joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425ee8
Capabilities:
Set registry key via offline registry library

Disassembly:
push ebp
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x425eef
call fcn.0045e790
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x28]
and ebx, ebx
jne 0x425f29
xor eax, eax
jmp 0x4260fd
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x425f44
push dword [esp + 0x28]
pop eax
mov dword [esp + 8], eax
jmp 0x425f54
push dword [esp]
push dword [esp + 0x2c]
call fcn.00422c4e
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
je 0x425f66
mov ebx, dword [esp + 0x38]
and ebx, ebx
je 0x425f66
jmp 0x425f6d
mov eax, 1
jmp 0x425f6f
xor eax, eax
and eax, eax
je 0x425f7a
xor eax, eax
jmp 0x4260fd
push dword [esp + 0x34]
mov ebx, 1
cmp ebx, dword [esp]
je 0x425f92
mov ebx, 2
cmp ebx, dword [esp]
jne 0x425fec
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x4c]
call fcn.0045ac80
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
push dword [esp + 0x10]
call fcn.0044f9d0
mov ebx, eax
add ebx, ebx
add ebx, 2
push ebx
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x40]
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x1c]
call sub.Toolsx86offreg.dll_ORSetValue
jmp 0x4260e7
mov ebx, 3
cmp ebx, dword [esp]
jne 0x42602a
mov ebx, dword [esp + 0x40]
and ebx, ebx
jne 0x42600b
push dword [esp + 0x3c]
call fcn.0045ac60
mov dword [esp + 0x40], eax
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x1c]
call sub.Toolsx86offreg.dll_ORSetValue
jmp 0x4260e7
mov ebx, 4
cmp ebx, dword [esp]
jne 0x426054
push 4
push dword [esp + 0x40]
push dword [esp + 0x40]
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x1c]
call sub.Toolsx86offreg.dll_ORSetValue
jmp 0x4260e7
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4260b5
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x4c]
call fcn.0045ac80
lea eax, [esp + 0x14]
push eax
call fcn.0045e660
push dword [esp + 0x10]
call fcn.0044f9d0
mov ebx, eax
add ebx, ebx
add ebx, 2
push ebx
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x40]
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x1c]
call sub.Toolsx86offreg.dll_ORSetValue
jmp 0x4260e7
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4260e7
push dword [esp + 0x3c]
pop eax
mov dword [esp + 0x1c], eax
push 8
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
push dword [esp + 0x40]
mov eax, dword [esp + 0x14]
push eax
push dword [esp + 0x1c]
call sub.Toolsx86offreg.dll_ORSetValue
pop eax
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 0x28]
je 0x4260fb
push dword [esp + 8]
call sub.Toolsx86offreg.dll_ORCloseKey
xor eax, eax
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
push dword [esp + 0xc]
call fcn.0045e7f0
add esp, 0x1c
pop ebx
pop ebp
ret 0x18
Function at 0x42769d
Capabilities:
Read .ini file

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4276a4
call fcn.0045e790
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.0044e000
push 1
push 0x10000
call sub.MSVCRT.dll_calloc
add esp, 8
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x24]
add ebx, 0x8000
push ebx
mov ebp, dword [esp + 0x28]
pop eax
mov dword [ebp + 4], eax
push dword [esp]
push 0x7fef
mov ebp, dword [esp + 0x2c]
push dword [ebp + 4]
mov eax, str.builds
push eax
call sub.kernel32.dll_GetPrivateProfileSectionW
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4277d6
mov ebp, dword [esp + 0x24]
push dword [ebp + 4]
pop eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
pop eax
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x10]
movzx ebx, word [ebp]
xor eax, eax
cmp ebx, eax
jne 0x42773d
jmp 0x4277d6
push dword [esp + 0x10]
call sub.MSVCRT.dll_wcslen
add esp, 4
mov ebx, eax
add ebx, ebx
add ebx, 2
mov dword [esp + 0x18], ebx
mov eax, 0x461d76
push eax
mov ebp, dword [esp + 0x10]
push dword [ebp]
call sub.MSVCRT.dll_wcstok
add esp, 8
mov dword [esp + 0x20], eax
mov eax, 0x461d76
push eax
push 0
call sub.MSVCRT.dll_wcstok
add esp, 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
mov ebp, dword [esp + 0x14]
push dword [ebp]
call sub.shlwapi.dll_StrToIntExW
push dword [esp + 0x1c]
mov ebp, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x2c]
mov eax, dword [ebp]
shl eax, 3
pop ebp
add ebp, eax
pop eax
mov dword [ebp + 8], eax
mov ebp, dword [esp + 0x24]
mov ebx, dword [ebp]
inc ebx
push ebx
mov ebp, dword [esp + 0x28]
pop eax
mov dword [ebp], eax
mov ebx, dword [esp + 0x10]
add ebx, dword [esp + 0x18]
mov dword [esp + 0x10], ebx
jmp 0x427720
mov ebp, dword [esp + 0x24]
mov dword [ebp], 0
push dword [esp]
push 0x7fff
mov ebp, dword [esp + 0x2c]
push dword [ebp + 4]
mov eax, str.builds
push eax
call sub.kernel32.dll_GetPrivateProfileSectionW
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4278b6
mov ebp, dword [esp + 0x24]
push dword [ebp + 4]
pop eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
pop eax
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x10]
movzx ebx, word [ebp]
xor eax, eax
cmp ebx, eax
jne 0x427833
jmp 0x4278b6
push dword [esp + 0x10]
call sub.MSVCRT.dll_wcslen
add esp, 4
mov ebx, eax
add ebx, ebx
add ebx, 2
mov dword [esp + 0x18], ebx
mov eax, 0x461d76
push eax
mov ebp, dword [esp + 0x10]
push dword [ebp]
call sub.MSVCRT.dll_wcstok
add esp, 8
mov dword [esp + 0x20], eax
mov eax, 0x461d76
push eax
push 0
call sub.MSVCRT.dll_wcstok
add esp, 8
mov dword [esp + 0x20], eax
push dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x2c]
mov eax, dword [ebp]
shl eax, 3
pop ebp
add ebp, eax
pop eax
mov dword [ebp + 0xc], eax
mov ebp, dword [esp + 0x24]
mov ebx, dword [ebp]
inc ebx
push ebx
mov ebp, dword [esp + 0x28]
pop eax
mov dword [ebp], eax
mov ebx, dword [esp + 0x10]
add ebx, dword [esp + 0x18]
mov dword [esp + 0x10], ebx
jmp 0x427816
mov eax, dword [esp + 0x24]
jmp 0x4278be
push dword [esp]
call fcn.0045e7f0
add esp, 0x28
pop ebx
pop ebp
ret 4
Function at 0x427c26
Capabilities:
Get file version info

Disassembly:
push ebp
mov edx, 0x8b
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x427c2c
call fcn.0045e790
push dword [esp + 0x23c]
call fcn.0044e2f0
mov edx, dword [esp + 0x234]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x238]
lea ecx, [esp + 4]
call fcn.0044e000
push dword [esp + 0x220]
mov eax, dword [esp + 4]
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x427db9
push dword [esp + 8]
call fcn.0045ac20
mov dword [esp + 0x224], eax
cmp dword [esp + 0x224], 0
je 0x427db9
push dword [esp + 0x224]
push dword [esp + 0xc]
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
and eax, eax
je 0x427dad
lea eax, [esp + 0xc]
mov edx, str.VarFileInfoTranslation
push edx
push 0x105
push eax
call fcn.0045e940
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x230]
call sub.VERSION.DLL_VerQueryValueW
and eax, eax
je 0x427dad
mov eax, dword [esp + 4]
push eax
mov ebp, dword [esp + 0x21c]
push ebp
pop ebp
movsx eax, word [ebp + 2]
push eax
mov ebp, dword [esp + 0x220]
push ebp
pop ebp
movsx eax, word [ebp]
push eax
mov eax, str.StringFileInfo_04x_04x_s
push eax
push 0x104
lea eax, [esp + 0x20]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x18
mov dword [esp + 0x218], 0
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x230]
call sub.VERSION.DLL_VerQueryValueW
and eax, eax
je 0x427dad
cmp dword [esp + 0x218], 0
je 0x427dad
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x228]
call fcn.0045ac80
lea eax, [esp + 0x220]
push eax
call fcn.0045e660
push dword [esp + 0x224]
call fcn.0045ac40
mov edx, dword [esp + 0x21c]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x427de4
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp + 0x21c]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x22c
pop ebp
ret 8
Function at 0x42b738
Capabilities:
Set registry key via offline registry library

