joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b50
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0a0e
mov eax, dword fs:[0]
push eax
mov eax, 0x2864
call fcn.004ad6f0
mov eax, dword [0x521e28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2870], ecx
mov dword [ebp - 0x2648], 0
mov ecx, dword [ebp - 0x2870]
call fcn.00404870
mov word [ebp - 0x2644], 0
push 0x206
push 0
lea eax, [ebp - 0x2642]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x2424
push 0
lea ecx, [ebp - 0x243c]
push ecx
call fcn.004ad2c0
add esp, 0xc
lea edx, [ebp - 0x2644]
push edx
push 2
call fcn.00428a40
mov ecx, dword [ebp - 0x2870]
call fcn.00403650
test eax, eax
je 0x403c39
lea ecx, [ebp - 0x2864]
call fcn.00405dc0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x243c]
push eax
push 0
lea ecx, [ebp - 0x2864]
call fcn.00406320
test eax, eax
je 0x403c22
mov dword [ebp - 0x2648], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2864]
call fcn.00405eb0
jmp 0x403cd7
mov dword [ebp - 0x286c], 0
mov dword [ebp - 0x2868], 0
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x286c], eax
cmp dword [ebp - 0x286c], 0
je 0x403cd7
push 0xf01ff
push 0x4ea69c
mov ecx, dword [ebp - 0x286c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2868], eax
cmp dword [ebp - 0x2868], 0
je 0x403cc0
mov edx, dword [ebp - 0x2868]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x403ca9
mov dword [ebp - 0x2648], 1
mov eax, dword [ebp - 0x2868]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x2868], 0
mov ecx, dword [ebp - 0x286c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x286c], 0
mov eax, dword [ebp - 0x2648]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad2aa
mov esp, ebp
pop ebp
ret
Function at 0x404870
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
call fcn.00403650
test eax, eax
je 0x4048b3
push 0
push 0
push 0x10
push 0x4ea898
push 0x4ea8bc
mov ecx, dword [ebp - 0x34]
call fcn.004037b0
mov dword [ebp - 8], eax
jmp 0x4049bd
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4049bd
push 0xf01ff
push 0x4ea8d0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4049ac
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x2c], 1
je 0x404926
lea eax, [ebp - 0x30]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x2c], 1
je 0x404994
cmp dword [ebp - 4], 5
jge 0x404994
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3e8
jae 0x404961
mov dword [ebp - 0x14], 0x3e8
jmp 0x404971
cmp dword [ebp - 0x14], 0x1388
jbe 0x404971
mov dword [ebp - 0x14], 0x1388
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x404934
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x404be0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
call fcn.00403650
test eax, eax
je 0x404c23
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 0x400
push eax
push 0x4ea988
push str.NSPUPSVC
mov ecx, dword [ebp - 0x30]
call fcn.004037b0
mov dword [ebp - 4], eax
jmp 0x404cbd
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404cbd
push 0x100
push 0x4ea9c0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404cac
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x28], 1
je 0x404c9b
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404c9b
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x404cf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
je 0x404d7a
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.004ad2c0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404d7a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x4053a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x521e28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movzx eax, byte [0x523538]
test eax, eax
jne 0x4053de
xor al, al
jmp 0x405583
mov byte [ebp - 0x11], 0
cmp dword [0x523d60], 0
je 0x405580
mov dword [ebp - 4], 0
call fcn.00405780
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jbe 0x405562
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0x18]
je 0x405562
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x51c0f0]
push eax
mov ecx, dword [0x523d60]
push ecx
call fcn.00405d10
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7f
ja case.0x405464.2
mov ecx, dword [ebp - 0x24]
movzx edx, byte [ecx + 0x4055bc]
jmp dword [edx*4 + 0x405598]
push str.ERROR
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.WARNING
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.NOTICE
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
mov eax, dword [0x523d60]
push eax
call fcn.004ade29
add esp, 4
mov ecx, dword [0x523d60]
movzx edx, word [ecx + eax*2]
cmp edx, 0xa
je 0x40552b
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s_n
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
jmp 0x405556
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
mov eax, dword [0x52353c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x11], 1
jmp 0x405579
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40546b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x521e28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movzx eax, byte [0x523538]
test eax, eax
jne 0x4053de
xor al, al
jmp 0x405583
mov byte [ebp - 0x11], 0
cmp dword [0x523d60], 0
je 0x405580
mov dword [ebp - 4], 0
call fcn.00405780
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jbe 0x405562
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0x18]
je 0x405562
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x51c0f0]
push eax
mov ecx, dword [0x523d60]
push ecx
call fcn.00405d10
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7f
ja case.0x405464.2
mov ecx, dword [ebp - 0x24]
movzx edx, byte [ecx + 0x4055bc]
jmp dword [edx*4 + 0x405598]
push str.ERROR
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.WARNING
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.NOTICE
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
mov eax, dword [0x523d60]
push eax
call fcn.004ade29
add esp, 4
mov ecx, dword [0x523d60]
movzx edx, word [ecx + eax*2]
cmp edx, 0xa
je 0x40552b
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s_n
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
jmp 0x405556
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
mov eax, dword [0x52353c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x11], 1
jmp 0x405579
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405481
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x521e28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movzx eax, byte [0x523538]
test eax, eax
jne 0x4053de
xor al, al
jmp 0x405583
mov byte [ebp - 0x11], 0
cmp dword [0x523d60], 0
je 0x405580
mov dword [ebp - 4], 0
call fcn.00405780
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jbe 0x405562
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0x18]
je 0x405562
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x51c0f0]
push eax
mov ecx, dword [0x523d60]
push ecx
call fcn.00405d10
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7f
ja case.0x405464.2
mov ecx, dword [ebp - 0x24]
movzx edx, byte [ecx + 0x4055bc]
jmp dword [edx*4 + 0x405598]
push str.ERROR
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.WARNING
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.NOTICE
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
mov eax, dword [0x523d60]
push eax
call fcn.004ade29
add esp, 4
mov ecx, dword [0x523d60]
movzx edx, word [ecx + eax*2]
cmp edx, 0xa
je 0x40552b
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s_n
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
jmp 0x405556
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
mov eax, dword [0x52353c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x11], 1
jmp 0x405579
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405497
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x521e28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movzx eax, byte [0x523538]
test eax, eax
jne 0x4053de
xor al, al
jmp 0x405583
mov byte [ebp - 0x11], 0
cmp dword [0x523d60], 0
je 0x405580
mov dword [ebp - 4], 0
call fcn.00405780
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jbe 0x405562
mov edx, dword [ebp + 8]
and edx, dword [ebp - 0x18]
je 0x405562
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x51c0f0]
push eax
mov ecx, dword [0x523d60]
push ecx
call fcn.00405d10
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7f
ja case.0x405464.2
mov ecx, dword [ebp - 0x24]
movzx edx, byte [ecx + 0x4055bc]
jmp dword [edx*4 + 0x405598]
push str.ERROR
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.WARNING
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
push str.NOTICE
push 0x208
push 0x523b58
call fcn.00405cc0
jmp 0x4054e1
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
xor al, al
jmp 0x405583
mov eax, dword [0x523d60]
push eax
call fcn.004ade29
add esp, 4
mov ecx, dword [0x523d60]
movzx edx, word [ecx + eax*2]
cmp edx, 0xa
je 0x40552b
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s_n
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
jmp 0x405556
mov eax, dword [0x523d60]
push eax
push 0x523b58
push 0x523950
push str.__s___s_:__s
mov ecx, dword [0x51c0ec]
push ecx
mov edx, dword [0x52353c]
push edx
call fcn.00405d60
add esp, 0x18
mov eax, dword [0x52353c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x11], 1
jmp 0x405579
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405640
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b2b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x521e28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movzx eax, byte [0x523538]
test eax, eax
jne 0x40567e
xor al, al
jmp 0x40576e
mov byte [ebp - 0x11], 0
cmp dword [0x523d60], 0
je 0x40576b
mov dword [ebp - 4], 0
call fcn.00405780
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xff
jne 0x405751
lea edx, [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x51c0f0]
push edx
mov eax, dword [0x523d60]
push eax
call fcn.00405d10
mov dword [ebp - 0x1c], 0
mov ecx, dword [0x523d60]
push ecx
call fcn.004ade29
add esp, 4
mov edx, dword [0x523d60]
movzx eax, word [edx + eax*2]
cmp eax, 0xa
je 0x40571e
mov ecx, dword [0x523d60]
push ecx
push 0x523950
push str.__s_:__s_n
mov edx, dword [0x51c0ec]
push edx
mov eax, dword [0x52353c]
push eax
call fcn.00405d60
add esp, 0x14
jmp 0x405744
mov ecx, dword [0x523d60]
push ecx
push 0x523950
push str.__s_:__s
mov edx, dword [0x51c0ec]
push edx
mov eax, dword [0x52353c]
push eax
call fcn.00405d60
add esp, 0x14
mov ecx, dword [0x52353c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x11], 1
jmp 0x405764
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
push 0x523540
call fcn.004ade29
add esp, 4
test eax, eax
je 0x405801
push 0x523748
call fcn.004ade29
add esp, 4
test eax, eax
je 0x405801
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x523540
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405801
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x523748
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x406320
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40635d
xor eax, eax
jmp 0x4063c9
cmp dword [ebp + 8], 1
jne 0x4063a4
lea edx, [ebp - 8]
push edx
push SysReAllocString
mov eax, dword [ebp + 0x10]
push eax
call fcn.00405280
test eax, eax
jge 0x40637d
xor eax, eax
jmp 0x4063c9
mov ecx, dword [ebp - 8]
add ecx, 2
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4063a2
xor eax, eax
jmp 0x4063c9
jmp 0x4063ba
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4063ba
xor eax, eax
jmp 0x4063c9
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4063d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x406406
xor eax, eax
jmp 0x40643d
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40642e
xor eax, eax
jmp 0x40643d
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407f60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x407f94
mov ecx, dword [ebp - 4]
add ecx, 0x20
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x409360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
jmp 0x407fb6
mov edx, dword [ebp - 4]
add edx, 0x20
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x409ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x407fc3
xor eax, eax
jmp 0x407fc8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x407fd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0
je 0x408114
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x24], 0
je 0x408114
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 4], 0
push 0x64
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x408053
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
call eax
push 0x1f4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x408051
push str.CTISMSIPCServer___has_been_exited_normally_n
call fcn.00405640
add esp, 4
mov dword [ebp - 4], 1
jmp 0x408067
push str.CTISMSIPCServer___has_been_exited_gracefully_n
call fcn.00405640
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x4080c9
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
je 0x408090
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4080bc
push str.CTISMSIPCServer___has_been_terminated_n
call fcn.00405640
add esp, 4
jmp 0x4080c9
push str.CTISMSIPCServer___has_NOT_been_terminated_n
call fcn.00405640
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x24], 0
je 0x4080e9
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x20], 0
mov esp, ebp
pop ebp
ret

Function at 0x4088e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x40a450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x408916
xor eax, eax
jmp 0x40891b
mov eax, 1
mov esp, ebp
pop ebp
ret