joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438c50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443a05
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x45aeb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], ecx
push str.CZDServWorker::SwitchDatacard___enter
lea ecx, [ebp - 0x7c]
call fcn.00401610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401650
push 0x44f5f4
lea ecx, [ebp - 0x98]
call fcn.00401610
mov dword [ebp - 4], 1
push str.SwitchCommand
lea ecx, [ebp - 0xb4]
call fcn.00401610
mov byte [ebp - 4], 2
push str.SWITCH
lea ecx, [ebp - 0xd0]
call fcn.00401610
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xec]
push ecx
mov ecx, 0x45f1c4
call fcn.0043fac0
mov dword [ebp - 0x150], eax
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x154], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x154]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043df20
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xec]
call fcn.00401650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd0]
call fcn.00401650
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb4]
call fcn.00401650
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x98]
call fcn.00401650
lea ecx, [ebp - 0x10]
push ecx
call fcn.00436d80
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10]
call fcn.00403070
test eax, eax
jle 0x438e64
push str.CZDServWorker::SwitchDatacard___before_ResetCD.exe
lea ecx, [ebp - 0x108]
call fcn.00401610
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x108]
push edx
call fcn.004013c0
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x108]
call fcn.00401650
push str.ResetCD.exe
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00401560
add esp, 0xc
mov byte [ebp - 4], 0xc
push 0x44f6ac
lea edx, [ebp - 0x12c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043e750
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x60]
push edx
mov ecx, dword [ebp - 0x15c]
call fcn.0043e130
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x12c]
call fcn.0043db70
push 0
push 0
lea ecx, [ebp - 0x5c]
call fcn.00403bd0
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401ca0
push eax
push 0x44f6b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x60]
call fcn.0043db70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3c]
call fcn.00402cd0
push str.CZDServWorker::SwitchDatacard___leave
lea ecx, [ebp - 0x148]
call fcn.00401610
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x148]
push eax
call fcn.004013c0
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x148]
call fcn.00401650
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
call fcn.00402cd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0043db70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418496
mov esp, ebp
pop ebp
ret 4
Function at 0x4392b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443e75
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x45aeb8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
lea eax, [ebp - 0x14]
push eax
call fcn.00436720
add esp, 4
mov dword [ebp - 4], 0
push 0x44f710
lea ecx, [ebp - 0x14]
call fcn.00403a30
lea ecx, [ebp - 0x14]
call fcn.00401ca0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439352
push str.CZDServWorker::PrepareCancelAutoPlayEnv_____CancelAutoPlay_not_exists
lea ecx, [ebp - 0x3c]
call fcn.00401610
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004013c0
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401650
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402cd0
mov al, byte [ebp - 0x3d]
jmp 0x4393ef
push 0x44f70c
lea ecx, [ebp - 0x44]
call fcn.00403540
mov byte [ebp - 4], 2
push str.regguid
lea ecx, [ebp - 0x48]
call fcn.00403540
mov byte [ebp - 4], 3
lea edx, [ebp - 0x44]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.004369e0
add esp, 0x18
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.00402cd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402cd0
mov dword [ebp - 0x10], 0
mov edx, dword [0x44f804]
mov dword [ebp - 0x20], edx
mov eax, dword [0x44f808]
mov dword [ebp - 0x1c], eax
push 0xa
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401ca0
push eax
call fcn.0043ba10
add esp, 0x10
mov byte [ebp - 0x49], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402cd0
mov al, byte [ebp - 0x49]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00418496
mov esp, ebp
pop ebp
ret
Function at 0x43b090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444392
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x45aeb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
push str.CZDServWorker::Run____Enter
lea ecx, [ebp - 0x2c]
call fcn.00401610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401650
mov byte [ebp - 0xd], 0
push str.GlobalZDServ_5EC1A546_14F0_483a_B76C_5993A49D332E
lea ecx, [ebp - 0x30]
call fcn.00403540
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.004367d0
add esp, 8
mov ecx, dword [ebp - 0xc0]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402cd0
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x43b179
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CZDServWorker::Run____ERROR_ALREADY_EXISTS
lea ecx, [ebp - 0x4c]
call fcn.00401610
mov dword [ebp - 4], 2
lea edx, [ebp - 0x4c]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401650
jmp 0x43b2da
mov eax, 1
test eax, eax
je 0x43b1e0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc0]
call fcn.00438a30
movzx ecx, al
test ecx, ecx
jne 0x43b1ad
mov edx, dword [ebp - 0xc0]
movzx eax, byte [edx + 0xc]
test eax, eax
je 0x43b1de
push str.CheckIsUserLogIn___find_log_in_user_or_need_quit_
lea ecx, [ebp - 0x68]
call fcn.00401610
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x68]
push ecx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401650
jmp 0x43b1e0
jmp 0x43b179
mov ecx, dword [ebp - 0xc0]
call fcn.004392b0
push 0
push 0
push 0
push 0x43b070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc0]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc0]
cmp dword [eax + 4], 0
jne 0x43b24d
push str.CZDServWorker::Run_____Create_Start_MonitorNetCardThread_Failed
lea ecx, [ebp - 0x84]
call fcn.00401610
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x84]
push ecx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00401650
push str.CZDServWorker::Run..._..._before_WaitForSingleObject
lea ecx, [ebp - 0xa0]
call fcn.00401610
mov dword [ebp - 4], 5
lea edx, [ebp - 0xa0]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00401650
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xc0]
call fcn.004391f0
push str.CZDServWorker::Run_____leave
lea ecx, [ebp - 0xbc]
call fcn.00401610
mov dword [ebp - 4], 6
lea edx, [ebp - 0xbc]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.00401650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43b3d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443ac1
mov eax, dword fs:[0]
push eax
sub esp, 0x888
mov eax, dword [0x45aeb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10
push 0
lea eax, [ebp - 0x824]
push eax
call fcn.00419450
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x874]
push ecx
call fcn.00419450
add esp, 0xc
mov dword [ebp - 0x874], 0x44
xor edx, edx
mov word [ebp - 0x814], dx
push 0x7fe
push 0
lea eax, [ebp - 0x812]
push eax
call fcn.00419450
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x814]
push edx
call fcn.004194ca
add esp, 8
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x10], 0
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
jne 0x43b4c8
push str.CreateEnvironmentBlock__failed
lea ecx, [ebp - 0x890]
call fcn.00401610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x890]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call fcn.00401650
lea ecx, [ebp - 0x824]
push ecx
lea edx, [ebp - 0x874]
push edx
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x420
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
je 0x43b569
cmp dword [ebp - 0x824], 0xffffffff
je 0x43b569
cmp dword [ebp + 0x18], 0
jg 0x43b528
mov dword [ebp - 0x894], 0xffffffff
jmp 0x43b531
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x894], edx
mov eax, dword [ebp - 0x894]
push eax
mov ecx, dword [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x820], 0xffffffff
je 0x43b57f
mov edx, dword [ebp - 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00418496
mov esp, ebp
pop ebp
ret
Function at 0x43ba10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443d36
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x45aeb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004365e0
movzx eax, al
test eax, eax
je 0x43ba81
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xa
push 5
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jle 0x43ba75
xor eax, eax
jmp 0x43bba2
mov eax, 0xd
jmp 0x43bba2
call fcn.00436630
movzx ecx, al
test ecx, ecx
je 0x43bad9
push str.CCommonTools::IsXP__
lea ecx, [ebp - 0x2c]
call fcn.00401610
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401650
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043b5b0
add esp, 0x10
jmp 0x43bba2
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00403540
mov dword [ebp - 4], 1
lea edx, [ebp - 0x34]
push edx
call fcn.00436df0
add esp, 4
mov byte [ebp - 0x2d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402cd0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x43bb5b
push str.GetExtIsNeedAdmin
lea ecx, [ebp - 0x50]
call fcn.00401610
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x50]
push ecx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00401650
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043b7a0
add esp, 0x10
jmp 0x43bba2
push str.ExecuteApp_last
lea ecx, [ebp - 0x6c]
call fcn.00401610
mov dword [ebp - 4], 3
lea eax, [ebp - 0x6c]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00401650
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043b5b0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43bbc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45aeb8]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.00418b51
add esp, 0xc
mov dword [ebp - 0x210], 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
push 0x450bd8
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43bc4b
push 0
lea edx, [ebp - 0x20c]
push edx
push 0
push 1
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00418496
mov esp, ebp
pop ebp
ret
Function at 0x43c190
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443b49
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x45aeb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.RemoveStartItemFromRegistry____Enter
lea ecx, [ebp - 0x38]
call fcn.00401610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00401650
lea ecx, [ebp - 0x1c]
call fcn.004010e0
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0xf003f
mov ecx, dword [ebp - 0x10]
push ecx
push 0x80000002
lea ecx, [ebp - 0x1c]
call fcn.004012c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43c25a
push str.RemoveStartItemFromRegistry____rk.Open_failed
lea ecx, [ebp - 0x54]
call fcn.00401610
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
push edx
call fcn.004013c0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00401650
mov byte [ebp - 0x55], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401110
mov al, byte [ebp - 0x55]
jmp 0x43c2c7
push str.LaunchUI
lea ecx, [ebp - 0x1c]
call fcn.004011c0
mov dword [ebp - 0x14], eax
push str.CancelAutoPlay_Server
lea ecx, [ebp - 0x1c]
call fcn.004011c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43c2a9
push str.RemoveStartItemFromRegistry____rk.DeleteValue_failed
lea ecx, [ebp - 0x74]
call fcn.00401610
mov byte [ebp - 4], 3
lea eax, [ebp - 0x74]
push eax
call fcn.004013c0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.00401650
lea ecx, [ebp - 0x1c]
call fcn.004011f0
mov byte [ebp - 0x75], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401110
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43cdd0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443d8d
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x45aeb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Uninstall___Enter
lea ecx, [ebp - 0x54]
call fcn.00401610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00401650
call fcn.0043c940
test eax, eax
jne 0x43ce73
push str.Uninstall___..._...Not_found_service
lea ecx, [ebp - 0x70]
call fcn.00401610
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x70]
push ecx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00401650
call fcn.0043c930
mov eax, 1
jmp 0x43cff5
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43ceca
push str.Uninstall___hSCM__NULL
lea ecx, [ebp - 0x8c]
call fcn.00401610
mov dword [ebp - 4], 2
lea edx, [ebp - 0x8c]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.00401650
xor eax, eax
jmp 0x43cff5
push 0x10020
push 0x450ac0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x43cf30
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.Uninstall___hService__NULL
lea ecx, [ebp - 0xa8]
call fcn.00401610
mov dword [ebp - 4], 3
lea edx, [ebp - 0xa8]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.00401650
xor eax, eax
jmp 0x43cff5
lea eax, [ebp - 0x38]
push eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x14], 0
je 0x43cfae
push str.Uninstall___DeleteService_success
lea ecx, [ebp - 0xc4]
call fcn.00401610
mov dword [ebp - 4], 4
lea edx, [ebp - 0xc4]
push edx
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00401650
call fcn.0043c930
mov eax, 1
jmp 0x43cff5
push str.Uninstall___DeleteService_failed
lea ecx, [ebp - 0xe0]
call fcn.00401610
mov dword [ebp - 4], 5
lea eax, [ebp - 0xe0]
push eax
call fcn.004013c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.00401650
push str.Service_could_not_be_deleted
call fcn.0043bbc0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43ea80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00403bd0
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403bd0
push eax
mov ecx, dword [ebp + 8]
call fcn.00403bd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43eae0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x45aeb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], 0
push 0x800
push 0
lea eax, [ebp - 0x808]
push eax
call fcn.00419450
add esp, 0xc
mov ecx, dword [ebp - 0x810]
add ecx, 4
call fcn.00403bd0
push eax
push 0x400
lea ecx, [ebp - 0x808]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00403bd0
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00403bd0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403bd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x43eb7e
lea edx, [ebp - 0x808]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401610
mov eax, dword [ebp - 0x80c]
or eax, 1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 8]
jmp 0x43eb9d
push 0x44d2cc
mov ecx, dword [ebp + 8]
call fcn.00401610
mov ecx, dword [ebp - 0x80c]
or ecx, 1
mov dword [ebp - 0x80c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418496
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43f070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442d4a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x45aeb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp + 8]
call fcn.00409560
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
sub eax, 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x10]
sub ecx, 2
cmp dword [ebp - 0x18], ecx
jne 0x43f12a
mov edx, dword [ebp - 0x10]
add edx, 0x800
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x24], 0
je 0x43f0e6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0040e762
add esp, 4
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040e757
add esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x58]
add ecx, 4
call fcn.00403bd0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov dword [ebp - 0x18], eax
jmp 0x43f0b7
push 0x208
call fcn.0040e757
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x14]
je 0x43f1d1
push 0
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040c600
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x20]
sar ecx, 1
mov dword [ebp - 0x18], ecx
jne 0x43f175
jmp 0x43f1d1
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0041a62e
add esp, 0xc
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x4c]
call fcn.00401610
mov dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004094e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00401650
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x43f14d
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push eax
call fcn.0040e762
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
push edx
call fcn.0040e762
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4