joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444fe0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test al, 1
je 0x4450a3
test al, 2
je 0x4450a3
mov eax, dword [esi + 0x20]
mov ecx, eax
and eax, 0x100
and ecx, 0xfffffcff
neg eax
push edi
sbb eax, eax
and eax, 0xffffff00
lea edx, [esp + 8]
push edx
add eax, 0xf023f
push eax
push 0
lea eax, [esi + 0x24]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x44508a
cmp byte [esp + 0x14], al
je 0x445067
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445067
lea edi, [eax + 0x50]
jmp 0x44508a
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x44508a
mov eax, dword [esp + 8]
test eax, eax
je 0x445099
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0xc
xor eax, eax
pop esi
add esp, 8
ret 0xc

Function at 0x4450b0
Capabilities:
Delete file

Disassembly:
add ecx, 0x22c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret

Function at 0x4450e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esi + 4]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
push ebx
mov dword [esp + 0x20], 0
call ebp
test eax, eax
jne 0x44514a
mov eax, dword [esi + 8]
mov ecx, dword [esp + 8]
push edi
lea edx, [ecx + eax + 4]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x445150
lea ebx, [eax + 0xe]
test edi, edi
je 0x445147
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
lea edx, [edi + ecx + 4]
mov ecx, dword [esi + 4]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push ecx
push ebx
call ebp
mov ebx, eax
test ebx, ebx
jne 0x445133
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], eax
mov dword [edi + edx], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
push edi
call fcn.004ad4d0
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x18]
lea ecx, [edi + eax + 4]
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], ecx
test eax, eax
je 0x4451b6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], edi
mov dword [esi + 0x434], edi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4451d0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x44520d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ecx
ret 4
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44523a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
test edi, edi
jne 0x445258
push esi
mov dword [esp + 0x10], 0x54f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebx
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x18]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
push edi
push esi
push edx
mov dword [ebp + 4], esi
mov dword [ebp + 0x434], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x445297
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4452b9
cmp dword [esp + 0x10], edi
je 0x4452a4
mov ebx, 0x1e
jmp 0x4452b9
xor eax, eax
test edi, edi
jbe 0x4452b9
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x4452b0
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x445333
mov esi, dword [ebp + 4]
mov eax, edi
shr eax, 1
test esi, esi
je 0x445309
cmp eax, 0x7fffffff
ja 0x445309
mov edx, eax
mov ecx, esi
test eax, eax
je 0x4452f4
jmp 0x4452e0
cmp word [ecx], 0
je 0x4452f0
add ecx, 2
sub edx, 1
jne 0x4452e0
jmp 0x4452f4
test edx, edx
jne 0x445305
mov ebx, 0x80070057
xor eax, eax
mov ecx, ebx
test ebx, ebx
jl 0x44530e
add eax, eax
jmp 0x445310
sub eax, edx
jmp 0x4452fb
mov ecx, 0x80070057
xor eax, eax
test ecx, ecx
jl 0x445333
add eax, 2
lea ecx, [eax + 4]
cmp ecx, edi
ja 0x445333
mov edx, dword [esi + eax]
sub edi, eax
lea ecx, [esi + eax + 4]
sub edi, 4
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edi
mov esi, dword [esp + 0x18]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x4454f0
Capabilities:
Check if file exists
Create directory
Get file attributes
Link many functions at runtime

Disassembly:
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlNtStatusToDosError
push eax
mov dword [0x513d08], eax
call esi
mov dword [0x513d0c], eax
mov eax, dword [0x513d08]
push str.ZwQueryInformationFile
push eax
call esi
mov ecx, dword [0x513d08]
push str.ZwCreateFile
push ecx
mov dword [0x513d1c], eax
call esi
mov edx, dword [0x513d08]
push str.RtlInitUnicodeString
push edx
mov dword [0x513d14], eax
call esi
mov dword [0x513d10], eax
mov eax, dword [0x513d08]
push str.ZwSetInformationFile
push eax
call esi
mov ecx, dword [esp + 8]
mov dword [0x513d18], eax
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, 0x513b00
call fcn.00443780
pop esi
test eax, eax
jge 0x445589
xor edx, edx
mov word [0x513b00], dx
lea eax, [edx + 0x57]
ret
push 0x513b00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4455b0
push 0
push 0x513b00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4455b0
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret

Function at 0x4457d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x5000f4]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push ebx
xor esi, esi
call ebp
cmp eax, 0xffffffff
jne 0x445901
push edi
mov esi, 3
mov dword [esp + 0xc], 0
test ebx, ebx
je 0x445828
lea edi, [esp + 0xc]
mov ecx, 0x104
mov edx, ebx
call fcn.00443740
test eax, eax
jl 0x44582d
mov ecx, dword [esp + 0xc]
add ecx, ecx
jmp 0x44582f
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
jne 0x445843
shr ecx, 1
je 0x445843
cmp word [ebx + ecx*2], 0x5c
je 0x44585d
sub ecx, 1
jne 0x445837
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004aa641
add esp, 0x210
ret
lea edi, [ebx + ecx*2]
test edi, edi
je 0x445843
lea eax, [esp + 0x10]
mov esi, 0x513b00
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x445896
movzx ecx, word [esi + eax]
test cx, cx
je 0x445896
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x445876
jmp 0x44589a
test edx, edx
jne 0x44589d
sub eax, 2
xor edx, edx
push edi
lea esi, [esp + 0x14]
mov word [eax], dx
call fcn.00443700
mov eax, esi
push eax
call ebp
cmp eax, 0xffffffff
je 0x4458e4
mov ecx, esi
push ecx
mov eax, SysReAllocString
mov ecx, 0x104
mov edx, ebx
call fcn.00443780
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004aa641
add esp, 0x210
ret
pop edi
pop esi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004aa641
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.004aa641
add esp, 0x210
ret
Function at 0x446520
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x680
mov eax, dword [0x5000f4]
xor eax, esp
mov dword [esp + 0x67c], eax
mov eax, dword [esp + 0x684]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x274]
mov esi, 0x513b00
mov ecx, eax
push edi
mov edx, 0x104
sub esi, ecx
jmp 0x446560
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x446580
movzx ecx, word [esi + eax]
test cx, cx
je 0x446580
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x446560
jmp 0x446584
test edx, edx
jne 0x446587
sub eax, 2
xor edx, edx
mov word [eax], dx
lea edi, [esp + 0x10]
mov ecx, 0x104
lea edx, [esp + 0x278]
call fcn.00443740
test eax, eax
jl 0x4465c6
mov eax, dword [esp + 0x10]
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x278]
push str..Q
mov eax, SysReAllocString
call fcn.00443780
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x27c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x446685
mov edi, dword [sym.imp.RPCRT4.dll_UuidFromStringW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x104
lea eax, [esp + 0x54]
lea esp, [esp]
cmp word [eax], 0
je 0x446610
add eax, 2
sub ecx, 1
jne 0x446600
jmp 0x44666e
test ecx, ecx
je 0x44666e
mov eax, 0x104
sub eax, ecx
add eax, eax
shr eax, 1
sub eax, 4
lea esi, [eax + eax]
push esi
lea edx, [esp + 0x5a]
push edx
lea eax, [esp + 0x488]
push eax
call fcn.004ad4d0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x484]
xor ecx, ecx
push eax
mov word [esp + esi + 0x488], cx
call edi
test eax, eax
jne 0x44666e
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00404c80
add esp, 8
test al, al
je 0x446685
lea eax, [esp + 0x28]
push eax
push ebx
call ebp
test eax, eax
jne 0x4465f0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x68c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004aa641
add esp, 0x680
ret
Function at 0x446e10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cec24
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [ebp], esi
jne 0x446e4f
call fcn.00446880
mov eax, dword [ebp + 4]
cmp eax, esi
jne 0x446e5b
call fcn.00446880
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], esi
call fcn.004a0ad2
add esp, 4
cmp eax, 6
jne 0x446f48
jmp 0x446e80
cmp dword [esp + 0x14], 0x3e8
jg 0x446f48
cmp dword [esp + 0x30], 3
jg 0x446f48
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.004ab619
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x446ed6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x446ed8
xor esi, esi
mov byte [esp + 0x28], 0
mov eax, dword [ebp]
push esi
push 0x4466c0
push eax
call fcn.0047c1fb
add esp, 0xc
nop
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x446ef0
test eax, eax
je 0x446f0d
inc dword [esp + 0x30]
mov ecx, dword [ebp]
push 0
push 0
push ecx
call fcn.0047c1fb
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 4]
inc dword [esp + 0x14]
push edx
call fcn.004946b1
mov eax, dword [ebp + 4]
push eax
call fcn.004a0ad2
add esp, 8
xor esi, esi
cmp eax, 6
je 0x446e80
cmp eax, 0x65
jne 0x446f90
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 1
call fcn.0045eff0
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
cmp eax, 0x64
mov eax, dword [ebp + 4]
push eax
jne 0x446fb6
mov edx, dword [ebp]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
call fcn.0045eff0
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
jmp 0x446f6c
call fcn.004946b1
mov ecx, dword [ebp]
push ecx
mov esi, eax
call fcn.004729a1
add esp, 8
push 0x4f0f64
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], esi
call fcn.004ad039
int3
Function at 0x4472f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cec24
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [ebp], eax
jne 0x44732b
call fcn.00446880
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push eax
mov ebx, ebp
call fcn.004474d0
mov ebx, eax
push ebx
call fcn.004a0ad2
add esp, 4
cmp eax, 6
jne 0x447426
cmp dword [esp + 0x14], 0x3e8
jg 0x447426
cmp dword [esp + 0x30], 3
jg 0x447426
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.004ab619
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x4473ac
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x4473ae
xor esi, esi
mov byte [esp + 0x28], 0
mov ecx, dword [ebp]
push esi
push 0x4466c0
push ecx
call fcn.0047c1fb
add esp, 0xc
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x4473c5
test eax, eax
je 0x4473e2
inc dword [esp + 0x30]
mov edx, dword [ebp]
push 0
push 0
push edx
call fcn.0047c1fb
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
push ebx
call fcn.00494663
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
mov ebx, ebp
call fcn.004474d0
mov ebx, eax
push ebx
call fcn.004a0ad2
add esp, 4
cmp eax, 6
je 0x447353
push ebx
cmp eax, 0x65
jne 0x447473
mov ecx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call fcn.0045eff0
add esp, 4
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
cmp eax, 0x64
jne 0x4474a9
mov edx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
call fcn.0045eff0
mov dword [esi + 0xc], eax
mov eax, 1
add esp, 4
mov byte [esi + 0x10], al
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], eax
jmp 0x44745b
call fcn.00494663
mov esi, eax
mov eax, dword [ebp]
push eax
call fcn.004729a1
add esp, 8
push 0x4f0f64
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], esi
call fcn.004ad039
int3
Function at 0x447eb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cd11f
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x2c]
mov dword [esi], vtable.ServiceWrapper.0
mov ebp, 7
xor ebx, ebx
xor eax, eax
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x2c]
push 0xffffffffffffffff
lea ecx, [esi + 0x48]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00407c60
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
lea ecx, [esi + 0x64]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00407c60
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x80]
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00407c60
mov byte [esp + 0x1c], 3
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, edi
mov dword [esi + 0x28], eax
mov byte [esi + 0x24], bl
mov dword [0x513d20], esi
call fcn.00407c60
mov byte [esi + 0x24], bl
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14

Function at 0x448120
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5000f4]
xor eax, esp
mov dword [esp + 0x114], eax
cmp byte [esi + 0x24], 0
je 0x448153
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004aa641
add esp, 0x118
ret 4
cmp edi, 2
jne 0x448161
mov dword [esi + 0xc], 0
jmp 0x4481a2
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.004ad2a0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44819b
cmp dword [esp + 4], 6
jb 0x44819b
mov dword [esi + 0xc], 0x185
jmp 0x4481a2
mov dword [esi + 0xc], 0x85
mov edx, dword [esp + 0x11c]
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], edx
cmp edi, 4
je 0x4481d0
cmp edi, 1
je 0x4481d0
mov eax, dword [0x50248c]
inc eax
mov dword [0x50248c], eax
mov dword [esi + 0x18], eax
jmp 0x4481d7
mov dword [esi + 0x18], 0
mov ecx, dword [esi + 0x20]
lea eax, [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, dword [esp + 0x114]
test eax, eax
setne al
xor ecx, esp
call fcn.004aa641
add esp, 0x118
ret 4
Function at 0x448740
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ca869
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x3c]
xor ebp, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x18], ebp
call fcn.00417950
mov dword [esp + 0x34], ebp
push ebp
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov eax, esi
je 0x4487d5
call fcn.00441950
mov eax, dword [esi]
push ebp
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], edi
mov eax, dword [eax]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4487ca
cmp dword [esp + 0x14], edi
je 0x4487d3
xor edi, edi
mov eax, esi
call fcn.00441950
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret

Function at 0x4487f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x448866
ja 0x448809
cmp esi, dword [esp + 0x20]
jae 0x44886a
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x448825
jb 0x448821
cmp ecx, 0x10000
jae 0x448825
mov edi, ecx
jmp 0x44882a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x448866
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x448866
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x448809
ja 0x448866
cmp esi, dword [esp + 0x20]
jb 0x448809
cmp esi, dword [esp + 0x20]
jne 0x448887
cmp ebp, ebx
jne 0x448887
or esi, ebp
je 0x44887f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x4489a0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4489c6
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
Function at 0x448ce0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4cb961
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x34]
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], edi
call fcn.00417950
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x448dde
mov ecx, dword [esp + 0x14]
mov edx, ecx
and edx, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x448dde
lea eax, [esp + 0x14]
push eax
call fcn.00448740
add esp, 4
mov ebx, eax
mov dword [esp + 0x2c], 1
mov edi, dword [esi]
add dword [edi + 8], 0xffffffff
jne 0x448d91
cmp dword [edi + 4], 0
je 0x448d91
mov eax, dword [edi]
push 0
push eax
call fcn.004ab194
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov eax, dword [ebx]
inc dword [eax + 8]
mov dword [esi], eax
mov byte [esp + 0x2c], 0
mov edi, dword [esp + 0x14]
dec dword [edi + 8]
cmp dword [edi + 8], 0
lea eax, [edi + 8]
jne 0x448dde
cmp dword [edi + 4], 0
je 0x448dc9
mov eax, dword [edi]
push 0
push eax
call fcn.004ab194
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], 0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045a597
add esp, 4
mov dword [esp + 0x14], 0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x44a390
Capabilities:
Compare security identifiers

Disassembly:
push 0xffffffffffffffff
push 0x4c93f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [0x513a38]
xor esi, esi
cmp dword [edi], esi
je 0x44a460
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x14], esi
cmp eax, esi
je 0x44a3e7
push eax
call ebx
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
push 1
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x44a44d
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x44a44d
cmp dword [esp + 0x10], esi
je 0x44a44d
mov ecx, dword [edi]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x44a44d
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x44a436
push eax
call ebx
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x44a460
push eax
call ebx
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4