joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402710
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a7348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_5
mov edi, dword [esp + 0x20]
push 0x4cb224
mov ecx, edi
mov dword [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::TrimLeft_1
push 0x4cb220
mov ecx, edi
call sub.MFC42u.DLL_CString::TrimLeft_1
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4027c3
mov esi, dword [0x545d9c]
mov eax, dword [0x545da0]
cmp eax, esi
je 0x4027c3
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi]
mov edx, dword [edi]
push edx
mov eax, dword [ecx - 8]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
lea eax, [esp + 0x14]
push 0x4cb23c
push eax
call sub.MFC42u.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push ecx
call ebx
test eax, eax
jne 0x4027b0
mov eax, dword [0x545da0]
add esi, 4
cmp eax, esi
jne 0x402774
jmp 0x4027c3
mov edx, dword [esp + 0xc]
push edx
push 0x4cb1f8
push edi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402980
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a739e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], edi
call fcn.004a6060
mov dword [edi], 0x4b2f9c
mov cl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
lea ebp, [edi + 0x40]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov byte [ebp + 1], cl
mov ecx, ebp
mov byte [ebp], al
mov byte [ebp + 8], bl
call fcn.00405c60
mov dl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
lea esi, [edi + 0x50]
push 1
push ebx
mov ecx, esi
mov byte [esp + 0x38], 1
mov byte [esi], dl
mov byte [esi + 1], al
mov byte [esi + 8], bl
call fcn.00407b90
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x545db0], ebx
jne 0x402a1e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [0x545db0], eax
mov dword [eax], ebx
mov ecx, dword [0x545db0]
mov dword [ecx + 8], ebx
mov edx, dword [0x545dac]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x545dac], edx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x402a46
push eax
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov edx, dword [0x545db0]
push ebx
push edx
mov ecx, esi
call fcn.00407b90
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
lea eax, [edi + 0x68]
mov byte [esp + 0x30], 2
push eax
mov dword [edi], 0x4b2ed8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 4]
push eax
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
call fcn.00404ec0
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
mov eax, dword [ebp]
mov dword [esp + 0x14], eax
je 0x402ac9
mov ecx, eax
cmp eax, ecx
jne 0x402ac9
mov edx, dword [ebp + 4]
mov ecx, esi
push edx
call fcn.00406980
mov eax, dword [esi + 4]
mov ecx, dword [0x545db0]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
jmp 0x402af3
cmp eax, ebp
je 0x402af3
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.00407f30
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, esi
call fcn.00406540
mov eax, dword [esp + 0x14]
cmp eax, ebp
jne 0x402acd
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x60], ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x408240
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4a768b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x4b3180
lea edi, [esi + 0x228]
mov dword [esp + 0x14], 5
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x220]
test eax, eax
je 0x4082a3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x220], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 0x1a0]
call fcn.00402d10
lea ecx, [esi + 0x160]
mov byte [esp + 0x14], 4
call sub.MFC42u.DLL_CButton::CButton
lea ecx, [esi + 0x120]
mov byte [esp + 0x14], 3
call sub.MFC42u.DLL_CStatic::CStatic
lea ecx, [esi + 0xe0]
mov byte [esp + 0x14], 2
call sub.MFC42u.DLL_CButton::CButton
lea ecx, [esi + 0xa0]
mov byte [esp + 0x14], 1
call fcn.004a6276
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CButton::CButton
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], 0x4b2d44
call fcn.004a6198
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40906f
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a77d0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, ecx
push edi
push 2
mov eax, dword [esi + 0x1c0]
push 0xffffffffffffffff
push 0x100c
push eax
call ebp
inc eax
test eax, eax
je 0x409120
mov ecx, dword [esi + 0x1c0]
lea edi, [eax - 1]
push 2
push edi
push 0x100c
push ecx
call ebp
test edi, edi
jl 0x409120
push 2
lea edx, [esp + 0x14]
push edi
push edx
lea ecx, [esi + 0x1a0]
call fcn.00404170
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString_5
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push str.url.dll_FileProtocolHandler_http:__fireeye.ijinshan.com_analyse.html_md5_s
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x18]
add esp, 0xc
push 1
push 0
push edx
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x409d10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3350
push 0x4a671c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4c], ebx
mov esi, dword [ebp + 8]
mov eax, esi
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax]
mov dword [ecx], edx
mov al, byte [eax + 4]
mov byte [ecx + 4], al
lea edi, [ebp - 0x40]
lea ecx, [ebx + esi]
push ecx
call fcn.00409840
add esp, 4
test eax, eax
je 0x409e3e
mov dword [edi], ebx
add ebx, dword [0x545e14]
add edi, 4
cmp ebx, 5
jl 0x409d5f
mov dword [ebp - 0x50], ebx
mov ecx, ebx
mov ebx, dword [ebp + 0x10]
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x40]
cmp ecx, 5
jg 0x409dcc
lea edx, [ebp - 0x40]
mov al, byte [ecx + ebx]
cmp al, 0xe8
je 0x409db1
cmp al, 0xe9
jne 0x409dbe
mov eax, dword [ecx + ebx + 1]
sub eax, ebx
add eax, dword [ebp + 8]
mov dword [ecx + ebx + 1], eax
add edx, 4
mov ecx, dword [edx]
test ecx, ecx
jle 0x409dcc
cmp ecx, 5
jle 0x409da6
mov dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
push 0x40
mov edi, dword [ebp - 0x50]
lea ecx, [edi + 5]
push ecx
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
lea edx, [ebp - 0x4c]
push edx
push 0x40
push 5
mov eax, dword [ebp + 8]
push eax
call esi
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, ebx
sub eax, 5
mov dword [ebp - 0x48], eax
add ebx, edi
mov dword [ebp - 0x54], ebx
mov byte [ebx], 0xe9
mov dword [ebx + 1], eax
mov edx, dword [ebp + 0xc]
sub edx, ecx
sub edx, 5
mov dword [ebp - 0x64], edx
mov edi, dword [ebp + 8]
mov al, 0xe9
stosb byte es:[edi], al
mov eax, dword [ebp - 0x64]
stosd dword es:[edi], eax
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x50], ebx
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3360
push 0x4a671c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [esi], edx
mov al, byte [ecx + 4]
mov byte [esi + 4], al
jmp 0x409ed6
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ae50
Capabilities:
Get file version info

Disassembly:
mov eax, 0x1214
call fcn.004a6750
push ebp
push esi
mov esi, dword [esp + 0x1220]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40afd1
mov ebp, dword [esp + 0x1224]
push ebx
push edi
mov ecx, ebp
call sub.MFC42u.DLL_CString::Empty
mov ecx, dword [esi]
push 0
mov eax, dword [ecx - 8]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, 0x1000
jbe 0x40aead
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
jmp 0x40aeb4
lea ebx, [esp + 0x224]
test ebx, ebx
je 0x40af7a
mov edx, dword [esi]
push ebx
push edi
push 0
mov eax, dword [edx - 8]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40af68
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40af68
mov eax, dword [esp + 0x18]
xor edx, edx
xor ecx, ecx
push 0x4cc128
mov dx, word [eax + 2]
mov cx, word [eax]
push edx
push ecx
push str.StringFileInfo_04x_04x_s
lea edx, [esp + 0x2c]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x18
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push eax
push ecx
push edx
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40af68
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 0x104
mov word [esp + 0x222], cx
jae 0x40af55
mov word [esp + eax*2 + 0x1c], cx
mov eax, dword [esp + 0x14]
push eax
push 0x4cb1f8
push ebp
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
cmp edi, 0x1000
jbe 0x40af7a
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [ebp]
pop edi
pop ebx
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40afdd
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
cmp eax, 2
jle 0x40afdd
cmp word [ecx + 2], 0x3a
jne 0x40afdd
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call fcn.0042faa0
add esp, 4
test al, al
jne 0x40afdd
mov edx, dword [0x545f7c]
mov eax, dword [edx*4 + 0x4cbb2c]
push eax
push 0x4cb1f8
push ebp
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
pop esi
pop ebp
add esp, 0x1214
ret
mov ecx, dword [esp + 0x1224]
call sub.MFC42u.DLL_CString::Empty
pop esi
pop ebp
add esp, 0x1214
ret
Function at 0x40ba20
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x5c
mov eax, dword [eax]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40bb11
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ba8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40ba8c
push edi
mov dword [esp + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x5c
ret
mov eax, dword [esp + 0x10]
mov dword [esp + 0x70], ebx
cmp eax, ebx
jne 0x40bafe
push ebx
push esi
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
cmp ebp, ebx
je 0x40bafe
push esi
push ebx
push ebx
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x40baf7
lea edx, [esp + 0x14]
push edx
call fcn.0049c410
push esi
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0049c460
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.0049c540
add esp, 0x18
mov dword [esp + 0x70], 1
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x5c
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x410fc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a7b46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_5
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x228], ebx
call sub.MFC42u.DLL_CString::Empty
mov esi, dword [esp + 0x230]
mov ebp, dword [sym.imp.MSVCRT.dll__wcsnicmp]
mov eax, dword [esi]
mov edi, dword [eax - 8]
cmp edi, 9
jbe 0x411066
push 9
push str.system32_
push edi
mov ecx, esi
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call ebp
add esp, 0xc
test eax, eax
jne 0x411066
lea ecx, [esp + 0x18]
push 0x104
push ecx
mov word [esp + 0x20], bx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, dword [esi]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x18]
push 0x4cb23c
push ecx
mov word [esp + 0x22e], bx
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
jmp 0x411127
cmp edi, 0xc
jbe 0x4110d0
mov edx, dword [esi]
push 0xc
push str.SystemRoot_
mov ecx, esi
mov eax, dword [edx - 8]
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call ebp
add esp, 0xc
test eax, eax
jne 0x4110d0
lea eax, [esp + 0x18]
push 0x104
push eax
mov word [esp + 0x20], bx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [esi]
mov word [esp + 0x21e], bx
mov eax, dword [ecx - 8]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::GetBuffer
add eax, 0x18
lea edx, [esp + 0x18]
push eax
push edx
lea eax, [esp + 0x18]
push 0x4cb23c
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
jmp 0x411127
cmp edi, 4
jbe 0x411127
mov ecx, dword [esi]
push 4
