joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3ae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push ebx
push esi
push edi
mov dword [ebp - 0x2a0], 0
cmp dword [ebp + 0x14], 0
je 0x40e3f2
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x21c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
jmp 0x40e3ff
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [ebp + 8], 0
je 0x40e436
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x200]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40e454
mov eax, dword [ebp + 0xc]
push eax
push 0x9a3740
push 0x46cc10
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
je 0x40e57f
lea eax, [ebp - 0x29c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov byte [ebp - 0x29c], 0x81
mov byte [ebp - 0x29b], 0x70
push 0
lea eax, [ebp - 0x208]
push eax
push 0xa
lea eax, [ebp - 0x29c]
push eax
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x208]
push eax
push 0x10
push 0x9854e0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.0040e14b
mov dword [ebp - 0x2a0], eax
mov ax, word [ebp - 0x2a0]
mov word [ebp - 0x29a], ax
push 0
lea eax, [ebp - 0x208]
push eax
push 4
lea eax, [ebp - 0x29a]
push eax
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x204], 0x10
mov eax, dword [ebp - 0x204]
lea esi, [ebp - 0x21c]
mov ecx, dword [ebp - 0x204]
inc ecx
add ecx, dword [ebp + 0x18]
mov edi, ecx
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0x208]
push eax
push 0x91
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e5a7
cmp dword [0x45e03c], 0
je 0x40e5a7
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nFailure__d_CRSN___s_
call fcn.00452380
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e5ac
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
push ebx
push esi
push edi
mov dword [ebp - 0x580], 0
lea eax, [ebp - 0x594]
push eax
push 0xf003f
push 0
push 0x46cc30
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
je 0x40e657
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x594]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x46cc74
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
je 0x40e657
cmp dword [0x45e03c], 0
je 0x40e652
mov eax, dword [ebp - 0x408]
push eax
push str._r_nADXRR___d_
call fcn.00452380
add esp, 8
jmp 0x40e789
lea eax, [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x590]
push eax
call fcn.0040e0ac
add esp, 4
mov dword [ebp - 0x578], 0
cmp dword [ebp - 0x408], 0
jne 0x40e77c
mov byte [ebp - 0x404], 0
mov dword [ebp - 0x570], 0x200
mov dword [ebp - 0x57c], 0x163
mov edx, dword [ebp - 0x57c]
lea edi, [ebp - 0x56c]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0x578]
push eax
mov eax, dword [ebp - 0x594]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x408], eax
inc dword [ebp - 0x578]
cmp dword [ebp - 0x408], 0
jne 0x40e777
lea eax, [ebp - 0x404]
push eax
push 0x9a3740
push 0x46cd0c
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x56c]
push eax
push 0
lea eax, [ebp - 0x590]
push eax
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
call fcn.0040e174
add esp, 0x18
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0x594]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x578], 0
jmp 0x40e67d
mov eax, dword [ebp - 0x594]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ed89
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x9a3740
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x9a3740
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ee09
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x9a3740]
cmp eax, 0x5c
je 0x40ee09
mov edi, 0x9a3740
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x46ce08]
mov word [edi - 1], ax
mov edx, str.LWA.ASL_
mov edi, 0x9a3740
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov al, byte [edx + 8]
mov byte [edi + 8], al
push 0
push 0x9a3740
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40ee99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40ee99
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x9a3740
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40ee99
cmp dword [0x45e03c], 0
je 0x40ee99
push 0x9a3740
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46ce18
call fcn.00452380
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x40eec4
push 0x9a3740
push 0x9a3740
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
push str._r_nADESK_SILO_LOG_PATH___X___s_
call fcn.00452380
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4102ad
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x12c]
push eax
cmp dword [0x462284], 1
mov eax, 0
adc eax, 0xffffffff
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SOFTWAREAutodesk
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410390
mov dword [ebp - 8], 0x100
lea edi, [ebp - 0x120]
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x130], eax
inc dword [ebp - 0x18]
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x130]
push eax
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x410379
push 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x12c]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0041001c
add esp, 0x14
jmp 0x41037e
jmp 0x410383
jmp 0x410300
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410395
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov edi, 0x5f95c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x2cc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0xffffffff
je 0x410471
cmp dword [0x45e03c], 0
je 0x41041a
lea eax, [ebp - 0x3e0]
push eax
push str._r_nADSKLMLOG:__s_
call fcn.00452380
add esp, 8
push str.adlm.log
lea eax, [ebp - 0x3e0]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x410439
inc dword [ebp - 4]
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41046c
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x410], 0xffffffff
jmp 0x4103ec
mov eax, dword [ebp - 4]
jmp 0x410479
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41047e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov edi, 0x5f4da0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x2cc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0xffffffff
je 0x41053e
cmp dword [0x45e03c], 0
je 0x410503
lea eax, [ebp - 0x3e0]
push eax
push str._r_nADSKLM_SDK_LOG:__s_
call fcn.00452380
add esp, 8
inc dword [ebp - 4]
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410539
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x410], 0xffffffff
jmp 0x4104d5
mov eax, dword [ebp - 4]
jmp 0x410546
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410b89
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [0x462378], 0
jne 0x410bae
push 0x2f4d60
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x462378], eax
mov edi, 0x508a20
xor eax, eax
mov ecx, 0x80
rep stosd dword es:[edi], eax
push 0x200
push 0x508a20
push str.PROGRAMDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, 0x508a20
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f95c0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.AutodeskAdlmadlm.log
mov edi, 0x5f95c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, 0x508a20
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x5f4da0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.AutodeskAdlmAdlSdk_.log
mov edi, 0x5f4da0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, str.AutodeskAdskLicensingServiceAdskLicensingService.sds
mov edi, 0x508a20
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411a1e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e4
push ebx
push esi
push edi
mov dword [ebp - 0x9e0], 0
lea eax, [ebp - 0x9d4]
push eax
push 0x9d0
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 0
jne 0x411a8d
cmp dword [0x45e03c], 0
je 0x411a83
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nRFVI:_ABORTING_ERROR_OBTAINING_VERSION__d___s_
call fcn.00452380
add esp, 0xc
mov eax, 0xfffffffe
jmp 0x411b8a
mov dword [ebp - 4], 0
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 4]
push eax
push 0x46d4e8
lea eax, [ebp - 0x9d4]
push eax
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 4], 0
je 0x411b80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xffff0000
mov dword [ebp - 0x9d8], eax
sar dword [ebp - 0x9d8], 0x10
and dword [ebp - 0x9d8], 0xff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x9e0], eax
and dword [ebp - 0x9e0], 0xff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
and eax, 0xffff0000
mov dword [ebp - 0x9e4], eax
sar dword [ebp - 0x9e4], 0x10
and dword [ebp - 0x9e4], 0xff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x9dc], eax
and dword [ebp - 0x9dc], 0xff
cmp dword [0x45e03c], 0
je 0x411b6a
mov eax, dword [ebp - 0x9dc]
push eax
mov eax, dword [ebp - 0x9e4]
push eax
mov eax, dword [ebp - 0x9e0]
push eax
mov eax, dword [ebp - 0x9d8]
push eax
mov eax, dword [ebp + 8]
push eax
push str._r_nVersion_of__s_r_n_______d___d___d___d
call fcn.00452380
add esp, 0x18
mov eax, dword [ebp - 0x9e0]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x9d8]
jmp 0x411b8a
mov eax, 0xffffffff
jmp 0x411b8a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413921
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], 0
cmp dword [0x462294], 0
jne 0x413943
jmp 0x413a0f
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.TSAdvertise
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4139a1
mov dword [0x462278], 0
jmp 0x4139a9
mov eax, dword [ebp - 8]
mov dword [0x462278], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x462278], 0
je 0x4139e5
cmp dword [0x45e03c], 0
je 0x4139e0
mov eax, dword [0x462278]
push eax
push str._n_r_TSE_Candidate_TSAdvertise_Status___d_
call fcn.00452380
add esp, 8
jmp 0x413a0f
call fcn.00413a14
mov dword [0x462278], eax
cmp dword [0x45e03c], 0
je 0x413a0f
mov eax, dword [0x462278]
push eax
push str._r_nTLS_TSE_Status___d_
call fcn.00452380
add esp, 8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413c13
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x46e534
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413c61
mov eax, dword [ebp - 4]
push eax
push str._nError_Updating_Registry_Version_data__x_
call fcn.00452380
add esp, 8
jmp 0x413caa
push 5
push 0x46e59c
push 1
push 0
push str.EXE_Version
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
push str.SYS_Version
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4153c5
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4153f3
jmp 0x41553a
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x415411
jmp 0x41553a
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41542f
jmp 0x41553a
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41544b
jmp 0x41553a
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x218]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0xc], 0
je 0x4154b1
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x218]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x415509
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
push str._r_n577:64:__x_.gle__d____s_
call fcn.00452380
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x41553a
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41553a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4161cb
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4621b4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x41621a
mov dword [0x4621b4], 0xffffffff
cmp dword [0x4621b8], 0
je 0x416210
mov eax, dword [0x4621b8]
mov byte [eax], 0x66
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push str..CPTWsync
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x41626f
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._n_rFound_CPTRAX_Server_Agent___blocking_unload_of_Kernel_driver_to_maintain_system_stability.
call fcn.00452380
add esp, 4
push str._n_rTo_restart_SofTrack_Agent_you_must_reboot_this_machine.
call fcn.00452380
add esp, 4
xor eax, eax
jmp 0x41631b
cmp dword [0x462e7c], 0
jne 0x416289
push 0x22c
call fcn.004020e8
add esp, 4
inc dword [0x462e7c]
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20], eax
cmp dword [0x45e03c], 0
je 0x4162c7
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x20]
push eax
push str._nStop_Service___x__if_0__err___S_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x20], 0
jne 0x4162d8
xor eax, eax
jmp 0x41631b
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [0x45e03c], 0
je 0x416313
mov eax, dword [ebp + 0xc]
push eax
push str._n_nServer___S__STOPPED._n
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x2c]
jmp 0x41631b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41807a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.00452960
push ebx
push esi
push edi
mov dword [ebp - 0x4004], 0x4000
lea eax, [ebp - 0x4004]
push eax
lea eax, [ebp - 0x4000]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [0x45e03c], 0
je 0x4180c9
lea eax, [ebp - 0x4000]
push eax
push str._n_r___s_
call fcn.00452380
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e60f
Capabilities:
Create thread
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
cmp dword [0x45e03c], 0
je 0x41e647
mov eax, dword [0x46207c]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push str._n_rSTOP_PID___d__TID___d_____x
call fcn.00452380
add esp, 0x10
cmp dword [0x46207c], 0
jne 0x41e670
push str.OpenThread
push 0x471db8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46207c], eax
cmp dword [0x46207c], 0
jne 0x41e682
jmp 0x41e86f
cmp dword [ebp + 0xc], 0
jne 0x41e712
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x41e70d
push 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x41e6de
cmp dword [0x45e03c], 0
je 0x41e6d9
mov eax, dword [ebp + 8]
push eax
push str._n_rVXTdll_Process_Succesfully_terminated__d
call fcn.00452380
add esp, 8
jmp 0x41e703
cmp dword [0x45e03c], 0
je 0x41e703
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rVXTdll_Error___d__d_terminating_process_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41e86f
mov eax, dword [ebp + 0xc]
push eax
push 0
push 2
call dword [0x46207c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41e797
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x41e763
cmp dword [0x45e03c], 0
je 0x41e75e
mov eax, dword [ebp + 0xc]
push eax
push str._n_rVXX_Thread_Succesfully_suspended__d
call fcn.00452380
add esp, 8
jmp 0x41e788
cmp dword [0x45e03c], 0
je 0x41e788
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rVXX_Error___d__d_suspending_thread_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41e7bc
cmp dword [0x45e03c], 0
je 0x41e7bc
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rVXX_Error___d__d_Opening_Thread_
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x18]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0x41e475
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41e85b
cmp dword [ebp - 0x18], 0
je 0x41e856
cmp dword [0x4622c8], 0
je 0x41e834
jmp 0x41e856
inc dword [ebp - 0x20]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x20], 0x26e
jle 0x41e851
jmp 0x41e856
jmp 0x41e818
jmp 0x41e86f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nVX_CTW_FAIL_d
call fcn.00452380
add esp, 8
pop edi
pop esi
pop ebx
leave
ret