joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
mov dword [eax], 0
mov eax, dword [esp + 0x28]
push edi
mov esi, 7
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409fa8
mov ecx, dword [esp + 0x20]
mov dword [ecx], 0
cmp eax, 2
jne 0x409f81
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
push edi
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
pop edi
mov eax, 1
pop esi
add esp, 8
ret
cmp dword [esp + 0xc], esi
je 0x409fda
mov edx, dword [esp + 0x14]
push 0
push edx
push edi
push 0x8000040f
push 2
call fcn.00402230
mov eax, dword [esp + 0x34]
add esp, 0x14
pop edi
mov dword [eax], 0
mov eax, 2
pop esi
add esp, 8
ret
cmp dword [esp + 8], 8
jae 0x409ff6
mov ecx, dword [esp + 0x20]
pop edi
mov dword [ecx], 0
mov eax, 3
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x40a016
push eax
push 0
call ebx
push eax
call ebp
mov edx, dword [esp + 0x10]
push edx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
jne 0x40a04f
push eax
push str.get_environment__
push edi
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop ebp
pop ebx
pop edi
mov eax, 4
pop esi
add esp, 8
ret
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a0a5
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
push edi
push 0xc00003fa
push 1
call fcn.00402230
mov ecx, dword [esi]
add esp, 0x14
push ecx
push 0
call ebx
push eax
call ebp
pop ebp
pop ebx
pop edi
mov dword [esi], 0
mov eax, 5
pop esi
add esp, 8
ret
mov edx, dword [esi]
push edx
call fcn.00401c10
mov ecx, dword [esp + 0x30]
add esp, 4
pop ebp
pop ebx
pop edi
mov dword [ecx], eax
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x40a0c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x20]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40a102
push eax
mov eax, dword [esp + 0x1c]
push str.get_string__
push eax
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop edi
lea eax, [esi + 1]
pop esi
add esp, 8
ret
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
push 0
push ebp
call fcn.00414b00
mov eax, dword [esp + 0x2c]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
push esi
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x40a18c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 2
jne 0x40a15f
cmp byte [esp + 0x34], 0
je 0x40a1d8
push 0
push ebx
call fcn.004020f0
mov edx, dword [esp + 0x28]
add esp, 4
push eax
push edx
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
pop ebp
pop ebx
pop edi
mov eax, 2
pop esi
add esp, 8
ret
cmp byte [esp + 0x30], 0
je 0x40a19a
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
cmp byte [esp + 0x2c], 0
jne 0x40a1b2
cmp dword [esp + 0x10], 2
jne 0x40a1b9
mov dword [esp + 0x10], 1
jmp 0x40a1b9
cmp dword [esp + 0x10], 2
je 0x40a1e2
mov eax, dword [esp + 0x14]
push eax
push esi
push ebp
call fcn.00414570
add esp, 0xc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40a1f3
cmp eax, edi
jbe 0x40a1c8
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fe
push 1
call fcn.00402230
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop ebx
pop edi
mov eax, 3
pop esi
add esp, 8
ret

Function at 0x40a270
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a280
sub eax, esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
sar eax, 1
cmp byte [esp + 0x14], cl
lea eax, [eax + eax + 2]
setne cl
push eax
push edx
mov edx, dword [esp + 0x10]
inc ecx
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a2b8
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
pop esi
ret
Function at 0x40a310
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a332
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
pop esi
ret

Function at 0x40a360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40a3a2
pop edi
lea eax, [esi + 1]
pop esi
add esp, 8
ret
cmp esi, 2
jne 0x40a3b6
cmp byte [esp + 0x20], 0
jne 0x40a3b6
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push 0
push esi
call fcn.004020f0
add esp, 4
push eax
push edi
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
xor eax, eax
cmp esi, 2
sete al
pop edi
pop esi
add eax, 0xfffffffe
add esp, 8
ret

Function at 0x40ab10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40abba
cmp eax, 2
je 0x40abb4
cmp dword [esp + 0xc], 4
je 0x40ab98
mov eax, dword [esp + 0x4c]
push eax
push 0x421e00
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.0041454f
mov eax, dword [esp + 0x64]
push 0
lea edx, [esp + 0x2c]
push edx
push esi
push edi
push eax
push 2
call fcn.00402230
add esp, 0x2c
jmp 0x40abb4
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
mov ecx, dword [esp + 0x4c]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00414aec
add esp, 0x2c
ret
Function at 0x40af20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x30
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x48]
push esi
push edi
mov edi, dword [esp + 0x48]
push 0x20019
test edi, edi
sete cl
push str.AppExit
push ebx
mov dword [esp + 0x1c], eax
mov byte [ebp], cl
call fcn.0040ad50
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40af7d
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00414aec
add esp, 0x30
ret
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x10
test edi, edi
jne 0x40afe8
xor edx, edx
mov word [esp + 0x1c], dx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
test eax, eax
je 0x40b030
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40b036
mov ecx, dword [esp + 0x10]
push ebp
push ecx
push 0
push ebx
call fcn.0040af20
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00414aec
add esp, 0x30
ret
mov eax, dword [edi]
push eax
push 0x421e00
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
push 0x10
push ecx
call fcn.0041454f
add esp, 0x14
test eax, eax
jge 0x40af98
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
push ebp
push edx
push 0
push ebx
call fcn.0040af20
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00414aec
add esp, 0x30
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00414aec
add esp, 0x30
ret
Function at 0x40b050
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x214]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x21c]
push eax
push str.AppEvents
push 0x4213dc
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 0xff
push eax
mov dword [esp + 0x28], esi
call fcn.0041454f
add esp, 0x18
test eax, eax
jge 0x40b0e2
push 0
push str.set_hook__
push str.hook_registry
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414aec
add esp, 0x20c
ret
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b0e7
sub eax, edx
sar eax, 1
push edi
jne 0x40b13a
push 0
push 0x20019
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.0040ad20
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b132
push 0
push 0
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
jne 0x40b136
xor eax, eax
jmp 0x40b1a0
mov esi, dword [esp + 0x14]
push 0x20006
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.0040ad50
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40b158
lea eax, [esi + 1]
jmp 0x40b1a0
mov eax, ebp
mov edi, 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b162
sub eax, edx
sar eax, 1
je 0x40b184
push 1
push ebp
push ebx
push esi
call fcn.0040a270
add esp, 0x10
mov edi, eax
jmp 0x40b197
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40b195
cmp eax, 2
jne 0x40b197
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414aec
add esp, 0x20c
ret
Function at 0x40c4d0
Capabilities:
Query service status

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push edi
push esi
xor ebp, ebp
push eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40c556
mov edi, edi
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x14]
mov eax, edx
call fcn.0040c3d0
test eax, eax
je 0x40c55e
jg 0x40c50a
cmp edx, dword [esp + 0x1c]
jne 0x40c559
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
jne 0x40c516
cmp dword [esi + 0x18], ebp
je 0x40c518
xor edi, edi
mov ebp, dword [esi + 0x18]
inc edi
cmp edi, 0xa
mov ebx, ecx
jle 0x40c528
mov edi, 0xa
mov edx, dword [esp + 0x20]
mov ecx, edi
imul ecx, ecx, 0x32
test edx, edx
je 0x40c53f
cmp dword [esp + 0xc], edx
ja 0x40c559
add dword [esp + 0xc], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x18]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40c4f0
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x40d6c0
Capabilities:
Modify service

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d6d2
cmp word [eax], 0
mov dword [esp + 0xc], eax
jne 0x40d6da
mov dword [esp + 0xc], 0x42198c
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x40d6f3
xor eax, eax
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
mov edx, dword [esp + 0xc]
add esp, 4
push eax
push edx
push 0x40000428
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
ret

Function at 0x40e720
Capabilities:
Delete service

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x40e72e
lea eax, [ebx + 1]
pop ebx
ret
push edi
push 5
call fcn.0040ca50
mov edi, eax
add esp, 4
test edi, edi
jne 0x40e75b
push 0x400001fb
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 8
lea eax, [edi + 2]
pop edi
pop ebx
ret
push esi
push 0x100
lea esi, [ebx + 2]
push esi
push 0x10000
push esi
push edi
call fcn.0040ca90
add esp, 0x14
mov dword [ebx + 0x704b0], eax
test eax, eax
jne 0x40e78e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, 3
pop ebx
ret
push ebp
lea eax, [esp + 0x14]
push eax
lea ebp, [ebx + 0x202]
push ebp
push esi
push edi
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameW]
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
mov edx, dword [ebx + 0x704b0]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
pop ebp
test eax, eax
jne 0x40e7f9
push 0x40000221
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, 4
pop ebx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push 0x40000222
call fcn.0041439a
add eax, 0x20
push eax
call fcn.004022a0
add esp, 0xc
pop esi
pop edi
xor eax, eax
pop ebx
ret

Function at 0x40e820
Capabilities:
Modify service

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x704b0]
lea eax, [esp + 4]
push eax
push 4
push ecx
mov dword [esp + 0x10], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40e870
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7c
je 0x40e870
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
add esi, 2
push esi
push 0x40000413
push 1
call fcn.00402230
add esp, 0x14
pop esi
pop ecx
ret
Function at 0x40f270
Capabilities:
Query service status

Disassembly:
sub esp, 0x27c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x278], eax
mov eax, dword [esp + 0x284]
push ebp
push edi
mov edi, dword [esp + 0x288]
xor ebp, ebp
cmp edi, 1
mov dword [esp + 0x14], eax
mov dword [esp + 8], ebp
jge 0x40f2c4
push 1
call fcn.004086a0
add esp, 4
pop edi
pop ebp
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00414aec
add esp, 0x27c
ret
push esi
push 1
call fcn.0040ca50
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, ebp
jne 0x40f30c
push 0x400001fb
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 8
pop esi
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00414aec
add esp, 0x27c
ret
push ebx
call fcn.00408e40
mov ebx, eax
mov dword [esp + 0x18], ebx
test edi, edi
jle 0x40f49c
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + ebp*4]
push 0x100
lea edx, [esp + 0x8c]
push edx
push 4
push eax
push esi
call fcn.0040ca90
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x40f34f
inc dword [esp + 0x10]
jmp 0x40f486
lea eax, [esp + 0x20]
push eax
push 0x24
lea ecx, [esp + 0x6c]
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x40f3aa
push ebx
call fcn.004020f0
add esp, 4
push eax
lea edx, [esp + 0x8c]
push edx
push str._s:__s_n
call fcn.0041439a
add eax, 0x40
push eax
call fcn.00414f48
add esp, 0x10
inc dword [esp + 0x10]
jmp 0x40f486
push 0x40
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00414b00
mov eax, dword [esp + 0x8c]
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
je 0x40f486
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x40f419
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
mov ecx, dword [esp + 0x34]
add esp, 4
push eax
push ecx
lea edx, [esp + 0x90]
push edx
push str._s:__lu:__s_n
call fcn.0041439a
add eax, 0x40
push eax
call fcn.00414f48
add esp, 0x14
jmp 0x40f486
lea ecx, [esp + 0x50]
push ecx
push eax
call fcn.00409010
add esp, 8
test eax, eax
jne 0x40f486
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0040db50
mov esi, eax
test esi, esi
jne 0x40f447
inc dword [esp + 0x10]
jmp 0x40f486
lea eax, [esp + 0x88]
push eax
push 0x421914
push 0xffffffffffffffff
lea edi, [esi + 2]
push 0x100
push edi
call fcn.0041454f
mov ecx, dword [esp + 0x44]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0x409570
push esi
mov dword [esp + 0x48], edi
call fcn.00409790
push esi
call fcn.0040db90
add esp, 0x28
mov esi, dword [esp + 0x14]
inc ebp
cmp ebp, dword [esp + 0x290]
jl 0x40f320
mov ebx, dword [esp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, 0xffffffff
je 0x40f4af
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x288]
mov eax, dword [esp + 0x10]
pop ebx
pop esi
pop edi
pop ebp
xor ecx, esp
call fcn.00414aec
add esp, 0x27c
ret
Function at 0x4105f0
Capabilities:
Create service
Delete service
Persist via windows service

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x4105fe
lea eax, [esi + 1]
pop esi
ret
push ebp
push 3
call fcn.0040ca50
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x410631
push 0x400001fb
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
push esi
call fcn.0040db90
add esp, 0xc
lea eax, [ebp + 2]
pop ebp
pop esi
ret
push ebx
push edi
lea ebx, [esi + 0x8418]
call fcn.00408810
push eax
push 0x421914
push 0xffffffffffffffff
push 0x7fff
push ebx
call fcn.0041454f
add esp, 0x14
push 0
push 0
push 0
push 0
push 0
push ebx
push 1
push 2
push 0x10
push 0xf01ff
lea edi, [esi + 2]
push edi
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [esi + 0x704b0], eax
test eax, eax
jne 0x4106b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push 0x40000203
call fcn.0041439a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 0xc
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop ebp
mov eax, 5
pop esi
ret
push 0
push esi
call fcn.0040f590
add esp, 8
test eax, eax
je 0x4106e4
mov eax, dword [esi + 0x704b0]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop ebp
mov eax, 6
pop esi
ret
push edi
push 0x4000021e
call fcn.0041439a
add eax, 0x20
push eax
call fcn.004022a0
add esp, 0xc
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
ret

Function at 0x414aec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428930]
jne 0x414af6
repz ret
jmp fcn.0041876b
Function at 0x41f7aa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041818b
and dword [ebp - 4], 0
cmp dword [0x45a104], 0
mov ebx, eax
jne 0x41f85b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f90c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41f90c
push eax
call fcn.00418119
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45a104], eax
call esi
push eax
call fcn.00418119
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45a108], eax
call esi
push eax
call fcn.00418119
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45a10c], eax
call esi
push eax
call fcn.00418119
pop ecx
mov dword [0x45a114], eax
test eax, eax
je 0x41f85b
push 0x424cac
push edi
call esi
push eax
call fcn.00418119
pop ecx
mov dword [0x45a110], eax
mov eax, dword [0x45a110]
cmp eax, ebx
je 0x41f8b3
cmp dword [0x45a114], ebx
je 0x41f8b3
push eax
call fcn.00418194
push dword [0x45a114]
mov esi, eax
call fcn.00418194
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f8b3
test edi, edi
je 0x41f8b3
call esi
test eax, eax
je 0x41f8aa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f8aa
test byte [ebp - 0xc], 1
jne 0x41f8b3
or dword [ebp + 0x10], 0x200000
jmp 0x41f8ec
mov eax, dword [0x45a108]
cmp eax, ebx
je 0x41f8ec
push eax
call fcn.00418194
pop ecx
test eax, eax
je 0x41f8ec
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f8ec
mov eax, dword [0x45a10c]
cmp eax, ebx
je 0x41f8ec
push eax
call fcn.00418194
pop ecx
test eax, eax
je 0x41f8ec
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45a104]
call fcn.00418194
pop ecx
test eax, eax
je 0x41f90c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f90e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret