joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011b3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af8
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af3
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x4495dc]
call sub.kernel32.dll_ResumeThread
mov dword [0x4495e8], 0x10007
push 0xa
call sub.kernel32.dll_Sleep
push 0x4495e8
push dword [0x4495dc]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x4496a0], eax
jne 0x401237
jmp 0x401239
jmp 0x401213
push dword [0x4495dc]
call sub.kernel32.dll_SuspendThread
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af8
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
leave
ret 4

Function at 0x40126e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af8
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_ReadProcessMemory
push 0
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448b08
push dword [0x448c48]
push dword [0x4495d8]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af3
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af3
push dword [0x448c48]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x4495dc]
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep
mov dword [0x4495e8], 0x10007
push 0x4495e8
push dword [0x4495dc]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x4496a0], eax
jne 0x401340
jmp 0x401351
mov eax, dword [0x448c48]
mov ebx, dword [0x4496a0]
cmp eax, ebx
je 0x4013b4
jmp 0x401323
push dword [0x4495dc]
call sub.kernel32.dll_SuspendThread
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af8
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448b08
push dword [0x448c48]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 0
leave
ret 4
push dword [0x4495dc]
call sub.kernel32.dll_SuspendThread
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448af8
push dword [ebp + 8]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x4498b4]
push 0
mov al, byte [0x448af7]
movzx ax, al
push ax
push 0x448b08
push dword [0x448c48]
push dword [0x4495d8]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 1
leave
ret 4
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44a220]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x44a220], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret
Function at 0x4038fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004038aa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.004038bf
lea eax, [ebp - 0x72c]
push eax
push dword [ebp + 8]
call fcn.004038bf
add esp, 0x14
push 0x70
pop ebx
lea esi, [ebp - 0x71c]
mov edi, ebx
lea eax, [esi - 0x10]
push esi
push eax
call fcn.004038bf
push esi
call fcn.00403872
add esp, 0xc
add esi, 0x10
dec edi
jne 0x403937
movsx edx, word [0x449e90]
xor esi, esi
shl edx, 2
mov edi, dword [ebp + 0x10]
movsx eax, si
mov ecx, eax
add eax, edx
mov eax, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and eax, dword [ebp + ecx - 0x1c]
inc esi
mov dword [ecx + edi], eax
cmp si, 4
jb 0x40395c
mov dword [ebp - 8], 0x44a058
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403872
and dword [ebp - 4], 0
pop ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx - 0x1c6]
movzx ecx, word [ecx]
movsx esi, cx
movsx edi, ax
shl esi, 2
shl edi, 2
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ebx, [esi + eax]
mov ebx, dword [ebp + ebx*4 - 0x72c]
mov ecx, eax
add eax, edi
xor ebx, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and ebx, dword [ebp + ecx - 0x1c]
add edx, ecx
xor dword [edx], ebx
inc dword [ebp - 4]
cmp word [ebp - 4], 4
jb 0x4039af
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x403988
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ea7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
xor ecx, ecx
push esi
inc ecx
push edi
mov eax, ecx
xor edi, edi
mov esi, 0xe3
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ebf
cmp ax, cx
jne 0x403f01
mov eax, 0xe2
xor edi, edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ee5
jmp 0x403f22
push 0x71
pop edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
movzx eax, dx
mov edx, 0xe2
cmp di, dx
jl 0x403f04
mov eax, ecx
mov word [0x449e90], ax
or eax, 0xffffffff
mov word [0x44a056], ax
mov edi, ecx
mov dword [ebp - 8], 0x70
lea eax, [ecx + ecx]
cdq
mov ecx, esi
idiv ecx
movzx eax, dx
movsx ecx, ax
lea eax, [ecx + ecx]
mov edx, eax
neg edx
mov bx, word [ebp + edx - 0x10]
mov dx, word [ebp + edx - 0x14]
mov word [ebp - 0xe], dx
mov dx, word [ebp + eax - 0x1da]
mov ax, word [ebp + eax - 0x1d6]
mov word [ebp - 0xc], dx
xor edx, edx
mov word [ebp - 0x10], bx
mov word [ebp - 0xa], ax
mov dword [ebp - 4], edx
movsx eax, word [ebp - 4]
movzx eax, word [ebp + eax*2 - 0x10]
cmp ax, 0x71
jge 0x403fa3
movsx ebx, dx
imul ebx, ebx, 0xe3
add ebx, edi
mov word [ebx*2 + 0x449e90], ax
inc edx
inc dword [ebp - 4]
cmp dx, 2
jl 0x403f80
inc edi
dec dword [ebp - 8]
jne 0x403f3c
push 0x70
pop ebx
xor eax, eax
push 0x10
mov word [0x449e70], ax
pop eax
mov edx, eax
mov edi, 0xffff0000
mov esi, edi
and esi, ebx
je 0x403fd6
add word [0x449e70], dx
mov ebx, esi
cdq
sub eax, edx
sar eax, 1
movzx edx, ax
movsx eax, dx
mov esi, edi
mov ecx, eax
shr esi, cl
xor edi, esi
test dx, dx
jne 0x403fc7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403ff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.0040383c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038fa
mov esi, dword [ebp + 0xc]
add esp, 0x18
push dword [ebp + 0x10]
xor edi, edi
cmp word [esi], di
je 0x404042
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004038fa
add esp, 0xc
jmp 0x404048
call fcn.004038aa
pop ecx
mov edx, dword [ebp + 0x10]
movsx eax, di
mov ecx, eax
mov eax, dword [esi + eax*4 + 0x14]
shl ecx, 2
xor eax, dword [ebp + ecx - 0x20]
add edx, ecx
xor dword [edx], eax
inc edi
cmp di, 4
jb 0x404048
pop edi
pop esi
leave
ret
Function at 0x414de9
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], edi
inc ecx
add esi, 4
and ecx, ebx
push 0xdd57a6ea
pop eax
inc eax
cmp esi, edx
jne fcn.00414de9
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401ff1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00447ae0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop esi
test eax, eax
jne 0x402057
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsVista:GetVersionEx_error__last_d
call fcn.0043f416
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441f6f
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x110], 2
jne 0x402047
cmp dword [ebp - 0x11c], 6
jb 0x402047
xor eax, eax
inc eax
jmp 0x402049
Function at 0x402419
Capabilities:
Check if file exists
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x491330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
mov ebx, ecx
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x402613
test byte [ebp - 0x48], 0x10
je 0x402613
test dword [ebp - 0x48], 0x10000
jne 0x402613
push ebx
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
test eax, eax
js 0x402613
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathBuildRootW]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x402613
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402613
lea eax, [ebp - 0x178]
mov dword [ebp - 0x178], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x168], 2
je 0x4024c1
xor eax, eax
inc eax
jmp 0x402615
xor ecx, ecx
lea eax, [ebp - 0x17c]
push eax
push ecx
push ecx
push 7
push ebx
mov dword [ebp - 0x17c], ecx
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402613
mov edi, dword [ebp - 0x17c]
push edi
call fcn.00442985
mov esi, eax
pop ecx
test esi, esi
je 0x402613
test edi, edi
je 0x402512
mov byte [eax], 0
inc eax
dec edi
jne 0x402505
mov edi, dword [ebp - 0x17c]
lea eax, [ebp - 0x17c]
push eax
push edi
push esi
push 7
push ebx
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
je 0x40260c
xor ebx, ebx
push 2
mov dword [ebp - 0x184], ebx
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x402606
lea eax, [ebp - 0x184]
push eax
push ebx
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x402606
push 0x10
mov dword [ebp - 0x188], 6
lea eax, [ebp - 0x24]
pop ecx
mov byte [eax], bl
inc eax
dec ecx
jne 0x402573
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x120116
push eax
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
lea eax, [ebp - 0x180]
mov dword [ebp - 0x180], 1
push eax
lea eax, [ebp - 0x190]
mov dword [ebp - 0x18c], 0x14
push eax
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x190], ebx
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x188]
push dword [ebp - 0x184]
push esi
call dword [sym.imp.ADVAPI32.dll_AccessCheck]
neg eax
sbb eax, eax
and dword [ebp - 0x180], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call fcn.0044294d
pop ecx
push dword [ebp - 0x184]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x180]
jmp 0x402615
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call fcn.0044294d
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441f6f
mov esp, ebp
pop ebp
ret
Function at 0x402fd3
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x348
mov eax, 0x464994
call fcn.0044584f
mov esi, ecx
mov dword [ebp - 0x354], esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x402ff7
mov eax, dword [edi]
jmp 0x402ff9
mov eax, edi
push eax
push str.CFileListCreator::_FindFiles
lea ecx, [ebp - 0x100]
call fcn.004075be
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0x47bc74
push edi
push eax
call fcn.00404d93
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x350]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40304a
push eax
jmp 0x403161
cmp word [ebp - 0x324], 0x2e
je 0x40314a
test byte [ebp - 0x350], 0x10
push 0x47b858
push edi
je 0x4030b4
lea eax, [ebp - 0xa4]
push eax
call fcn.00404d93
add esp, 0xc
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402989
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 4
call fcn.00401833
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00402fd3
lea ecx, [ebp - 0x40]
jmp 0x40313d
lea eax, [ebp - 0xbc]
push eax
call fcn.00404d93
add esp, 0xc
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00402989
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 7
call fcn.00401833
mov esi, dword [ebp - 0x330]
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00404375
push 0x47bb10
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 8
call fcn.00401720
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp - 0x354]
lea eax, [ebp - 0x8c]
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.004045fe
lea ecx, [ebp - 0x8c]
call fcn.0040318a
lea ecx, [ebp - 0x58]
push 0
push 1
mov byte [ebp - 4], 1
call fcn.00401833
lea eax, [ebp - 0x350]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40304a
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401833
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.004076a4
call fcn.004457fe
ret 4
Function at 0x4031a6
Capabilities:
Read .ini file

Disassembly:
push 0x860
mov eax, 0x4649d2
call fcn.0044584f
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x44], ebx
jne 0x4031c8
xor eax, eax
jmp 0x40332f
push ebx
push str.CFileListCreator::_GetProfileSectionNames
lea ecx, [ebp - 0x868]
call fcn.004075be
mov dword [ebp - 4], ebx
mov ecx, edi
push dword [edi + 4]
push dword [edi]
call fcn.004049b7
mov eax, dword [edi]
mov dword [edi + 4], eax
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
call fcn.00447ae0
lea eax, [esi + 0x34]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x403216
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov dword [ebp - 0x86c], eax
test eax, eax
je 0x40331e
xor eax, eax
mov dword [ebp - 0x814], 7
lea esi, [ebp - 0x810]
mov dword [ebp - 0x818], ebx
mov word [ebp - 0x828], ax
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov ebx, dword [ebp - 0x86c]
push esi
call fcn.004012f1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x828]
call fcn.00401a41
mov ecx, dword [ebp - 0x818]
test ecx, ecx
je 0x4032dc
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push fcn.00442ef1
cmovae eax, dword [ebp - 0x828]
lea edx, [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
push edx
lea eax, [eax + ecx*2]
push eax
lea ecx, [ebp - 0x828]
cmovae ecx, dword [ebp - 0x828]
lea eax, [ebp - 0x86c]
push ecx
push eax
call fcn.00404d64
add esp, 0x14
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.0040478a
mov ecx, dword [ebp - 0x818]
lea esi, [esi + ecx*2]
add esi, 2
je 0x4032f5
lea eax, [ebp - 0x810]
lea eax, [eax + ebx*2]
cmp esi, eax
jb 0x403262
mov eax, dword [edi + 4]
sub eax, dword [edi]
push 0x18
pop ecx
cdq
idiv ecx
push eax
push str.quickLaunch__fileList___GetProfileSectionNames__vtSection_size___d
call fcn.0042ade0
pop ecx
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x828]
push 0
inc ebx
push ebx
call fcn.00401833
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x868]
call fcn.004076a4
mov eax, ebx
call fcn.004457fe
ret 4
Function at 0x403eaa
Capabilities:
Get common file path

Disassembly:
push 0x268
mov eax, 0x464ae8
call fcn.0044584f
mov ebx, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x403ec8
mov eax, dword [esi]
jmp 0x403eca
mov eax, esi
push eax
push str.CFileListCreator::_ParseTargetPath
lea ecx, [ebp - 0x270]
call fcn.004075be
and dword [ebp - 4], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00447ae0
add esp, 0xc
mov edi, str._uninstall_
push edi
call fcn.004012f1
pop ecx
push eax
push edi
push dword [esi + 0x10]
mov ecx, esi
push 0
call fcn.00402823
xor edi, edi
inc edi
test eax, eax
jne 0x403f3a
lea eax, [ebx + 0x4c]
cmp esi, eax
je 0x4040b4
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00401bb1
jmp 0x4040b4
mov ebx, str._system_
push ebx
call fcn.004012f1
pop ecx
push eax
push ebx
push dword [esi + 0x10]
mov ecx, esi
push 0
call fcn.00402823
test eax, eax
jne 0x403f6c
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x403fe4
mov ebx, str._windows_
push ebx
call fcn.004012f1
pop ecx
push eax
push ebx
push dword [esi + 0x10]
mov ecx, esi
push 0
call fcn.00402823
test eax, eax
jne 0x403f9e
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x403fe4
mov ebx, str._pdriver_
push ebx
call fcn.004012f1
pop ecx
push eax
push ebx
push dword [esi + 0x10]
xor ebx, ebx
mov ecx, esi
push ebx
call fcn.00402823
test eax, eax
jne 0x404005
call fcn.004041f1
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], ebx
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push ebx
push ebx
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
lea eax, [ebp - 0x218]
push eax
call fcn.004012f1
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401a41
jmp 0x4040b4
mov ebx, str._kdriver_
push ebx
call fcn.004012f1
pop ecx
push eax
push ebx
push dword [esi + 0x10]
mov ecx, esi
push 0
call fcn.00402823
test eax, eax
jne 0x4040b2
mov ebx, 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
call fcn.004012f1
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401a41
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00442c3a
pop ecx
pop ecx
cmp word [ebp + eax*2 - 0x21a], 0x5c
je 0x40409b
push 0x47b858
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00404d93
add esp, 0xc
mov ecx, esi
push eax
call fcn.0040439d
push 0
push edi
lea ecx, [ebp - 0x230]
call fcn.00401833
mov ebx, str.drivers
push ebx
call fcn.004012f1
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00402a5c
jmp 0x4040b4
xor edi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.004076a4
mov eax, edi
call fcn.004457fe
ret 4
Function at 0x4041f1
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push 0x6c
mov eax, 0x464b18
call fcn.0044584f
xor edi, edi
lea ecx, [ebp - 0x70]
push edi
push str.CFileListCreator::CheckSpoolerService
call fcn.004075be
push 0xf003f
push str.ServicesActive
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x40431a
push 0xf01ff
push str.Spooler
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40424b
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40431a
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40430e
cmp dword [ebp - 0x28], 4
jne 0x404278
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
xor edi, edi
inc edi
jmp 0x40431a
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40430e
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40430e
jmp 0x4042d9
mov eax, dword [ebp - 0x14]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x4042b1
mov eax, ecx
jmp 0x4042bb
mov ecx, 0x2710
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x404302
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x18], eax
jbe 0x4042ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x78], eax
jmp 0x4042f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x14]
ja 0x404302
mov ecx, dword [ebp - 0x28]
cmp ecx, 2
je 0x40429a
jmp 0x404305
mov ecx, dword [ebp - 0x28]
xor eax, eax
inc eax
cmp ecx, 4
cmove edi, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.004076a4
mov eax, edi
call fcn.004457fe
ret