joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4259cd
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x45915b
call fcn.00441f1a
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406ec6
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x425a09
mov eax, dword [ebx]
jmp 0x425a0b
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x425ac3
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x464
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x3c]
mov dword [esp], 0x46d888
push eax
call fcn.0043a470
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0041053c
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x425adf
mov edx, dword [ebx]
jmp 0x425ae1
mov edx, ebx
mov edi, dword [sym.imp.version.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x425b7f
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46d
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 9
jmp 0x425aa5
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x428cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f50
call fcn.00441eb1
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428dc4
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428da4
cmp dword [0x47d500], 1
jg 0x428da4
lea eax, [ebp - 0xb4]
push eax
call fcn.00409545
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b58e
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040df0e
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078b6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.0040789c
cmp dword [ebp - 0x14], 0x102
jne 0x428dc4
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0043a470
pop ecx
mov al, bl
call fcn.00441f89
ret
mov bl, 1
jmp 0x428daf

Function at 0x434134
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4566fc
call fcn.00441eb1
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x43418a
push 0xc8
lea esi, [ebp - 0x20]
call fcn.0043a470
push 0x46d720
mov eax, esi
push eax
call fcn.0043a470
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00414d60
push 0x4695b4
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0043a470
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00432e7f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00414e32
push 1
lea esi, [ebp]
call fcn.00414e32
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x244
leave
ret

Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5

Function at 0x43a470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x43a47f
pop dword [ebp - 4]
mov eax, 0xd54d3c8b
add eax, 0x2af667f4
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x43ae6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x89bcdb75
add ecx, 0x764360fc
mov edi, eax
mov ebx, 0x37a925a4
sub ebx, 0x375f1fa4
add ebx, dword [ebp - 4]
mov edx, 0xb29b8a1
sub edx, 0x43310c86
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
add edi, 4
add ebx, 4
loop 0x43a4d9
add eax, 0x12d242ba
sub eax, 0x12d15e23
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x401790
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004082c0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004082c0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4017f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40c05c]
test esi, esi
jle 0x401910
mov eax, dword [0x40c060]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401824
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401810
mov dword [esp], ebx
call fcn.00402170
mov edi, eax
test eax, eax
je 0x401937
mov eax, dword [0x40c060]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004022b0
mov edx, dword [0x40c060]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401917
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018b0
add dword [0x40c05c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40c060]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401790
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40182e
mov eax, dword [0x40c060]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401790
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401790
lea esi, [esi]
nop
Function at 0x401df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40c078
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40c070]
sub esp, 4
test ebx, ebx
je 0x401e45
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e3e
test esi, esi
je 0x401e3e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e20
mov dword [esp], 0x40c078
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402170
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402195
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021a0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402195
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4021e8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4021de
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4021ea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4021d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x402470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x4025f8
cmp byte [ebx], 0
je 0x4025c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x402608
test al, 0x10
je 0x4025c0
lea esi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 0x1c], eax
mov ebp, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x40261a
lea edx, [eax + 0x22c]
lea eax, [ebp + 1]
cmp eax, 4
jb 0x402598
mov ecx, dword [esp + eax + 0x28]
mov edi, edx
mov dword [edx + eax - 4], ecx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x22c], 0
je 0x402540
movzx ecx, byte [ebx + ebp + 0x22b]
cmp cl, 0x5c
je 0x402540
cmp cl, 0x2f
jne 0x4025e0
lea esi, [esi]
mov eax, dword [esp + 0x1c]
mov ecx, 0x2a
mov word [edx + eax], cx
lea edx, [ebx + 0x120]
mov ecx, 0x41
xor eax, eax
mov dword [ebx + 0x224], 0xffffffff
mov edi, edx
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov dword [ebx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x40251b
movzx ecx, byte [esp + 0x2c]
mov byte [edx], cl
test al, 2
je 0x40251b
movzx ecx, word [esp + eax + 0x2a]
mov word [edx + eax - 2], cx
jmp 0x40251b
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5c
mov dword [esp + 0x1c], eax
mov word [edx + ebp], si
jmp 0x402540
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x402586
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x402586
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x402586
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401c66
pop dword [ebp - 0x10]
mov eax, 0x401c66
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x6973e32a
sub dword [ebp - 0x20], 0x1b219ddf
mov dword [ebp - 0x1c], 0xc1b66c2a
add dword [ebp - 0x1c], 0x707ce01b
mov dword [ebp - 0x18], 0xb35848fc
add dword [ebp - 0x18], 0x98f3fb32
mov dword [ebp - 0x14], 0xcddefa8d
add dword [ebp - 0x14], 0x32210573
lea eax, [ebp - 0x20]
push eax
mov eax, 0x9d091050
add eax, 0x63372004
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf0fa1f9
add dword [ebp - 0x20], 0x6562c75d
mov dword [ebp - 0x1c], 0x8ad6e52a
sub dword [ebp - 0x1c], 0x496a83b5
mov dword [ebp - 0x18], 0x42e54585
add dword [ebp - 0x18], 0x208a26e7
mov dword [ebp - 0x14], 0xb24bb236
sub dword [ebp - 0x14], 0xb24bb236
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xcaa403be
sub eax, 0xca63d392
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3780e
push 0
call eax
mov ecx, 0x2e0d07c2
add ecx, 0xd1f34455
mov esi, eax
mov edx, 0xef97b9e2
sub edx, 0xef5749e2
add edx, dword [ebp - 0x10]
mov edi, 0x1b6da637
sub edi, 0xfa72f547
sub dword [ebp - 4], 0x5246b87c
mov ebx, dword [edx]
sub dword [ebp - 8], 0x29a880eb
sub ebx, edi
mov dword [ebp - 4], 0x44910ead
mov dword [esi], ebx
xor dword [ebp - 4], 0x87f83e52
add esi, 0xcd0c085a
sub esi, 0xcd0c0856
add edx, 0x9aefbc1b
add edx, 0x651043e9
loop 0x401d83
add eax, 0xc7848e7
sub eax, 0xc7725b8
mov ebx, eax
add eax, 0xcc1a9c14
sub eax, 0xcc1a9c0f
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4024b0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4dded8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x50c7c4]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x50c7c4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00403430
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.004023d0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x40252d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.004a6dd1
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x402556
push dword [esp + 0x10]
call fcn.004a78e3
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4043d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de150
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [0x511d74]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], edi
call fcn.004a9990
add esp, 4
push 0
push 0x3e8
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.004b4050
mov ecx, eax
mov esi, edx
movzx eax, word [ebp - 0x20]
cdq
add ecx, eax
mov dword [ebp - 4], 0
mov eax, dword [0x50d724]
adc esi, edx
mov dword [0x511d78], ecx
mov dword [0x511d7c], esi
mov ecx, eax
lea esi, [edi + 8]
mov dword [edi + 0xc], 2
push esi
push dword [edi + 0x24]
inc eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x20], 0
mov dword [0x50d724], eax
mov dword [edi + 0x1c], ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push dword [ebp - 0x30]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 8]
call dword [eax + 4]
push esi
push dword [edi + 0x24]
mov dword [edi + 0xc], 4
mov dword [edi + 0x14], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x50d730], 0xffffffff
jne 0x4044dc
push 0
push 0
push fcn.00402280
call fcn.004a7984
mov ecx, dword [0x50d730]
add esp, 0xc
cmp eax, 0xffffffff
cmovne ecx, eax
mov dword [0x50d730], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret 8
Function at 0x404a70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x404ac6
mov ecx, dword [edi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x404ad0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push str._s_failed_w_err_0x_08lx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004040b0
add esp, 0x14
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x404b64
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret 8
Function at 0x404b90
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x404bdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.004a827a
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret
push ebx
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x404c13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.004a827a
add esp, 8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push str.LocalSystem
push 0x4eef1c
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x4ef388
push 0x4ef388
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x404c5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
jmp 0x404cae
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea eax, [ebp - 0x214]
push eax
push 1
push edi
mov dword [ebp - 0x214], str.Lenovo_GDCAgent
call esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 3
push edi
call esi
test eax, eax
setne al
test al, al
jne 0x404ca4
push str.Failed_to_set_the_service_delay_startup._n
call fcn.004a827a
add esp, 4
push 0x4ef388
push str._s_is_installed._n
call fcn.004a827a
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push ebx
call esi
test edi, edi
je 0x404cc6
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret
Function at 0x404ce0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x50c7c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 1
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push 0
movdqu xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x404da4
push esi
push edi
push 0x10024
push 0x4ef388
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x404d92
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404d67
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call edi
test eax, eax
je 0x404d67
cmp dword [ebp - 0x1c], 3
jne 0x404d67
lea eax, [ebp - 0x20]
push eax
push esi
call edi
test eax, eax
jne 0x404d56
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x404d80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed_w_err_0x_08lx_n
jmp 0x404d8a
push 0x4ef388
push str._s_is_removed._n
call fcn.004a827a
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
test esi, esi
je 0x404da2
push esi
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a6d1e
mov esp, ebp
pop ebp
ret

Function at 0x405510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push dword [ebp + 8]
mov esi, ecx
push 0x405550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
test eax, eax
jne 0x40553a
xor al, al
pop ebp
ret 0xc
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop ebp
ret 0xc
Function at 0x405570
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de309
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x50c7c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
sub esp, 0x10
call fcn.004042e0
mov dword [ebp - 4], 0
mov dword [esi], vtable.lagent::ServiceWrapper.0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x50], 0xf
mov dword [esi + 0x4c], 0
mov byte [esi + 0x3c], 0
push 0
push 0
push 1
push 0
mov byte [esi + 0x58], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x54], eax
mov byte [esi + 0x58], 0
test eax, eax
jne 0x405608
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEvent_failed___d__n
call fcn.004a8ede
add esp, 8
lea eax, [esi + 0x64]
mov byte [esi + 0x5c], 0
push eax
mov dword [esi + 0x60], vtable.lagent::Mutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
mov byte [ebp - 4], 3
push 0
mov dword [esi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x405654
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push 0x5095a4
push eax
call fcn.004ad92b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14