joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006923
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x101078c], 0
push ebx
push esi
push edi
push ebp
jne 0x1006967
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100694b
mov dword [0x101078c], 1
jmp 0x100696b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x1006a76
mov dword [0x101078c], 2
jmp 0x100696f
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
cmp dword [0x101078c], 1
jne 0x1006a0a
test esi, esi
jne 0x1006990
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1006a76
cmp word [esi], 0
mov edi, esi
je 0x10069aa
add edi, 2
cmp word [edi], 0
jne 0x1006998
add edi, 2
cmp word [edi], 0
jne 0x1006998
sub edi, esi
xor ebx, ebx
sar edi, 1
push ebx
inc edi
push ebx
push ebx
push ebx
push edi
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x1006a01
push eax
call fcn.01008440
add esp, 4
mov ebp, eax
cmp ebp, ebx
je 0x1006a01
push ebx
push ebx
push dword [esp + 0x18]
push ebp
push edi
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x10069f6
push ebp
call fcn.01008428
add esp, 4
xor ebp, ebp
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebp
jmp 0x1006a78
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1006a76
cmp dword [0x101078c], 2
jne 0x1006a76
test ebx, ebx
jne 0x1006a23
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x1006a76
mov ebp, ebx
cmp byte [ebx], 0
je 0x1006a38
inc ebp
cmp byte [ebp], 0
jne 0x1006a2a
inc ebp
cmp byte [ebp], 0
jne 0x1006a2a
sub ebp, ebx
inc ebp
push ebp
call fcn.01008440
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x1006a55
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x1006a76
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
jmp 0x1006a78
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x1006ee6
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.010080c0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10109cc], eax
cmp eax, 0xffffffff
je 0x1006f3e
push 0x74
push 1
call fcn.0100849e
add esp, 8
mov esi, eax
test esi, esi
je 0x1006f3e
push esi
mov eax, dword [0x10109cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1006f3e
push esi
call fcn.01006f42
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
jmp 0x1006f40
xor eax, eax
pop esi
ret
Function at 0x1006f55
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x10109cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1006fb8
push 0x74
push 1
call fcn.0100849e
add esp, 8
mov esi, eax
test esi, esi
je 0x1006fae
push esi
mov eax, dword [0x10109cc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1006fae
push esi
call fcn.01006f42
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
jmp 0x1006fb8
push 0x10
call fcn.01005e3c
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
Function at 0x1007105
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x10109d8
mov ebp, esp
sub esp, 0x1ac
push ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
push edi
cmp dword [eax], ecx
je 0x1007131
add eax, 8
inc dword [ebp - 4]
cmp eax, 0x1010a60
jb 0x1007120
mov eax, dword [ebp - 4]
cmp dword [eax*8 + 0x10109d8], ecx
jne 0x10072d9
cmp dword [0x1010480], 1
je 0x100729b
cmp dword [0x1010480], 0
jne 0x1007164
cmp dword [0x1010484], 1
je 0x100729b
cmp ecx, 0xfc
je 0x10072d9
push 0x104
lea eax, [ebp - 0x1ac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100719d
mov esi, 0x100169c
lea edi, [ebp - 0x1ac]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x1ac]
mov edx, 0xffffffff
mov edi, ebx
mov ecx, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x10071d8
mov edi, ebx
mov ecx, edx
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
push 0x1001698
lea ebx, [ecx + ebp - 0x1e8]
push ebx
call fcn.01008580
add esp, 0xc
mov esi, 0x100167c
lea edi, [ebp - 0xa8]
mov ecx, 6
mov edx, 0xffffffff
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebx
mov ecx, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
mov ecx, edx
lea edi, [ebp - 0xa8]
sub eax, eax
repne scasb al, byte es:[edi]
add edi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1001678
mov ecx, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
mov ecx, edx
lea edi, [ebp - 0xa8]
sub eax, eax
repne scasb al, byte es:[edi]
add edi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
mov ecx, edx
mov edi, dword [eax*8 + 0x10109dc]
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
lea edi, [ebp - 0xa8]
mov ecx, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x12010
and ecx, 3
push 0x1001650
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xa8]
push eax
call fcn.010084e8
add esp, 0xc
jmp 0x10072d9
mov eax, dword [0x1017730]
mov edx, dword [eax + 0x48]
cmp edx, 0xffffffff
jne 0x10072b2
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, eax
mov eax, dword [ebp - 4]
push 0
lea ecx, [ebp - 8]
mov esi, dword [eax*8 + 0x10109dc]
push ecx
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10086ef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0x10], esi
jne 0x100870c
xor eax, eax
jmp 0x1008873
mov ecx, dword [ebp + 8]
mov eax, ecx
mov edi, ecx
and al, 0xe7
and edi, 0x1f
sar eax, 3
add eax, 0x1017730
mov dword [ebp - 8], eax
mov edx, dword [eax]
imul edi, edi, 0x24
test byte [edx + edi + 4], 0x20
je 0x100873c
push 2
push 0
push ecx
call fcn.010088eb
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, edi
test byte [ecx + 4], 0x80
je 0x10087d3
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x1008800
lea ebx, [ebp - 0x418]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x10087a1
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov al, byte [eax]
cmp al, 0xa
jne 0x100878d
inc dword [ebp - 0x14]
mov byte [ebx], 0xd
inc ebx
lea ecx, [ebp - 0x418]
mov byte [ebx], al
inc ebx
mov eax, ebx
sub eax, ecx
cmp eax, 0x400
jl 0x100876f
lea eax, [ebp - 0x418]
push 0
sub ebx, eax
lea ecx, [ebp - 0x418]
lea eax, [ebp - 0xc]
push eax
push ebx
push ecx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
push dword [edx + edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10087f7
add esi, dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jge 0x100875a
jmp 0x1008800
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10087f7
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0xc]
jmp 0x1008800
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test esi, esi
jne 0x100886e
cmp dword [ebp - 4], 0
je 0x1008839
cmp dword [ebp - 4], 5
jne 0x1008827
call fcn.01009cbb
mov dword [eax], 9
call fcn.01009cc4
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x1008832
push dword [ebp - 4]
call fcn.01009c48
add esp, 4
mov eax, 0xffffffff
jmp 0x1008873
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
test byte [ecx + edi + 4], 0x40
je 0x1008851
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x1008851
xor eax, eax
jmp 0x1008873
call fcn.01009cbb
mov dword [eax], 0x1c
call fcn.01009cc4
mov dword [eax], 0
mov eax, 0xffffffff
jmp 0x1008873
mov eax, esi
sub eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a186
Capabilities:
Get geographical location

Disassembly:
push ebp
mov eax, dword [0x1011a1c]
mov ebp, esp
xor ecx, ecx
push ebx
test eax, eax
push esi
push edi
jne 0x100a1ab
push ecx
push ecx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100a1cc
mov eax, 1
mov dword [0x1011a1c], eax
cmp eax, 1
jne 0x100a1e4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x100a258
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100a256
mov eax, 2
jmp 0x100a1ab
mov dword [0x1011a1c], eax
cmp eax, 2
jne 0x100a258
mov esi, dword [ebp + 0x18]
test esi, esi
jne 0x100a1fb
mov esi, dword [0x1010cc8]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebx, eax
test ebx, ebx
je 0x100a256
push ebx
call fcn.01008440
add esp, 4
mov edi, eax
test edi, edi
je 0x100a256
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100a24d
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
jne 0x100a25d
push ebx
push ebx
push 0xffffffffffffffff
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
mov esi, eax
jne 0x100a275
push edi
call fcn.01008428
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x100a24d
push edi
call fcn.01008428
add esp, 4
mov eax, esi
jmp 0x100a258
Function at 0x100a282
Capabilities:
Get geographical location

Disassembly:
push ebp
mov eax, dword [0x1011a20]
mov ebp, esp
xor ecx, ecx
push ebx
test eax, eax
push esi
push edi
jne 0x100a2a7
push ecx
push ecx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100a2c8
mov eax, 2
mov dword [0x1011a20], eax
cmp eax, 2
jne 0x100a2e4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x100a364
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100a362
mov eax, 1
jmp 0x100a2a7
mov dword [0x1011a20], eax
cmp eax, 1
jne 0x100a364
mov esi, dword [ebp + 0x18]
test esi, esi
jne 0x100a2fb
mov esi, dword [0x1010cc8]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
test ebx, ebx
je 0x100a362
lea eax, [ebx*2]
push eax
call fcn.01008440
add esp, 4
mov edi, eax
test edi, edi
je 0x100a362
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100a359
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
jne 0x100a369
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
push 0x220
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
mov esi, eax
jne 0x100a388
push edi
call fcn.01008428
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push 0x220
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x100a359
push edi
call fcn.01008428
add esp, 4
mov eax, esi
jmp 0x100a364

Function at 0x100c000
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, edi
shr ecx, 2
mov edx, ecx
dec ecx
test edx, edx
jle 0x100c04b
xor edx, edx
inc esi
xor ebx, ebx
inc esi
inc esi
mov dl, byte [esi - 3]
mov bl, byte [esi - 2]
inc esi
shl ebx, 8
or edx, ebx
xor ebx, ebx
mov bl, byte [esi - 2]
shl ebx, 0x10
or edx, ebx
xor ebx, ebx
mov bl, byte [esi - 1]
shl ebx, 0x18
or edx, ebx
xor eax, edx
mov edx, ecx
dec ecx
test edx, edx
jg 0x100c01b
xor ecx, ecx
and edi, 3
cmp edi, 1
je 0x100c06f
cmp edi, 2
je 0x100c065
cmp edi, 3
jne 0x100c075
mov cl, byte [esi]
inc esi
shl ecx, 0x10
xor edx, edx
mov dl, byte [esi]
inc esi
shl edx, 8
or ecx, edx
xor edx, edx
mov dl, byte [esi]
or ecx, edx
xor eax, ecx
pop edi
pop esi
pop ebx
ret
Function at 0x409930
Capabilities:
Parse pe header

Disassembly:
add eax, 0xffff3fa8
cmp eax, 0x1b8
ja case.0x409947.49241
movzx eax, byte [eax + 0x409dac]
jmp dword [eax*4 + 0x409bec]
xor eax, eax
ret
mov eax, 1
ret
mov eax, 2
ret
mov eax, 3
ret
mov eax, 4
ret
mov eax, 5
ret
mov eax, 6
ret
mov eax, 7
ret
mov eax, 8
ret
mov eax, 9
ret
mov eax, 0xa
ret
mov eax, 0xb
ret
mov eax, 0xc
ret
mov eax, 0xd
ret
mov eax, 0xe
ret
mov eax, 0xf
ret
mov eax, 0x10
ret
mov eax, 0x11
ret
mov eax, 0x12
ret
mov eax, 0x13
ret
mov eax, 0x14
ret
mov eax, 0x15
ret
mov eax, 0x16
ret
mov eax, 0x17
ret
mov eax, 0x18
ret
mov eax, 0x19
ret
mov eax, 0x1a
ret
mov eax, 0x1b
ret
mov eax, 0x1c
ret
mov eax, 0x1d
ret
mov eax, 0x1e
ret
mov eax, 0x1f
ret
mov eax, 0x20
ret
mov eax, 0x21
ret
mov eax, 0x22
ret
mov eax, 0x23
ret
mov eax, 0x24
ret
mov eax, 0x25
ret
mov eax, 0x26
ret
mov eax, 0x27
ret
mov eax, 0x28
ret
mov eax, 0x29
ret
mov eax, 0x2a
ret
mov eax, 0x2b
ret
mov eax, 0x2c
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x2f
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x3d
ret
mov eax, 0x3e
ret
mov eax, 0x3f
ret
mov eax, 0x40
ret
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x50
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x5a
ret
mov eax, 0x5b
ret
mov eax, 0x5c
ret
mov eax, 0x5d
ret
mov eax, 0x5e
ret
mov eax, 0x5f
ret
mov eax, 0x60
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0x65
ret
mov eax, 0x66
ret
mov eax, 0x67
ret
mov eax, 0x68
ret
mov eax, 0x69
ret
mov eax, 0x6a
ret
mov eax, 0x6b
ret
mov eax, 0x6c
ret
mov eax, 0x6d
ret
mov eax, 0x6e
ret
or eax, 0xffffffff
ret
Function at 0x40ae80
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
jne 0x40aeaf
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x94
push 0x4073e8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40aef2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
push edi
jne 0x40aee4
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esi + 1]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40af25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x40af3b
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40af48
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp dword [ebp - 0x20], 2
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 4], ecx
jne 0x40afc0
nop
mov eax, 0xcccccccd
mul dword [ebp - 0xc]
shr edx, 3
cmp edx, 0x3e8
jae 0x40af7a
mov edx, 0x3e8
jmp 0x40af87
cmp edx, 0x2710
jbe 0x40af87
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x24]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40afc0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jbe 0x40afb1
call ebx
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 4], ecx
jmp 0x40afba
call ebx
sub eax, edi
cmp eax, dword [ebp - 0xc]
ja 0x40afc0
cmp dword [ebp - 0x20], 2
je 0x40af60
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [ebp - 8]
push edx
call esi
xor eax, eax
cmp dword [ebp - 0x20], 4
pop ebx
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40aff0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
jne 0x40b01f
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0xa4
push 0x4073e8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40b062
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
push edi
jne 0x40b054
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esi + 1]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40b09e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x40b087
cmp eax, 0x45b
jne 0x40b0ad
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x24]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40b0c1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp dword [ebp - 0x20], 3
mov edx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 4], edx
jne 0x40b140
jmp 0x40b0e0
mov eax, 0xcccccccd
mul dword [ebp - 0xc]
shr edx, 3
cmp edx, 0x3e8
jae 0x40b0fa
mov edx, 0x3e8
jmp 0x40b107
cmp edx, 0x2710
jbe 0x40b107
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40b140
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x10], ecx
jbe 0x40b131
call ebx
mov edx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 4], edx
jmp 0x40b13a
call ebx
sub eax, edi
cmp eax, dword [ebp - 0xc]
ja 0x40b140
cmp dword [ebp - 0x20], 3
je 0x40b0e0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [ebp - 8]
push eax
call esi
xor eax, eax
cmp dword [ebp - 0x20], 1
pop ebx
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x410f50
Capabilities:
Check os version
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x426178]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x124]
push eax
push 0x104
push esi
push 1
push 0
push 0
mov dword [ebp - 0x124], 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
mov edi, eax
test edi, edi
je 0x410ffd
push ebx
push 0x11c
lea ecx, [ebp - 0x120]
push 0
push ecx
call fcn.0041ae20
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call ebx
test eax, eax
jne 0x410fd5
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call ebx
cmp dword [ebp - 0x11c], 5
pop ebx
jb 0x410fe6
push 0x40751c
jmp 0x410feb
push 0x407524
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004143f7
mov esp, ebp
pop ebp
ret

Function at 0x411020
Capabilities:
Check os version
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x426178]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x124]
push eax
push 0x104
push esi
push 1
push 0
push 0
mov dword [ebp - 0x124], 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
test eax, eax
je 0x4110d2
push edi
push 0x11c
lea ecx, [ebp - 0x120]
push 0
push ecx
call fcn.0041ae20
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call edi
test eax, eax
jne 0x4110a2
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call edi
cmp dword [ebp - 0x11c], 5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
jb 0x4110b8
push 0x40751c
jmp 0x4110bd
push 0x407524
push esi
call edi
push 0x40752c
push esi
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004143f7
mov esp, ebp
pop ebp
ret