joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4121f0
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x418]
push 0
push eax
mov dword [ebp - 0x630], edi
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4123aa
nop word [eax + eax]
push 0x20a
lea eax, [ebp - 0x624]
push 0
push eax
call fcn.0042b800
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042b800
push 0x104
push dword [ebp - 0x630]
lea eax, [ebp - 0x210]
push eax
call fcn.0043afb8
lea eax, [ebp - 0x210]
add esp, 0x24
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4122b0
sub eax, edx
mov ecx, 0x104
sar eax, 1
sub ecx, eax
lea eax, [ebp - 0x418]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0043b180
add esp, 0xc
lea eax, [ebp - 0x624]
push 0x104
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x41232e
lea eax, [ebp - 0x624]
push esi
push eax
call fcn.0043affb
add esp, 8
test eax, eax
je 0x412386
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x624]
push eax
push esi
call fcn.004121f0
add esp, 0x10
test al, al
jne 0x41234b
push 0x104
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
test eax, eax
jne 0x412260
jmp 0x4123a3
mov esi, dword [ebp - 0x628]
lea eax, [ebp - 0x418]
mov ebx, dword [ebp - 0x62c]
push esi
push eax
push ebx
call fcn.0043afb8
xor eax, eax
mov word [ebx + esi*2 - 2], ax
lea eax, [ebp - 0x210]
push esi
push eax
push ebx
call fcn.0043b180
add esp, 0x18
xor eax, eax
mov word [ebx + esi*2 - 2], ax
jmp 0x4123a1
push dword [ebp - 0x628]
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x62c]
call fcn.0043afb8
add esp, 0xc
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x4123c0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a3c
call fcn.00429120
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x1a3c], eax
lea eax, [ebp - 0x1a34]
push eax
push 0x1000
lea eax, [ebp - 0x1a30]
push eax
call sub.PSAPI.DLL_EnumProcesses
mov eax, dword [ebp - 0x1a34]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1a34], eax
mov dword [ebp - 0x1a38], esi
test eax, eax
je 0x412620
push ebx
push edi
nop word [eax + eax]
mov esi, dword [ebp + esi*4 - 0x1a30]
test esi, esi
je 0x4125d6
cmp esi, 4
je 0x4125d6
xor bl, bl
call fcn.004145d0
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x41245d
call fcn.004145b0
jmp 0x4125d6
push 0x104
lea eax, [ebp - 0x620]
push eax
push edi
call fcn.00411e90
add esp, 0xc
test eax, eax
je 0x41255a
cmp word [ebp - 0x620], 0x5c
jne 0x41255a
lea eax, [ebp - 0x61e]
push 0x5c
push eax
call fcn.0042c810
mov esi, eax
add esp, 8
test esi, esi
je 0x41255a
lea eax, [esi + 2]
push 0x5c
push eax
call fcn.0042c810
mov esi, eax
add esp, 8
test esi, esi
je 0x41255a
xor eax, eax
push 0x104
mov word [esi], ax
lea eax, [ebp - 0x418]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x41253d
push 0x104
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x41253d
lea ecx, [ebp - 0x828]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412500
sub ecx, edx
lea eax, [ebp - 0x418]
sar ecx, 1
lea eax, [eax + ecx*2]
push eax
lea eax, [esi + 2]
push eax
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x41253d
lea eax, [ebp - 0x210]
push 0x104
push eax
lea eax, [ebp - 0x418]
jmp 0x412588
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.00412a00
add esp, 0xc
mov bl, al
test bl, bl
jne 0x412593
push 0x104
lea eax, [ebp - 0xa30]
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x412593
lea eax, [ebp - 0x210]
push 0x104
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00411dd0
mov bl, 1
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004145b0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00412160
add esp, 8
test bl, bl
je 0x4125d6
push dword [ebp - 0x1a3c]
lea eax, [ebp - 0x210]
push eax
call fcn.0043affb
add esp, 8
test eax, eax
je 0x412602
mov esi, dword [ebp - 0x1a38]
inc esi
mov dword [ebp - 0x1a38], esi
cmp esi, dword [ebp - 0x1a34]
jb 0x412420
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1a38]
pop edi
pop ebx
pop esi
mov eax, dword [ebp + eax*4 - 0x1a30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x412830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov byte [ebp - 1], 1
mov dword [ebp - 8], 1
call fcn.004145d0
push dword [ebp + 8]
push 0
push 0x601
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x41286d
xor bl, bl
call fcn.004145b0
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [0x47bbc8]
test edi, edi
je 0x41288d
push 0
push 4
lea eax, [ebp - 8]
mov ecx, edi
push eax
push 0x1d
push esi
call dword [0x45343c]
call edi
cmp dword [ebp - 8], 1
jne 0x4128bf
mov edi, dword [0x47bbcc]
mov dword [ebp - 8], 0
test edi, edi
je 0x4128bf
push 4
lea eax, [ebp - 8]
mov ecx, edi
push eax
push 0x1d
push esi
call dword [0x45343c]
call edi
test eax, eax
je 0x4128bf
xor bl, bl
jmp 0x4128d1
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
neg ebx
sbb bl, bl
and bl, byte [ebp - 1]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
call fcn.004145b0
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4128f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x274], eax
push edi
mov edi, 0x10
test eax, eax
je 0x4129e1
push ebx
mov dword [ebp - 0x270], 0x22c
call fcn.004145d0
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x278], ebx
cmp ebx, 0xffffffff
jne 0x412946
xor bl, bl
jmp 0x4129b8
lea eax, [ebp - 0x270]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4129a8
lea edi, [ebp - 0x44]
sub edi, 4
nop dword [eax]
push dword [ebp - 0x274]
lea eax, [ebp - 0x24c]
push eax
call fcn.0040d0f0
add esp, 8
test eax, eax
je 0x41298a
inc esi
add edi, 4
cmp esi, 0x10
jg 0x41298a
mov eax, dword [ebp - 0x268]
mov dword [edi], eax
lea eax, [ebp - 0x270]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x412960
test esi, esi
je 0x4129a8
cmp esi, 0x10
jg 0x4129a8
mov bl, 1
jmp 0x4129aa
xor bl, bl
mov edi, esi
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004145b0
test bl, bl
pop ebx
je 0x4129e1
xor esi, esi
test edi, edi
jle 0x4129e1
nop dword [eax + eax]
push dword [ebp + esi*4 - 0x44]
call fcn.00412830
inc esi
add esp, 4
cmp esi, edi
jl 0x4129d0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x4138c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x413901
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4138d0
sub eax, esi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
test eax, eax
jne 0x413901
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x413910
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x214], 0
mov byte [ebp - 0x20d], 1
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x218], esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x21c], edi
test ebx, ebx
je 0x413aea
test esi, esi
je 0x413aea
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0042b800
add esp, 0xc
nop dword [eax + eax]
push dword [ebp - 0x220]
mov ecx, esi
push edi
push ebx
call dword [0x45343c]
call esi
add esp, 0xc
test al, al
je 0x413aea
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x413ac2
cmp dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x228]
lea esi, [eax + 1]
mov dword [ebp - 0x224], esi
jbe 0x413abc
lea eax, [esi*2 + 2]
push eax
call fcn.0043b175
mov edi, eax
add esp, 4
test edi, edi
je 0x413ab6
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x413aad
dec eax
mov dword [ebp - 0x214], eax
test esi, esi
je 0x413aa5
push esi
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x413a9f
lea eax, [ebp - 0x22c]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x413a9f
mov esi, dword [ebp - 0x22c]
test esi, esi
je 0x413a99
push edi
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push str._s_s
push 0x104
push eax
call fcn.00410d00
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x218]
push eax
push esi
call fcn.00413910
add esp, 0x24
mov byte [ebp - 0x20d], al
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x20d], 0
je 0x413aad
mov esi, dword [ebp - 0x224]
mov eax, dword [ebp - 0x214]
test eax, eax
jne 0x413a10
push edi
call fcn.0043b170
add esp, 4
mov edi, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x218]
cmp dword [ebp - 0x214], 0
mov al, byte [ebp - 0x20d]
je 0x413aec
test al, al
jne 0x413980
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x413b00
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451319
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x47a42c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], 1
push eax
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x479510
push eax
mov dword [ebp - 0x24], 0x40
movlpd qword [ebp - 0x1c], xmm0
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
je 0x413bf6
mov eax, dword [ebp - 0x1c]
push 1
lea eax, [eax*4 + 4]
push eax
mov dword [ebp - 0x14], eax
call fcn.0043b5af
mov edi, eax
add esp, 8
test edi, edi
je 0x413bf6
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00403240
add esp, 0x10
test eax, eax
jne 0x413bed
push 5
push str.Enc2
mov ecx, esi
call fcn.0040cfe0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413bd5
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00413c10
push edi
call fcn.0043b170
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4145b0
Capabilities:
Acquire debug privileges

Disassembly:
push 0
push str.SeDebugPrivilege
call fcn.00414440
add esp, 8
test eax, eax
setne al
ret

Function at 0x4145d0
Capabilities:
Acquire debug privileges

Disassembly:
push 1
push str.SeDebugPrivilege
call fcn.00414440
add esp, 8
test eax, eax
setne al
ret

Function at 0x4155f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
lea eax, [ebp - 0x414]
xor bl, bl
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push str._SystemRoot_explorer.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call fcn.004145d0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.00412640
add esp, 0xc
test al, al
je 0x415691
push 0x104
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x415697
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x4161d0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 8
push edi
push 0
mov dword [ebp - 8], 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x41626b
mov eax, dword [ebp - 4]
test eax, eax
je 0x41626b
cmp dword [ebp - 8], 0
je 0x41626b
push esi
mov esi, dword [eax]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp esi, 1
jbe 0x41621e
cmp esi, 4
jne 0x416263
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 5
push edi
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x416263
mov eax, dword [ebp - 4]
test eax, eax
je 0x416263
cmp dword [ebp - 8], 0
je 0x416263
push ebx
xor ebx, ebx
cmp word [eax], bx
push eax
setne bl
call sub.WTSAPI32.dll_WTSFreeMemory
test byte [ebp + 0xc], 1
mov eax, 1
cmovne eax, ebx
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push edi
call fcn.00415e60
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4163d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [esi], 0x409
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esi], eax
call fcn.0040c1b0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.softwareFortinetFortiClientFA_UI
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41644b
mov eax, dword [ebp - 4]
test eax, eax
je 0x41644b
lea ecx, [ebp - 8]
push ecx
push str.LCID
push eax
call fcn.00413700
add esp, 0xc
test al, al
je 0x416440
mov eax, dword [ebp - 8]
test eax, eax
je 0x416440
mov dword [esi], eax
push dword [ebp - 4]
call fcn.00413610
add esp, 4
mov ecx, dword [esi]
xor eax, eax
nop
cmp dword [eax*8 + 0x45d938], ecx
je 0x41646b
inc eax
cmp eax, 3
jb 0x416450
mov dword [esi], ecx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax*8 + 0x45d93c]
mov dword [esi], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4167b0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41685b
push edi
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x416851
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x416842
cmp dword [ebp - 0x1c], 1
je 0x416848
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x416842
mov esi, 0x12c
nop dword [eax]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x416842
cmp dword [ebp - 0x1c], 1
je 0x416848
push 0x64
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jg 0x416820
cmp dword [ebp - 0x1c], 1
jne 0x41684a
mov bl, 1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x4169b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x47bbfc], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], edi
jne 0x416a4f
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042b800
add esp, 0xc
mov dword [0x47bbfc], 1
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004169b0
add esp, 8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0043afb8
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004169b0
add esp, 0x14
xor esi, esi
call fcn.00403200
push edi
push esi
mov ecx, eax
push ebx
push esi
push esi
mov eax, dword [ecx]
push dword [ecx + 4]
or eax, 2
mov dword [ebp - 0x21c], ecx
push eax
call fcn.00432710
mov ebx, eax
or eax, 0xffffffff
test ebx, ebx
cmovs ebx, eax
lea eax, [ebx*2 + 0xe]
push eax
call fcn.0043b175
mov edi, eax
add esp, 0x20
test edi, edi
je 0x416acc
push dword [ebp - 0x214]
mov ecx, dword [ebp - 0x21c]
xor eax, eax
push eax
push dword [ebp - 0x218]
mov dword [edi + ebx*2 + 0xa], eax
lea eax, [edi + 0xa]
push ebx
push eax
mov eax, dword [ecx]
push dword [ecx + 4]
or eax, 1
push eax
call fcn.00432710
mov esi, eax
add esp, 0x1c
test esi, esi
mov eax, 0xffffffff
cmovs esi, eax
test esi, esi
cmovs esi, ebx
add esi, 5
test edi, edi
je 0x416b22
push dword [0x4799dc]
push 0x45d81c
push 5
push edi
call fcn.00410d00
add esp, 0x10
mov ebx, esi
test esi, esi
jle 0x416b06
cmp word [edi + esi*2 - 2], 0xa
je 0x416b06
mov dword [edi + esi*2], 0xa
lea ebx, [esi + 1]
push edi
call fcn.0043b170
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret

Function at 0x416b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.softwareFortinetEMSDEPLOY
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x416b71
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00416cc0
test eax, eax
je 0x416ba9
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.sch_setup_starttime
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416ba9
cmp dword [ebp - 0xc], 4
cmove esi, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
test eax, eax
je 0x416bb7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.softwareFortinetEMSDEPLOY
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x416bf1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00416cc0
test eax, eax
je 0x416c29
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.sch_setup_user_notified_flag
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416c29
cmp dword [ebp - 0xc], 4
cmove esi, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
test eax, eax
je 0x416c37
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416c40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push str.softwareFortinetEMSDEPLOY
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416cab
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.reboot_needed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416cab
cmp dword [ebp - 0xc], 4
jne 0x416cab
push str.reboot_needed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], 1
sete bl
mov eax, dword [ebp - 4]
test eax, eax
je 0x416cb9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x47bc00], 0
push esi
je 0x416d44
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.softwareFortinetEMSDEPLOY
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416d44
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.sch_setup_schid
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416d2f
cmp dword [ebp - 0xc], 4
jne 0x416d2f
mov eax, dword [0x47bc00]
mov ecx, 1
cmp eax, dword [ebp - 0x10]
cmove esi, ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x416d3d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret