joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d770
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490cc6
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.0043ab70
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 8], 0
jne 0x40d7b8
cmp dword [edi + 4], 0
je 0x40d91b
lea ebx, [edi + 0x14]
push ebx
mov dword [ebp - 0x2020], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x201c], 1
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x10]
cmp dword [eax - 0xc], 0
jle 0x40d80e
test esi, esi
je 0x40d914
cmp dword [eax - 0xc], 0
jl 0x40d914
push esi
push eax
call fcn.0046c864
add esp, 8
test eax, eax
je 0x40d914
sub eax, dword [edi + 0x10]
sar eax, 1
js 0x40d914
push 0x2000
lea eax, [ebp - 0x2014]
push 0
push eax
call fcn.0046ce30
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x2014]
push 0xfff
push eax
call fcn.00415150
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00472f23
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x40d864
cmp eax, 0xfff
ja 0x40d864
jne 0x40d86a
xor eax, eax
mov word [ebp - 0x16], ax
call fcn.00403f70
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40d886
push 0x80004005
call fcn.00404990
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2014]
mov byte [ebp - 4], 1
push eax
push esi
lea eax, [ebp - 0x2018]
push str.__s___s_r_n
push eax
call fcn.00411c10
mov esi, dword [ebp - 0x2018]
add esp, 0x10
cmp dword [edi + 8], 0
je 0x40d8c9
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [edi + 4], 0
je 0x40d8f8
mov ecx, dword [edi + 0xc]
cmp ecx, 0xffffffff
je 0x40d8f8
push 0
mov dword [ebp - 0x2018], 0
lea edx, [ebp - 0x2018]
mov eax, dword [esi - 0xc]
push edx
add eax, eax
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d914
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
Function at 0x40dd40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490df8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [edi + 0x14]
xorps xmm0, xmm0
mov dword [edi], vtable.CUpdateMgr.1.0
mov dword [edi + 4], vtable.CUpdateMgr.0
mov eax, dword [edx + 0x24]
movups xmmword [edx + 0x24], xmm0
movq qword [edx + 0x34], xmm0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x24], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x24]
movups xmmword [ecx + 0x24], xmm0
movq qword [ecx + 0x34], xmm0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x24], eax
lea ecx, [edi + 0x24]
call fcn.00408d80
push 0
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [edi + 0x8c]
or esi, 0xffffffff
sub edx, 0x10
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40dddc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi + 0x88]
sub edx, 0x10
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40ddf7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x40de3a
push dword [ebp - 0x10]
mov edx, dword [edi + 0x7c]
push ecx
call fcn.00413360
mov ecx, dword [edi + 0x78]
add esp, 8
mov eax, dword [edi + 0x80]
sub eax, ecx
sar eax, 3
push eax
push ecx
call fcn.004116b0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x70]
lea ecx, [edi + 0x70]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.00411340
push dword [edi + 0x70]
call fcn.0043991c
add esp, 4
lea eax, [edi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x1c]
call fcn.00411d90
mov eax, dword [edi + 0x18]
test eax, eax
je 0x40de7e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x18], 0
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x14]
mov dword [edi + 0x10], vtable.CECHttpDownloadEventPtr_class_CUpdateMgr_.0
test eax, eax
je 0x40deb6
mov dword [eax + 0x24], 0
xorps xmm0, xmm0
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx + 0x24]
movups xmmword [ecx + 0x24], xmm0
movq qword [ecx + 0x34], xmm0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x24], eax
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x40dec7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov eax, dword [edi + 0xc]
mov dword [edi + 8], vtable.CECHttpDownloadEventPtr_class_CUpdateMgr_.0
test eax, eax
je 0x40deff
mov dword [eax + 0x24], 0
xorps xmm0, xmm0
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x24]
movups xmmword [ecx + 0x24], xmm0
movq qword [ecx + 0x34], xmm0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x24], eax
mov byte [ebp - 4], 3
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x40df10
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi], vtable.CSingletonBase_class_CUpdateMgr_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fd50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4913a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x40ff06
mov eax, dword [edi + 8]
xor ecx, ecx
sub eax, dword [edi + 4]
sar eax, 4
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x40fec2
xor esi, esi
or ebx, 0xffffffff
mov dword [ebp - 0x18], esi
mov eax, dword [edi + 4]
cmp dword [esi + eax + 0xc], 0
jne 0x40fdb5
cmp dword [ebp + 0x10], 0
je 0x40fea7
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
add eax, 4
add eax, esi
push eax
call fcn.0042b340
add esp, 4
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fee7
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
je 0x40fee7
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi + 8]
sub ecx, 0x10
call fcn.004094f0
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00430a80
mov byte [ebp - 4], 2
mov ecx, dword [eax]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x40ff1c
push ecx
push esi
call fcn.00470614
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c]
test eax, eax
mov eax, ebx
setne byte [ebp + 0xb]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fe5f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
cmp byte [ebp + 0xb], 0
jne 0x40fedb
test eax, eax
jg 0x40fe80
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fea1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov eax, dword [edi + 8]
inc ecx
sub eax, dword [edi + 4]
add esi, 0x10
sar eax, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], esi
cmp ecx, eax
jb 0x40fda1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jg 0x40fee7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40ff06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00404990
int3
Function at 0x412ee0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [0x4b81bc]
xor eax, esp
mov dword [esp + 0x838], eax
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x412fbf
push 0x2c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0046ce30
push 0x800
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 0x30
push 0
push eax
mov dword [esp + 0x34], 0x400000
call fcn.0046ce30
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.MsgDelegateWnd_lu
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.0040d070
add esp, 0x10
mov dword [esp + 0x10], 0x413b40
lea eax, [esp + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x412fd9
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.00439921
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x83c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00439921
mov esp, ebp
pop ebp
ret 8

Function at 0x415980
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0x10
je 0x415a04
cmp eax, 0x113
je 0x4159c1
cmp eax, 0x2400
je 0x4159ac
mov eax, dword [ebp + 0x14]
pop esi
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 0
je 0x415a09
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 0x3e9
jne 0x415a09
lea ecx, [ebp + 0xc]
call fcn.0041f2a0
push 5
push 0
push str._fromupdate
push dword [eax]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415a02
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.00415e20
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x41db50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4908d6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b81bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00439955
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00438afa
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f300
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492970
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
call fcn.004310c0
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41f36f
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
lea ecx, [ebp - 0x18]
call fcn.004038a0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.0042b340
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x18]
add esp, 4
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f3ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x41f3cd
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret

Function at 0x41f3f0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492970
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
mov edx, str.UserData
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.0041f300
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41f464
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
lea ecx, [ebp - 0x18]
call fcn.004038a0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x14]
mov ecx, edi
call fcn.0042b340
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f4a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x41f4c2
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
Function at 0x41f510
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492970
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
mov edx, str.Update
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.0041f300
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41f584
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
lea ecx, [ebp - 0x18]
call fcn.004038a0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x14]
mov ecx, edi
call fcn.0042b340
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f5c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x41f5e2
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret

Function at 0x41f600
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492970
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, str.Dump
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.0041f300
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41f672
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
lea ecx, [ebp - 0x18]
call fcn.004038a0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.0042b340
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x18]
add esp, 4
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f6b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x41f6d1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
Function at 0x4236d0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d10
call fcn.0043ab70
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x2d10], eax
test eax, eax
je 0x423830
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop
push esi
push 0x4aad58
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.00424290
add esp, 0x10
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x423813
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2d00], 0
lea eax, [ebp - 0x2cfc]
movq qword [ebp - 0x2d0c], xmm0
push 0
push eax
mov dword [ebp - 0x2d04], 0
mov dword [ebp - 0x2d0c], 0
mov dword [ebp - 0x2d08], 0
call fcn.0046ce30
add esp, 0xc
lea eax, [ebp - 0x2d00]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d0c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x423808
push 0x3e8
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.0046ce30
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x5ec]
add esp, 0xc
push eax
push ecx
lea ecx, [ebp - 0x2cfc]
call fcn.004254b0
mov ecx, dword [ebp - 0x2d10]
lea eax, [ebp - 0x5ec]
add esp, 8
mov edx, 0x64
push eax
call fcn.00424220
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x42381d
inc esi
cmp esi, 0x10
jl 0x423700
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
Function at 0x423af0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x4b81bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x4f4], ebx
test ebx, ebx
je 0x423ce6
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0046ce30
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x4ec]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x423cb7
push edi
xor edi, edi
mov dword [ebp - 0x4e0], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x2d4]
push eax
push edi
push dword [ebp - 0x4ec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x423ca8
lea eax, [ebp - 0x4f0]
push eax
push 1
push 0
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x4ec]
call esi
test eax, eax
jne 0x423c72
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x4e8], 1
push eax
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4e4], 0x208
push eax
lea eax, [ebp - 0x4e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x4f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423c6a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0046ce30
add esp, 8
lea edx, [ebp - 0xcc]
lea ecx, [ebp - 0x4dc]
call fcn.004239d0
add esp, 4
test eax, eax
je 0x423c6a
cmp byte [ebp - 0x68], 0
je 0x423c2f
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x423c6a
lea eax, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov ecx, eax
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x423c5c
mov cl, byte [esi + eax]
test cl, cl
je 0x423c5c
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x423c41
jmp 0x423c60
test edx, edx
jne 0x423c61
dec eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [eax], 0
push dword [ebp - 0x4f0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4e0], 0x104
push eax
lea eax, [ebp - 0x2d4]
inc edi
push eax
push edi
push dword [ebp - 0x4ec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x423b84
push dword [ebp - 0x4ec]
call ebx
mov ebx, dword [ebp - 0x4f4]
pop edi
cmp byte [ebp - 0x68], 0
pop esi
je 0x423ce6
lea eax, [ebp - 0x68]
mov edx, 0x64
push eax
mov ecx, ebx
call fcn.00424220
xor ecx, ecx
test eax, eax
pop ebx
setns cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439921
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.00439921
mov esp, ebp
pop ebp
ret