joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x2a
lea ecx, [fcn.10002f50]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10002f7a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x10002f8f
jmp 0x10002f9f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
je 0x10002f69
jmp 0x10002f9f
mov eax, dword [ebp - 0x10]
mov dword [0x100d2f38], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, 0x1e0d
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10002f7a

Function at 0x10003730
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x100d2f38], 0x6a9
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x100d2f3c], 0x9a7
mov esi, dword [0x100d2f38]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
jmp 0x100037c4
mov eax, 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10003879
jmp 0x10003872
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [0x100d2f38], ecx
mov dword [0x100d2f3c], 0x85f
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10003805
jmp 0x10003872
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffbee
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], esi
je 0x1000379a
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
jl 0x100037c4
jmp 0x1000379a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10003872
mov dword [0x100d2f3c], 0x18d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10003872
mov dword [0x100d2f3c], 0xfffff24c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10003872
mov dword [0x100d2f38], 0x144b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10003872
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1000377a
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10003879
mov eax, dword [ebp - 0x20]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x401010
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x45a790]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x11c
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0042d1b0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call esi
test eax, eax
jne 0x40107e
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call esi
test eax, eax
jne 0x40107e
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0042b53d
add esp, 0x120
ret
mov eax, dword [esp + 0xc]
cmp eax, 6
jne 0x40108f
cmp dword [esp + 0x10], edi
ja 0x401091
jmp 0x401096
jbe 0x401096
mov edi, 1
mov ecx, dword [esp + 0x124]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0042b53d
add esp, 0x120
ret

Function at 0x402b50
Capabilities:
Create directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x45a790]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
push str.InstallProgramFiles__
mov ebx, ecx
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 4
push 0x1fe
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.0042d1b0
add esp, 0xc
push 0x100
push str.INSTALL_DIRECTORY
call fcn.00405a00
push eax
lea edi, [esp + 0x1c]
call fcn.004061a0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x44bec8
lea esi, [ebx + 0xa10]
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call ebp
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
push 0
push esi
call ebp
push esi
push str.__programFilesDir:_s
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 8
push esi
add ebx, 0xc18
push ebx
push 0x44da58
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 0xc
push 1
push esi
push ebx
push 0x44da88
call fcn.00409480
mov ecx, dword [esp + 0x224]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0042b53d
add esp, 0x20c
ret
Function at 0x4048d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4048e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404924
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404920
lea ebx, [ebx]
cmp esi, eax
jae 0x404924
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404910
cmp esi, eax
jb 0x40492a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x405000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x200c
call fcn.0042f500
mov eax, dword [0x45a790]
xor eax, esp
mov dword [esp + 0x2008], eax
cmp dword [esp + 0x2010], 0
push ebx
push ebp
push esi
je 0x40514a
push 0x1ffe
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.0042d1b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea ecx, [edi + 0x248]
push ecx
push str._s__X_:
lea edx, [esp + 0x1c]
push 0x1000
push edx
call fcn.0042b66a
mov edx, dword [esp + 0x2030]
add esp, 0x14
lea ecx, [esp + 0x2020]
push ecx
push edx
mov ecx, 0x1000
sub ecx, eax
push ecx
lea edx, [esp + eax*2 + 0x1c]
push edx
call fcn.0042b2f5
push 0x44cc4c
lea eax, [esp + 0x24]
push 0x1000
push eax
call fcn.0042c7ff
lea eax, [edi + 0x40]
add esp, 0x1c
lea edx, [eax + 2]
jmp 0x4050b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4050b0
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub eax, edx
sar eax, 1
je 0x4050e2
lea esi, [edi + 4]
push esi
call ebx
lea ecx, [esp + 0x10]
push ecx
mov eax, edi
call fcn.00404f70
push esi
call ebp
lea eax, [esp + 0x10]
xor edx, edx
lea esi, [eax + 2]
jmp 0x4050f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4050f0
sub eax, esi
sar eax, 1
add eax, 0xfffffffe
je 0x405136
cmp word [esp + edx*2 + 0x10], 0xa
jne 0x405113
mov word [esp + edx*2 + 0x10], 0x20
lea eax, [esp + 0x10]
add edx, 1
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405120
sub eax, esi
sar eax, 1
add eax, 0xfffffffe
cmp edx, eax
jb 0x405104
lea esi, [edi + 4]
push esi
call ebx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call ebp
mov ecx, dword [esp + 0x2014]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042b53d
add esp, 0x200c
ret

Function at 0x406030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443e18
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45a790]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, 1
mov dword [esp + 0x24], ebx
mov edi, dword [esp + 0x34]
push 0
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push edi
call fcn.00404010
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 2
mov esi, dword [esp + 0x3c]
add esi, 0xfffffff0
mov dword [esp + 0x24], esp
mov ebp, esp
push esi
call fcn.00404010
mov ecx, dword [esp + 0x3c]
add eax, 0x10
mov dword [ebp], eax
add esp, 4
mov byte [esp + 0x30], bl
call fcn.00405cc0
mov ebx, eax
mov byte [esp + 0x24], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4060c9
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [esp + 0x24], 0xffffffff
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060ea
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x408cd0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
push edi
push str.In_RebootSystemNow
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 4
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408d07
xor eax, eax
pop edi
add esp, 0x18
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408d00
push 0x80020003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop edi
add esp, 0x18
ret

