joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4242a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], ebp
mov dword [esp + 0x18], 0
je 0x424446
test ebp, ebp
je 0x424446
push ebx
push edi
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x20]
push eax
push 0xf003f
push 0
push str.SoftwareATIACE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x424336
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push 0
push str.PATH
push eax
call ebx
test eax, eax
jne 0x424336
push str.GetACEPrbPath___ACE_PATH_is_OK
jmp 0x4243f3
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push 0
push str.SoftwareATI
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x424376
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push str.PATH
push ecx
call ebx
test eax, eax
jne 0x424376
push str.GetACEPrbPath___ACE_PATH_NEW_is_OK
jmp 0x4243f3
lea edx, [esp + 0x20]
push edx
push 0xf003f
push 0
push str.SoftwareWOW6432NodeATIACE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4243b6
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.PATH
push edx
call ebx
test eax, eax
jne 0x4243b6
push str.GetACEPrbPath___ACE_REMAP_PATH_is_OK
jmp 0x4243f3
lea eax, [esp + 0x20]
push eax
push 0xf003f
push 0
push str.SoftwareWOW6432NodeATI
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x424437
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x30]
push str.PATH
push eax
call ebx
test eax, eax
jne 0x424437
push str.GetACEPrbPath___ACE_REMAP_PATH_NEW_is_OK
call fcn.0040aab0
add esp, 4
push 0x5c
push esi
call fcn.0045ee10
add esp, 8
test eax, eax
je 0x424419
lea ecx, [esi + ebp - 1]
cmp eax, ecx
jae 0x424419
mov cl, byte [eax + 1]
test cl, cl
je 0x424421
lea edx, [esi + ebp - 1]
cmp eax, edx
jne 0x424424
mov byte [eax], 0
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
push str.GetACEPrbPath___Get_ACE_registry_key_failed_n
call fcn.0040aab0
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x4244d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
push esi
push edi
je 0x4244ec
mov dword [ebx], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4245ad
cmp byte [esi], 0
je 0x4245ad
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424512
sub eax, edx
cmp eax, 0x104
jbe 0x424527
mov eax, 0x103
push eax
lea eax, [esp + 0x6c]
push esi
push eax
call fcn.0045e030
lea ecx, [esp + 0x74]
push ecx
call fcn.0040aab0
xor edx, edx
xor eax, eax
mov dword [esp + 0x20], edx
mov ecx, 0x11
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x24], edx
add esp, 0x10
test eax, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0x44
je 0x4245b4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x4245de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.FAILURE:_Failed_to_CreateProcess_for__s
call fcn.0040aab0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42459f
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x424603
test ebx, ebx
je 0x424603
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424be0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2124
call fcn.0045ef00
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0044e550
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov edx, dword [ebp + 0x14]
xor eax, eax
mov byte [esp + 0x28], bl
lea edi, [esp + 0x29]
mov dword [edx], ebx
mov dword [esp + 0x1c], ecx
mov ecx, 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push 0x1000
lea ecx, [esp + 0x1138]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x424c5b
push str.g_pfnEnumProcesses:_Failed
call fcn.0040aab0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x20]
shr edi, 2
cmp edi, ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ebx
jbe 0x424dc7
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x424dc7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x424c9c
mov edx, dword [esp + ebx*4 + 0x1130]
push edx
call fcn.0044e550
cmp eax, dword [ebp + 0x1c]
jne 0x424d8a
mov eax, dword [esp + ebx*4 + 0x1130]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x424d8a
xor edx, edx
mov dword [esp + 0x130], edx
mov dword [esp + 0x14], edx
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov ecx, 0x3ff
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
push 0x1000
lea eax, [esp + 0x138]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x424d7f
mov eax, dword [esp + 0x14]
xor ebx, ebx
test eax, 0xfffffffc
jbe 0x424d7b
jmp 0x424d10
mov edx, dword [esp + ebx*4 + 0x130]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x28]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2c]
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x424d52
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.0045f6e1
add esp, 0xc
test eax, eax
je 0x424d60
mov eax, dword [esp + 0x14]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x424d10
jmp 0x424d7b
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push ecx
push edx
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x424da2
mov ebx, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x24]
inc ebx
cmp ebx, edi
mov dword [esp + 0x18], ebx
jb 0x424c72
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.OpenProcessToken:_Failed
call fcn.0040aab0
mov eax, dword [ebp + 0x14]
add esp, 4
push esi
mov dword [eax], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424de0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
mov eax, dword [ebp + 8]
test eax, eax
