joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45560c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4556e4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d9a0c], 0
jne 0x4556c8
lea eax, [ebp - 4]
mov edx, 0x4556fc
call fcn.0046f0e4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0046f490
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4556c8
mov eax, ebx
call fcn.0046dcb4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4556c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x4556ab
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45570c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4556ab
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4d9a0c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4556c8
mov eax, dword [ebp - 0xc]
call fcn.0046dccc
ret
mov ebx, dword [0x4d9a0c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4556eb
lea eax, [ebp - 4]
call fcn.0046f04c
ret

Function at 0x45b3fc
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4d9a30], 0
jne 0x45b41f
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x45b380
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4d9a30], eax
ret

Function at 0x4698c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4698fd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0046f134
jmp 0x469906
mov eax, ebx
mov edx, esi
call fcn.0046f0a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x469910
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x469931
mov al, byte [esp]
jmp 0x469933
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x46def8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x46df27
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0046f134
jmp 0x46df45
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0046de80
mov edi, eax
test ebx, ebx
je 0x46df45
cmp dword [esi], 0
je 0x46df45
dec ebx
jmp 0x46df2e
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x46e268
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d31a4]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x46e300
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46e2e0
xor eax, eax
push ebp
push 0x46e2d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x46e31c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e2e0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4d31a4]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d31a4], ax
mov esp, ebp
pop ebp
ret

Function at 0x46f000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0046dcb4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4d9cc1], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x46efc8
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x47057c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x470738
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4705dd
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x470754
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x47064f
xor eax, eax
push ebp
push 0x470648
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004703d4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x470631
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x470774
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47064f
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x470730
cmp byte [ebp - 0xd], 0
jne 0x470691
cmp byte [ebp - 0x12], 0
je 0x470730
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4706aa
dec ebx
cmp byte [ebx], 0x2e
je 0x4706b9
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4706a9
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x470730
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4706e6
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x470730
cmp byte [ebp - 0xd], 0
je 0x470730
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x470730
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470b24
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x470c0c
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x4da0a4], 1
jae 0x470bfe
xor eax, eax
mov dword [0x4d9cb0], eax
xor eax, eax
mov dword [0x4d9cb8], eax
xor eax, eax
mov dword [0x4d9cbc], eax
mov byte [0x4d9cc2], 2
mov byte [0x4d9cc3], 2
mov byte [0x4d9cc4], 3
mov word [0x4da06c], 0
mov word [0x4da07c], 1
mov word [0x4da08c], 0xa
mov dword [0x4da094], 0x80020004
mov dword [0x4da060], 0x46fd10
mov dword [0x4da064], 0x46fd08
mov dword [0x4da068], 0x46fd10
call fcn.0046e238
test al, al
je 0x470bbd
call fcn.0046e268
call fcn.0046e32c
mov eax, 0x4d9cc8
mov edx, 0x470c18
call fcn.0046ba0a
mov eax, 0x4d9e94
mov edx, 0x470c18
call fcn.0046ba0a
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4d9ca8], eax
call fcn.0046c970
mov dword [0x4d9ca4], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4d9c9c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470c13
ret

Function at 0x472ce8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x472d04
call fcn.0047406c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x472d20
test bl, 1
je 0x472d20
call fcn.00477aa0
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x472f04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00473c08
test byte [ebp + 0xd], 0xc0
jne 0x472f28
mov eax, dword [0x4d40c8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x472f35
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x472f62
je 0x472f74
sub ecx, 0x100
je 0x472f82
sub ecx, 0x100
je 0x472f89
sub ecx, 0x100
je 0x472f7b
jmp 0x472f90
sub ecx, 0x600
je 0x472f89
sub ecx, 0x100
je 0x472f74
jmp 0x472f90
mov edi, 1
jmp 0x472f95
mov edi, 2
jmp 0x472f95
mov edi, 4
jmp 0x472f95
mov edi, 5
jmp 0x472f95
mov edi, 3
test byte [ebp + 0xd], 1
je 0x472fbc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4d3b40]
test al, 0x80
je 0x472fb5
mov ebx, 0x80
jmp 0x472fce
mov ebx, 1
jmp 0x472fce
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x472fce
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x472fe0
je 0x472fe9
dec eax
je 0x472ff2
jmp 0x472ffb
mov dword [ebp - 4], 0x80000000
jmp 0x47300a
mov dword [ebp - 4], 0x40000000
jmp 0x47300a
mov dword [ebp - 4], 0xc0000000
jmp 0x47300a
push 1
call fcn.00474000
pop ecx
mov ebx, eax
jmp 0x4730fa
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x473026
sub eax, 0x10
je 0x47302d
sub eax, 0x10
je 0x473036
sub eax, 0x10
je 0x47303f
jmp 0x47303f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x473046
mov dword [ebp - 8], 1
jmp 0x473046
mov dword [ebp - 8], 2
jmp 0x473046
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4730b3
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4730a8
test byte [ebp + 0xd], 1
je 0x4730a3
mov ebx, 0x50
jmp 0x4730a8
mov ebx, 2
push ebx
call fcn.00474000
pop ecx
mov ebx, eax
jmp 0x4730fa
mov edi, esi
push edi
call fcn.00472e68
pop ecx
test eax, eax
je 0x4730c7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4730d3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00473d28
add esp, 8
mov ebx, eax
inc eax
jne 0x4730fa
push 4
call fcn.00474000
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00473c3c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477a38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x477a9a
call fcn.004779e8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00471be0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00471be0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x477b18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4d4f68], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x477bf2
cmp dword [0x4d4f64], 0
jne 0x477bf2
cmp dword [0x4d5148], 0
je 0x477bac
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004778e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x477b92
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004778e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x477b92
lea ebx, [ebp - 0x84]
jmp 0x477b93
inc ebx
call fcn.00477ad4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x477c2d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4d4f6c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00471be0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4d4f6f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x477c2d
cmp dword [0x4d4f64], 0
je 0x477c0c
cmp dword [0x4d4f64], 0xffffffff
je 0x477c2d
push esi
call dword [0x4d4f64]
pop ecx
mov eax, dword [0x4d4f68]
test eax, eax
je 0x477c2d
cmp dword [0x4d4f68], 0xffffffff
je 0x477c2d
cmp byte [eax], 0
je 0x477c2d
push esi
push eax
call fcn.00477a38
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4783c4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4da9ac], 0
jne 0x478445
cmp dword [0x4da9cc], 0
jne 0x4783f4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4da9cc], eax
test eax, eax
jne 0x4783f4
push str.GetEnvironmentStrings_failed
call fcn.00477c44
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4da9cc]
jmp 0x478408
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00471be0
pop ecx
mov edi, eax
test eax, eax
jne 0x478400
lea edi, [ebp + 1]
push edi
call fcn.00471620
pop ecx
mov ebx, eax
mov dword [0x4da9b0], ebx
test ebx, ebx
jne 0x478432
xor eax, eax
jmp 0x478508
push edi
mov edx, dword [0x4da9cc]
push edx
push ebx
call fcn.00471a90
add esp, 0xc
jmp 0x478465
xor esi, esi
mov ebx, dword [0x4da9ac]
jmp 0x47845f
push eax
call fcn.00471be0
pop ecx
test eax, eax
jne 0x47845b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x47844f
lea ebx, [esi + 4]
push 4
mov dword [0x4da9b4], ebx
inc ebx
push ebx
call fcn.004710f8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x478488
xor eax, eax
jmp 0x478508
cmp dword [0x4da9ac], 0
jne 0x4784b9
xor esi, esi
mov ebx, dword [0x4da9b0]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4784aa
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00471be0
pop ecx
mov edi, eax
test eax, eax
jne 0x4784a0
jmp 0x4784ea
xor esi, esi
mov ebx, dword [0x4da9ac]
mov eax, dword [esp]
mov edi, eax
jmp 0x4784e4
push eax
call fcn.00471be0
pop ecx
test eax, eax
je 0x4784d9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4784dd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4784c8
mov eax, dword [0x4da9ac]
test eax, eax
je 0x4784fa
push eax
call fcn.00471630
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4da9ac], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47e9b4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47e9e2
mov eax, ebx
call fcn.0047f458
cmp dword [ebx + 0x3c], 0
je 0x47e9db
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47ea53
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x47ea45
cmp dword [ebx + 8], 0
je 0x47ea04
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x47ea16
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47ea45
cmp dword [ebx + 8], 0
je 0x47e9f7
cmp eax, 3
je 0x47ea29
dec eax
jne 0x47e9f7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47e9f7
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x47e9f7
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47ea71
cmp dword [ebx + 0x10], 0xcc
je 0x47ea71
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047ea7c
pop ebx
ret
Function at 0x406ab0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x600f80]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x406af5
xorps xmm0, xmm0
movq qword [esp + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0xc], esi
call fcn.00569210
mov dword [esp + 0x10], eax
test esi, esi
jne 0x406b08
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
mov edx, 0x5db610
lea ecx, [esp + 0xc]
call fcn.00406920
int3
Function at 0x407420
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov esi, ecx
mov dword [ebp - 0xc], 0
test eax, eax
mov dword [ebp - 8], 0
mov ecx, 1
cmovne edi, ecx
cmp dword [esi + 0x13c], 0
jne 0x40746f
lea eax, [esi + 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x13c]
test eax, eax
je 0x407493
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push edi
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x14

Function at 0x407520
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x60e520]
push edi
push str.Entering_CNTService::ServiceMain__
push esi
call fcn.00407b00
add esp, 8
cmp dword [esi + 0x134], 0
je 0x4075ca
push 0x4078d0
lea edi, [esi + 4]
mov dword [esi + 0x118], 2
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [esi + 0x110], eax
test eax, eax
jne 0x4075ca
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x13c], eax
jne 0x407591
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x13c]
test eax, eax
je 0x40764c
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
push 0x67
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.004076b0
test eax, eax
je 0x407606
mov eax, dword [esi]
mov ecx, esi
push 0
mov dword [esi + 0x130], 1
mov dword [esi + 0x120], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
call dword [eax + 0x10]
push 1
push dword [esi + 0x110]
push str.CNTService::SetStatus__lu___lu_
push esi
call fcn.00407b00
mov ecx, dword [esi + 0x110]
add esp, 0x10
mov dword [esi + 0x118], 1
test ecx, ecx
je 0x40763e
lea eax, [esi + 0x114]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push str.Leaving_CNTService::ServiceMain__
push esi
call fcn.00407b00
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 8
Function at 0x4076b0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
push str.Entering_CNTService::Initialize__
push edi
call fcn.00407b00
push 2
push dword [edi + 0x110]
push str.CNTService::SetStatus__lu___lu_
push edi
call fcn.00407b00
mov ecx, dword [edi + 0x110]
add esp, 0x18
mov ebx, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [edi + 0x118], 2
test ecx, ecx
je 0x407709
lea eax, [edi + 0x114]
push eax
push ecx
call ebx
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [edi + 0x120], eax
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
pop esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jne 0x4077d5
cmp dword [edi + 0x13c], 0
jne 0x40776c
lea eax, [edi + 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [edi + 0x13c], eax
mov eax, dword [edi + 0x13c]
test eax, eax
je 0x40778f
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
push 0x68
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push 1
push dword [edi + 0x110]
push str.CNTService::SetStatus__lu___lu_
push edi
call fcn.00407b00
mov ecx, dword [edi + 0x110]
add esp, 0x10
mov dword [edi + 0x118], 1
test ecx, ecx
je 0x4077c3
lea eax, [edi + 0x114]
push eax
push ecx
call ebx
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x13c], 0
jne 0x4077f0
lea eax, [edi + 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [edi + 0x13c], eax
mov eax, dword [edi + 0x13c]
test eax, eax
je 0x407813
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
push 0x69
push 0
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push 4
push dword [edi + 0x110]
push str.CNTService::SetStatus__lu___lu_
push edi
call fcn.00407b00
mov ecx, dword [edi + 0x110]
add esp, 0x10
mov dword [edi + 0x118], 4
test ecx, ecx
je 0x407847
lea eax, [edi + 0x114]
push eax
push ecx
call ebx
push str.Leaving_CNTService::Initialize__
push edi
call fcn.00407b00
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 1
pop edi
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x407b00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [esi + 4]
push eax
push str.__s___lu_:
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.0053d0d6
add esp, 0x14
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407b45
lea ecx, [ebp + 0x10]
sub eax, edx
push ecx
push dword [ebp + 0xc]
mov ecx, 0x800
sub ecx, eax
push ecx
lea ecx, [ebp - 0x804]
add eax, ecx
push eax
call fcn.0053e08f
push 0xffffffffffffffff
push 0x5dba44
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.0053d744
add esp, 0x20
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret

Function at 0x407d80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x600f80]
xor eax, esp
mov dword [esp + 0x1a0], eax
push esi
push 0xa989b8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x407dc6
lea eax, [esp + 0x10]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0xa989bc
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp byte [ebp + 8], 0
je 0x407ddd
push 0
push 0xa989bc
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x407df4
mov ecx, dword [esp + 0x1a4]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 4
xorps xmm0, xmm0
movq qword [esp + 8], xmm0
mov dword [esp + 8], eax
call fcn.00569210
mov edx, str.winsock
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
call fcn.00406920
int3