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x1c]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x20]
lea ecx, [esp + 4]
call fcn.0044e000
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x42b769
xor eax, eax
jmp 0x42b7e6
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x42b784
push dword [esp + 0x18]
pop eax
mov dword [esp + 8], eax
jmp 0x42b794
push dword [esp]
push dword [esp + 0x1c]
call fcn.00422c4e
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x42b7a0
xor eax, eax
jmp 0x42b7e6
push 4
lea eax, [esp + 0x28]
push eax
push 4
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x18]
call sub.Toolsx86offreg.dll_ORSetValue
mov ebx, eax
and ebx, ebx
jne 0x42b7cb
mov dword [esp + 0xc], 1
mov ebx, dword [esp + 8]
cmp ebx, dword [esp + 0x18]
je 0x42b7de
push dword [esp + 8]
call sub.Toolsx86offreg.dll_ORCloseKey
mov eax, dword [esp + 0xc]
jmp 0x42b7e6
push dword [esp]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
add esp, 0x10
pop ebx
ret 0x10

Function at 0x42bb5b
Capabilities:
Read .ini file

Disassembly:
mov edx, 0x4004
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x42bb60
call fcn.0045e790
push dword [esp + 0x10024]
call fcn.0044e2f0
mov edx, dword [esp + 0x10014]
lea ecx, [esp]
call fcn.0044e000
mov edx, dword [esp + 0x10018]
lea ecx, [esp + 4]
call fcn.0044e000
mov edx, dword [esp + 0x1001c]
lea ecx, [esp + 8]
call fcn.0044e000
mov edx, dword [esp + 0x10020]
lea ecx, [esp + 0xc]
call fcn.0044e000
mov eax, dword [esp]
push eax
push 0x7fff
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
lea edx, [esp + 0x10]
push edx
call fcn.0045e620
pop edx
push eax
push 0x8000
push edx
call fcn.0045e880
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x42bc0c
push dword [esp + 0xc]
call fcn.0045e7f0
push dword [esp + 8]
call fcn.0045e7f0
push dword [esp + 4]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x10010
ret 0x10
Function at 0x430090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
lea eax, [esp]
push eax
mov ebx, dword [esp + 0x30]
or ebx, 0x20019
push ebx
push 0
push dword [esp + 0x30]
push dword [esp + 0x30]
call sub.advapi32.dll_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x4301df
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x38]
push dword [esp + 0x14]
call sub.advapi32.dll_RegQueryValueExW
cmp dword [esp + 0xc], 0
je 0x4301d7
push dword [esp + 0xc]
call fcn.0045ac20
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 8]
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x38]
push dword [esp + 0x14]
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
and ebx, ebx
jne 0x4301d7
push dword [esp + 8]
mov ebx, 1
cmp ebx, dword [esp]
je 0x430144
mov ebx, 2
cmp ebx, dword [esp]
jne 0x430187
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x19
push 0xffffffff
push dword [esp + 0x1c]
call fcn.0045ac80
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f890
call fcn.0044e2f0
mov dword [esp + 0x14], eax
jmp 0x4301cd
mov ebx, 3
cmp ebx, dword [esp]
jne 0x43019f
mov ebp, dword [esp + 8]
push dword [ebp]
pop eax
mov dword [esp + 0x14], eax
jmp 0x4301cd
mov ebx, 4
cmp ebx, dword [esp]
je 0x4301b3
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4301c1
mov ebp, dword [esp + 8]
push dword [ebp]
pop eax
mov dword [esp + 0x14], eax
jmp 0x4301cd
mov ebp, dword [esp + 8]
push dword [ebp]
pop eax
mov dword [esp + 0x14], eax
pop eax
push dword [esp + 4]
call fcn.0045ac40
push dword [esp]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x4301e7
add esp, 0x14
pop ebx
pop ebp
ret 0x10
Function at 0x432e7b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.0044e000
mov eax, dword [esp]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
mov ebx, eax
add ebx, ebx
add ebx, 2
push ebx
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x432f1c
push dword [esp + 4]
call sub.kernel32.dll_GlobalLock
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x432f13
mov eax, dword [esp]
push eax
push dword [esp + 0xc]
call sub.MSVCRT.dll_wcscpy
add esp, 8
push dword [esp + 4]
call sub.kernel32.dll_GlobalUnlock
push 0
call sub.user32.dll_OpenClipboard
and eax, eax
je 0x432f13
call sub.user32.dll_EmptyClipboard
push dword [esp + 4]
push 0xd
call sub.user32.dll_SetClipboardData
mov dword [esp + 0xc], eax
call sub.user32.dll_CloseClipboard
push dword [esp + 4]
call sub.kernel32.dll_GlobalFree
mov eax, dword [esp + 0xc]
jmp 0x432f24
push dword [esp]
call fcn.0045e7f0
add esp, 0x10
pop ebx
ret 4

Function at 0x43333c
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0044e000
push edx
call fcn.0045e620
pop edx
push eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0
push edx
call fcn.0045e620
pop edx
push eax
mov edx, 0x469c1e
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 2
push dword [esp + 0x2c]
call fcn.0044f540
pop eax
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_CreateFileW
call fcn.0044e2f0
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
cmp ebx, 0xffffffff
jne 0x4333d2
xor eax, eax
jmp 0x433412
push 0
lea eax, [esp + 0x14]
push eax
push 0xc
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x2d1080
push dword [esp + 0x30]
call sub.kernel32.dll_DeviceIoControl
push dword [esp + 0x14]
call sub.kernel32.dll_CloseHandle
lea ebp, [esp + 4]
mov eax, dword [ebp + 4]
jmp 0x433412
push dword [esp]
call fcn.0045e7f0
add esp, 0x18
pop ebx
pop ebp
ret 4
Function at 0x434e1c
Capabilities:
Open registry key via offline registry library

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.0044e000
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.Toolsx86offreg.dll_OROpenHive
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x434e55
mov eax, dword [esp + 4]
jmp 0x434e6a
cmp dword [esp + 0x1c], 0
je 0x434e68
push dword [esp + 8]
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp], eax
xor eax, eax
push dword [esp]
call fcn.0045e7f0
add esp, 0xc
pop ebx
pop ebp
ret 8
Function at 0x436a10
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x436a17
call fcn.0045e790
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.0044e000
mov ebp, dword [0x47356c]
push dword [ebp + 0x24]
mov edx, 0x46920c
pop ecx
call fcn.0044e300
je 0x436a73
mov edx, dword [esp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.i386imdisk.sys
push edx
call fcn.0045e6f0
lea eax, [esp + 0x20]
push eax
call fcn.0045e660
jmp 0x436a99
mov edx, dword [esp]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._amd64imdisk.sys
push edx
call fcn.0045e6f0
lea eax, [esp + 0x20]
push eax
call fcn.0045e660
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
mov eax, str.systemCurrentControlSet_servicesImDisk
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x436c01
push 0
mov eax, str.ErrorControl
push eax
mov eax, 0x46105e
push eax
push dword [esp + 0x10]
call fcn.00415596
push 2
mov eax, str.Start
push eax
mov eax, 0x46105e
push eax
push dword [esp + 0x10]
call fcn.00415596
push 1
mov eax, str.Type
push eax
mov eax, 0x46105e
push eax
push dword [esp + 0x10]
call fcn.00415596
push 0
mov eax, str.Disk_emulation_driver
push eax
push 1
mov eax, str.Discription
push eax
mov eax, 0x46105e
push eax
push dword [esp + 0x18]
call fcn.00414cea
push 0
mov eax, str.ImDisk_Virtual_Disk_Driver
push eax
push 1
mov eax, str.DisplayName
push eax
mov eax, 0x46105e
push eax
push dword [esp + 0x18]
call fcn.00414cea
push dword [esp + 4]
call sub.advapi32.dll_RegCloseKey
push 0xf000f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x436c01
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x30]
push eax
push 1
push 2
push 2
push 0
push 0
mov eax, str.Imdisk
push eax
push dword [esp + 0x44]
call sub.advapi32.dll_CreateServiceW
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x436bf8
mov dword [esp + 0x10], 1
push dword [esp + 0x18]
call sub.advapi32.dll_CloseServiceHandle
push dword [esp + 0x14]
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [esp + 0x10]
jmp 0x436c09
push dword [esp + 0x1c]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x20
pop ebx
pop ebp
ret 4
Function at 0x4451b5
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0045e790
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.0044e000
mov eax, dword [esp]
push eax
pop eax
mov dword [esp + 8], eax
push dword [esp]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x4451ed
xor eax, eax
jmp 0x44527e
mov ebp, dword [esp + 8]
cmp word [ebp], 0
je 0x445239
mov ebp, dword [esp + 8]
movzx ebx, word [ebp]
mov eax, 0x5c
cmp ebx, eax
jne 0x44522c
mov ebp, dword [esp + 8]
mov word [ebp], 0
push 0
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov ebp, dword [esp + 8]
mov word [ebp], 0x5c
mov ebx, dword [esp + 8]
add ebx, 2
mov dword [esp + 8], ebx
jmp 0x4451ed
push 0
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CreateDirectoryW
push dword [esp]
call sub.kernel32.dll_GetFileAttributesW
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
je 0x44526f
mov ebx, dword [esp + 4]
and ebx, 0x10
and ebx, ebx
je 0x44526f
mov eax, 1
jmp 0x445271
xor eax, eax
and eax, eax
je 0x44527c
mov eax, 1
jmp 0x44527e
xor eax, eax
push dword [esp]
call fcn.0045e7f0
add esp, 0xc
pop ebx
pop ebp
ret 4
Function at 0x447391
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045e790
lea eax, [esp]
push eax
mov ebx, dword [esp + 0x2c]
or ebx, 0x20019
push ebx
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.advapi32.dll_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x4473fd
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x34]
push dword [esp + 0x14]
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
and ebx, ebx
jne 0x4473f5
push dword [esp + 8]
pop eax
mov dword [esp + 0x10], eax
push dword [esp]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x447405
add esp, 0x14
pop ebx
ret 0x10

Function at 0x44740c
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
mov edx, 0x90
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x447413
call fcn.0045e790
push dword [esp + 0x24c]
call fcn.0044e2f0
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esp + 0x238], eax
lea ebp, [esp + 0xc]
mov dword [ebp], 0x22c
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov dword [esp], eax
mov ebx, dword [esp]
cmp ebx, 0xffffffff
je 0x4474b1
lea eax, [esp + 0xc]
push eax
push dword [esp + 4]
call sub.kernel32.dll_Process32FirstW
and eax, eax
je 0x4474a9
lea eax, [esp + 0xc]
push eax
push dword [esp + 4]
call sub.kernel32.dll_Process32NextW
and eax, eax
je 0x4474a9
mov ebx, dword [esp + 0x238]
lea ebp, [esp + 0xc]
cmp ebx, dword [ebp + 8]
jne 0x4474a7
lea ebp, [esp + 0xc]
push dword [ebp + 0x18]
pop eax
mov dword [esp + 0x23c], eax
jmp 0x4474a9
jmp 0x447474
push dword [esp]
call sub.kernel32.dll_CloseHandle
push edx
call fcn.0045e620
pop edx
push eax
push dword [esp + 0x240]
call fcn.0043689d
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x4474db
push dword [esp + 8]
call fcn.0045e7f0
add esp, 0x240
pop ebx
pop ebp
ret
Function at 0x44811a
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x448122
call fcn.0045e790
push dword [esp + 0x34]
call fcn.0044e2f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x104
call fcn.0044f2b0
lea eax, [esp + 4]
push eax
call fcn.0045e660
mov eax, dword [esp]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x4482a0
mov edx, 0x4686d2
lea ecx, [esp + 0x1c]
call fcn.0044e008
mov eax, dword [esp + 0x1c]
push eax
pop eax
mov dword [esp + 0x20], eax
mov eax, dword [esp]
mov ebx, eax
mov edi, dword [esp + 0x10]
add edi, edi
add ebx, edi
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
mov eax, ebx
mov ecx, 4
cdq
idiv ecx
mov ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x5a
jmp 0x4481e9
mov eax, 0x41
cmp eax, dword [esp + 8]
jg 0x4482a0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 1
jmp 0x44820a
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 4]
jl 0x44823d
mov ebx, dword [esp + 0x18]
add ebx, 0xfffffff8
mov dword [esp + 0x18], ebx
mov ebp, dword [esp + 0x18]
movzx ebx, word [ebp]
mov eax, dword [esp + 8]
cmp ebx, eax
jne 0x448237
mov dword [esp + 0xc], 1
inc dword [esp + 4]
jno 0x44820a
cmp dword [esp + 0xc], 0
je 0x448248
xor eax, eax
jmp 0x44824d
mov eax, 1
and eax, eax
je 0x448296
push dword [esp + 8]
mov ebp, dword [esp + 0x24]
pop eax
mov word [ebp], ax
push 0x104
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov ebx, eax
and ebx, ebx
jne 0x448296
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x4482aa
dec dword [esp + 8]
jno 0x4481e9
call fcn.0045e820
mov word [eax], 0
push dword [esp + 0x1c]
call fcn.0045e7f0
push dword [esp + 0x14]
call fcn.0045e7f0
push dword [esp]
call fcn.0045e7f0
add esp, 0x24
pop edi
pop ebx
pop ebp
ret