joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410500
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x3a4
mov eax, dword [0x4762c4]
xor eax, esp
mov dword [esp + 0x3a0], eax
mov eax, dword [esp + 0x3ac]
push ebx
mov ebx, dword [esp + 0x3ac]
push ebp
push esi
push edi
lea ecx, [esp + 0x18]
push ecx
push 8
xor esi, esi
push esi
push eax
push ebx
mov dword [esp + 0x30], eax
mov byte [esp + 0x27], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41062e
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c4]
push eax
push esi
mov ebp, 0x100
push ecx
mov dword [esp + 0x34], ebp
call edi
cmp eax, 0x103
je 0x4105cd
mov edx, dword [esp + 0x14]
add edx, 1
push edx
call fcn.0042f832
mov edx, dword [esp + 0x18]
add esp, 4
lea ecx, [esp + 0x1b0]
push ecx
add edx, 1
push edx
push eax
mov dword [esp + esi*4 + 0x2c], eax
call section..text
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c4]
push ecx
add esi, 1
push esi
push edx
mov dword [esp + 0x34], ebp
call edi
cmp eax, 0x103
jne 0x410578
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
test esi, esi
jbe 0x410636
mov edi, edi
mov edi, dword [esp + ebp*4 + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push str._s_s
lea edx, [esp + 0x2bc]
push 0x100
push edx
call fcn.00408310
push 1
lea eax, [esp + 0x2c8]
push eax
push ebx
call fcn.00410500
add esp, 0x20
test al, al
jne 0x41061c
mov byte [esp + 0x13], al
push edi
call fcn.0042f837
add ebp, 1
add esp, 4
cmp ebp, esi
jb 0x4105e0
jmp 0x410636
cmp eax, 2
sete byte [esp + 0x13]
cmp byte [esp + 0x3c0], 0
je 0x41065d
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x410659
cmp eax, 2
je 0x410659
xor al, al
jmp 0x410661
mov al, 1
jmp 0x410661
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3b0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00440494
add esp, 0x3a4
ret
Function at 0x421650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45ede8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4762c4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [ecx + 0x38]
cmp esi, dword [ecx + 0x3c]
lea edi, [ecx + 0x34]
jbe 0x421687
call fcn.00440a0f
mov ebp, 0xf
xor ebx, ebx
mov edi, edi
mov eax, dword [edi + 8]
cmp dword [edi + 4], eax
mov dword [esp + 0x14], eax
jbe 0x4216a1
call fcn.00440a0f
cmp edi, edi
je 0x4216aa
call fcn.00440a0f
cmp esi, dword [esp + 0x14]
je 0x421826
mov eax, dword [esp + 0x2c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
add eax, 8
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d00
cmp esi, dword [edi + 8]
mov dword [esp + 0x40], ebx
jb 0x4216e4
call fcn.00440a0f
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 0xffffffffffffffff
lea eax, [esi + 8]
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d00
mov dword [esp + 0x5c], 0xffffffff
call fcn.0042eee0
add esp, 0x38
cmp eax, ebx
jne 0x421814
mov eax, dword [esp + 0x2c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
add eax, 0x5c
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d00
cmp esi, dword [edi + 8]
mov dword [esp + 0x40], 1
jb 0x42174e
call fcn.00440a0f
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
lea eax, [esi + 0x5c]
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d00
mov dword [esp + 0x5c], 0xffffffff
call fcn.0042eee0
add esp, 0x38
cmp eax, ebx
jne 0x421814
mov eax, dword [esp + 0x2c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
add eax, 0x24
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d00
cmp esi, dword [edi + 8]
mov dword [esp + 0x40], 2
jb 0x4217b8
call fcn.00440a0f
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
lea eax, [esi + 0x24]
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d00
mov dword [esp + 0x5c], 0xffffffff
call fcn.0042eee0
add esp, 0x38
cmp eax, ebx
jne 0x421814
cmp esi, dword [edi + 8]
jb 0x4217f4
call fcn.00440a0f
mov al, byte [esi + 4]
mov ecx, dword [esp + 0x2c]
cmp al, byte [ecx + 4]
jne 0x421814
cmp esi, dword [edi + 8]
jb 0x42180a
call fcn.00440a0f
mov edx, dword [esi]
mov eax, dword [esp + 0x2c]
cmp edx, dword [eax]
je 0x421832
cmp esi, dword [edi + 8]
jb 0x42181e
call fcn.00440a0f
add esi, 0x78
jmp 0x421690
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.0041a240
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x423010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45f1ca
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4762c4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.CSifFile.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x78], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x88], ecx
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x90], ecx
mov dword [eax + 0x98], ecx
mov dword [eax + 0x9c], ecx
mov dword [eax + 0xa0], ecx
mov dword [eax + 0xa8], ecx
mov dword [eax + 0xac], ecx
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov dword [eax + 0xc0], ecx
mov dword [eax + 0xc8], ecx
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd8], ecx
mov dword [eax + 0xdc], ecx
mov dword [eax + 0xe0], ecx
mov dword [eax + 0xe8], ecx
mov dword [eax + 0xec], ecx
mov dword [eax + 0xf0], ecx
mov dword [eax + 0xf8], ecx
mov dword [eax + 0xfc], ecx
mov dword [eax + 0x100], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x424ca0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x4762c4]
xor eax, esp
mov dword [esp + 0x104], eax
cmp dword [0x477abc], 0x10
mov eax, dword [0x477aa8]
push ebx
push esi
push edi
mov edi, ecx
jae 0x424ccc
mov eax, 0x477aa8
push str.SETUP.INI
push eax
push str._s_s
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.00408310
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
push 0x100
lea esi, [edi + 0x100]
push esi
push 0x462a70
push str.Setup
push str.General
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x424d36
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00440494
add esp, 0x108
ret
lea edx, [esp + 0xc]
push edx
push 0x104
add edi, 0x204
push edi
push str.EPSON_Scanner
push str.UninstRegKey
push str.General
call ebx
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00440494
add esp, 0x108
ret
Function at 0x425230
Capabilities:
Delete directory

Disassembly:
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
xor ebx, ebx
lea ebx, [ebx]
mov eax, dword [esi + 0x418]
test eax, eax
je 0x425340
mov ecx, dword [esi + 0x41c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x425340
mov eax, dword [esi + 0x418]
test eax, eax
je 0x42529a
mov ecx, dword [esi + 0x41c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x42529f
call fcn.00440a0f
mov eax, dword [esi + 0x418]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x4252b2
mov eax, dword [eax + 4]
jmp 0x4252b5
add eax, 4
push 0x477810
push eax
call fcn.0042e5b0
add esp, 8
test al, al
je 0x425339
mov eax, dword [esi + 0x418]
test eax, eax
je 0x4252ec
mov ecx, dword [esi + 0x41c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, 1
mov ecx, edi
test ecx, ecx
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
jge 0x425303
fadd qword [0x464180]
test eax, eax
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
jge 0x425315
fadd qword [0x464180]
fdivp st(1)
fmul qword [0x464178]
call fcn.00443030
mov edx, 0x1e
sub edx, eax
push edx
mov ecx, esi
call fcn.00424c70
add ebx, 0x1c
jmp 0x425240
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
xor edi, edi
xor ebx, ebx
jmp 0x425350
mov eax, dword [esi + 0x438]
test eax, eax
je 0x4253e2
mov ecx, dword [esi + 0x43c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x4253e2
mov eax, dword [esi + 0x438]
test eax, eax
je 0x4253a6
mov ecx, dword [esi + 0x43c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4253ab
call fcn.00440a0f
mov eax, dword [esi + 0x438]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x4253be
mov eax, dword [eax + 4]
jmp 0x4253c1
add eax, 4
push 0x477810
push eax
call fcn.0042e610
add esp, 8
test al, al
je 0x425339
add edi, 1
add ebx, 0x1c
jmp 0x425350
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edi, edi
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [esi + 0x428]
test eax, eax
je 0x425474
mov ecx, dword [esi + 0x42c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x425474
mov eax, dword [esi + 0x428]
test eax, eax
je 0x425442
mov ecx, dword [esi + 0x42c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x425447
call fcn.00440a0f
mov eax, dword [esi + 0x428]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x425463
mov eax, dword [eax + 4]
push eax
call ebp
add edi, 1
add ebx, 0x1c
jmp 0x4253f0
add eax, 4
push eax
call ebp
add edi, 1
add ebx, 0x1c
jmp 0x4253f0
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret
Function at 0x4285f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45fad8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4762c4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.CUninstLog.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x78], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x88], ecx
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x90], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x42d170
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jbe 0x42d1ef
push edi
push esi
call fcn.00442924
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x42d1e5
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42d1e5
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42d1dc
mov edx, dword [esp + 0x10]
movzx eax, word [edx]
sub eax, 0x401
je 0x42d1da
sub eax, 0xc
jne 0x42d1dc
mov bl, 1
push edi
call fcn.00440d43
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x42d200
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4762c4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
xor ebx, ebx
mov byte [esp + 7], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42d326
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 2
push eax
mov dword [esp + 0x24], ebx
call edi
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00442924
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x42d305
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 2
push ecx
call edi
test eax, eax
je 0x42d2fc
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x42d2fc
xor edi, edi
cmp dword [esi], ebx
jbe 0x42d2f1
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push ebp
lea ebp, [esi + 4]
jmp 0x42d2d0
mov ecx, dword [ebp]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call ebx
test eax, eax
jne 0x42d2eb
add edi, 1
add ebp, 8
cmp edi, dword [esi]
jb 0x42d2d0
jmp 0x42d2f0
mov byte [esp + 0x13], 1
pop ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.00440d43
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00440494
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00440494
add esp, 0x1c
ret
Function at 0x42d340
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
cmp esi, edi
jl 0x42d4fd
lea eax, [esp + 0x10]
push eax
push 0x468b78
push 1
push edi
push 0x468b98
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x42d49d
cmp eax, edi
jl 0x42d49d
mov edx, dword [ecx]
lea eax, [esp + 0x14]
push eax
push 0x468b88
push ecx
mov ecx, dword [edx]
call ecx
cmp dword [esp + 0x14], edi
je 0x42d491
cmp eax, edi
jl 0x42d491
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push ecx
push eax
call edx
mov esi, eax
cmp esi, edi
jl 0x42d450
mov ecx, dword [esp + 0x24]
cmp ecx, edi
je 0x42d3e3
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
cmp esi, edi
jl 0x42d450
mov ecx, dword [esp + 0x28]
cmp ecx, edi
je 0x42d3fe
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x2c]
call eax
mov esi, eax
cmp esi, edi
jl 0x42d450
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x42d419
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x24]
call eax
mov esi, eax
cmp esi, edi
jl 0x42d450
mov ecx, dword [esp + 0x30]
cmp ecx, edi
je 0x42d439
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
mov edx, dword [eax]
push esi
push ecx
push eax
mov eax, dword [edx + 0x44]
call eax
mov esi, eax
cmp esi, edi
jl 0x42d450
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
mov esi, eax
mov ebx, dword [esp + 0x1c]
push edi
push edi
push 0xffffffffffffffff
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebp, [eax + 1]
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042f832
mov edi, eax
add esp, 4
test edi, edi
jne 0x42d4a7
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
push ebp
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x42d4c1
mov esi, 0x80004005
jmp 0x42d4d6
test esi, esi
jl 0x42d4d6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push edi
push eax
call edx
mov esi, eax
push edi
call fcn.0042f837
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 4
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
test esi, esi
pop esi
pop ebp
setge al
pop ebx
add esp, 8
ret
Function at 0x42d5b0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x4762c4]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push esi
lea ecx, [esp + 8]
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d60f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esp, [esp]
test byte [esp + 0xc], 0x10
je 0x42d605
lea edx, [esp + 0xc]
push edx
push esi
call edi
test eax, eax
jne 0x42d5f0
jmp 0x42d607
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [esp + 0x148]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00440494
add esp, 0x144
ret

