joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e200
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9248
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x93c708
mov esi, ecx
call ebx
mov edi, dword [0x93c704]
push 0x93c708
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 1
jne 0x44e29e
lea eax, [ebp - 0x48]
push eax
call fcn.0044cd70
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x44e26a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], esi
jb 0x44e289
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004d5559
add esp, 4
xor edx, edx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], dx
jmp 0x44e363
inc dword [esi + 4]
mov edi, dword [esi + 4]
push 0x93c708
call ebx
mov ebx, dword [0x93c704]
push 0x93c708
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, ebx
jl 0x44e2c7
mov dword [esi + 4], 1
mov ecx, dword [esi + 4]
lea esi, [ebp - 0x2c]
call fcn.0044e480
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x44e2e9
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x48]
push eax
call fcn.0044cd70
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x44e308
lea ecx, [ebp - 0x2c]
cmp dword [eax + 0x14], esi
jb 0x44e30f
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], esi
jb 0x44e32c
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004d5559
add esp, 4
mov edi, 7
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], dx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], esi
jb 0x44e357
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004d5559
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x44e380
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fddf8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x93c708
mov dword [ebp - 0x30], 0
mov edi, 1
call ebx
mov esi, dword [0x93c704]
push 0x93c708
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, edi
jle 0x44e453
lea esp, [esp]
mov ecx, edi
lea esi, [ebp - 0x2c]
call fcn.0044e480
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x44e3f9
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x44e41b
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004d5559
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
test esi, esi
je 0x44e436
inc dword [ebp - 0x30]
push 0x93c708
inc edi
call ebx
mov esi, dword [0x93c704]
push 0x93c708
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, esi
jl 0x44e3e0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x44e7e0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7112
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x50]
push edx
push 5
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0x104
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
call esi
test eax, eax
je 0x44e9c1
mov eax, dword [ebp - 0x50]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e845
sub eax, edx
sar eax, 1
je 0x44e9c1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 7
push edi
push 0
call esi
test eax, eax
je 0x44e9c1
mov esi, dword [ebp - 0x54]
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e880
sub eax, edx
sar eax, 1
je 0x44e9c1
mov eax, dword [ebp - 0x50]
lea edx, [eax + 2]
jmp 0x44e8a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e8a0
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e8b6
sub eax, esi
sar eax, 1
lea esi, [eax + edx + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44e9c1
push esi
push 0
push ebx
call fcn.00401020
mov ecx, dword [ebp - 0x54]
add esp, 0xc
mov edx, ebx
nop
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x44e900
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44e914
mov eax, dword [0x504a74]
mov dword [edi], eax
mov eax, dword [ebp - 0x50]
mov esi, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e930
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x44e940
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x5c]
push ecx
mov eax, esi
call fcn.0044eae0
mov eax, ebx
lea ecx, [ebp - 0x2c]
call fcn.00401c60
mov dword [ebp - 4], 0
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp - 0x4c]
push ecx
mov edi, eax
call fcn.0041a2f0
mov byte [ebp - 4], 1
add esi, 0x200848
mov ecx, eax
mov edx, esi
call fcn.0041a750
push eax
push esi
lea edi, [ebp - 0x64]
call fcn.0041a3f0
mov byte [ebp - 4], 0
lea edx, [ebp - 0x4c]
push edx
call fcn.004195c0
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.00401ca0
mov eax, dword [ebp - 0x50]
mov esi, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test eax, eax
je 0x44e9d1
push eax
call esi
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x44e9db
push eax
call esi
test ebx, ebx
je 0x44e9e8
push ebx
call fcn.004d632b
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 8
Function at 0x44ec30
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 4]
sub esp, 8
push ebx
push edi
test eax, eax
je 0x44ed1e
mov ebx, dword [eax + 0x1e8]
mov dword [ebp - 4], ebx
cmp ebx, 3
jne 0x44ec66
cmp dword [esi], ebx
je 0x44ec6b
mov edi, dword [esi + 8]
call fcn.0040f2a0
mov eax, esi
mov dword [esi], ebx
call fcn.0044f690
cmp dword [esi], 3
jne 0x44ec88
test ebx, ebx
je 0x44ec79
cmp ebx, 1
je 0x44ec79
cmp ebx, 2
jne 0x44ec88
mov edi, dword [esi + 8]
call fcn.0040f3a0
mov eax, esi
call fcn.0044f6d0
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x44ecaa
push eax
push 0
call edi
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44ecbd
push eax
push 0
call edi
mov dword [esi + 0x14], 0
cmp ebx, 3
jne 0x44ed1c
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x374]
call fcn.0044edd0
test ebx, ebx
je 0x44ed19
mov edi, dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x539960], esi
cmp ebx, 3
jle 0x44ed04
lea ecx, [ebx - 3]
imul ecx, ecx, 0xea60
push 0x44f3a0
push ecx
push 0
push 0
call edi
mov dword [esi + 0x14], eax
imul ebx, ebx, 0xea60
push 0x44f3a0
push ebx
push 0
push 0
call edi
mov dword [esi + 0x10], eax
mov ebx, dword [ebp - 4]
mov dword [esi], ebx
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44ed30
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esi + 4]
test eax, eax
je 0x44edc8
push ebx
mov ebx, dword [eax + 0x1e8]
push edi
cmp ebx, 3
jne 0x44ed5d
cmp dword [esi], ebx
je 0x44ed62
mov edi, dword [esi + 8]
call fcn.0040f2a0
mov eax, esi
mov dword [esi], ebx
call fcn.0044f690
cmp dword [esi], 3
jne 0x44ed7f
test ebx, ebx
je 0x44ed70
cmp ebx, 1
je 0x44ed70
cmp ebx, 2
jne 0x44ed7f
mov edi, dword [esi + 8]
call fcn.0040f3a0
mov eax, esi
call fcn.0044f6d0
cmp ebx, 3
jne 0x44ed88
cmp dword [esi], ebx
je 0x44edc4
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x44edaa
push eax
push 0
call edi
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44edbd
push eax
push 0
call edi
mov dword [esi + 0x14], 0
pop edi
mov dword [esi], ebx
pop ebx
mov eax, 1
ret
Function at 0x44ee30
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x44ef88
test edi, edi
je 0x44ef88
xor eax, eax
push 0x1fc
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.004da450
add esp, 0xc
xor eax, eax
jmp 0x44ee80
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoScheduler]
mov word [ebp + eax - 0x204], cx
add eax, 2
test cx, cx
jne 0x44ee80
lea edx, [ebp - 0x204]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x208]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea edx, [ebp - 0x204]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x20c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44ef88
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44eef7
mov ecx, dword [ebp - 0x208]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.StartDateTime
push ecx
call esi
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ef27
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [ebp - 0x208]
push edx
push edi
push 1
push 0
push str.EndDateTime
push eax
call esi
mov edx, dword [ebp - 0x208]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push str.DurationInMin
push edx
call esi
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
Function at 0x44f280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44f2bb
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push str.StartDateTime
push edx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x44f317
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x44f317
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp - 8]
push 0
push 0
push str.StartDateTime
push eax
call esi
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push str.EndDateTime
push edx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x44f36c
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x44f36c
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp - 8]
push 0
push 0
push str.EndDateTime
push eax
call esi
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push edx
push 0
push 0
push str.DurationInMin
push eax
call esi
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44f5b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebx + 4]
push esi
push edi
add eax, 0x290
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebx + 4]
mov ecx, dword [edx + 0x1e8]
push 0
push 1
push 0
push 0
push 0
push 0
mov dword [ebp - 8], ecx
push 1
xor ecx, ecx
call fcn.00434160
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x288]
mov dword [ebp - 4], edi
test edi, edi
je 0x44f605
mov edi, dword [ebx + 8]
mov esi, eax
call fcn.0040e3f0
mov edi, dword [ebp - 4]
mov eax, dword [ebx + 4]
mov esi, dword [eax + 0x1e8]
add eax, 0x290
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 8]
mov ecx, dword [ebx + 0xc]
push edx
push esi
call fcn.00421970
xor esi, esi
cmp edi, esi
je 0x44f647
cmp dword [ebx], 3
jne 0x44f641
mov edi, dword [ebx + 8]
call fcn.0040f3a0
mov eax, ebx
call fcn.0044f6d0
mov dword [ebx], 1
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebx + 0x10]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
cmp eax, esi
je 0x44f668
push eax
push esi
call edi
mov dword [ebx + 0x10], esi
mov eax, dword [ebx + 0x14]
cmp eax, esi
je 0x44f676
push eax
push esi
call edi
pop edi
mov dword [ebx + 0x14], esi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44f6d0
Capabilities:
Create thread
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
push 0
push eax
push 0x44f7a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x44f72a
mov edx, dword [ebp - 4]
push str.NoAutoUpdate
push edx
call ebx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x44f75e
mov edx, dword [ebp - 4]
push str.DisableWindowsUpdateAccess
push edx
call ebx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x44f792
mov edx, dword [ebp - 4]
push str.DisableWindowsUpdateAccessMode
push edx
call ebx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f7c0
Capabilities:
Modify service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x4c], edi
cmp edi, ebx
je 0x44f8cd
push 0xf01ff
push str.wuauserv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
je 0x44f8cd
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push esi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x44f82e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x44f8a5
mov ebx, dword [ebp - 0x48]
push ebx
push 0
mov dword [ebp - 0x48], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x44f8a2
lea ecx, [ebp - 0x48]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x44f89b
lea edx, [ebp - 0x48]
push edx
push 4
lea eax, [ebp - 0x50]
push eax
push 3
xor ebx, ebx
push esi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
lea ecx, [ebp - 0x48]
push ecx
push 0x24
lea edx, [ebp - 0x28]
push edx
push ebx
push esi
mov dword [ebp - 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x50]
mov edx, dword [edi + 4]
push eax
push ecx
push edx
mov ecx, str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoWinUpdServ
call fcn.0044fb30
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x44f8e0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x44f8eb
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x44fb30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x44fb63
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0
push str.StartupType
push eax
call esi
test eax, eax
jne 0x44fbb3
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push str.AutoDelayStartupType
push eax
call esi
test eax, eax
jne 0x44fbb3
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push str.CurrentServiceStatus
push eax
call esi
test eax, eax
je 0x44fbc6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44fbe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 6
push 0
push 0
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44fc30
mov ecx, dword [ebp - 4]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x44fc38
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x450b10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004da450
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x450b72
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x450c59
cmp dword [ebp - 0x110], 2
jne 0x450c59
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x450c04
mov eax, dword [ebp - 0x118]
cmp eax, 2
jne 0x450bb0
xor eax, eax
cmp byte [ebp - 6], 1
pop esi
setne al
add eax, 7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x450bce
cmp byte [ebp - 6], al
jne 0x450bdc
mov eax, 6
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x450c59
cmp byte [ebp - 6], 1
je 0x450bf0
mov eax, 5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
mov eax, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x450c59
mov eax, dword [ebp - 0x118]
cmp eax, 2
jne 0x450c28
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x450c41
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x450c59
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret

Function at 0x450e60
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.Secur32.dll_GetUserNameExW]
lea eax, [ebp - 4]
push eax
push 0
push 2
mov dword [ebp - 4], 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x450e90
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push ebx
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x450ebb
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x450edb
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
push edi
or eax, edx
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
pop edi
lea eax, [ebp - 4]
push eax
push ebx
push 2
call esi
test al, al
je 0x450f0a
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450ef0
mov esi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
call fcn.004027c0
push ebx
call fcn.004d632b
mov edx, dword [ebp + 8]
add esp, 4
xor ecx, ecx
cmp ecx, dword [edx + 0x10]
pop ebx
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret