joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7ccb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4f0840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004a85fa
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004a85fa
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4b7d42
cmp word [ecx], dx
je 0x4b7d42
mov eax, dword [0x4e8e0c]
push edi
dec eax
push eax
push 0x4e8cf8
call fcn.004b7c6a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4b7db5
cmp word [eax], dx
je 0x4b7db5
mov eax, dword [edi]
test eax, eax
je 0x4b7d66
cmp word [eax], dx
je 0x4b7d66
lea eax, [ebp - 0x10]
push eax
call fcn.004b764d
jmp 0x4b7d6f
lea eax, [ebp - 0x10]
push eax
call fcn.004b76e8
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4b7ddf
mov eax, dword [0x4e8cf4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4e89e8
call fcn.004b7c6a
add esp, 0xc
test al, al
je 0x4b7ddf
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4b7daa
cmp word [eax], di
je 0x4b7daa
lea eax, [ebp - 0x10]
push eax
call fcn.004b764d
pop ecx
jmp 0x4b7de1
lea eax, [ebp - 0x10]
push eax
call fcn.004b76e8
jmp 0x4b7da7
mov eax, dword [edi]
test eax, eax
je 0x4b7dcc
cmp word [eax], dx
je 0x4b7dcc
lea eax, [ebp - 0x10]
push eax
call fcn.004b75e4
pop ecx
jmp 0x4b7ddf
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4b7eaa
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004b7aef
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4b7eaa
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4b7eaa
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4b7eaa
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4b7e37
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004ac954
test ebx, ebx
je 0x4b7ea5
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004ac954
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4b7eaa
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4b7eaa
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004c01b6
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4b7eac
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466875
leave
ret
Function at 0x54fb50
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi], ebp
pop eax
mov dword [edx - 0x3f], ecx
jb 0x54fb2d
mov eax, 0x447b923
lahf
in eax, dx
adc dl, byte [eax - 0x7181202]
mov dl, 0x98
cmp dword [ebp - 0x29], edx
bound esp, qword [eax]
fst dword [0xa1f4ff71]
mov eax, dword [0xe5a88143]
mov cl, 0xa5
pop ss
xlatb
loopne 0x54fbc3
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0xe5a88143]
mov cl, 0xa5
pop ss
xlatb
loopne 0x54fbc3
cmpsd dword [esi], dword es:[edi]
jnp 0x54fb2d
mov dword [edi + 0x583d87], edx
push ss
pop eax
add byte [esi], dl
add bl, byte [edi + 0x4e38c0]
rcl dword [0x525a025d]
test al, 0x1f
mov bl, 0x30
add ah, byte [ecx]
sbb byte [esi + 0x25], dl
mov bh, 0xc0
adc dl, byte [eax]
and cl, byte [edx]
test al, 0x75
mov esp, dword [ebx]
std
xor edx, dword [ebx]
push edi
jb 0x54fb62
mov byte ss:[0xb720c245], al
mov ah, 0x78
mov dl, 0xc7
dec esp
dec esi
add eax, 0xc6ce077
in al, dx
xchg ecx, eax
push 0xffffffffffffffc0
inc edi
je 0x54fb97
cmp eax, 0x7da52b1b
mov bh, 0xf1
or al, 0xba
or byte [esi], ch
fbld tbyte [edx]
call 0x3d76fd56
mov dh, 0xa6
pushfd
xlatb
adc dword [ecx + 0xf], 0xf942e654
out 0x42, al
stc
xchg edi, eax
fild word [0xa30257f0]
jl 0x54fbfc
invalid
xor dl, byte [esi + 0x5696f70c]
jo 0x54fbc9
dec edi
and eax, 0xae907f1
out 0xb4, eax
loop 0x54fbfe
inc ebp
rol eax, 1
mov word [edi + 0x3f], ss
and cl, dl
ret 0xe38c
in al, 0xa6
adc byte [eax - 0x6ca87ce3], 0xb5
mov byte [edi - 0x9a683bc], 0x15
adc byte [eax], 0x7b
and ch, dh
jl 0x54fc57
not byte [0x207b1080]
cmc
sahf
push es
aas
in eax, dx
daa
pop es
not byte [ecx - 0x20]
lodsb al, byte [esi]
inc eax
or dword [ebx + 0x6ecbc7f1], ebx
xor al, 0xcf
aam 0x3d
push esp
jbe 0x54fbef
rcl byte [esi - 0x38], cl
xor edx, esi
lahf
mov bh, 0xaf
jecxz 0x54fbbd
cmp dword [edi + 0x64], ebx
invalid
xchg ebp, eax
inc ebx
cmpsb byte [esi], byte es:[edi]
xor dl, cl
xor byte ss:[ecx], ah
cdq
iretd