Function at 0x42d630
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x148
mov eax, dword [0x4762c4]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
mov esi, dword [esp + 0x150]
push esi
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x3a
jne 0x42d677
mov al, 1
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.00440494
add esp, 0x148
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d6b3
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0xc], 0x10
jne 0x42d6a6
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
test eax, eax
jne 0x42d691
jmp 0x42d6ab
mov byte [esp + 0xb], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [esp + 0x148]
mov al, byte [esp + 7]
pop esi
xor ecx, esp
call fcn.00440494
add esp, 0x148
ret

Function at 0x42d730
Capabilities:
Get disk size

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x2c
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x42d785
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
push 0
push 0
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x42d785
mov ecx, dword [esp + 0xc]
cmp ecx, esi
ja 0x42d785
jb 0x42d77d
mov edx, dword [esp + 8]
cmp edx, edi
jae 0x42d785
pop edi
xor al, al
pop esi
add esp, 0x2c
ret
pop edi
mov al, 1
pop esi
add esp, 0x2c
ret

Function at 0x42d7c0
Capabilities:
Create service

Disassembly:
push ebx
push esi
push 0xf003f
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x42d822
mov cl, byte [esp + 0x18]
mov eax, dword [esp + 0x14]
push edi
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
push 0
neg cl
push eax
mov eax, dword [esp + 0x28]
push 1
sbb ecx, ecx
add ecx, 3
push ecx
push 0x10
push 0xf01ff
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x42d81e
push eax
call edi
mov bl, 1
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x42d830
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x34
push ebx
push esi
push 0xf003f
push 0
push 0
mov byte [esp + 0x17], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x42d950
mov eax, dword [esp + 0x40]
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x42d949
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x42d889
pop esi
xor al, al
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42d881
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
cmp dword [esp + 0x24], 2
mov edi, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
jne 0x42d934
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xcccccccd
mul dword [esp + 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x42d8de
mov edx, 0x3e8
jmp 0x42d8eb
cmp edx, 0x2710
jbe 0x42d8eb
mov edx, 0x2710
push edx
call ebx
lea ecx, [esp + 0x18]
push ecx
push 0x24
lea edx, [esp + 0x28]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42d930
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x34], eax
jbe 0x42d91f
call ebp
mov ecx, dword [esp + 0x34]
mov edi, eax
mov dword [esp + 0x14], ecx
jmp 0x42d929
call ebp
sub eax, edi
cmp eax, dword [esp + 0x38]
ja 0x42d930
cmp dword [esp + 0x24], 2
je 0x42d8c3
mov ebx, dword [esp + 0x1c]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x24], 4
pop edi
pop ebp
jne 0x42d949
mov byte [esp + 0xb], 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x34
ret