push ebx
push esi
push edi
je 0x424f24
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x424f24
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x424f24
mov esi, dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [edx]
mov edi, 0x100
push eax
mov dword [esp + 0x10], edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
je 0x424e77
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x114]
push edx
mov dword [esp + 0x14], edi
call ebx
test eax, eax
je 0x424e97
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x424e77
push str.Failed_to_revert_1st.1
call fcn.0040aab0
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call esi
test eax, eax
je 0x424ec4
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], edi
call ebx
test eax, eax
jne 0x424ead
push str.IsSameUserByTokens:_GetUserName_failed
call fcn.0040aab0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x424ec4
push str.Failed_to_revert_1st.2
call fcn.0040aab0
add esp, 4
lea eax, [esp + 0x110]
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424ed0
sub eax, edx
push eax
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0045f6e1
add esp, 0xc
test eax, eax
jne 0x424ef8
mov esi, 1
lea eax, [esp + 0x10]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424f00
mov ecx, dword [ebp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0045e030
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.IsSameUserByTokens:_bad_inout
call fcn.0040aab0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426850
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
push ebx
push esi
push edi
mov eax, 0x400
call fcn.0045ef00
mov esi, esp
xor ebx, ebx
cmp esi, ebx
jne 0x426880
push str.FAILURE:_Failed_at__alloca_for_paclKey
call fcn.0040aab0
add esp, 4
jmp 0x426a0e
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.00426780
add esp, 8
test eax, eax
je 0x426a0e
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push edx
push eax
lea ecx, [ebp - 0x44]
push esi
push ecx
call fcn.00426690
add esp, 0x10
test eax, eax
je 0x426a0e
lea edx, [ebp - 0x54c]
push ebx
push edx
call fcn.0040aac0
push eax
call fcn.0044c890
add esp, 0xc
cmp eax, 1
jne 0x426a0e
lea eax, [ebp - 8]
push eax
push 0x2001f
push ebx
lea ecx, [ebp - 0x548]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x426a0e
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push str.DefaultMode
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x426a08
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push str.REG_SZ
push ebx
lea ecx, [ebp - 0x548]
push ecx
push VariantClear
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x426a08
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20]
push edx
push 4
push ebx
push str.DefaultSettings.BitsPerPel
push eax
mov dword [ebp - 0x2c], ebx
call esi
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 0x2c]
push ecx
push 4
push ebx
push str.DefaultSettings.Flags
push edx
call esi
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push ebx
push str.DefaultSettings.VRefresh
push ecx
call esi
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push ebx
push str.DefaultSettings.XPanning
push eax
call esi
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push ebx
push str.DefaultSettings.XResolution
push edx
call esi
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push str.DefaultSettings.YPanning
push ecx
call esi
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp - 0x24]
push edx
push 4
push ebx
push str.DefaultSettings.YResolution
push eax
call esi
mov ecx, dword [ebp - 4]
push ecx
call edi
mov edx, dword [ebp - 8]
push str.DefaultMode
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 8]
push eax
call edi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_FreeSid]
je 0x426a1e
push eax
call esi
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x426a28
push eax
call esi
lea esp, [ebp - 0x558]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426c10
Capabilities:
Get session user name
Impersonate user

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push esi
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
push edi
call ebx
test eax, eax
jne 0x426c52
push str.ImpersonateCurrentLogontUser:_ImpersonateLoggedOnUser_to_get_username_failed
call fcn.0040aab0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x426c81
push str.ImpersonateCurrentLogontUser:_RevertToSelf_failed_after_get_username
call fcn.0040aab0
add esp, 4
mov esi, dword [ebp + 0xc]
xor edx, edx
mov eax, esi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
push esi
mov dword [eax + 0x1c], edx
lea ecx, [esp + 0x14]
push edi
mov dword [esi], 0x20
mov dword [esi + 8], ecx
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x426cd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fail_to_LoadUserProfile___d
call fcn.0040aab0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call ebx
test eax, eax
jne 0x426cfd
push str.ImpersonateCurrentLogontUser:_ImpersonateLoggedOnUser_to_get_username_failed
call fcn.0040aab0
mov edx, dword [esi + 0x1c]
add esp, 4
push edx
push edi
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427740
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x868
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
mov eax, dword [0x4900e8]
xor ebp, ebp
test ah, 4
je 0x427776
push str.StopGlobalService_is_called
call fcn.0040aab0
add esp, 4
push 4
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, ebp
jne 0x4277b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x5c]
push str.StopGlobalService._failed_to_open_SCM._err_d
push eax
call fcn.0045e6a9
lea ecx, [esp + 0x64]
push ecx
call fcn.00411050
add esp, 0x10
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x491098], 7
mov eax, str.Ati_HotKey_Poller
jbe 0x4277c6
mov eax, str.Ati_External_Event_Utility
push 0x34
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebp
jne 0x42780a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x5c]
push str.StopGlobalService._failed_to_OpenService._err_d
push edx
call fcn.0045e6a9
lea eax, [esp + 0x64]
push eax
call fcn.00411050
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
xor eax, eax
mov ecx, 0x188
lea edi, [esp + 0x258]
rep stosd dword es:[edi], eax
push 1
mov ecx, 0xb
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x260]
push eax
push str..pipeExtEventPipe_Service
mov dword [esp + 0x20], ebp
mov dword [esp + 0x270], 0x40
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42788e
mov eax, dword [0x4900e8]
test ah, 4
je 0x42791c
push str.StopGlobalService:_enable_stop_global_service_capability_fails__n
call fcn.0040aab0
add esp, 4
jmp 0x42791c
cmp dword [esp + 0x54], 2
jne 0x42791c
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4278d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x5c]
push str.StopGlobalService._failed_to_ControlService._err_d
push edx
call fcn.0045e6a9
lea eax, [esp + 0x64]
push eax
call fcn.00411050
add esp, 0x10
jmp 0x42791c
mov ecx, dword [esp + 0x38]
push ecx
push ebp
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebp
jne 0x427900
mov eax, dword [0x4900e8]
test ah, 4
je 0x42791c
push str.StopGlobalService:_open_service_process_fails__n
call fcn.0040aab0
add esp, 4
jmp 0x42791c
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x427915
mov ebp, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427940
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2120
call fcn.0045ef00
push ebx
push ebp
xor ebx, ebx
push esi
xor ebp, ebp
mov eax, str.ati2evxx.exe
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427968
sub eax, edx
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, 0x400
lea edi, [esp + 0x1130]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea ecx, [esp + 0x1138]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x427a9e
mov edi, dword [esp + 0x1c]
shr edi, 2
cmp edi, ebx
mov dword [esp + 0x24], edi
jbe 0x427a9e
jmp 0x4279c0
mov edx, dword [esp + ebx*4 + 0x1130]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x427a95
xor eax, eax
mov dword [esp + 0x130], edx
mov ecx, 0x3ff
lea edi, [esp + 0x134]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x1000
lea ecx, [esp + 0x138]
push ecx
push esi
mov dword [esp + 0x28], edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x427a86
mov eax, dword [esp + 0x18]
xor ebp, ebp
test eax, 0xfffffffc
jbe 0x427a86
jmp 0x427a30
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x2c]
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + ebp*4 + 0x134]
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x427a74
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push str.ati2evxx.exe
push edx
call fcn.0045f6e1
add esp, 0xc
test eax, eax
je 0x427a82
mov eax, dword [esp + 0x18]
inc ebp
shr eax, 2
cmp ebp, eax
jb 0x427a30
jmp 0x427a86
inc dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
inc ebx
cmp ebx, edi
jb 0x4279c0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427ab0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x427af0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427ae0
sub eax, edx
add eax, 0x30
cmp eax, ebx
jb 0x427af6
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, esi
lea edx, [eax + 1]
jmp 0x427b00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427b00
push str.GlobalAti_VariBrightMonitorEvent
sub eax, edx
push str.atibrtmon.exe
add eax, esi
push 0x47a48c
push eax
call fcn.0045e6a9
add esp, 0x10
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x427b60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x254
xor eax, eax
push edi
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push str.GlobalAti_VariBrightMonitorEvent
push eax
mov ecx, 0x11
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
push 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x44
call dword [sym.imp.KERNEL32.dll_OpenEventA]
test eax, eax
pop edi
je 0x427bad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x254
ret
lea ecx, [esp + 0x54]
push 0x200
push ecx
call fcn.00427ab0
add esp, 8
test eax, eax
jne 0x427bd7
push str.VBMonitorProcessStart:_Failed_to_retreive_VBMonitor_Full_Name_n
call fcn.0040aab0
add esp, 4
add esp, 0x254
ret
lea edx, [esp]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x74]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x427c18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VBMonitorProcessStart:_Failed_to_create_VariBright_Monitor_Process._WinAPI_Error_Code__lu_n
call fcn.0040aab0
add esp, 8
add esp, 0x254
ret
mov edx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 4]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
push str.VBMonitorProcessStart:_VariBright_Monitor_Process__ProcessID__lu__created_n
call fcn.0040aab0
add esp, 8
pop esi
add esp, 0x254
ret