joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409290
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push ebp
push edi
xor edi, edi
push edi
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4092d5
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push ecx
push 0xc0000408
push 1
call fcn.00402230
add esp, 0x14
pop edi
xor eax, eax
pop ebp
add esp, 0x1c
ret
xor eax, eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
push ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x409340
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push ecx
push 0xc0000409
push 1
call fcn.00402230
add esp, 0x14
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebp
add esp, 0x1c
ret
mov edx, dword [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.USER32.dll_PostThreadMessageW]
push esi
mov esi, dword [esp + 0x34]
cmp edx, dword [esi + 0xc]
jne 0x409366
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 0x18]
push 0
push eax
push 0x12
push ecx
call ebx
mov edi, eax
lea edx, [esp + 0x10]
push edx
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x40939e
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0xc]
jne 0x40938f
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0x18]
push 0
push ecx
push 0x12
push edx
call ebx
or edi, eax
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x409375
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x12
je 0x4093cb
push 0
call ebx
push eax
call fcn.004020f0
mov ecx, dword [esi]
add esp, 4
push eax
push ecx
push 0xc0000409
push 1
call fcn.00402230
add esp, 0x14
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
add esp, 0x1c
ret
Function at 0x409690
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4096a0
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4096bd
cmp dword [esp + 0xc], 0x103
jne 0x409699
test byte [esi + 0x14], 1
je 0x4096d0
push esi
call fcn.00409550
add esp, 4
test eax, eax
je 0x409699
test byte [esi + 0x14], 2
je 0x409713
push esi
push 0x409230
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esi + 0x3c], 0
je 0x409713
mov edx, dword [esi + 0x1c]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x28]
push str.kill_process
push eax
mov eax, dword [esi + 0x24]
push ecx
push edx
push eax
call fcn.0040ee30
add esp, 0x18
test eax, eax
je 0x409699
mov dword [esi + 0x3c], 0
test byte [esi + 0x14], 4
je 0x40974e
push esi
call fcn.004093e0
add esp, 4
test eax, eax
je 0x40974e
mov ecx, dword [esi + 0x20]
mov edx, dword [esi]
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi + 0x28]
push str.kill_process
push edx
mov edx, dword [esi + 0x24]
push eax
push ecx
push edx
call fcn.0040ee30
add esp, 0x18
test eax, eax
je 0x409699
test byte [esi + 0x14], 8
je 0x409764
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x409bf0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x208], eax
push str.NSSM
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.0041453f
add esp, 0x14
push 0
test eax, eax
jge 0x409c5b
push str.create_messages__
push str.eventlog_registry
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
lea ecx, [esp + 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x409cc1
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
lea eax, [esp + 0x10]
push eax
push 0xc00003f9
push 1
call fcn.00402230
add esp, 0x14
mov eax, 2
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
push esi
call fcn.004087f0
mov ecx, eax
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x409cd0
mov edx, dword [esp + 4]
sub ecx, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push 0
push str.EventMessageFile
push edx
call esi
mov ecx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push str.TypesSupported
push ecx
mov dword [esp + 0x20], 7
call esi
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00414adc
add esp, 0x20c
ret
Function at 0x409d80
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x208], eax
mov edx, dword [esp + 0x210]
push esi
push edi
mov edi, dword [esp + 0x21c]
push 1
mov eax, 0xff
lea ecx, [esp + 0x14]
mov esi, str.AppExit
call fcn.00409b00
add esp, 4
test eax, eax
jge 0x409df7
push 0
push str.create_exit_action__
push str.NSSM_REG_EXIT
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x409e64
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
lea eax, [esp + 0x18]
push eax
push 0xc00003f9
push 1
call fcn.00402230
add esp, 0x14
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
cmp dword [esp + 0xc], 2
jne 0x409e7f
cmp byte [esp + 0x220], 0
jne 0x409e7f
mov ecx, dword [esp + 8]
push ecx
jmp 0x409f00
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409e84
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [esp + 8]
push edx
push edi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x409efb
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push str.AppExit
push 0xc00003fb
push 1
call fcn.00402230
mov ecx, dword [esp + 0x1c]
add esp, 0x14
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00414adc
add esp, 0x20c
ret
Function at 0x409f20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
mov dword [eax], 0
mov eax, dword [esp + 0x28]
push edi
mov esi, 7
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409f98
mov ecx, dword [esp + 0x20]
mov dword [ecx], 0
cmp eax, 2
jne 0x409f71
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
push edi
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
pop edi
mov eax, 1
pop esi
add esp, 8
ret
cmp dword [esp + 0xc], esi
je 0x409fca
mov edx, dword [esp + 0x14]
push 0
push edx
push edi
push 0x8000040f
push 2
call fcn.00402230
mov eax, dword [esp + 0x34]
add esp, 0x14
pop edi
mov dword [eax], 0
mov eax, 2
pop esi
add esp, 8
ret
cmp dword [esp + 8], 8
jae 0x409fe6
mov ecx, dword [esp + 0x20]
pop edi
mov dword [ecx], 0
mov eax, 3
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x40a006
push eax
push 0
call ebx
push eax
call ebp
mov edx, dword [esp + 0x10]
push edx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
jne 0x40a03f
push eax
push str.get_environment__
push edi
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop ebp
pop ebx
pop edi
mov eax, 4
pop esi
add esp, 8
ret
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a095
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
push edi
push 0xc00003fa
push 1
call fcn.00402230
mov ecx, dword [esi]
add esp, 0x14
push ecx
push 0
call ebx
push eax
call ebp
pop ebp
pop ebx
pop edi
mov dword [esi], 0
mov eax, 5
pop esi
add esp, 8
ret
mov edx, dword [esi]
push edx
call fcn.00401c10
mov ecx, dword [esp + 0x30]
add esp, 4
pop ebp
pop ebx
pop edi
mov dword [ecx], eax
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x40a0b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x20]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40a0f2
push eax
mov eax, dword [esp + 0x1c]
push str.get_string__
push eax
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop edi
lea eax, [esi + 1]
pop esi
add esp, 8
ret
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
push 0
push ebp
call fcn.00414af0
mov eax, dword [esp + 0x2c]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
push esi
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x40a17c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 2
jne 0x40a14f
cmp byte [esp + 0x34], 0
je 0x40a1c8
push 0
push ebx
call fcn.004020f0
mov edx, dword [esp + 0x28]
add esp, 4
push eax
push edx
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
pop ebp
pop ebx
pop edi
mov eax, 2
pop esi
add esp, 8
ret
cmp byte [esp + 0x30], 0
je 0x40a18a
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
cmp byte [esp + 0x2c], 0
jne 0x40a1a2
cmp dword [esp + 0x10], 2
jne 0x40a1a9
mov dword [esp + 0x10], 1
jmp 0x40a1a9
cmp dword [esp + 0x10], 2
je 0x40a1d2
mov eax, dword [esp + 0x14]
push eax
push esi
push ebp
call fcn.00414560
add esp, 0xc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40a1e3
cmp eax, edi
jbe 0x40a1b8
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fe
push 1
call fcn.00402230
add esp, 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop ebx
pop edi
mov eax, 3
pop esi
add esp, 8
ret

Function at 0x40a260
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a270
sub eax, esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
sar eax, 1
cmp byte [esp + 0x14], cl
lea eax, [eax + eax + 2]
setne cl
push eax
push edx
mov edx, dword [esp + 0x10]
inc ecx
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a2a8
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
pop esi
ret
Function at 0x40a300
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a322
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fb
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
pop esi
ret

Function at 0x40a350
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x40a392
pop edi
lea eax, [esi + 1]
pop esi
add esp, 8
ret
cmp esi, 2
jne 0x40a3a6
cmp byte [esp + 0x20], 0
jne 0x40a3a6
pop edi
xor eax, eax
pop esi
add esp, 8
ret
push 0
push esi
call fcn.004020f0
add esp, 4
push eax
push edi
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
xor eax, eax
cmp esi, 2
sete al
pop edi
pop esi
add eax, 0xfffffffe
add esp, 8
ret

Function at 0x40ab00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40abaa
cmp eax, 2
je 0x40aba4
cmp dword [esp + 0xc], 4
je 0x40ab88
mov eax, dword [esp + 0x4c]
push eax
push 0x421de0
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.0041453f
mov eax, dword [esp + 0x64]
push 0
lea edx, [esp + 0x2c]
push edx
push esi
push edi
push eax
push 2
call fcn.00402230
add esp, 0x2c
jmp 0x40aba4
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
push esi
push 0xc00003fa
push 1
call fcn.00402230
add esp, 0x14
mov ecx, dword [esp + 0x4c]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00414adc
add esp, 0x2c
ret
Function at 0x40af10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x30
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x48]
push esi
push edi
mov edi, dword [esp + 0x48]
push 0x20019
test edi, edi
sete cl
push str.AppExit
push ebx
mov dword [esp + 0x1c], eax
mov byte [ebp], cl
call fcn.0040ad40
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40af6d
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00414adc
add esp, 0x30
ret
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x10
test edi, edi
jne 0x40afd8
xor edx, edx
mov word [esp + 0x1c], dx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
test eax, eax
je 0x40b020
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40b026
mov ecx, dword [esp + 0x10]
push ebp
push ecx
push 0
push ebx
call fcn.0040af10
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00414adc
add esp, 0x30
ret
mov eax, dword [edi]
push eax
push 0x421de0
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
push 0x10
push ecx
call fcn.0041453f
add esp, 0x14
test eax, eax
jge 0x40af88
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
push ebp
push edx
push 0
push ebx
call fcn.0040af10
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00414adc
add esp, 0x30
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00414adc
add esp, 0x30
ret
Function at 0x40b040
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x428930]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x214]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x21c]
push eax
push str.AppEvents
push 0x4213b8
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 0xff
push eax
mov dword [esp + 0x28], esi
call fcn.0041453f
add esp, 0x18
test eax, eax
jge 0x40b0d2
push 0
push str.set_hook__
push str.hook_registry
push 0xc00003eb
push 1
call fcn.00402230
add esp, 0x14
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b0d7
sub eax, edx
sar eax, 1
push edi
jne 0x40b12a
push 0
push 0x20019
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.0040ad10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b122
push 0
push 0
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
jne 0x40b126
xor eax, eax
jmp 0x40b190
mov esi, dword [esp + 0x14]
push 0x20006
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.0040ad40
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40b148
lea eax, [esi + 1]
jmp 0x40b190
mov eax, ebp
mov edi, 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b152
sub eax, edx
sar eax, 1
je 0x40b174
push 1
push ebp
push ebx
push esi
call fcn.0040a260
add esp, 0x10
mov edi, eax
jmp 0x40b187
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x40b185
cmp eax, 2
jne 0x40b187
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414adc
add esp, 0x20c
ret
Function at 0x40c4c0
Capabilities:
Query service status

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push edi
push esi
xor ebp, ebp
push eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40c546
mov edi, edi
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x14]
mov eax, edx
call fcn.0040c3c0
test eax, eax
je 0x40c54e
jg 0x40c4fa
cmp edx, dword [esp + 0x1c]
jne 0x40c549
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
jne 0x40c506
cmp dword [esi + 0x18], ebp
je 0x40c508
xor edi, edi
mov ebp, dword [esi + 0x18]
inc edi
cmp edi, 0xa
mov ebx, ecx
jle 0x40c518
mov edi, 0xa
mov edx, dword [esp + 0x20]
mov ecx, edi
imul ecx, ecx, 0x32
test edx, edx
je 0x40c52f
cmp dword [esp + 0xc], edx
ja 0x40c549
add dword [esp + 0xc], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x18]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40c4e0
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x40d6b0
Capabilities:
Modify service

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d6c2
cmp word [eax], 0
mov dword [esp + 0xc], eax
jne 0x40d6ca
mov dword [esp + 0xc], 0x42196c
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x40d6e3
xor eax, eax
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020f0
mov edx, dword [esp + 0xc]
add esp, 4
push eax
push edx
push 0x40000428
push 1
call fcn.00402230
add esp, 0x14
mov eax, 1
ret

Function at 0x40e710
Capabilities:
Delete service

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x40e71e
lea eax, [ebx + 1]
pop ebx
ret
push edi
push 5
call fcn.0040ca40
mov edi, eax
add esp, 4
test edi, edi
jne 0x40e74b
push 0x400001fb
call fcn.0041438a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 8
lea eax, [edi + 2]
pop edi
pop ebx
ret
push esi
push 0x100
lea esi, [ebx + 2]
push esi
push 0x10000
push esi
push edi
call fcn.0040ca80
add esp, 0x14
mov dword [ebx + 0x704b0], eax
test eax, eax
jne 0x40e77e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, 3
pop ebx
ret
push ebp
lea eax, [esp + 0x14]
push eax
lea ebp, [ebx + 0x202]
push ebp
push esi
push edi
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameW]
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push edi
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
mov edx, dword [ebx + 0x704b0]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
pop ebp
test eax, eax
jne 0x40e7e9
push 0x40000221
call fcn.0041438a
add eax, 0x40
push eax
call fcn.004022a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, 4
pop ebx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push 0x40000222
call fcn.0041438a
add eax, 0x20
push eax
call fcn.004022a0
add esp, 0xc
pop esi
pop edi
xor eax, eax
pop ebx
ret

Function at 0x40e810
Capabilities:
Modify service

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x704b0]
lea eax, [esp + 4]
push eax
push 4
push ecx
mov dword [esp + 0x10], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40e860
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7c
je 0x40e860
push 0
push eax
call fcn.004020f0
add esp, 4
push eax
add esi, 2
push esi
push 0x40000413
push 1
call fcn.00402230
add esp, 0x14
pop esi
pop ecx
ret