 + 0x458ef4]
push str.Core_Edtion___
lea ecx, [esp + 0x1c]
push 7
push ecx
call fcn.0044cd10
add esp, 0xc
mov ebx, 1
push ebx
push str.return___d
lea edx, [esp + 0x20]
push 2
push edx
call fcn.0044cd10
add esp, 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.0044cc70
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b6d0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
push eax
xor esi, esi
push edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45b775
cmp dword [ebp - 0x1c], 1
je 0x45b78a
lea ecx, [ebp - 0x20]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x45b775
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebx
nop
lea edx, [ebp - 0x20]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45b750
cmp dword [ebp - 0x1c], 1
je 0x45b79b
push 0x3e8
call ebx
add esi, 0x3e8
mov eax, 0x7530
sub eax, esi
jne 0x45b720
mov eax, dword [ebp - 0x24]
jmp 0x45b756
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x1c], 1
je 0x45b79e
test eax, eax
jne 0x45b79e
pop ebx
mov eax, 0x5b4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
pop esi
call fcn.0055649d
mov esp, ebp
pop ebp
ret

Function at 0x45b7b0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
push eax
xor esi, esi
push edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45b84c
cmp dword [ebp - 0x1c], 4
je 0x45b861
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x45b84c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebx
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45b827
cmp dword [ebp - 0x1c], 4
je 0x45b872
push 0x3e8
call ebx
add esi, 0x3e8
mov edx, 0x7530
sub edx, esi
jne 0x45b7f7
mov eax, dword [ebp - 0x24]
jmp 0x45b82d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x1c], 4
je 0x45b875
test eax, eax
jne 0x45b875
pop ebx
mov eax, 0x5b4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
pop esi
call fcn.0055649d
mov esp, ebp
pop ebp
ret
Function at 0x45ba60
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5817f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5eb770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov dword [eax], edi
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
push edi
push edi
mov dword [ecx], edi
mov ecx, dword [ebp + 8]
push ebx
push ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x45bb06
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x45bb08
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x14]
push edx
call fcn.00461caa
mov esi, eax
add esp, 4
cmp esi, edi
je 0x45bb45
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push ecx
push edx
push esi
push ebx
push eax
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x45bb20
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
mov dword [ecx], esi
mov dword [eax], edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.00461cb5
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret