joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c57b0
Capabilities:
Stop service

Disassembly:
jmp 0x4c57b0
push 0xffffffffffffffff
push 0x78593c
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
push 0x33
xor ebx, ebx
mov edi, 0xf
push str.ShutDownService___Trying_to_shutdown_service_status
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00405920
push ebx
lea eax, [esp + 0x18]
push eax
mov ecx, 0x868edc
mov dword [esp + 0x78], ebx
call fcn.0054c860
mov ebp, 0x10
mov dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x2c], ebp
jb 0x4c582e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00564155
add esp, 4
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
jne 0x4c589f
push 0x28
push str.ShutDownService___Failed_getting_the_SCM
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00405920
push 1
lea edx, [esp + 0x18]
push edx
mov ecx, 0x868edc
mov dword [esp + 0x78], 1
call fcn.0054c860
cmp dword [esp + 0x2c], ebp
jb 0x4c5889
mov eax, dword [esp + 0x18]
push eax
call fcn.00564155
add esp, 4
xor al, al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov ecx, dword [esp + 0x78]
push 0x20
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
jne 0x4c591c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2c
push str.ShutDownService___Failed_getting_the_service
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00405920
push 1
lea edx, [esp + 0x34]
push edx
mov ecx, 0x868edc
mov dword [esp + 0x78], 2
call fcn.0054c860
cmp dword [esp + 0x48], ebp
jb 0x4c5889
mov eax, dword [esp + 0x34]
push eax
call fcn.00564155
add esp, 4
xor al, al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
lea ecx, [esp + 0x4c]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call edi
push esi
call edi
cmp ebp, ebx
setne al
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x4cead0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x120], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0x14]
push esi
xor edi, edi
or eax, 0x2001f
push eax
push edi
push edx
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
cmp esi, edi
jne 0x4ceb46
xor eax, eax
cmp ecx, edi
je 0x4ceb34
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov esi, eax
mov dword [esp + 0xc], ecx
cmp eax, edi
je 0x4ceb54
cmp ecx, edi
je 0x4cebf2
push ecx
jmp 0x4cebec
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x20]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x4cebbc
lea esp, [esp]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401e6f
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0x4cec0b
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
push edx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x4ceb80
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4cebcf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebx]
push eax
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4cebf2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x4cebf4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret 4
Function at 0x4d96b0
Capabilities:
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
jmp 0x4d96b0
push 0xffffffffffffffff
push 0x786fd1
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1ac]
xor ebx, ebx
push 0x124
lea eax, [esp + 0x78]
push ebx
push eax
mov dword [esp + 0x7c], ebx
call fcn.00566330
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
jne 0x4d9725
xor al, al
jmp 0x4d987a
lea ecx, [esp + 0x70]
push ecx
push esi
mov dword [esp + 0x78], 0x128
mov byte [esp + 0x1e], bl
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4d986f
mov edi, 0x10
lea esp, [esp]
lea eax, [esp + 0x94]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4d9770
sub eax, edx
push eax
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x24]
call fcn.00405920
lea eax, [esp + 0x38]
push ebp
push eax
mov dword [esp + 0x1ac], ebx
call fcn.004037e7
mov esi, eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x60]
push edx
mov byte [esp + 0x1b4], 1
call fcn.004037e7
add esp, 0x10
mov ecx, dword [esi + 0x14]
mov byte [esp + 0x1a4], 2
cmp dword [esi + 0x18], edi
jb 0x4d97ce
mov esi, dword [esi + 4]
jmp 0x4d97d1
add esi, 4
push ecx
mov ecx, dword [eax + 0x14]
push esi
push ecx
push ebx
mov ecx, eax
call fcn.00408076
test eax, eax
sete byte [esp + 0x17]
cmp dword [esp + 0x6c], edi
jb 0x4d97f9
mov edx, dword [esp + 0x58]
push edx
call fcn.00564155
add esp, 4
mov esi, 0xf
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0x50], edi
jb 0x4d981d
mov eax, dword [esp + 0x3c]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x1a4], 0xffffffff
cmp dword [esp + 0x34], edi
jb 0x4d9847
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00564155
add esp, 4
cmp byte [esp + 0x17], bl
jne 0x4d9866
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x70]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4d9750
jmp 0x4d986b
mov byte [esp + 0x16], 1
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x16]
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.00564b24
add esp, 0x194
ret 4
Function at 0x4e5b70
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4e5b70
push 0xffffffffffffffff
push 0x788069
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], eax
mov dword [esp + 0x18], ebx
mov byte [ebx + 4], al
mov edi, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x10]
xor esi, esi
sub eax, dword [edi + 0xc]
mov dword [esp + 0x14], 1
je 0x4e5bf7
cmp esi, eax
jb 0x4e5bd4
call fcn.00565471
mov eax, dword [edi + 0xc]
mov cl, byte [esi + eax]
mov byte [esp + 0x10], cl
mov edx, dword [esp + 0x10]
push edx
push 1
mov ecx, ebx
call fcn.0040323d
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
inc esi
cmp esi, eax
jb 0x4e5bd4
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4e8740
Capabilities:
Get common file path

Disassembly:
jmp 0x4e8740
push 0xffffffffffffffff
push 0x788460
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov esi, dword [esp + 0x130]
mov edi, dword [esp + 0x134]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x14], esi
mov byte [esi + 4], bl
lea eax, [esp + 0x18]
push eax
push 0x104
mov dword [esp + 0x130], ebx
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4e87c5
sub eax, edx
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00405920
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
call fcn.00401e38
mov eax, esi
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00564b24
add esp, 0x11c
ret
Function at 0x4ea490
Capabilities:
Get common file path

Disassembly:
jmp 0x4ea490
push 0xffffffffffffffff
push 0x788829
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov esi, dword [esp + 0x230]
mov ebx, dword [esp + 0x234]
mov dword [esp + 0xc], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0x10], esi
mov word [esi + 4], ax
lea ecx, [esp + 0x14]
push ecx
push 0x104
mov dword [esp + 0x230], eax
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ea520
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00405ef2
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.004019a1
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00564b24
add esp, 0x220
ret
Function at 0x4faf50
Capabilities:
Query service status

Disassembly:
jmp 0x4faf50
push 0xffffffffffffffff
push 0x789ef1
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, dword [esp + 0x64]
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x4fafe8
mov ebp, dword [esp + 0x68]
cmp ebp, ebx
je 0x4faf8e
mov byte [ebp], 1
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
jne 0x4fafec
push 0x27
push str.CWFP::UninstallWFP___Failed_to_open_SCM
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00405920
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x64], ebx
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
cmp dword [esp + 0x2c], 0x10
jb 0x4fafe8
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00564155
add esp, 4
xor al, al
jmp 0x4fb060
cmp dword [esi + 0x18], 8
jb 0x4faff7
mov eax, dword [esi + 4]
jmp 0x4faffa
lea eax, [esi + 4]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
jne 0x4fb018
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x4fb060
lea edx, [esp + 0x64]
push edx
push 0x24
lea eax, [esp + 0x38]
push eax
push 0
push esi
xor bl, bl
mov dword [esp + 0x78], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4fb052
mov eax, dword [esp + 0x34]
cmp eax, 4
sete bl
test ebp, ebp
je 0x4fb052
cmp eax, 1
sete cl
mov byte [ebp], cl
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov al, bl
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 8
Function at 0x4fb080
Capabilities:
Start service

Disassembly:
jmp 0x4fb080
push 0xffffffffffffffff
push 0x789f3c
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [edi + 0x14], ebx
jne 0x4fb0dd
mov esi, dword [esp + 0x7c]
push 0x1b
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push str.CWFP::StartWFP___Wrong_data
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405920
jmp 0x4fb2a4
push ebx
push edi
call fcn.00405d53
test al, al
je 0x4fb10b
mov esi, dword [esp + 0x7c]
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x7bb84b
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405920
jmp 0x4fb2a4
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
jne 0x4fb130
mov esi, dword [esp + 0x7c]
push str.CWFP::StartWFP___Failed_to_open_SCM
mov ecx, esi
call fcn.004062df
jmp 0x4fb2a4
cmp dword [edi + 0x18], 8
jb 0x4fb13b
mov edi, dword [edi + 4]
jmp 0x4fb13e
add edi, 4
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
jne 0x4fb1b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x34]
push edi
push eax
call fcn.004083af
add esp, 8
mov esi, eax
push str.CWFP::StartWFP___Failed_to_open_service_with_error:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x78], ebx
call fcn.004062df
push esi
mov esi, dword [esp + 0x80]
push eax
push esi
mov byte [esp + 0x80], 1
call fcn.00402fd1
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00402ed7
lea ecx, [esp + 0x34]
call fcn.00402ed7
jmp 0x4fb2a4
push ebx
push ebx
push edi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4fb1ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
cmp ebp, ebx
je 0x4fb22e
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.004083af
add esp, 8
mov esi, eax
push str.CWFP::StartWFP___Failed_to_start_service_with_error
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], 2
call fcn.004062df
push esi
mov esi, dword [esp + 0x80]
push eax
push esi
mov byte [esp + 0x80], 3
call fcn.00402fd1
add esp, 0xc
lea ecx, [esp + 0x34]
call fcn.00402ed7
lea ecx, [esp + 0x18]
call fcn.00402ed7
jmp 0x4fb2a4
mov eax, dword [esp + 0x84]
cmp eax, ebx
jne 0x4fb240
push 0x1388
jmp 0x4fb241
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xa0], esp
push str.CWFP::StartWFP
call fcn.004062df
lea edx, [esp + 0x70]
push edx
mov dword [esp + 0x98], 4
call fcn.00408a76
mov ecx, eax
mov dword [esp + 0x98], 0xffffffff
call fcn.00406cd5
mov esi, dword [esp + 0x7c]
push eax
push esi
mov dword [esp + 0x7c], 5
call fcn.00407662
add esp, 8
lea ecx, [esp + 0x50]
call fcn.00403a26
mov eax, esi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc
Function at 0x4fc4b0
Capabilities:
Stop service

Disassembly:
jmp 0x4fc4b0
push 0xffffffffffffffff
push 0x78a140
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov edi, dword [esp + 0xb8]
xor ebx, ebx
mov dword [esp + 0x4c], ebx
cmp dword [edi + 0x14], ebx
jne 0x4fc516
mov esi, dword [esp + 0xb4]
push 0x1a
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push str.CWFP::StopWFP___Wrong_data
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405920
jmp 0x4fc6db
lea eax, [esp + 0x14]
push eax
call fcn.00404c0a
mov ebp, 0x10
cmp dword [esp + 0x2c], ebp
jb 0x4fc538
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00564155
add esp, 4
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
jne 0x4fc56f
mov esi, dword [esp + 0xb4]
push 0x22
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push str.CWFP::StopWFP___Failed_to_open_SCM
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00405920
jmp 0x4fc6db
cmp dword [edi + 0x18], 8
jb 0x4fc57a
mov eax, dword [edi + 4]
jmp 0x4fc57d
lea eax, [edi + 4]
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
jne 0x4fc621
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea edx, [esp + 0x50]
push edi
push edx
call fcn.004083af
add esp, 8
mov esi, eax
push str.CWFP::StopWFP___Failed_to_open_service_with_error:
lea ecx, [esp + 0x18]
mov dword [esp + 0xb0], ebx
call fcn.004062df
push esi
mov esi, dword [esp + 0xb8]
push eax
push esi
mov byte [esp + 0xb8], 1
call fcn.00402fd1
add esp, 0xc
cmp dword [esp + 0x2c], ebp
jb 0x4fc5f5
mov eax, dword [esp + 0x18]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x68], ebp
jb 0x4fc6db
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00564155
add esp, 4
jmp 0x4fc6db
xor eax, eax
lea edx, [esp + 0x30]
push edx
push 1
push edi
xor ebp, ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4fc65b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
cmp ebp, ebx
je 0x4fc6c8
lea eax, [esp + 0x88]
push ebp
push eax
call fcn.004083af
add esp, 8
mov esi, eax
push str.Failed_to_stop_service_with_error
lea ecx, [esp + 0x70]
mov dword [esp + 0xb0], 2
call fcn.004062df
push esi
mov esi, dword [esp + 0xb8]
push eax
push esi
mov byte [esp + 0xb8], 3
call fcn.00402fd1
add esp, 0xc
lea ecx, [esp + 0x6c]
call fcn.00402ed7
lea ecx, [esp + 0x88]
call fcn.00402ed7
jmp 0x4fc6db
mov esi, dword [esp + 0xb4]
push 0x7bb877
mov ecx, esi
call fcn.004062df
mov eax, esi
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 8
Function at 0x506180
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x78ad33
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CReferenceSPT_class_CProxyDataStructureManager::CDataMapClass_.0
call fcn.005041b0
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call edx
mov ecx, dword [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [eax + 0x10]
call fcn.00505c40
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
call edx
mov ebx, dword [eax + 0x28]
mov eax, dword [eax + 0x10]
test esi, esi
je 0x50620b
cmp esi, eax
je 0x506210
call fcn.00565471
cmp edi, ebx
je 0x506298
test esi, esi
jne 0x506262
call fcn.00565471
cmp edi, dword [esi + 0x18]
jne 0x50622b
call fcn.00565471
cmp dword [edi + 0x2c], 0
je 0x506298
push 0x28
call fcn.005645f4
mov esi, eax
add esp, 4
mov dword [esp + 0x38], esi
mov byte [esp + 0x30], 1
test esi, esi
je 0x506266
lea ecx, [esp + 0x18]
call fcn.00504e60
mov eax, dword [eax + 0x20]
push eax
mov ecx, esi
call fcn.00503ed0
mov esi, eax
jmp 0x506268
mov esi, dword [esi]
jmp 0x506221
xor esi, esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], vtable.CReferenceSPT_class_CProxyDataStructureManager::CDataMapClass_.0
call fcn.00504220
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], vtable.CReferenceSPT_class_CProxyDataStructureManager::CDataMapClass_.0
call fcn.00504220
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x515a80
Capabilities:
Get number of processors
Parse credit card information

Disassembly:
push 0xffffffffffffffff
push 0x78c198
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.0050eff0
mov dword [esp + 0x30], 0
mov edi, 1
mov edi, edi
cmp byte [esi + 0xa8], 0
jne 0x515ad5
cmp dword [esi + 0xac], edi
je 0x515c6b
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x515b59
cmp byte [esi + 0xb8], 0x7b
jne 0x515af4
cmp dword [esi + 0xbc], edi
je 0x515c43
cmp byte [esi + 0xb8], 0x3f
jne 0x515b09
cmp dword [esi + 0xbc], edi
je 0x515c43
cmp byte [esi + 0xb8], 0x2a
jne 0x515b1e
cmp dword [esi + 0xbc], edi
je 0x515c43
cmp byte [esi + 0xb8], 0x2b
jne 0x515b33
cmp dword [esi + 0xbc], edi
je 0x515c43
mov al, byte [esi + 0xa8]
push edi
push edi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c], al
call fcn.0050f170
mov ecx, esi
call fcn.00513890
jmp 0x515ac0
cmp eax, edi
jne 0x515ac0
mov al, byte [esi + 0xa8]
cmp al, 0x29
je 0x515c6b
cmp al, 0x7c
je 0x515c6b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jg 0x515c77
cmp al, 0x28
je 0x515cad
cmp al, 0x5b
je 0x515cd7
cmp al, 0x2e
je 0x515cd7
cmp al, 0x77
je 0x515cd7
cmp al, 0x57
je 0x515cd7
cmp al, 0x73
je 0x515cd7
cmp al, 0x53
je 0x515cd7
cmp al, 0x64
je 0x515cd7
cmp al, 0x44
je 0x515cd7
cmp al, 0x5e
je 0x515cc9
cmp al, 0x24
je 0x515cc9
cmp al, 0x41
je 0x515cc9
cmp al, 0x5a
je 0x515cc9
cmp al, 0x7a
je 0x515cc9
cmp al, 0x62
je 0x515cc9
cmp al, 0x42
je 0x515cc9
cmp al, 0x47
je 0x515cc9
cmp al, 0x5c
je 0x515cbb
cmp al, 0x6b
je 0x515cbb
cmp al, 0x67
je 0x515cbb
push edi
push edi
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c], al
call fcn.0050f170
mov ecx, esi
call fcn.00513890
jmp 0x515ac0
cmp dword [esp + 0x1c], 0
jne 0x515c6b
mov al, byte [esi + 0xa8]
push edi
push edi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c], al
call fcn.0050f170
mov ecx, esi
call fcn.00513890
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jle 0x515d10
push 0x20
call fcn.005645f4
mov edi, eax
add esp, 4
test edi, edi
je 0x515ce5
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
mov ecx, eax
and ecx, 8
push ecx
and eax, 0x10
push eax
push ebp
lea ecx, [esp + 0x20]
call fcn.0050f030
push eax
mov ecx, edi
call fcn.00512cd0
mov edi, eax
jmp 0x515ce7
mov edx, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.00516cd0
jmp 0x515d19
mov eax, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.00514af0
jmp 0x515d19
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, esi
call fcn.00514880
jmp 0x515d19
mov edx, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.005142c0
jmp 0x515d19
xor edi, edi
push edi
lea ecx, [esi + 0x14]
call fcn.0050eba0
lea ecx, [esp + 0x14]
call fcn.0050e420
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4
push 0
mov ecx, esi
call fcn.00513a40
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0050e420
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4