joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e50
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x46ea7b
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x498700]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xd0]
xor ebx, ebx
lea esi, [esp + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
call fcn.004091f0
mov dword [esp + 0xc8], ebx
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x403ebf
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x403f68
push esi
call fcn.00430f50
add esp, 4
cmp dword [esp + 0x38], 8
mov edi, eax
mov eax, dword [esp + 0x24]
jae 0x403eee
lea eax, [esp + 0x24]
mov edx, dword [esp + 0x18]
push edi
push esi
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x403f5f
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x480d88
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403f5f
cmp dword [esp + 0x1c], ebx
je 0x403f5f
mov eax, dword [esp + 0x14]
cmp dword [eax], 0xfeef04bd
jne 0x403f5f
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push 0x480d8c
lea ecx, [esp + 0x50]
push 0x40
push ecx
call fcn.0044e75f
add esp, 0x1c
lea edx, [esp + 0x3c]
push edx
lea ecx, [ebp + 0x68]
call fcn.004064e0
push edi
call fcn.00430f55
add esp, 4
cmp dword [esp + 0x38], 8
jb 0x403f7c
mov eax, dword [esp + 0x24]
push eax
call fcn.00430f55
add esp, 4
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0044de0c
add esp, 0xb8
ret 4
Function at 0x404210
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x46f84c
mov eax, dword fs:[0]
push eax
sub esp, 0x304
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
mov eax, dword [0x498700]
xor eax, esp
push eax
lea eax, [esp + 0x310]
mov dword fs:[0], eax
lea eax, [esp + 0x7c]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4043ef
xor ebx, ebx
push 0xfe
lea ecx, [esp + 0x211]
push ebx
push ecx
mov byte [esp + 0x218], bl
call fcn.00450a50
add esp, 0xc
push 0xff
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [esp + 0x20c]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4042d0
sub eax, edx
push eax
lea ecx, [esp + 0x210]
push ecx
lea ecx, [esp + 0x14]
call fcn.00408f00
lea ecx, [esp + 0xc]
lea eax, [esp + 0x44]
mov dword [esp + 0x318], ebx
call fcn.00409600
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0xbc]
mov byte [esp + 0x324], 1
call fcn.00406a70
cmp dword [esp + 0x5c], 8
jb 0x40432c
mov edx, dword [esp + 0x48]
push edx
call fcn.00430f55
add esp, 4
mov dword [esp + 0x318], 0xffffffff
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], bx
jb 0x40435c
mov eax, dword [esp + 0x10]
push eax
call fcn.00430f55
add esp, 4
mov eax, esi
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x404371
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.00408f00
lea ecx, [esp + 0x28]
lea eax, [esp + 0x60]
mov dword [esp + 0x318], 2
call fcn.00409600
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0xd8]
mov byte [esp + 0x324], 3
call fcn.00406a70
cmp dword [esp + 0x78], 8
jb 0x4043ca
mov ecx, dword [esp + 0x64]
push ecx
call fcn.00430f55
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], ebx
mov word [esp + 0x64], bx
jb 0x4043ef
mov edx, dword [esp + 0x2c]
push edx
call fcn.00430f55
add esp, 4
mov ecx, dword [esp + 0x310]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.0044de0c
add esp, 0x310
ret
Function at 0x404420
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x24
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0x20], eax
xor eax, eax
push 7
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
lea eax, [esp + 4]
push eax
push 0x59
push 0x800
mov word [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [esp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404472
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0xf4]
call fcn.00406b60
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044de0c
add esp, 0x24
ret

Function at 0x4044b0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
mov dword [esp + 0x10], 0x2000
jmp 0x4044d0
mov eax, dword [esp + 0x10]
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x404590
lea ecx, [esp + 0x10]
push ecx
push esi
push 0
push 0x10
push 0
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x404518
push esi
push 0
call edi
push eax
call ebp
add ebx, 1
cmp ebx, 3
jb 0x4044d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
test eax, eax
jne 0x404590
mov edx, dword [esi + 0x20]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404524
mov ebx, dword [esp + 0x18]
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebx + 0x110]
call fcn.00406b60
mov ecx, dword [esi + 0x24]
mov eax, ecx
lea edi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x404550
sub eax, edi
sar eax, 1
push eax
push ecx
lea ecx, [ebx + 0x12c]
call fcn.00406b60
mov esi, dword [esi + 0x28]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404574
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebx + 0x148]
call fcn.00406b60
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x404840
Capabilities:
Check os version

Disassembly:
sub esp, 0x138
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x13c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebp
push esi
mov dword [esp + 0x14], eax
mov eax, 6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [esp + 0x1c], 3
mov ebp, 1
mov dword [esp + 0x14], eax
push eax
call fcn.004049c0
test eax, eax
je 0x4048e5
mov esi, dword [esp + 0x1c]
cmp esi, 5
ja 0x4048ed
jmp 0x4048a0
push 0x11c
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00450a50
add esp, 0xc
push 1
push 1
push 0
push 0
mov dword [esp + 0x30], 0x11c
mov dword [esp + 0x38], esi
call edi
push edx
push eax
push 1
lea edx, [esp + 0x2c]
push edx
call ebx
test eax, eax
jne 0x40491a
add esi, 1
xor ebp, ebp
cmp esi, 5
jbe 0x4048a0
jmp 0x4048ed
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, 0xc
mov dword [esp + 0x14], eax
jbe 0x404885
xor al, al
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044de0c
add esp, 0x138
ret 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 1
mov dword [eax], ecx
mov dword [eax + 4], esi
call fcn.00404b20
test eax, eax
je 0x404936
mov al, 1
jmp 0x404953
push 3
call fcn.00404b20
test eax, eax
je 0x404945
mov al, 3
jmp 0x404953
push 2
call fcn.00404b20
neg eax
sbb al, al
and eax, 2
cmp bp, 4
mov edx, dword [esp + 0x18]
mov byte [edx + 0xc], al
movzx esi, bp
ja 0x4049b8
push 0x11c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00450a50
add esp, 0xc
push 1
push 0x20
push 0
push 0
mov dword [esp + 0x30], 0x11c
mov word [esp + 0x144], si
call edi
push edx
push eax
push 0x20
lea ecx, [esp + 0x2c]
push ecx
call ebx
test eax, eax
jne 0x4049b0
add esi, 1
cmp si, 4
jbe 0x404963
mov al, 1
jmp 0x4048ff
mov edx, dword [esp + 0x18]
mov word [edx + 8], si
mov al, 1
jmp 0x4048ff
Function at 0x409320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f668
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x498700]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x10]
mov dword [esp + 0xc], ebx
call fcn.004091f0
push 2
mov dword [esp + 0x3c], ebx
push 0x4812d0
mov ebx, esi
call fcn.00409640
add eax, 1
push eax
xor ecx, ecx
mov esi, edi
mov edx, ebx
call fcn.00406520
cmp dword [esp + 0x28], 8
jb 0x409394
mov eax, dword [esp + 0x14]
push eax
call fcn.00430f55
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044de0c
add esp, 0x30
ret

Function at 0x4099c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc58
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0xc54], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc64]
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4099ee
xor al, al
jmp 0x409b20
test ebp, ebp
jne 0x4099f5
lea ebp, [edi + 8]
push ebp
call fcn.00409bc0
add esp, 4
test al, al
je 0x4099e7
lea esi, [esp + 0x18]
call fcn.004098c0
cmp byte [esp + 0x248], 0
push 0
mov eax, esi
push eax
je 0x409a45
add edi, 8
push edi
lea ecx, [esp + 0x364]
push 0
push ecx
call fcn.0044f03c
lea edx, [esp + 0x36c]
add esp, 0x14
push edx
call fcn.00409bc0
add esp, 4
jmp 0x409b20
push ebp
lea ecx, [esp + 0x25c]
push 0
push ecx
call fcn.0044f03c
add esp, 0x14
lea eax, [esp + 0x250]
call fcn.00409c70
test al, al
je 0x4099e7
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4099e7
mov eax, dword [edi + 4]
push eax
call fcn.0042d120
add esp, 4
test eax, eax
jne 0x4099e7
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [edi + 4]
lea eax, [esp + 0x460]
push eax
push ecx
call fcn.0042d2c0
mov esi, eax
add esp, 8
test esi, esi
jle 0x409af3
push 0
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x46c]
push eax
push ebp
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x409af0
cmp dword [esp + 0x14], esi
je 0x409ab1
or esi, 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 4]
call fcn.0042d530
test esi, esi
jne 0x409b19
mov ecx, dword [esp + 0x230]
lea eax, [esp + 0x250]
call fcn.00409cc0
xor eax, eax
test esi, esi
sete al
mov ecx, dword [esp + 0xc64]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044de0c
add esp, 0xc58
ret 4
Function at 0x409bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x409c61
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x409c61
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409bf5
and al, 0x10
xor ecx, ecx
cmp al, 0x10
sete cl
mov al, cl
pop edi
ret
push esi
push edi
call fcn.0044f05a
mov esi, eax
push 0x5c
push esi
call fcn.0044f0b0
add esp, 0xc
test eax, eax
jne 0x409c1c
push 0x2f
push esi
call fcn.0044f0b0
add esp, 8
test eax, eax
je 0x409c5c
push esi
mov byte [eax], 0
call fcn.00409bc0
add esp, 4
test al, al
push esi
jne 0x409c3a
call fcn.0044f0dd
add esp, 4
pop esi
xor al, al
pop edi
ret
call fcn.0044f0dd
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x409c5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409c35
pop esi
mov al, 1
pop edi
ret
xor al, al
pop edi
ret

Function at 0x409cc0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x30
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x409ced
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x409d5b
lea ecx, [esp + 0x18]
push ecx
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x409d5b
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x409d5b
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp eax, 1
sete bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x30
ret
Function at 0x40a030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46e8cb
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x498700]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov eax, dword [0x49d350]
mov esi, dword [0x49d34c]
cmp esi, eax
mov edi, eax
jbe 0x40a09f
call fcn.0044ec76
mov eax, dword [0x49d350]
mov esi, dword [0x49d34c]
cmp esi, eax
jbe 0x40a09f
call fcn.0044ec76
mov eax, dword [0x49d350]
cmp esi, edi
je 0x40a0c8
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + esi]
jle 0x40a0c2
push ecx
push edi
push ecx
push esi
call fcn.0044e125
add esp, 0x10
mov dword [0x49d350], ebx
xor eax, eax
push 9
push str.poker.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
mov word [esp + 0x24], ax
call fcn.00406b60
xor esi, esi
push 0x228
lea eax, [esp + 0x3c]
push esi
mov dword [esp + 0x280], esi
push eax
mov dword [esp + 0x40], esi
call fcn.00450a50
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x40a139
cmp dword [esp + 0x30], 8
jb 0x40a132
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00430f55
add esp, 4
xor al, al
jmp 0x40a1e2
lea edx, [esp + 0x34]
push edx
push esi
mov dword [esp + 0x3c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a1a8
lea eax, [esp + 0x58]
test eax, eax
je 0x40a199
lea edx, [eax + 2]
jmp 0x40a160
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a160
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x58]
push ecx
mov edi, eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
call fcn.004085f0
test eax, eax
jne 0x40a199
lea ebx, [esp + 0x3c]
mov esi, 0x49d348
call fcn.00410e00
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a150
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x49d34c]
test ecx, ecx
jne 0x40a1bd
xor eax, eax
jmp 0x40a1c7
mov eax, dword [0x49d350]
sub eax, ecx
sar eax, 2
test eax, eax
seta bl
cmp dword [esp + 0x30], 8
jb 0x40a1e0
mov eax, dword [esp + 0x1c]
push eax
call fcn.00430f55
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0044de0c
mov esp, ebp
pop ebp
ret
Function at 0x40a210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x49d350]
push ebx
push ebp
push esi
push edi
mov edi, dword [0x49d34c]
cmp edi, eax
jbe 0x40a233
call fcn.0044ec76
mov eax, dword [0x49d350]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, 0x49d348
mov ebx, ecx
cmp dword [0x49d34c], eax
mov esi, eax
jbe 0x40a254
call fcn.0044ec76
mov eax, dword [0x49d350]
test ebx, ebx
je 0x40a260
cmp ebx, 0x49d348
je 0x40a26a
call fcn.0044ec76
mov eax, dword [0x49d350]
cmp edi, esi
je 0x40a2b4
test ebx, ebx
jne 0x40a277
call fcn.0044ec76
cmp edi, dword [ebx + 8]
jb 0x40a281
call fcn.0044ec76
mov eax, dword [edi]
push eax
push 0
push 1
call ebp
mov esi, eax
test esi, esi
je 0x40a2a0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, dword [ebx + 8]
jb 0x40a2aa
call fcn.0044ec76
mov eax, dword [0x49d350]
add edi, 4
jmp 0x40a240
cmp dword [0x49d34c], eax
mov edi, eax
jbe 0x40a2c8
call fcn.0044ec76
mov eax, dword [0x49d350]
mov esi, dword [0x49d34c]
cmp esi, eax
jbe 0x40a2dc
call fcn.0044ec76
mov eax, dword [0x49d350]
cmp esi, edi
je 0x40a305
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + esi]
jle 0x40a2ff
push ecx
push edi
push ecx
push esi
call fcn.0044e125
add esp, 0x10
mov dword [0x49d350], ebx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a9a0
Capabilities:
Query service status

Disassembly:
sub esp, 0x28
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40a9be
or eax, 0xffffffff
pop edi
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40a9e8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
or eax, 0xffffffff
pop edi
add esp, 0x28
ret
push ebx
lea ecx, [esp + 0xc]
push ecx
push 0x24
lea edx, [esp + 0x18]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
test ebx, ebx
pop ebx
je 0x40a9df
mov eax, dword [esp + 0x10]
pop esi
pop edi
add esp, 0x28
ret
Function at 0x413670
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46ef68
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push edi
mov eax, dword [0x498700]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x20]
push esi
mov dword [esp + 0x1c], 0
call fcn.00409000
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
push edx
sub esp, 0xc
mov dword [edi + 8], ecx
add ebx, 0xfffffff0
mov dword [esp + 0x30], esp
mov edi, esp
push ebx
call fcn.00409080
add eax, 0x10
mov ecx, dword [esp + 0x40]
mov dword [edi], eax
mov eax, dword [esp + 0x3c]
mov dword [edi + 4], eax
sub ebp, esi
mov eax, 0x2aaaaaab
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add esp, 4
add eax, edx
push eax
mov dword [edi + 8], ecx
push esi
xor ecx, ecx
call fcn.00413190
add esp, 0x18
mov dword [esp + 0x18], 0xffffffff
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413723
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4138b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x49d344], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
jne 0x41395e
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
mov esi, 0x49e35c
call fcn.00414690
mov edi, dword [esp + 0x10]
cmp edi, esi
mov ebx, dword [0x49e360]
je 0x4138f6
call fcn.0044ec76
mov esi, dword [esp + 0x14]
cmp ebx, esi
je 0x41395e
test edi, edi
jne 0x413907
call fcn.0044ec76
cmp esi, dword [edi + 4]
jne 0x413911
call fcn.0044ec76
lea ebx, [esi + 0x10]
lea eax, [esp + 0x10]
mov esi, 0x49e350
call fcn.00414690
mov esi, dword [esp + 0x10]
cmp esi, 0x49e350
mov edi, dword [0x49e354]
je 0x413939
call fcn.0044ec76
mov ebx, dword [esp + 0x14]
cmp edi, ebx
je 0x41395e
test esi, esi
jne 0x41394a
call fcn.0044ec76
cmp ebx, dword [esi + 4]
jne 0x413954
call fcn.0044ec76
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413970
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x49d344], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
jne 0x413a1e
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
mov esi, 0x49e35c
call fcn.00414690
mov edi, dword [esp + 0x10]
cmp edi, esi
mov ebx, dword [0x49e360]
je 0x4139b6
call fcn.0044ec76
mov esi, dword [esp + 0x14]
cmp ebx, esi
je 0x413a1e
test edi, edi
jne 0x4139c7
call fcn.0044ec76
cmp esi, dword [edi + 4]
jne 0x4139d1
call fcn.0044ec76
lea ebx, [esi + 0x10]
lea eax, [esp + 0x10]
mov esi, 0x49e350
call fcn.00414690
mov esi, dword [esp + 0x10]
cmp esi, 0x49e350
mov edi, dword [0x49e354]
je 0x4139f9
call fcn.0044ec76
mov ebx, dword [esp + 0x14]
cmp edi, ebx
je 0x413a1e
test esi, esi
jne 0x413a0a
call fcn.0044ec76
cmp ebx, dword [esi + 4]
jne 0x413a14
call fcn.0044ec76
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413a30
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor ebx, ebx
cmp ebp, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
jne 0x413a4a
mov ebp, 0x49d345
push 1
push 0x4823d4
mov ecx, 0x49e368
call fcn.00401ca0
push 0x48
call fcn.00430f25
add esp, 4
cmp eax, ebx
je 0x413a86
mov ecx, 7
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ebx
mov word [eax + 4], bx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x34], ebx
mov word [eax + 0x24], bx
mov esi, eax
jmp 0x413a88
xor esi, esi
mov eax, dword [esp + 0x20]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00406a70
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [esi + 0x20]
call fcn.00406a70
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push ebx
push esi
push 0x4145c0
push ebx
push ebx
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], 4
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x28], edi
jne 0x413aed
call fcn.00413b30
xor eax, eax
cmp edi, ebx
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea ebx, [esp + 0x28]
mov eax, 0x49e350
call fcn.00414700
mov dword [eax], ebp
lea ebx, [esp + 0x14]
mov eax, 0x49e35c
call fcn.00414700
mov edi, dword [esp + 0x28]
mov dword [eax], edi
xor ebx, ebx
xor eax, eax
cmp edi, ebx
pop edi
pop esi
pop ebp
setne al
pop ebx
add esp, 0xc
ret