push 0x4cd9dc
mov eax, dword [ecx - 8]
mov ecx, esi
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x411127
lea edx, [esp + 0x14]
push 4
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x22c], 1
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x228], bl
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
push eax
push 0x4cb1f8
push esi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x228], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret 4
Function at 0x417a30
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a83db
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, ecx
mov eax, dword [esi]
mov eax, dword [eax - 8]
test eax, eax
je 0x417b4c
cmp eax, 4
jle 0x417aba
push 4
push 0x4cd9dc
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x417aba
lea ecx, [esp + 8]
push 4
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::Mid
push eax
mov ecx, esi
mov dword [esp + 0x224], 0
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 8]
mov dword [esp + 0x220], 0xffffffff
call sub.MFC42u.DLL_CString::CString
push 0x25
mov ecx, esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x417b11
mov edx, dword [edi]
push esi
mov ecx, edi
call dword [edx + 0xf0]
test al, al
jne 0x417b11
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x417b11
cmp eax, 0x103
jae 0x417b11
lea edx, [esp + 0xc]
mov word [esp + 0x214], 0
push edx
push 0x4cb1f8
push esi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jbe 0x417b4c
cmp eax, 0x103
jae 0x417b4c
lea edx, [esp + 0xc]
mov word [esp + 0x214], 0
push edx
push 0x4cb1f8
push esi
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
mov ecx, dword [esp + 0x218]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret 4
Function at 0x4194c0
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x4a8540
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
xor ebx, ebx
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.0043f5c0
push 0xf003f
push ebx
push ebx
mov byte [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x41953e
mov eax, dword [esp + 0x38]
push 0xf01ff
mov eax, dword [eax]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
je 0x419537
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebp
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push edx
push str.RegistryMachineSYSTEMCurrentControlSetServices_s
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0043f6f0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
push eax
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
lea ecx, [esp + 0x1c]
call fcn.0043f800
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [edx + pe_nt_image_headers32]
or ebx, eax
cmp ebx, 1
jne 0x419609
mov ebp, dword [esp + 0x3c]
lea edi, [esi + 0xa0]
push ebp
mov ecx, edi
call fcn.004042f0
cmp eax, ebx
jne 0x4195ae
dec dword [esi + 0x12c]
push ebp
mov ecx, edi
call fcn.00403590
mov ecx, dword [esi + 0xc0]
push 0
push 0
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x545f7c]
mov edx, dword [esi + 0x12c]
push edx
mov edx, dword [ecx*4 + 0x4cf0c8]
push edx
push eax
mov eax, dword [ecx*4 + 0x4cf0bc]
lea ecx, [esp + 0x1c]
push eax
push str._s_d____s_d
push ecx
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x28]
add esp, 0x18
lea ecx, [esi + 0x60]
push edx
call sub.MFC42u.DLL_CWnd::SetWindowTextW
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.0043f670
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x4194da
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x4a8540
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
xor ebx, ebx
call sub.MFC42u.DLL_CString::CString_5
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.0043f5c0
push 0xf003f
push ebx
push ebx
mov byte [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x41953e
mov eax, dword [esp + 0x38]
push 0xf01ff
mov eax, dword [eax]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
je 0x419537
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebp
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push edx
push str.RegistryMachineSYSTEMCurrentControlSetServices_s
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0043f6f0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
push eax
push eax
call sub.MFC42u.DLL_CString::GetBuffer
push eax
lea ecx, [esp + 0x1c]
call fcn.0043f800
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [edx + pe_nt_image_headers32]
or ebx, eax
cmp ebx, 1
jne 0x419609
mov ebp, dword [esp + 0x3c]
lea edi, [esi + 0xa0]
push ebp
mov ecx, edi
call fcn.004042f0
cmp eax, ebx
jne 0x4195ae
dec dword [esi + 0x12c]
push ebp
mov ecx, edi
call fcn.00403590
mov ecx, dword [esi + 0xc0]
push 0
push 0
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x545f7c]
mov edx, dword [esi + 0x12c]
push edx
mov edx, dword [ecx*4 + 0x4cf0c8]
push edx
push eax
mov eax, dword [ecx*4 + 0x4cf0bc]
lea ecx, [esp + 0x1c]
push eax
push str._s_d____s_d
push ecx
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x28]
add esp, 0x18
lea ecx, [esi + 0x60]
push edx
call sub.MFC42u.DLL_CWnd::SetWindowTextW
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.0043f670
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x41c390
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi + 0x104], 1
lea ebx, [edi + 0xec]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0xe8]
test esi, esi
je 0x41c3c0
mov dword [edi + 0xe8], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x41c3f8
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xbb8
push esi
call edi
cmp eax, 0x102
jne 0x41c3f1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x3e8
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret