joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432bc0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x40c], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x432e0e
push ebx
push 0
push 2
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0x80010119
movzx ebx, bl
lea eax, [ebp - 0x40c]
mov ecx, 1
push eax
push 0x5782d8
push ecx
push 0
push 0x5782c8
cmove ebx, ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x432c8f
mov eax, dword [ebp - 0x40c]
lea edx, [ebp - 0x408]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x408], 0
mov ecx, dword [eax]
push str.ROOTcimv2
push eax
call dword [ecx + 0xc]
test eax, eax
jns 0x432ca6
mov eax, dword [ebp - 0x40c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [sym.imp.ole32.dll_CoSetProxyBlanket]
push edi
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x408]
call esi
mov edi, eax
test bl, bl
je 0x432ce0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xa
push dword [ebp - 0x408]
call esi
mov eax, dword [ebp - 0x408]
test edi, edi
js 0x432df3
lea edx, [ebp - 0x410]
mov dword [ebp - 0x410], 0
mov ecx, dword [eax]
push edx
push 0
push 0x30
push dword [ebp - 0x414]
push eax
call dword [ecx + 0x48]
test eax, eax
jns 0x432d1e
mov eax, dword [ebp - 0x408]
jmp 0x432dff
mov ecx, dword [ebp - 0x410]
xor esi, esi
test ecx, ecx
je 0x432ded
nop
mov eax, dword [ecx]
lea edx, [ebp - 0x420]
push edx
lea edx, [ebp - 0x414]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
test eax, eax
jne 0x432ded
mov eax, dword [ebp - 0x414]
lea edx, [ebp - 0x430]
push 0
push 0
push edx
mov ecx, dword [eax]
push 0
push dword [ebp - 0x418]
push eax
call dword [ecx + 0x10]
mov edi, eax
cmp esi, dword [ebp + 0x14]
jne 0x432dd6
mov edx, dword [ebp - 0x428]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432d81
sub ecx, ebx
sar ecx, 1
push edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.0052c857
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432db0
sub eax, edx
lea ecx, [ebp - 0x404]
sar eax, 1
push ecx
inc eax
push eax
push dword [ebp - 0x41c]
call fcn.0052c857
add esp, 0xc
test edi, edi
js 0x432d13
mov ecx, dword [ebp - 0x410]
inc esi
test ecx, ecx
jne 0x432d30
mov eax, dword [ebp - 0x408]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4330f0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x433138
push edi
push 0x55f1f8
call fcn.00433050
add esp, 8
test al, al
je 0x433164
mov eax, dword [ebp + 8]
sub eax, 0
je 0x433153
sub eax, 1
je 0x43314c
mov eax, 0x11
jmp 0x433158
mov eax, 5
jmp 0x433158
mov eax, 1
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edi, eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x433193
push 0
push 0x55f1f8
call fcn.00432fb0
add esp, 8
mov ecx, dword [ebp - 4]
test edi, edi
pop edi
setne al
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret

Function at 0x4349b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c2e9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a4ca4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5bd844
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5bd844
mov dword [esi + 0x30], 0x5bd844
mov dword [esi + 0x34], 0x5bd844
mov edi, dword [ebp + 8]
mov edx, edi
mov byte [ebp - 4], 3
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x434a51
sub edx, ebx
push edx
push edi
call fcn.004347e0
mov edi, dword [ebp + 0xc]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x434a70
sub edx, ecx
lea ecx, [esi + 0x30]
push edx
push edi
call fcn.004347e0
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x434a90
sub edx, ecx
lea ecx, [esi + 0x34]
push edx
push edi
call fcn.004347e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434ac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c323
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a4ca4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5bd844
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5bd844
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x55a8b0
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004347e0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x435d30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x435d50
push ebx
push ebx
push ebx
push 2
call fcn.004386e0
pop edi
xor al, al
pop ebx
pop ebp
ret 8
push esi
mov esi, dword [edi + 0x18]
test esi, esi
je 0x435d67
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x435d58
push 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push ebx
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.0052d57c
push ebx
call fcn.0052e434
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp + 8], esi
call fcn.0052d57c
add esp, 0x1c
test esi, esi
jg 0x435dc1
push 0
push 0
push 0
push 0xc
mov ecx, edi
call fcn.004386e0
pop esi
pop edi
xor al, al
pop ebx
pop ebp
ret 8
lea eax, [esi + 1]
push eax
call fcn.005099f5
push ebx
mov ebx, dword [ebp + 8]
mov esi, eax
push 1
push ebx
push esi
mov byte [esi], 0
call fcn.0052dc82
add esp, 0x14
cmp eax, 1
je 0x435e05
push esi
call fcn.005099fe
add esp, 4
mov ecx, edi
push 0
push 0
push 0
push 2
call fcn.004386e0
pop esi
pop edi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [esi + ebx], 0
mov eax, esi
mov cl, byte [esi]
mov edx, esi
test cl, cl
je 0x435e36
mov dword [ebp + 8], eax
lea ebx, [edx + 1]
inc eax
cmp cl, 0xd
jne 0x435e2c
mov byte [edx], 0xa
cmp byte [eax], 0xa
cmovne eax, dword [ebp + 8]
inc eax
jmp 0x435e2e
mov byte [edx], cl
mov cl, byte [eax]
mov edx, ebx
test cl, cl
jne 0x435e13
push dword [ebp + 0xc]
mov byte [edx], 0
mov ecx, edi
mov eax, dword [edi]
push 0
push esi
call dword [eax + 8]
push esi
call fcn.005099fe
add esp, 4
cmp byte [edi + 0x2c], 0
sete al
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43bbc0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x5bd86c], eax
call esi
push 0
push 0
push 0
push 0
mov dword [0x5bd870], eax
call esi
push dword [0x5bd86c]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [0x5bd868], eax
call esi
push dword [0x5bd870]
call esi
push dword [0x5bd868]
call esi
push 0
push 0
push 0x43a910
call fcn.00531d5f
add esp, 0xc
mov dword [0x5bd874], eax
pop esi
ret
Function at 0x43cc70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
call fcn.00409b60
push dword [eax + 4]
push dword [eax]
call fcn.0052b479
xor eax, eax
add esp, 0x20
cmp dword [esi + 0x260], 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
jne 0x43ccd7
push eax
call fcn.00531b27
add esp, 4
lea eax, [esi + 0x40]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x43cd0c
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0050970c
mov esp, ebp
pop ebp
ret
Function at 0x43de60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5a41a4]
mov edx, dword [0x5a41a8]
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, 1
push edi
mov edi, ecx
cmp eax, edx
jae 0x43deee
test esi, esi
js 0x43e035
mov ebx, dword [eax]
test ebx, ebx
je 0x43dee4
mov ecx, dword [ebx + 8]
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x43dea2
xor esi, esi
jmp 0x43dee4
lea eax, [ebp - 4]
push eax
push 0x55fc60
push dword [ebx + 0xc]
call ecx
mov esi, eax
test esi, esi
js 0x43dece
mov eax, dword [ebx + 0x10]
add eax, 4
push eax
push 5
push 4
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43dedb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [0x5a41a8]
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp eax, edx
jb 0x43de82
test esi, esi
js 0x43e035
jne 0x43e031
cmp byte [edi + 0x3c], 0
je 0x43dfd0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x43dfb9
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x43d100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x43df4b
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x30], ebx
test ebx, ebx
je 0x43dfb9
cmp dword [edi + 0x260], 0
je 0x43df8e
mov edx, 4
lea ecx, [edi + 0x248]
mov eax, 2
lock cmpxchg dword [ecx], edx
cmp eax, 2
jne 0x43df8e
push str.Service_started_resumed
push edi
call fcn.0043cc70
add esp, 8
lea eax, [edi + 0x244]
push eax
push dword [edi + 0x240]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x43dfb0
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43e01b
mov ecx, edi
mov esi, 0x80004005
call fcn.00440490
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x260], 0
je 0x43e013
mov edx, 4
lea ecx, [edi + 0x248]
mov eax, 2
lock cmpxchg dword [ecx], edx
cmp eax, 2
jne 0x43e013
push str.Service_started_resumed
push edi
call fcn.0043cc70
add esp, 8
lea eax, [edi + 0x244]
push eax
push dword [edi + 0x240]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x43e035
mov ecx, edi
call fcn.00440490
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [edi + 0x3c], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43ead0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c956
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x43eb7c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x43eb7c
call fcn.00439d10
mov esi, eax
jmp 0x43ec6c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x43eb9f
call fcn.00439d10
jmp 0x43ec5f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x43ebbd
call fcn.00439d10
jmp 0x43ec5f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x43ebde
mov esi, 0x8007000e
jmp 0x43ec61
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00439b40
jmp 0x43ec08
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x43ec1f
mov esi, 0x8007000e
jmp 0x43ec61
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x43ec3f
call fcn.00439d10
jmp 0x43ec5f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0043e930
mov esi, eax
test edi, edi
je 0x43ec6c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x43ec90
lea ecx, [ebp - 0x418]
call fcn.0043c590
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x440760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x440775
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440780
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x440870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20019
push str.AppID
mov edi, ecx
mov dword [ebp - 0x22c], 0
push SysReAllocStringLen
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
call fcn.0043d660
mov esi, eax
mov eax, dword [ebp - 0x22c]
test esi, esi
je 0x4408d6
mov dword [edi + 0x250], esi
jmp 0x440a43
push ebx
push 0x20019
push str.BEBCB884_9C21_4117_B30B_CED03A72B50F
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
call fcn.0043d660
mov ebx, dword [ebp - 0x21c]
mov esi, eax
test esi, esi
jne 0x440a2b
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push str.LocalService
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440990
mov eax, dword [ebp - 0x230]
cmp eax, 1
je 0x440963
cmp eax, 2
je 0x440963
mov eax, 0xd
jmp 0x440990
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x440985
test al, 1
jne 0x44097e
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x44098e
mov eax, 0xd
jmp 0x440990
xor eax, eax
mov word [ebp - 0x20c], ax
xor eax, eax
mov dword [edi + 0x260], 0
test eax, eax
jne 0x4409f4
lea eax, [edi + 0x40]
mov dword [edi + 0x260], 1
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x21c], 0x441570
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4409ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x250], eax
mov esi, dword [edi + 0x250]
jmp 0x440a31
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
jns 0x440a1b
cmp esi, 0x80010106
jne 0x440a31
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x440a1f
jmp 0x440a31
mov byte [edi + 0x3e], 1
push dword [ebp + 8]
mov ecx, edi
call fcn.004404e0
mov esi, eax
mov dword [edi + 0x250], esi
test ebx, ebx
je 0x440a3c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
pop ebx
test eax, eax
je 0x440a4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0050970c
mov esp, ebp
pop ebp
ret 4
Function at 0x440eb0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00440c20
test eax, eax
jne 0x440ec8
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0x20006
push str.AppID
push SysReAllocStringLen
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0043d660
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xc]
test eax, eax
je 0x440f11
push eax
call fcn.00439d30
add esp, 4
mov esi, eax
jmp 0x440f75
push 0x20006
push str.BEBCB884_9C21_4117_B30B_CED03A72B50F
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0043d660
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x440f4b
push eax
call fcn.00439d30
add esp, 4
jmp 0x440f5e
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.00440f90
mov esi, eax
test edi, edi
je 0x440f6f
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x440f75
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x440f7c
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444090
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x44410a
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push str.GlobalAccess_ISABUS.HTP.Method
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4440f5
cmp eax, 5
jne 0x44410a
push str.GlobalAccess_ISABUS.HTP.Method
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp

Function at 0x4441b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5bdb88]
sub esp, 0x24
test eax, eax
jne 0x44426b
push esi
push 8
call fcn.0050971d
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x444260
push 1
lea eax, [ebp - 0x24]
mov dword [esi + 4], 0
push eax
mov dword [esi], vtable.ISABUSMutex.0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], 0xc
push str.GlobalAccess_ISABUS.HTP.Method
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44423e
cmp eax, 5
jne 0x444262
push str.GlobalAccess_ISABUS.HTP.Method
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 4], eax
mov eax, esi
mov dword [0x5bdb88], esi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [0x5bdb88], esi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44f1c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d45e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a4ca4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
lea esi, [edi + 8]
mov dword [edi], vtable.FanCtrlInfoProtobuf.0
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00404260
mov dword [esi], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00404260
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00404260
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45d570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5a4ca4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x45d611
cmp byte [esi + 0x3d], 0
je 0x45d611
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x45d5c7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x45d5d9
sub eax, 1
je 0x45d5dd
sub eax, 2
je 0x45d611
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x45d5fa
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0053233b
add esp, 0x10
cmp edi, eax
jne 0x45d5c7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050970c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0050970c
mov esp, ebp
pop ebp
ret