Function at 0x408f50
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x45a790]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.0042d1b0
add esp, 0xc
lea ecx, [esp]
push ecx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
mov word [esi], 0
jl 0x408fa0
lea edx, [esp]
push edx
jmp 0x408fa5
push str.C:Program_Files
push 0x104
push esi
call fcn.0042b5fe
mov ecx, dword [esp + 0x214]
add esp, 0xc
xor ecx, esp
call fcn.0042b53d
add esp, 0x20c
ret
Function at 0x409480
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x678
mov eax, dword [0x45a790]
xor eax, esp
mov dword [esp + 0x670], eax
mov eax, dword [esp + 0x684]
push ebx
mov ebx, dword [esp + 0x684]
push esi
push edi
mov edi, dword [esp + 0x688]
push 0x206
lea ecx, [esp + 0x26e]
push 0
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
mov esi, 1
mov word [esp + 0x274], 0
call fcn.0042d1b0
add esp, 0xc
push 0x206
lea edx, [esp + 0x476]
push 0
push edx
mov word [esp + 0x47c], 0
call fcn.0042d1b0
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
push ebx
push edi
push str.CopyFilterFiles__s___s___s_
call fcn.00404b20
mov edi, eax
call fcn.00405000
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push 0x44c170
lea edx, [esp + 0x284]
push 0x104
push edx
call fcn.0042b66a
add esp, 0x24
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
jne 0x409553
xor esi, esi
mov edx, dword [esp + 0xc]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test esi, esi
je 0x4096c6
mov esi, dword [esp + 0x694]
nop
mov ecx, 0x44dac8
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4095a6
test dx, dx
je 0x4095a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4095a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x409580
xor eax, eax
jmp 0x4095ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4096b2
mov ecx, 0x44dacc
lea eax, [esp + 0x44]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4095e6
test dx, dx
je 0x4095e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4095e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4095c0
xor eax, eax
jmp 0x4095eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4096b2
lea eax, [esp + 0x44]
push eax
push ebx
push 0x44c170
lea ecx, [esp + 0x274]
push 0x104
push ecx
call fcn.0042b66a
mov eax, dword [esp + 0x20]
add esp, 0x14
lea edx, [esp + 0x44]
push edx
push eax
push 0x44c170
lea ecx, [esp + 0x47c]
push 0x104
push ecx
call fcn.0042b66a
add esp, 0x14
test esi, esi
je 0x409672
test byte [esp + 0x18], 0x10
je 0x409672
push 0
lea edx, [esp + 0x474]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 0x474]
push eax
lea ecx, [esp + 0x270]
push ecx
push edx
call fcn.00409480
add esp, 0x10
jmp 0x4096b2
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x26c]
push ecx
push str.Copy_file__s_to__s
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 0xc
push 0
lea edx, [esp + 0x474]
push edx
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409570
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0042b53d
add esp, 0x678
ret
Function at 0x4096f0
Capabilities:
Identify system language via api

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebp, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push str._____Language_IDs____
mov dword [esp + 0x14], eax
call fcn.00404b20
mov edi, eax
call fcn.00405000
movzx eax, si
add esp, 4
push eax
push eax
push str.__User_Default_UI_Language_____d_____x
call fcn.00404b20
mov edi, eax
call fcn.00405000
movzx eax, bx
add esp, 0xc
push eax
push eax
push str.__System_Default_UI_Language___d_____x
call fcn.00404b20
mov edi, eax
call fcn.00405000
movzx eax, bp
add esp, 0xc
push eax
push eax
push str.__User_Default_Language_ID_____d_____x
call fcn.00404b20
mov edi, eax
call fcn.00405000
movzx eax, word [esp + 0x1c]
add esp, 0xc
push eax
push eax
push str.__System_Default_Language_ID___d_____x
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 0xc
call fcn.00409800
movzx ecx, ax
push ecx
call fcn.00409800
movzx edx, ax
push edx
push str.__Language_ID_To_Be_Used_______d_____x
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x409800
Capabilities:
Identify system language via api

Disassembly:
push esi
xor ecx, ecx
movzx esi, ax
mov edx, 0x45bfb0
jmp 0x4097e0
cmp dword [edx], esi
je 0x4097f1
add ecx, 1
add edx, 0x10
cmp ecx, 0x26
jb 0x4097e0
pop esi
ret
shl ecx, 4
mov ax, word [ecx + 0x45bfb4]
pop esi
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp si, di
movzx eax, ax
jne 0x40983b
cmp si, ax
jne 0x40983b
pop edi
mov eax, esi
pop esi
pop ebx
jmp 0x4097d0
xor eax, eax
movzx edx, bx
mov ecx, 0x45bfb0
cmp dword [ecx], edx
je 0x40985b
add eax, 1
add ecx, 0x10
cmp eax, 0x26
jb 0x409845
pop edi
pop esi
movzx eax, bx
pop ebx
ret
pop edi
shl eax, 4
movzx eax, word [eax + 0x45bfb4]
pop esi
pop ebx
ret
Function at 0x40aad0
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x814
mov eax, dword [0x45a790]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
mov ebp, dword [esp + 0x820]
push edi
xor ebx, ebx
push 0x7fe
lea eax, [esp + 0x22]
push ebx
push eax
mov edi, ecx
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x28], bx
call fcn.0042d1b0
push edi
push str.SELECT_Value_FROM_Property_WHERE_Property___s
lea ecx, [esp + 0x30]
push 0x400
push ecx
call fcn.0042b66a
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
push ebx
push esi
call sub.msi.dll_MsiOpenProductW
mov ebx, eax
test ebx, ebx
je 0x40ab5e
push str.CMsi::GetPropertyFromMsi_MsiOpenDatabase
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
jmp 0x40ac1a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.msi.dll_MsiEnumClientsA
mov ebx, eax
test ebx, ebx
je 0x40ab91
push str.CMsi::GetPropertyFromMsi_MsiDatabaseOpenView
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
jmp 0x40ac24
mov eax, dword [esp + 0xc]
push 0
push eax
call sub.msi.dll_MsiViewModify
mov ebx, eax
test ebx, ebx
je 0x40abb9
push str.CMsi::GetPropertyFromMsi_MsiViewExecute
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
jmp 0x40ac24
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push edx
call sub.msi.dll_MsiDatabaseIsTablePersistentA
mov ebx, eax
test ebx, ebx
je 0x40abe4
push str.CMsi::GetPropertyFromMsi_MsiViewFetch
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
jmp 0x40ac1a
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebp
push 1
push ecx
call sub.msi.dll_MsiRecordSetStreamA
mov ebx, eax
test ebx, ebx
je 0x40ac10
push str.CMsi::GetPropertyFromMsi_MsiRecordGetString
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [esp + 0xc]
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [esp + 0x10]
push ecx
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
test ebx, ebx
je 0x40ac64
push ebp
push str.CMsi::GetPropertyFromMsi_failed._Setting__s_to_UNKNOWN
call fcn.00404b20
mov edi, eax
call fcn.00405000
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
mov word [ebp], 0
jbe 0x40ac64
push str.UNKNOWN
push eax
push ebp
call fcn.0042b5fe
add esp, 0xc
mov ecx, dword [esp + 0x81c]
pop edi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042b53d
add esp, 0x814
ret 4
Function at 0x40ac80
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
push str.ParentIdPrefix
mov esi, eax
push esi
push str.GetValueFromHKey__s__s
mov dword [esp + 0x18], 0
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40acfd
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ParentIdPrefix
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 8
push str.GetValueFromHKLM__RegOpenKeyEx_failed
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 8
Function at 0x40b2d0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
push edi
push str.Spooler
push str.StartAService__s_
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x18], ebp
jne 0x40b32e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed__gle_d_
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push 0xf01ff
push str.Spooler
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x40b353
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed__gle_d_
jmp 0x40b315
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40b390
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x420
je 0x40b324
push str.StartService_failed
call fcn.00404b20
mov ecx, eax
call fcn.00405170
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esp + 0x1c]
push eax
push 0x24
lea ecx, [esp + 0x28]
push ecx
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x40b3ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryServiceStatusEx_failed__gle_d_
jmp 0x40b315
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esp + 0x34]
mov esi, eax
mov eax, dword [esp + 0x24]
cmp eax, 2
mov dword [esp + 0x14], edx
jne 0x40b459
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, 0xcccccccd
mul dword [esp + 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x40b3fb
mov edx, 0x3e8
jmp 0x40b408
cmp edx, 0x2710
jbe 0x40b408
mov edx, 0x2710
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push 0x24
lea ecx, [esp + 0x28]
push ecx
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40b451
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x34], edx
jbe 0x40b43c
call edi
mov esi, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
jmp 0x40b446
call edi
sub eax, esi
cmp eax, dword [esp + 0x38]
ja 0x40b451
mov eax, dword [esp + 0x24]
cmp eax, 2
je 0x40b3e0
jmp 0x40b455
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x18]
cmp eax, 4
jne 0x40b462
xor esi, esi
jmp 0x40b48b
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push eax
push str.Spooler
push str.Failed_to_start__s_service.__nCurrent_State:__d_nExit_Code:__d_nService_Specific_Exit_Code:__d_n
call fcn.00404b20
mov edi, eax
call fcn.00405000
add esp, 0x14
mov esi, 0x507
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
push ebp
call edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret