joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x48f008]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push pe_nt_image_headers32
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.00441560
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x20]
mov dword [ebx + 4], edi
call fcn.004344d0
mov edx, eax
add esp, 0x10
mov dword [esp + 0xc], edx
test edx, edx
jne 0x435654
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x43563e
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x492680]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x492780]
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4944a8]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4934a8]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4938a8]
mov dword [edi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x492680]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4944a8]
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4934a8]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x492780]
movzx eax, bl
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4938a8]
mov dword [edi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x492680]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4944a8]
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4934a8]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x492780]
movzx eax, bl
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4938a8]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x492680]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4944a8]
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4934a8]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x492780]
movzx eax, bl
movzx eax, byte [eax + 0x492680]
xor edx, dword [eax*4 + 0x4938a8]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x4354e0
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, pe_nt_image_headers32
lea ecx, [esp + 0x10]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x435660
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
Function at 0x4361b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
test al, 0xf
je 0x4361cc
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x436317
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test edx, edx
jne 0x436263
mov ebx, dword [ebp + 0xc]
dec eax
mov ecx, dword [ebp + 0x10]
mov edi, ebx
shr eax, 4
sub edi, esi
inc eax
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
movups xmm0, xmmword [ecx]
mov edx, ecx
mov ecx, dword [ebp - 4]
push esi
movups xmmword [ebp - 0x20], xmm0
call fcn.00435c20
lea eax, [ebx + 0xf]
add esp, 4
cmp esi, eax
ja 0x436231
lea eax, [esi + 0xf]
cmp eax, ebx
jb 0x436231
mov ecx, esi
mov edx, 0x10
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x436221
jmp 0x43623e
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
mov ecx, dword [ebp + 8]
add esi, 0x10
movups xmm0, xmmword [ebp - 0x20]
add ecx, 0x10
sub edi, 0x10
sub dword [ebp - 8], 1
movups xmmword [ebx], xmm0
mov dword [ebp + 8], ecx
jne 0x4361f7
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
lea edx, [eax - 1]
mov edi, dword [ebp + 0x10]
mov ebx, ecx
sub ebx, edi
shr edx, 4
inc edx
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
nop dword [eax]
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x43628e
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x43629c
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x4362ca
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x4362ca
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 8]
sub ebx, edi
mov edx, 0x10
nop word [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x4362b0
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
jmp 0x4362d7
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp - 0x10], 1
mov edx, esi
mov ecx, dword [ebp - 4]
push esi
jne 0x4362ea
call fcn.00435690
jmp 0x4362ef
call fcn.00435c20
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0xc]
sub ebx, 0x10
add esi, 0x10
mov dword [ebp + 8], ebx
add esp, 4
mov dword [ebp - 8], esi
add edi, 0x10
sub dword [ebp - 0xc], 1
movups xmmword [ecx], xmm0
jne 0x436280
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x437d50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, edx
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437d6c
pop edi
lea eax, [edx + 0x57]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x437d79
mov eax, dword [esi]
xor ecx, ecx
push ebx
mov word [eax], cx
mov ebx, 0x200
lea eax, [ebx + ebx]
cmp edi, 0x7a
mov ecx, esi
cmovne eax, ebx
mov ebx, eax
mov edx, ebx
call fcn.00414e60
test al, al
je 0x437e07
mov ecx, dword [esi + 0x14]
mov eax, esi
cmp ecx, 8
jb 0x437da8
mov eax, dword [esi]
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x437dca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x7a
je 0x437d84
test edi, edi
je 0x437dcc
jmp 0x437e0c
xor edi, edi
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x437dd6
mov eax, dword [esi]
xor edx, edx
test eax, eax
je 0x437df0
mov edx, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x437de1
sub edx, ecx
sar edx, 1
mov ecx, esi
call fcn.00414e60
test al, al
jne 0x437e20
pop ebx
pop edi
mov eax, 0x7a
pop esi
mov esp, ebp
pop ebp
ret
mov edi, 0x7a
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x437e1b
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4387c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456cdd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x48f008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
push 0x20
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0043ff45
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00438350
mov esi, eax
test esi, esi
jne 0x43896a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x43883d
mov esi, 0xe8
jmp 0x43896a
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x4388aa
nop dword [eax]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov edi, dword [esi]
jb 0x43886d
mov eax, dword [eax]
test eax, eax
je 0x4388a1
push str.jsdlp_devflt
push eax
call fcn.00445736
add esp, 8
test eax, eax
jne 0x4388a1
mov eax, dword [ebp - 0x24]
dec dword [eax + 4]
mov ecx, dword [esi]
mov dword [esi], 0
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov dword [ebp - 0x1c], esi
mov esi, edi
cmp edi, ebx
jne 0x438860
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
call fcn.00438b80
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
je 0x438833
test eax, eax
jne 0x43895d
cmp dword [edi + 0x2c], eax
je 0x4388d6
cmp dword [edi + 0x30], 8
lea eax, [edi + 0x1c]
jb 0x4388d6
mov eax, dword [eax]
push 0
push eax
push 1
push 0x20006
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKeyExW]
mov esi, eax
mov dword [ebp - 0x24], vtable.kn::auto_handle_struct_HKEY_____struct_kn::system::registry_key_delete_.0
mov dword [ebp - 0x20], esi
test esi, esi
je 0x43894b
cmp esi, 0xffffffff
je 0x43894b
mov ecx, edi
mov dword [ebp - 0x3c], vtable.kn::auto_handle_struct_HKEY_____struct_kn::system::registry_key_delete_.0
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x40], 0
call fcn.00437c30
test eax, eax
jne 0x43893f
lea esi, [eax + 0x57]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x44], vtable.kn::system::registry_object.0
mov dword [ebp - 0x38], 0
call fcn.0041f580
lea ecx, [ebp - 0x24]
call fcn.0041f580
jmp 0x43896a
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
jmp 0x43891f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.0041f580
jmp 0x43896a
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00438480
mov esi, eax
mov edx, dword [ebp - 0x18]
call fcn.00433cc0
push 0x20
push dword [ebp - 0x18]
call fcn.0043fc69
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456dbd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, 7
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
mov word [ebp - 0x28], cx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edi, dword [edi]
mov esi, dword [edi]
cmp esi, edi
je 0x439108
nop word [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
jb 0x43907c
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x18]
lea ecx, [ebp - 0x28]
inc eax
push eax
call fcn.004064b0
add esp, 4
test al, al
je 0x4390a9
mov esi, dword [esi]
cmp esi, edi
jne 0x439070
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test edx, edx
je 0x439108
lea edx, [edx*2 + 2]
jmp 0x43910a
mov esi, 0x7a
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4390e8
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4390de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43917a
push edx
push ecx
call fcn.0043fc69
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov ecx, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
mov edi, dword [ebx + 0xc]
cmp eax, 8
cmovae esi, ecx
test edi, edi
je 0x439147
test edx, edx
je 0x439147
test esi, esi
je 0x439147
push edx
push esi
push 7
push 0
push dword [ebp - 0x2c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x4390ae
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x43914c
mov esi, 0x57
cmp eax, 8
jb 0x4390e8
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4390de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4390de
call fcn.0044316c
int3
Function at 0x43a8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, edx
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
push esi
lea esi, [eax - 0x21524111]
mov edx, esi
mov dword [ebp - 4], edx
push edi
mov edi, esi
cmp eax, 0xc
jbe switch.0x0043a9b3
lea ecx, [eax - 0xd]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 0xc], eax
nop dword [eax]
movzx ecx, byte [ebx + 7]
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 5]
add edx, esi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 4]
shl ecx, 8
add edi, eax
movzx eax, byte [ebx + 0xa]
add edi, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov esi, edx
add ecx, eax
rol esi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ebx, 0xc
add ecx, eax
sub ecx, edx
add edx, edi
add ecx, dword [ebp - 4]
xor esi, ecx
sub edi, esi
mov eax, esi
rol eax, 6
add esi, edx
xor eax, edi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, esi
xor ecx, edx
sub esi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, esi
sub eax, edx
mov edi, edx
ror edi, 0xd
add edx, ecx
xor edi, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov esi, edi
sub ecx, edi
rol esi, 4
sub eax, 0xc
xor esi, ecx
add edi, edx
mov dword [ebp - 8], eax
sub dword [ebp - 0xc], 1
jne 0x43a8f0
cmp eax, 0xc
ja 0x43aa1f
jmp dword [eax*4 + 0x43aa6c]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 8]
add esi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edx, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add edx, eax
movzx eax, byte [ebx]
add edx, eax
mov dword [ebp - 4], edx
xor esi, edi
mov eax, edi
rol eax, 0xe
sub esi, eax
mov eax, esi
mov edx, esi
xor edx, dword [ebp - 4]
rol eax, 0xb
sub edx, eax
xor edi, edx
mov eax, edx
ror eax, 7
sub edi, eax
mov eax, edi
xor esi, edi
rol eax, 0x10
sub esi, eax
mov eax, esi
mov ecx, esi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor edi, ecx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor esi, edi
ror eax, 8
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x48f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x38], eax
mov esi, edx
test edi, edi
je 0x43e00d
test esi, esi
je 0x43e00d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43def1
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
sub esp, 0xc
lea ecx, [ebp - 0x34]
push edi
call fcn.0043f500
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x43df1f
lea ecx, [ebp - 0x34]
call fcn.0043cca0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
test eax, eax
je 0x43df2f
cmp eax, 0xffffffff
jne 0x43dfbe
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0xf01ff
cmovae eax, dword [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
test eax, eax
je 0x43df5b
cmp eax, 0xffffffff
jne 0x43df64
call edi
test eax, eax
jne 0x43dfb7
mov eax, dword [ebp - 8]
test eax, eax
je 0x43dfbe
cmp eax, 0xffffffff
je 0x43dfbe
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x43df95
call edi
lea ecx, [ebp - 0x34]
call fcn.0043cca0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x34]
mov dword [ebp - 8], 0
call fcn.0043cca0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
cmp eax, 0x424
je 0x43dfd9
lea ecx, [ebp - 0x34]
call fcn.0043cca0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
sub esp, 0xc
push dword [ebp - 0x38]
push ebx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
push dword [ebp + 8]
push esi
call fcn.0043f600
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.0043cca0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
Function at 0x43e110
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x48f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
test ecx, ecx
je 0x43e1e9
sub esp, 0xc
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043f500
cmp dword [ebp - 0x30], 0
jne 0x43e1e1
mov eax, dword [ebp - 8]
test eax, eax
je 0x43e151
cmp eax, 0xffffffff
jne 0x43e1e1
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0xf01ff
cmovae eax, dword [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x43e177
cmp eax, 0xffffffff
jne 0x43e184
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43e1e1
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x38], 0
push ecx
push 0x24
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0
push ecx
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x58], xmm0
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x43e1bb
cmp dword [ebp - 0x54], 1
setne bl
mov eax, dword [ebp - 8]
test eax, eax
je 0x43e1e1
cmp eax, 0xffffffff
je 0x43e1e1
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x43e1da
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43e1e1
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.0043cca0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
Function at 0x43e200
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x48f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
test ecx, ecx
jne 0x43e22b
lea eax, [ecx + 0x57]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
sub esp, 0xc
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043f500
mov esi, dword [ebp - 0x30]
test esi, esi
jne 0x43e363
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [ebp - 8]
test eax, eax
je 0x43e266
cmp eax, 0xffffffff
je 0x43e266
mov esi, 0xb7
jmp 0x43e320
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0xf01ff
cmovae eax, dword [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x43e28c
cmp eax, 0xffffffff
jne 0x43e29b
call edi
mov esi, eax
test esi, esi
jne 0x43e320
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x38], 0
push ecx
push 0x24
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0
push ecx
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x58], xmm0
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x43e2cf
call edi
jmp 0x43e31e
mov eax, dword [ebp - 0x54]
cmp eax, 1
jne 0x43e2de
mov esi, 0x435
jmp 0x43e320
cmp eax, 3
jne 0x43e2f6
push 0
push 1
push eax
lea ecx, [ebp - 0x34]
call fcn.0043f9b0
mov esi, eax
test esi, esi
je 0x43e320
lea eax, [ebp - 0x58]
push eax
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x43e30d
call edi
jmp 0x43e31e
push 0x2710
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.0043f9b0
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x43e342
cmp eax, 0xffffffff
je 0x43e342
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x43e33b
call edi
jmp 0x43e342
mov dword [ebp - 8], 0
test esi, esi
je 0x43e363
cmp esi, 0x435
je 0x43e363
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x43e250
lea ecx, [ebp - 0x34]
call fcn.0043cca0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
Function at 0x43f380
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, edx
xor ebx, ebx
mov dword [ebp - 8], eax
push esi
mov esi, ecx
test eax, eax
jne 0x43f39e
pop esi
lea eax, [edx + 0x57]
pop ebx
mov esp, ebp
pop ebp
ret
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x43f3c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x43f3d6
push eax
call fcn.0043ff40
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
push 0x4582b0
push edi
call fcn.0043fc9a
add esp, 8
mov dword [esi + 4], eax
test eax, eax
je 0x43f411
push eax
push edi
push dword [ebp - 4]
mov dword [esi + 0xc], edi
push dword [ebp - 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x43f408
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x7a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f850
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x48f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0043cd60
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x43f87e
mov esi, 0xb7
jmp 0x43f95b
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x43f889
mov eax, dword [eax]
push 0xf01ff
push eax
push dword [edi + 0x24]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [edi + 0x2c], eax
test eax, eax
je 0x43f8a4
cmp eax, 0xffffffff
jne 0x43f8b0
call ebx
mov esi, eax
test esi, esi
jne 0x43f95b
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], 0
push eax
push 0x24
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push eax
push 0
push dword [edi + 0x2c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x43f8e8
call ebx
mov esi, eax
jmp 0x43f95b
mov eax, dword [ebp - 0x24]
cmp eax, 1
je 0x43f8fc
cmp eax, 3
je 0x43f8fc
mov esi, 0x420
jmp 0x43f95b
push 0x2710
push 1
push 3
mov ecx, edi
call fcn.0043f9b0
mov esi, eax
test esi, esi
jne 0x43f95b
push eax
push eax
push dword [edi + 0x2c]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x43f927
call ebx
mov esi, eax
jmp 0x43f95b
push 0
push 1
push 2
mov ecx, edi
call fcn.0043f9b0
lea eax, [ebp - 0x2c]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push dword [edi + 0x2c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x43f953
call ebx
mov esi, eax
jmp 0x43f95b
cmp dword [ebp - 0x24], 4
cmovne esi, dword [ebp - 0x1c]
mov edx, dword [edi + 0x2c]
test edx, edx
je 0x43f999
cmp edx, 0xffffffff
je 0x43f999
mov ecx, edi
call fcn.0043cd60
test al, al
je 0x43f999
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x43f992
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fc58
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x2c], 0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043fc58
mov esp, ebp
pop ebp
ret