Function at 0x5d7b31
Capabilities:
Encode data using xor

Disassembly:
push edx
call 0x649fe3c5
test al, 0xf4
shr byte [eax - 0x3d], cl
jmp 0x5d7b7c
sbb dl, byte [edx]
xor eax, 0x86c67e89
push edi
stc
jns 0x5d7be9
cdq
adc dh, al
pop esi
rol byte [esp + 0x5ca30814], cl
xchg cl, bh
xchg esi, eax
movsb byte es:[edi], byte [esi]
adc al, 8
mov dword [0x96f9865c], eax
out dx, al
sbb dl, byte [ebx + 0x13]
mov es, word [edx + 0x62c04996]
movsb byte es:[edi], byte [esi]
sbb eax, 0xdb164c7c
mov cs, edx
jl 0x5d7b6b
push eax
pop ecx
retf 0x69c2
xchg edx, eax
mov ss, word [eax + ebp*8 + 0x71]
aad 0x61
mov eax, 0xcee3911c
mov dh, 0x7a
and byte [edx + 0x28921586], dh
mov bl, 0xe
sbb eax, 0xd8daa2c2
mov ch, 4
cld
adc cl, byte [edi - 0x176f18ab]
stc
dec ebx
invalid
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4ff250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb6000]
push edi
or ebp, 0xffffffff
jmp 0x4ff272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ff279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ff268
mov eax, 1
add ebx, ebx
jne 0x4ff28b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ff29c
jne 0x4ff2ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ff2ac
dec eax
add ebx, ebx
jne 0x4ff2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ff280
xor ecx, ecx
sub eax, 3
jb 0x4ff2c4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ff336
sar eax, 1
mov ebp, eax
jmp 0x4ff2cf
add ebx, ebx
jne 0x4ff2cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4ff2dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4ff300
inc ecx
add ebx, ebx
jne 0x4ff2ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ff2e1
jne 0x4ff2fd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ff2e1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ff320
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ff311
jmp 0x4ff26e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ff320
add edi, ecx
jmp 0x4ff26e
pop esi
mov edi, esi
mov ecx, 0x8c1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ff33e
cmp byte [edi], 0x14
jne 0x4ff33e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4ff343
lea edi, [esi + 0xfd000]
mov eax, dword [edi]
or eax, eax
je 0x4ff3bb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1086b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1086ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ff370
mov ecx, edi
jns 0x4ff39f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1086f0]
or eax, eax
je 0x4ff3b5
mov dword [ebx], eax
add ebx, 4
jmp 0x4ff38d
call dword [esi + 0x1086f4]
popal
jmp 0x405b38

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40f251
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x34]
add esi, dword [ebp + 0xc]
mov ecx, dword [edi + 0x3c]
mov eax, esi
sub eax, ecx
je 0x40f2b7
push 0
lea edx, [ebp + 0xc]
push edx
push eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f2b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40f292
and eax, 0xffff
or eax, 0x80070000
cmp dword [edi + 0x2c], 8
mov esi, eax
jb 0x40f29f
mov edi, dword [edi + 0x18]
jmp 0x40f2a2
add edi, 0x18
push esi
push edi
push 0x403480
push 2
call fcn.00415621
add esp, 0x10
mov eax, esi
jmp 0x40f2bc
mov dword [edi + 0x3c], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x40f3fa
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x423fae
call fcn.00418bbc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
and dword [ebp - 0x30], 0
mov esi, ecx
mov ecx, edi
mov dword [ebp - 0x3c], ebx
call dword [eax + 4]
test al, al
mov ecx, edi
je 0x40f50f
call fcn.0040b97c
add eax, dword [esi + 0x34]
cmp dword [esi + 0x3c], eax
jae 0x40f44b
mov ecx, edi
call fcn.0040b97c
push eax
push ebx
mov ecx, esi
call fcn.0040f251
test eax, eax
jl 0x40f547
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.0040b984
mov ecx, eax
call fcn.00416f59
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], edi
call fcn.00411ac8
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040f13a
cmp eax, edi
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x38]
jl 0x40f4f9
push edi
lea eax, [ebp - 0x40]
push eax
call fcn.0040b984
push eax
lea ecx, [ebp - 0x38]
call fcn.00411b55
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f4f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x40f4ba
and eax, 0xffff
or eax, 0x80070000
cmp dword [esi + 0x2c], 8
mov ebx, eax
jb 0x40f4c7
mov esi, dword [esi + 0x18]
jmp 0x40f4ca
add esi, 0x18
push ebx
push esi
push 0x403500
push 2
call fcn.00415621
add esp, 0x10
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00411ad2
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040c857
mov eax, ebx
jmp 0x40f547
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00411ad2
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040c857
jmp 0x40f544
call fcn.0040b984
mov ecx, eax
call fcn.00416448
mov ebx, eax
add ebx, dword [esi + 0x34]
add ebx, dword [esi + 0xc]
cmp dword [esi + 0x3c], ebx
jae 0x40f544
mov ecx, edi
call fcn.0040b97c
push eax
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.0040f251
test eax, eax
mov dword [ebp - 0x30], eax
jl 0x40f547
mov dword [esi + 0x3c], ebx
mov eax, dword [ebp - 0x30]
call fcn.00418c3f
ret 8
Function at 0x410a70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x410aa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x410aea
and eax, 0xffff
or eax, 0x80070000
jmp 0x410aea
cmp dword [ebp - 4], 0
je 0x410ab6
mov eax, 0x80070032
jmp 0x410aea
test eax, eax
je 0x410ae8
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esi + 8], eax
je 0x410a93
push 0
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410a93
xor eax, eax
pop esi
leave
ret 4

Function at 0x411c1b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411c75
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411c66
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x411c62
cmp esi, eax
jae 0x411c66
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x411c54
cmp esi, eax
jb 0x411c6a
xor eax, eax
jmp 0x411c74
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x4128a0
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x4128f5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x41290d
push 0x80004005
call fcn.0040aea3
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x412910
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x412e40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x42817c]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.00412869
mov edi, eax
cmp edi, esi
je 0x412eaa
lea ecx, [ebp - 0x70]
call fcn.00412800
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041799b
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x412ec2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00412e40
cmp eax, esi
jne 0x412ef5
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x412eb2
lea ecx, [ebp - 0x70]
call fcn.00412800
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00412800
mov eax, esi
jmp 0x412e90
Function at 0x4143f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x42817c]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x424408
call fcn.00418b86
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x429140]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x4144ab
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040ae00
test eax, eax
jl 0x4144ab
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x414493
push edi
call fcn.0040b064
test al, al
je 0x414493
mov eax, edi
call fcn.00418760
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x41449c
push edi
lea ecx, [ebp - 0x20]
call fcn.0040b0d8
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.0040ae69
cmp eax, ebx
jne 0x4144f0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4144bb
lea ecx, [ebp]
call fcn.00412e0f
lea ecx, [ebp - 0x20]
call fcn.0040af6b
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0041799b
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x41450f
call fcn.0041271f
mov esi, eax
jmp 0x4145d9
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x41452c
call fcn.0041271f
jmp 0x4145ce
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x414522
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x414573
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x41455f
lea ecx, [ebp]
call fcn.00412e0f
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.0040af6b
mov eax, esi
jmp 0x4144c8
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00413465
mov dword [ebp - 4], 1
jmp 0x41459b
cmp dword [ebp], ebx
jne 0x4145a7
mov esi, 0x8007000e
jmp 0x4145d0
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.0040b9b9
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.00414095
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x414564
lea ecx, [ebp]
call fcn.00412e0f
jmp 0x414564
Function at 0x415703
Capabilities:
Modify service

Disassembly:
push 0x1c
mov eax, 0x4244f2
call fcn.00418b53
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], ebx
call fcn.00411ac8
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jne 0x415745
mov esi, 0x80004003
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00411ad2
mov eax, esi
call fcn.00418c2b
ret 8
push 1
push 0x408794
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [ebp - 0x18]
call fcn.004109f3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00410a24
test al, al
je 0x41579f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x415780
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x408728
push 2
call fcn.00415621
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00410a43
jmp 0x41572f
push 3
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00411b55
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
lea ecx, [ebp - 0x14]
call fcn.004109f3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00410a24
test al, al
je 0x415803
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4157e0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push dword [ebp + 8]
push 0x408698
push 2
call fcn.00415621
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410a43
jmp 0x415792
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.00411b55
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
mov esi, 0xffff
mov edi, 0x80070000
jne 0x41588d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x415834
and eax, esi
or eax, edi
cmp eax, 0x8007007a
mov dword [ebp - 0x10], eax
je 0x415870
push eax
push dword [ebp + 8]
push 0x4085f8
push 2
call fcn.00415621
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410a43
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00410a43
mov esi, dword [ebp - 0x10]
jmp 0x41572f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x28]
call fcn.00411ae9
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x415851
lea ecx, [ebp - 0x28]
call fcn.00411b55
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.00411b55
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x4158c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4158b8
and eax, esi
or eax, edi
mov esi, eax
push esi
push dword [ebp + 8]
push 0x4085f8
jmp 0x4157eb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 4], eax
je 0x415851
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00411b55
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x415851
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x415908
and eax, esi
or eax, edi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x408558
jmp 0x415847
Function at 0x415919
Capabilities:
Start service

Disassembly:
push 0x10
mov eax, 0x424525
call fcn.00418b53
lea ecx, [ebp - 0x1c]
call fcn.00411ac8
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
jne 0x415954
mov esi, 0x80004003
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00411ad2
mov eax, esi
call fcn.00418c2b
ret 8
push 1
push 0x408794
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [ebp - 0x10]
call fcn.004109f3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00410a24
test al, al
je 0x4159ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x41598f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x408728
push 2
call fcn.00415621
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00410a43
jmp 0x41593e
push 0x14
push edi
lea ecx, [ebp - 0x10]
call fcn.00411b55
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
lea ecx, [ebp - 0x14]
call fcn.004109f3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00410a24
test al, al
je 0x415a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4159ed
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push edi
push 0x408698
push 2
call fcn.00415621
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410a43
jmp 0x4159a1
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.00411b55
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x415a41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x415a37
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070420
jne 0x415a5f
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00410a43
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00410a43
xor esi, esi
jmp 0x41593e
cmp byte [ebp + 0xc], bl
je 0x415a6c
cmp esi, 0x8007042c
je 0x415a00
cmp esi, 0x80070433
je 0x415a00
push esi
push edi
push 0x4087a8
jmp 0x4159f6

Function at 0x415ac7
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov esi, 0x3e8
push edi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x415b0b
mov eax, dword [edi + 4]
cmp eax, dword [esp + 0x14]
jne 0x415b35
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, esi
cmp ebx, 0x1d4c0
jb 0x415ad7
mov eax, 0x8007041d
pop edi
pop esi
pop ebx
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x415b1f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x408838
push 2
call fcn.00415621
add esp, 0xc
mov eax, esi
jmp 0x415b05
xor eax, eax
jmp 0x415b05