joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4102f3
Capabilities:
Check http status code
Read http header

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea eax, [esp + 0x10]
push edi
xor ebp, ebp
mov ebx, ecx
push ebp
push eax
push ebp
push ebp
push 0x16
push dword [ebx + 0x80]
mov edi, ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.0040f545
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
push ebp
push 0x16
push dword [ebx + 0x80]
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x410363
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:__Error_in_WinHttpQueryHeaders______d
call fcn.0041c596
pop ecx
pop ecx
push edi
call fcn.0040f7b4
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 4
push ecx
lea eax, [ebx + 8]
push eax
push 0
push 0x20000013
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x4103a0
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:_WinHttpQueryHeaders_failed_with_the_error_code_while_getting_http_status_code__d
call fcn.0041c596
pop ecx
pop ecx
push edi
call fcn.0040f7b4
push dword [ebx + 8]
push str.DCGetResponseStatusCode_:_Status_code_:__d
call fcn.0041c596
cmp dword [ebx + 8], 0xc8
pop ecx
pop ecx
jne 0x410459
xor ecx, ecx
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
push ecx
push 1
push dword [ebx + 0x80]
mov dword [esp + 0x2c], ecx
call esi
mov edx, dword [esp + 0x14]
lea ecx, [ebx + 0x5c]
call fcn.0040f545
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea eax, [esp + 0x14]
push 0
push eax
push dword [ebx + 0x5c]
push 0
push 1
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x410417
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:__Error_in_WinHttpQueryHeaders______d
call fcn.0041c596
pop ecx
pop ecx
push edi
call fcn.0040f7b4
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [ebx + 0x4c]
push eax
push 0
push 0x20000005
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x410454
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:_WinHttpQueryHeaders_failed_with_the_error_code_while_getting_http_status_code__d
call fcn.0041c596
pop ecx
pop ecx
push edi
call fcn.0040f7b4
and dword [esp + 0x14], 0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x410813
Capabilities:
Set http header

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
je 0x410846
push 0x20000000
push 0xffffffffffffffff
push dword [esp + 0x14]
push dword [ecx + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x410846
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.0040f7b4
mov eax, esi
pop esi
pop ecx
ret 4

Function at 0x4108e3
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [esp + 0xc], 0xc
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ebx
push esi
cmp dword [ebx + 0x24], 4
push edi
mov dword [esp + 0x1c], ebp
lea edi, [ebx + 0x40]
mov dword [esp + 0x20], ebp
jne 0x410950
push dword [ebx + 0x3c]
call fcn.0045ea48
mov esi, eax
mov dword [esp], str..tmp
call fcn.0045ea48
add eax, 2
pop ecx
add esi, eax
mov ecx, edi
mov edx, esi
call fcn.0040f545
push dword [ebx + 0x3c]
push esi
push dword [edi]
call fcn.00465700
add esp, 0xc
push str..tmp
push esi
push dword [edi]
call fcn.004666c7
add esp, 0xc
jmp 0x4109a4
push 0xff
push 1
call fcn.004639a4
pop ecx
pop ecx
push 0xfe
mov ebx, eax
push ebx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
call fcn.0045ea48
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [edi + 0x14]
mov esi, eax
mov edi, dword [esp + 0x14]
add edi, 0x40
mov ecx, edi
call fcn.0040f545
push esi
push ebx
push str._sdc_d.tmp
push dword [edi]
call fcn.0040f51f
add esp, 0x10
push ebp
push 0x80
push 2
lea eax, [esp + 0x24]
push eax
push 1
push 0x40000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x4109e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push str.InternetGetRequestEx_:_Error_occured_while_creating_the_file______d
call fcn.0041c596
pop ecx
pop ecx
mov ecx, ebp
call fcn.0040f535
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4109f3
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0x1c
mov byte [0x4c2fec], 0
push ebx
push ebp
push esi
push edi
push str.WinHttp::Getting_Proxy_Information
mov ebp, ecx
xor esi, esi
call fcn.0041c596
pop ecx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
xor ebx, ebx
inc ebx
test eax, eax
je 0x410a4b
cmp dword [esp + 0x18], esi
je 0x410a35
push str.GetIEProxyInfo::proxy_configuration_for_the_current_user_specifies__automatically_detect_settings_
mov esi, ebx
call fcn.0041c596
pop ecx
cmp dword [esp + 0x1c], 0
je 0x410a4d
push str.GetIEProxyInfo::proxy_configuration_for_the_current_user_specifies__Use_automatic_proxy_configuration__with_specified_Auto_Configuration_URL
mov esi, ebx
call fcn.0041c596
pop ecx
jmp 0x410a4d
mov esi, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x410b1b
cmp dword [0x4c2e0c], 0
je 0x410a70
mov dword [0x4c2e04], 2
jmp 0x410a80
mov dword [0x4c2e04], ebx
mov dword [0x4c2e08], 3
xor eax, eax
mov dword [0x4c2e18], ebx
push eax
push eax
push eax
push ebx
mov ecx, 0x4c3008
call fcn.00402642
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
lea ecx, [esp + 0x14]
mov dword [ebp + 0x7c], eax
call fcn.00402286
push dword [ebp + 0x28]
lea eax, [esp + 0x18]
push str.http:___s
push eax
call fcn.0040289a
add esp, 0xc
lea ecx, [esp + 0x14]
push 0x4c2e1c
push 0x4c2e04
call fcn.00402642
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0040223f
test esi, esi
je 0x410b1b
mov eax, dword [0x4c2e20]
test eax, eax
je 0x410b4f
push eax
mov ecx, 0x4c2ff0
mov byte [0x4c2fec], bl
call fcn.0040221b
push dword [0x4c2e24]
mov ecx, 0x4c2ffc
call fcn.0040221b
push str.GetIEProxyInfo::Auto_Proxy_information_detected
jmp 0x410b49
cmp dword [esp + 0x20], 0
je 0x410b5c
push dword [esp + 0x20]
mov ecx, 0x4c2ff0
mov byte [0x4c2fec], bl
call fcn.0040221b
push dword [esp + 0x24]
mov ecx, 0x4c2ffc
call fcn.0040221b
push str.GetIEProxyInfo::Explicit_Proxy_information_specified
call fcn.0041c596
pop ecx
cmp dword [esp + 0x20], 0
je 0x410b5c
push dword [esp + 0x20]
call edi
cmp dword [esp + 0x24], 0
je 0x410b69
push dword [esp + 0x24]
call edi
mov eax, dword [0x4c2e20]
test eax, eax
je 0x410b75
push eax
call edi
mov eax, dword [0x4c2e24]
test eax, eax
je 0x410b81
push eax
call edi
push dword [0x4c2ff0]
movzx eax, byte [0x4c2fec]
push eax
push str.GetIEProxyInfo::_ProxyNeeded_d___ProxyHostName_s
call fcn.0041c596
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x412af5
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp + 8]
push ebx
push esi
push edi
call fcn.00402642
mov ebx, 0x4c3140
push eax
mov ecx, ebx
call fcn.00405cf0
test eax, eax
jne 0x412b27
push str.Updated_location_is_same
call fcn.0041c596
pop ecx
jmp 0x412c3c
lea ecx, [ebp - 0xc]
call fcn.00402286
lea ecx, [ebp - 8]
call fcn.00402286
lea eax, [ebp - 0x14]
push eax
call fcn.0040b5ac
mov edi, 0x49a36c
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push edi
push eax
call fcn.0040289a
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.0040223f
mov esi, 0x4a2bc8
lea eax, [ebp - 8]
push esi
push dword [ebp + 8]
push edi
push eax
call fcn.0040289a
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0040590f
push eax
lea ecx, [ebp - 8]
call fcn.0040590f
push eax
call fcn.00466761
pop ecx
pop ecx
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.File_rename__d__d____s_:__s
call fcn.0041c596
add esp, 0x14
lea ecx, [ebp - 0x10]
call fcn.00402286
lea ecx, [ebp - 4]
call fcn.00402286
push esi
lea ecx, [ebp + 8]
call fcn.0040590f
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0040289a
add esp, 0x10
mov ecx, ebx
push esi
call fcn.0040590f
push eax
lea eax, [ebp - 4]
push edi
push eax
call fcn.0040289a
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 4]
add esp, 0xc
mov ecx, esp
push eax
call fcn.00402274
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.00402274
lea ecx, [ebp - 0x14]
call fcn.00416db5
push dword [ebp - 0x14]
push dword [ebp - 4]
push str.Connect_exe_copied_from__s_to_localapp_:__d
call fcn.0041c613
add esp, 0x14
lea ecx, [ebp - 4]
call fcn.0040223f
lea ecx, [ebp - 0x10]
call fcn.0040223f
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp - 0xc]
call fcn.0040223f
lea ecx, [ebp + 8]
call fcn.0040223f
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x416a85
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x416acf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AllocateAndInitializeSid_Status_:__d
call fcn.0041c596
pop ecx
pop ecx
xor eax, eax
jmp 0x416b06
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x416afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckTokenMembership_Status_:__d
call fcn.0041c596
pop ecx
pop ecx
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x416b09
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
push edi
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x114
push eax
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x497a60
mov ecx, edi
call fcn.00402244
cmp esi, 5
jne 0x416bc8
push str.XP_OS
call fcn.0041c613
and dword [ebp - 8], 0
pop ecx
lea ecx, [ebp - 4]
call fcn.00402286
lea ecx, [ebp - 0x24]
call fcn.0040ecc8
lea eax, [ebp - 4]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.0040289a
pop ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.00402274
lea ecx, [ebp - 0x24]
call fcn.0040321d
push str.CSDVersion
lea ecx, [ebp - 0xc]
call fcn.0040221b
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.0040ed3c
mov esi, eax
mov ecx, edi
push esi
call fcn.0040221b
push dword [edi]
push esi
push str._s:_s
call fcn.0041c596
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.004038bb
lea ecx, [ebp - 4]
call fcn.0040223f
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x416bce
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
push edi
push 0x497a60
mov esi, edx
mov edi, ecx
call fcn.00402244
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x13c]
mov dword [esi], ecx
sub eax, 0
je 0x416cc6
sub eax, 1
je 0x416c96
sub eax, 1
jne 0x416ce0
mov eax, dword [ebp - 0x138]
cmp ecx, 5
jne 0x416c5f
test eax, eax
jne 0x416c40
lea eax, [ebp - 0x12c]
push eax
push str.Windows_2000_With__s
jmp 0x416c51
cmp eax, 1
jne 0x416c88
lea eax, [ebp - 0x12c]
push eax
push str.Windows_XP__s
push edi
call fcn.0040289a
add esp, 0xc
jmp 0x416ce0
mov ecx, dword [ebp - 0x13c]
cmp ecx, 4
ja 0x416c88
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x138]
push ecx
push str.Windows_NT__d._d_with__s
push edi
call fcn.0040289a
add esp, 0x14
jmp 0x416ce0
push eax
push dword [ebp - 0x13c]
push str.Windows__d._d
jmp 0x416cd7
mov eax, dword [ebp - 0x138]
test eax, eax
jne 0x416ca7
push str.Windows_t95
jmp 0x416cbd
cmp eax, 0xa
jne 0x416cb3
push str.Windows_98
jmp 0x416cbd
cmp eax, 0x5a
jne 0x416ce0
push str.Windows_tMe
mov ecx, edi
call fcn.0040221b
jmp 0x416ce0
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
push 0x4ad81c
push edi
call fcn.0040289a
add esp, 0x10
mov edx, dword [ebp - 0x13c]
lea ecx, [ebp - 8]
call fcn.00416b09
push edi
lea eax, [ebp - 4]
push str.OSVersion:
push eax
call fcn.0041648f
add esp, 0xc
mov ecx, edi
push eax
call fcn.0040222d
lea ecx, [ebp - 4]
call fcn.0040223f
and dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
call fcn.00402286
lea ecx, [ebp - 0x28]
call fcn.0040ecc8
lea eax, [ebp - 4]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.0040289a
pop ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.00402274
lea ecx, [ebp - 0x28]
call fcn.0040321d
push 0x4ad96c
lea ecx, [ebp - 0x10]
call fcn.0040221b
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040ed3c
push dword [ebp - 8]
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
push eax
push str._s__d._d._d__s
push edi
call fcn.0040289a
add esp, 0x1c
mov ecx, edi
call fcn.0040590f
push eax
push 0x49b884
call fcn.0041c596
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004038bb
lea ecx, [ebp - 4]
call fcn.0040223f
lea ecx, [ebp - 8]
call fcn.0040223f
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x416db5
Capabilities:
Copy file

Disassembly:
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
push 0
call fcn.00402642
push eax
lea ecx, [esp + 0x18]
call fcn.00402642
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0xc]
mov dword [edi], eax
call fcn.0040223f
lea ecx, [esp + 0x10]
call fcn.0040223f
pop edi
mov eax, esi
pop esi
ret
Function at 0x416e48
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x20c]
push esi
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, esi
call fcn.00402286
lea eax, [ebp - 0x20c]
push eax
push 0x49b884
push esi
call fcn.0040289a
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x416e87
Capabilities:
Create directory
Get session user name
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov ax, word [0x497a60]
push ebx
push esi
push 0x18e
mov word [ebp - 0x1b4], ax
xor ebx, ebx
lea eax, [ebp - 0x1b2]
push ebx
push eax
call fcn.0045b550
add esp, 0xc
mov dword [ebp - 0x1c], 0xc8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.00416a85
push eax
lea eax, [ebp - 0x1b4]
push eax
push str.USER:_s___AdminProcess:_d
call fcn.0041c613
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00402286
lea ecx, [ebp - 0x10]
call fcn.00402286
lea ecx, [ebp - 0xc]
call fcn.00402286
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040221b
lea ecx, [ebp + 8]
call fcn.00406e94
test al, al
je 0x416f29
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 8]
call fcn.0040222d
jmp 0x416f65
push ebx
push 0x4a3cb4
lea ecx, [ebp - 0x10]
call fcn.0040580b
test eax, eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
js 0x416f4a
push 0x23
jmp 0x416f4c
push 0x1c
pop edx
call fcn.00416df6
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.0040222d
lea ecx, [ebp - 0x14]
call fcn.0040223f
push 0x4ad984
lea ecx, [ebp - 8]
call fcn.0040585f
lea eax, [ebp - 0x18]
push eax
call fcn.0040b41d
push eax
lea ecx, [ebp - 8]
call fcn.00402209
lea ecx, [ebp - 0x18]
call fcn.0040223f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040222d
lea ecx, [ebp - 0xc]
call fcn.00402642
mov esi, eax
push esi
call fcn.004667ba
pop ecx
test eax, eax
je 0x416fc6
call fcn.00462f9e
cmp dword [eax], 0x11
je 0x416fc6
push dword [ebp - 0xc]
push str.Unable_to_create_directory:___s
call fcn.0041c596
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x416fde
push str.Unable_to_set_working_directory
call fcn.0041c596
pop ecx
jmp 0x416fe0
mov bl, 1
lea ecx, [ebp - 0xc]
call fcn.0040223f
lea ecx, [ebp - 0x10]
call fcn.0040223f
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp + 8]
call fcn.0040223f
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x4170e0
Capabilities:
Check if file exists
Get file version info

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push edi
call fcn.00402286
lea ecx, [esp + 0x34]
call fcn.0040229a
test al, al
je 0x417176
call fcn.00416a7c
push eax
lea ecx, [esp + 0x14]
call fcn.0040221b
push str..exe
lea ecx, [esp + 0x14]
call fcn.004021f7
lea ecx, [esp + 0x18]
call fcn.00417006
lea eax, [esp + 0x10]
push eax
push 0x49a000
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00405731
add esp, 0xc
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00405774
add esp, 0xc
lea ecx, [esp + 0x10]
push eax
call fcn.0040222d
lea ecx, [esp + 0x14]
call fcn.0040223f
lea ecx, [esp + 0x20]
call fcn.0040223f
lea ecx, [esp + 0x18]
call fcn.0040223f
jmp 0x417184
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
call fcn.0040222d
lea ecx, [esp + 0x10]
call fcn.00402642
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4171a9
push 0x497a60
mov ecx, esi
call fcn.00402244
jmp 0x4172c0
push 4
lea ecx, [esp + 0x14]
call fcn.004022af
and dword [esp + 0x24], 0
mov ebx, eax
push 0x50
pop eax
push eax
mov dword [esp + 0x2c], eax
call fcn.00465f6e
pop ecx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
push ebp
call fcn.00465f6e
mov edi, eax
pop ecx
test edi, edi
jne 0x4171fb
push str.null_pointer_since_malloc_failed._returning
call fcn.0041c596
mov dword [esp], 0x497a60
jmp 0x41719d
push edi
push ebp
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x417222
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_version_info:__d
call fcn.0041c596
pop ecx
pop ecx
jmp 0x417198
mov ebx, 0x497a60
lea ecx, [esp + 0x18]
push ebx
call fcn.00402244
lea ecx, [esp + 0x14]
call fcn.00402286
lea ecx, [esp + 0x30]
call fcn.0040590f
push eax
lea eax, [esp + 0x18]
push str.StringFileInfo_sFileVersion
push eax
call fcn.0040289a
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.004022af
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41729b
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push 0x49b884
push eax
call fcn.0040289a
add esp, 0xc
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00402274
jmp 0x4172ae
push str.Unable_to_get_version._Name_may_not_exist_or_the_resource_is_in_valid
call fcn.0041c596
pop ecx
push ebx
mov ecx, esi
call fcn.00402244
lea ecx, [esp + 0x14]
call fcn.0040223f
lea ecx, [esp + 0x18]
call fcn.0040223f
lea ecx, [esp + 0x10]
call fcn.0040223f
lea ecx, [esp + 0x30]
call fcn.0040223f
lea ecx, [esp + 0x34]
call fcn.0040223f
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x417470
Capabilities:
Modify service

Disassembly:
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4174a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed___d_
call fcn.0041c596
pop ecx
pop ecx
jmp 0x417525
push 2
lea ecx, [esp + 0x14]
call fcn.00402642
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4174d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed___d_
call fcn.0041c596
pop ecx
pop ecx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x417525
push ebp
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x30]
call fcn.00402642
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x417504
xor edi, edi
mov ebp, str._ChangeServiceBinPath____Changeing_service_BinPath_success_with_errorcode_d
push 0xd
inc edi
pop eax
jmp 0x41750f
mov ebp, str._ChangeServiceBinPath____Changeing_service_BinPath_fail_with_errorcode_d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
call fcn.0041c596
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop ebp
lea ecx, [esp + 0x10]
call fcn.0040223f
lea ecx, [esp + 0x14]
call fcn.0040223f
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x41753d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1398
call fcn.004577a0
mov ax, word [0x497a60]
push ebx
push esi
push edi
push 2
pop esi
push 0x1386
mov word [ebp - 0x1398], ax
xor ebx, ebx
lea eax, [ebp - 0x1396]
mov dword [ebp - 0xc], esi
push ebx
push eax
mov edi, ecx
call fcn.0045b550
add esp, 0xc
mov dword [ebp - 4], 0x9c4
lea ecx, [ebp - 8]
call fcn.00402286
push dword [ebp + 8]
lea eax, [ebp - 8]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.0040289a
add esp, 0xc
lea eax, [ebp - 0x10]
lea ecx, [ebp - 8]
push eax
push 1
push ebx
call fcn.00402642
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4175be
push ebx
jmp 0x417619
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1398]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.ImagePath
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00430b64
mov ecx, dword [ebp - 4]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
push ebx
push esi
call fcn.0045b550
push dword [ebp - 4]
lea eax, [ebp - 0x1398]
push eax
push esi
call fcn.0045afd0
add esp, 0x1c
push esi
mov ecx, edi
call fcn.00402244
lea ecx, [ebp - 8]
call fcn.0040223f
lea ecx, [ebp + 8]
call fcn.0040223f
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417637
Capabilities:
Create directory

Disassembly:
sub esp, 0x4b8
push ebx
push ebp
mov ebx, ecx
lea eax, [esp + 0x10]
push edi
push ebx
push eax
mov dword [esp + 0x18], ebx
xor ebp, ebp
call fcn.004661d8
lea eax, [esp + 0x1c]
push eax
call fcn.0045ea48
and dword [esp + 0x18], ebp
mov edi, eax
add esp, 0xc
test edi, edi
jle 0x4176dc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
cmp edi, 0x12c
jge 0x4176d7
lea esi, [ebp*2]
movzx eax, word [esp + esi + 0x18]
cmp eax, 0x5c
je 0x41768f
cmp eax, 0x2f
jne 0x4176c1
xor eax, eax
push eax
mov word [esp + esi + 0x274], ax
lea eax, [esp + 0x274]
push eax
call ebx
test eax, eax
je 0x4176bc
lea eax, [esp + 0x270]
push eax
push str._nDirectory__s_Created
call fcn.0040e13e
pop ecx
pop ecx
movzx eax, word [esp + esi + 0x18]
mov word [esp + esi + 0x270], ax
inc ebp
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, edi
jl 0x417671
mov ebx, dword [esp + 0x14]
pop esi
push ebx
call fcn.004667ba
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x4b8
ret