joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40685b
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x406901
cmp dword [ebx + 4], 0xffffffff
jne 0x406901
lea esi, [ebx + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x406888
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp ax, 0x5c
je 0x4068bf
cmp ax, 0x2f
je 0x4068bf
dec esi
dec esi
mov ax, word [esi + 2]
inc esi
inc esi
test ax, ax
jne 0x4068ac
mov edi, esi
mov esi, 0x426bd4
movsd dword es:[edi], dword [esi]
push 0x18
call fcn.00411867
and dword [eax + 0x14], 0
and dword [eax + 7], 0
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x14]
push eax
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0xb], 0
mov dword [eax + 0x10], ecx
call fcn.00405dd5
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x406906
mov eax, 0x1000000
pop edi
pop esi
pop ecx
ret 8

Function at 0x4105a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b094]
jne 0x4105b2
repz ret
jmp fcn.00413177

Function at 0x41bfae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004155a7
and dword [ebp - 4], 0
cmp dword [0x42db40], 0
mov ebx, eax
jne 0x41c05f
push 0x4257a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c110
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x425794
push edi
call esi
test eax, eax
je 0x41c110
push eax
call fcn.00415535
mov dword [esp], 0x425784
push edi
mov dword [0x42db40], eax
call esi
push eax
call fcn.00415535
mov dword [esp], 0x425770
push edi
mov dword [0x42db44], eax
call esi
push eax
call fcn.00415535
mov dword [esp], 0x425754
push edi
mov dword [0x42db48], eax
call esi
push eax
call fcn.00415535
pop ecx
mov dword [0x42db50], eax
test eax, eax
je 0x41c05f
push 0x42573c
push edi
call esi
push eax
call fcn.00415535
pop ecx
mov dword [0x42db4c], eax
mov eax, dword [0x42db4c]
cmp eax, ebx
je 0x41c0b7
cmp dword [0x42db50], ebx
je 0x41c0b7
push eax
call fcn.004155b0
push dword [0x42db50]
mov esi, eax
call fcn.004155b0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c0b7
test edi, edi
je 0x41c0b7
call esi
test eax, eax
je 0x41c0ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c0ae
test byte [ebp - 0xc], 1
jne 0x41c0b7
or dword [ebp + 0x10], 0x200000
jmp 0x41c0f0
mov eax, dword [0x42db44]
cmp eax, ebx
je 0x41c0f0
push eax
call fcn.004155b0
pop ecx
test eax, eax
je 0x41c0f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c0f0
mov eax, dword [0x42db48]
cmp eax, ebx
je 0x41c0f0
push eax
call fcn.004155b0
pop ecx
test eax, eax
je 0x41c0f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42db40]
call fcn.004155b0
pop ecx
test eax, eax
je 0x41c110
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c112
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4023c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x4327a8], 3
mov dword [0x4327b0], esi
mov dword [0x4327bc], 0x3e8
mov dword [0x4327ac], esi
mov eax, dword [0x431a60]
lea ecx, [eax + 1]
mov dword [0x431a60], ecx
mov dword [0x4327b8], eax
push 0x4327a4
push dword [0x4327c0]
call edi
push 0x64
push dword [0x4327c4]
call ebx
cmp eax, 0x102
je 0x4023d4
push dword [0x4327c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [0x4327c4], esi
mov dword [0x4327a8], 1
mov dword [0x4327b0], esi
mov dword [0x4327bc], esi
mov dword [0x4327ac], 5
mov dword [0x4327b8], esi
push 0x4327a4
push dword [0x4327c0]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push esi
push esi
push esi
push 0x402310
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40248b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4024d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10014
call fcn.0041d740
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x431014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [edx], ebx
sub esp, 0x1c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
movaps xmm0, xmmword [0x429a30]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1001c], eax
cmp eax, 0xffffffff
je 0x402642
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
movaps xmm0, xmmword [0x429a30]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp eax, 0xffffffff
je 0x402633
xor ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push dword [ebp - 0x1001c]
call edi
mov ecx, edi
mov edi, eax
push ebx
mov dword [ebp - 0x10018], esi
push esi
call ecx
cmp edi, 0xffffffff
je 0x402628
cmp eax, 0xffffffff
mov esi, dword [ebp - 0x10018]
je 0x402633
cmp edi, eax
jne 0x402630
mov dword [ebp - 0x10020], edi
cmp edi, 0x8000
jae 0x402671
mov edi, dword [ebp - 0x10020]
and edi, 0x7fff
je 0x40261c
lea ecx, [ebp - 0x10014]
lea esi, [ebp - 0x8010]
push 0
push ecx
push edi
push esi
push dword [ebp - 0x1001c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
test eax, eax
je 0x402628
cmp dword [ebp - 0x10014], edi
jne 0x402628
lea edx, [ebp - 0x10010]
push 0
lea ecx, [ebp - 0x10014]
push ecx
push edi
push edx
push dword [ebp - 0x10018]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402628
cmp dword [ebp - 0x10014], edi
jne 0x402628
push edi
lea eax, [ebp - 0x10010]
push eax
push esi
call fcn.0040b85e
add esp, 0xc
test eax, eax
jne 0x402625
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x10018]
jmp 0x402633
xor ebx, ebx
inc ebx
mov eax, esi
inc eax
cmp eax, 2
jb 0x402642
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1001c]
inc eax
cmp eax, 2
jb 0x40265a
push dword [ebp - 0x1001c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, ebx
add esp, 0x10014
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x10020]
shr edi, 0xf
lea ebx, [ebp - 0x8010]
push 0
lea eax, [ebp - 0x10014]
push eax
push 0x8000
mov esi, ebx
push ebx
push dword [ebp - 0x1001c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
test eax, eax
je 0x402628
cmp dword [ebp - 0x10014], 0x8000
jne 0x402628
push 0
lea eax, [ebp - 0x10014]
push eax
push 0x8000
lea eax, [ebp - 0x10010]
push eax
push dword [ebp - 0x10018]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402628
cmp dword [ebp - 0x10014], 0x8000
jne 0x402628
push 0x8000
lea eax, [ebp - 0x10010]
push eax
mov ebx, esi
push esi
call fcn.0040b85e
add esp, 0xc
test eax, eax
jne 0x402625
dec edi
jne 0x402680
jmp 0x4025a5
Function at 0x404260
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov ebx, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
push eax
call fcn.0040a20b
add esp, 4
mov esi, eax
push eax
push edi
xor eax, eax
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4042e2
lea eax, [ebp - 0x14]
mov dword [eax], esi
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0x42c542
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40430d
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov ecx, dword [ebp + 8]
movzx edx, word [eax + 8]
mov dword [ecx], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [eax + 0xe]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + 0xc]
mov dword [ecx], eax
xor edi, edi
inc edi
jmp 0x404345
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x404362
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_obtain_file_info_of_old_service.____lu_
jmp 0x404336
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4043a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_query_file_version_info_of_old_service.____lu_
push 0x4327cc
call fcn.004086e0
add esp, 0xc
xor edi, edi
push esi
call fcn.0040a497
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4329d8
call fcn.0040a577
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x4042ff
mov dword [0x4327cc], 0
push 0x4024a0
call fcn.0040a73c
add esp, 4
push 0x4329d8
call fcn.0040a5c9
add esp, 4
jmp 0x4042ff
push 0x4329d8
call fcn.0040a577
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x40432a
mov dword [0x4327cc], 0
push 0x4024a0
call fcn.0040a73c
add esp, 4
push 0x4329d8
call fcn.0040a5c9
add esp, 4
jmp 0x40432a
Function at 0x4043f0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x4044a6
mov esi, eax
push 0xf01ff
push str.MozillaMaintenance
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x4044e0
mov edi, eax
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40447d
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x14]
call ebx
cmp dword [ebp - 0x28], 1
je 0x40447d
mov eax, dword [ebp - 0x14]
add esi, eax
add esi, 0xa
cmp esi, 0xea60
ja 0x40447d
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x404453
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test eax, eax
jne 0x40449a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x430
sete bl
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x30]
jmp 0x404518
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x404533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service_manager.____lu_
push 0x4327cc
call fcn.004086e0
add esp, 0xc
xor ebx, ebx
jmp 0x40451f
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x404576
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service.____lu_
push 0x4327cc
call fcn.004086e0
add esp, 0xc
xor ebx, ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4329d8
call fcn.0040a577
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x4044c3
mov dword [0x4327cc], 0
push 0x4024a0
call fcn.0040a73c
add esp, 4
push 0x4329d8
call fcn.0040a5c9
add esp, 4
jmp 0x4044c3
push 0x4329d8
call fcn.0040a577
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x4044fd
mov dword [0x4327cc], 0
push 0x4024a0
call fcn.0040a73c
add esp, 4
push 0x4329d8
call fcn.0040a5c9
add esp, 4
jmp 0x4044fd
Function at 0x405760
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x210
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp word [ecx], 0
je 0x405850
mov esi, ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4057d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4057d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4057d6
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x405864
push esi
push str.Could_not_delete_service_updater_path:__ls.
push 0x4327cc
call fcn.004086e0
add esp, 0xc
lea edi, [ebp - 0x216]
push 0x20a
push 0
push edi
call fcn.0040c770
add esp, 0xc
push str.updater.ini
push esi
push edi
call fcn.00408d00
add esp, 0xc
test eax, eax
je 0x405850
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405850
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x405850
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405850
mov eax, dword [0x4329d8]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4058a7
push edi
push str.Could_not_delete_service_updater_INI_path:__ls.
push 0x4327cc
call fcn.004086e0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040af35
add esp, 0x210
pop esi
pop edi
pop ebp
ret
push 0x4329d8
call fcn.0040a577
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x4057c3
mov dword [0x4327cc], 0
push 0x4024a0
call fcn.0040a73c
add esp, 4
push 0x4329d8
call fcn.0040a5c9
add esp, 4
jmp 0x4057c3
push 0x4329d8
call fcn.0040a577
add esp, 4
cmp dword [0x4329d8], 0xffffffff
jne 0x40583d
mov dword [0x4327cc], 0
push 0x4024a0
call fcn.0040a73c
add esp, 4
push 0x4329d8
call fcn.0040a5c9
add esp, 4
jmp 0x40583d
Function at 0x4086e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [esi], 0
je 0x408749
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
inc eax
push dword [esi]
push eax
push 0xd
push str._Warning:
call fcn.004135bb
add esp, 0x10
mov ebx, dword [ebp - 0x14]
mov edi, dword [esi]
call fcn.00401060
push ebx
push 0
push dword [ebp + 0xc]
push edi
push dword [eax + 4]
push dword [eax]
call fcn.0040d007
add esp, 0x18
push dword [esi]
xor eax, eax
inc eax
push eax
push 4
push str._n
call fcn.004135bb
add esp, 0x10
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408d50
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x8000
push section..rdata
call sub.SHELL32.dll_SHGetKnownFolderPath
xor esi, esi
test eax, eax
js 0x408d9a
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0040a34b
add esp, 4
cmp eax, 0x105
jb 0x408dae
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x105
push ebx
push edi
call fcn.0040a49c
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.Mozilla_Maintenance_Service
push edi
call fcn.00424f20
add esp, 8
test eax, eax
je 0x408d9a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408df2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408d9a
push str.UpdateLogs
push edi
call fcn.00424f20
add esp, 8
test eax, eax
je 0x408d9a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408e22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408d9a
xor esi, esi
inc esi
jmp 0x408d9a
Function at 0x409440
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push 5
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
je 0x409507
mov ebx, eax
push 4
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40952d
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0xcf
imul esi, eax, 0x3e8
test esi, esi
je 0x409555
mov dword [ebp - 0x3c], ebx
xor ebx, ebx
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4094be
cmp dword [ebp - 0x30], 1
jne 0x4094ea
jmp 0x409591
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jle 0x409578
lea ecx, [eax - 0x41c]
cmp ecx, 0xa
ja 0x4095c2
mov edx, 0x601
bt edx, ecx
jae 0x4095c2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x32
cmp ebx, esi
jb 0x40949c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
jmp 0x4095fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov esi, 0xfd
cmovne esi, ecx
jmp 0x40960a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x409561
cmp edi, 5
je 0x409599
cmp edi, 6
jne 0x4095a7
mov esi, 0xec
jmp 0x40960a
mov dword [ebp - 0x40], 0xcf
jmp 0x4095fb
cmp edi, 0x7b
je 0x4095a0
cmp edi, 0x424
jne 0x4095a7
mov esi, 0xee
jmp 0x40960a
cmp eax, 0x56
jg 0x4095ae
cmp eax, 5
mov ebx, dword [ebp - 0x3c]
je 0x4095d8
cmp eax, 6
jne 0x4095e6
mov eax, 0xd9
jmp 0x4095f5
mov ebx, dword [ebp - 0x3c]
xor eax, eax
inc eax
jmp 0x4095f8
mov esi, 0xeb
jmp 0x40960a
mov esi, 0xed
jmp 0x40960a
mov esi, 0xef
jmp 0x40960a
cmp eax, 0x57
mov ebx, dword [ebp - 0x3c]
je 0x4095df
cmp eax, 0x7a
jne 0x4095e6
mov eax, 0xdb
jmp 0x4095f5
cmp eax, 0x7c
je 0x4095ed
cmp eax, 0x45b
mov ebx, dword [ebp - 0x3c]
jne 0x4095e6
mov eax, 0xde
jmp 0x4095f5
mov eax, 0xda
jmp 0x4095f5
mov eax, 0xdc
jmp 0x4095f5
mov eax, 0xdf
jmp 0x4095f5
mov eax, 0xdd
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], eax
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x41c
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x424]
push 0x20a
push 0
push edi
call fcn.0040c770
add esp, 0xc
mov ecx, edi
call fcn.00408d50
xor esi, esi
test eax, eax
je 0x409684
lea ebx, [ebp - 0x21a]
push 0x20a
push 0
push ebx
call fcn.0040c770
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, str..status
push ebx
call fcn.00408e30
add esp, 4
test eax, eax
jne 0x40969b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, esi
add esp, 0x41c
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
push edi
call fcn.00424f20
add esp, 8
test eax, eax
je 0x409684
sub esp, 0x1c
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x429ab0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x409684
mov edi, eax
mov eax, dword [ebp + 0xc]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00424ed0
add esp, 0xc
push ebx
call fcn.00413db0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x428]
push 0
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne al
lea ecx, [ebp - 0x428]
cmp dword [ecx], esi
sete cl
and cl, al
movzx esi, cl
jmp 0x409684

Function at 0x409730
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x102
cmp dword [ebp + 0xc], 0
je 0x4097f7
mov ebx, dword [ebp + 8]
xor esi, esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x4097b1
mov edi, eax
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4097bb
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.00411e7d
add esp, 8
test eax, eax
je 0x4097c5
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x409785
mov ebx, 0x490
jmp 0x4097c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4097ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4097c7
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x490
je 0x4097f5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
jne 0x40975a
mov esi, 0x102
jmp 0x4097f7
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, esi
add esp, 0x230
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409860
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x210
mov ebx, dword [ebp + 8]
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call fcn.0040c770
add esp, 0xc
push ebx
call fcn.0040a34b
add esp, 4
xor esi, esi
cmp eax, 0x104
ja 0x4098ce
mov esi, dword [ebp + 0xc]
push 0x104
push ebx
push edi
call fcn.0040a49c
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [esi], ecx
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af35
mov eax, esi
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x419836
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419a7f

Function at 0x41d3df
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041d3ea
Function at 0x4068b0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4068ef
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4068ef
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4068ef
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4068ef
cmp dword [ecx + 0x74], 0xe
jbe 0x4068ef
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret