joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100719e2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007938c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100627ec
mov dword [ebp - 0x14], eax
cmp dword [0x10666124], esi
jne 0x10071ad5
push 0x800
push esi
push 0x10007c5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10071a62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10071bb5
push esi
push esi
push 0x10007c5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10071bb5
push 0x10007c74
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10071bb5
push eax
call ebx
push 0x10007c80
push edi
mov dword [0x10666124], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c90
push edi
mov dword [0x10666128], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ca4
push edi
mov dword [0x1066612c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666134], eax
test eax, eax
je 0x10071ad2
push 0x10007cc0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666130], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10071afa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10071aed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10071b0f
push 4
pop eax
jmp 0x10071bb7
cmp dword [ebp - 0x14], esi
je 0x10071b0f
push dword [0x10666124]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10071af4
mov eax, dword [0x10666130]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10071b6d
cmp dword [0x10666134], edi
je 0x10071b6d
push eax
call ebx
push dword [0x10666134]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10071b6d
test eax, eax
je 0x10071b6d
call ecx
test eax, eax
je 0x10071b62
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10071b62
test byte [ebp - 8], 1
jne 0x10071b6d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10071b9d
mov eax, dword [0x10666128]
cmp eax, edi
je 0x10071b9a
push eax
call ebx
test eax, eax
je 0x10071b9a
call eax
mov esi, eax
test esi, esi
je 0x10071b9a
mov eax, dword [0x1066612c]
cmp eax, edi
je 0x10071b9a
push eax
call ebx
test eax, eax
je 0x10071b9a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10666124]
call ebx
test eax, eax
je 0x10071bb5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10071bb7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x4016fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404038]
jne 0x401706
repz ret
jmp fcn.00401a6c
Function at 0x402890
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e522
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x634f58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x224], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call fcn.005552b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402925
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00402ed0
push str.Foxit_Software
mov ecx, esi
call fcn.00402a10
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x402959
mov ecx, dword [esi]
call fcn.00412a30
test eax, eax
jne 0x402971
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x40296c
mov ecx, dword [esi]
call fcn.00412b00
push str.Foxit_PDF_Reader_
mov ecx, esi
call fcn.00402a10
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x402987
mov ecx, dword [esi]
call fcn.00412a30
test eax, eax
jne 0x40299f
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x40299a
mov ecx, dword [esi]
call fcn.00412b00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret
Function at 0x404000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x404029
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40403f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404036
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404072
nop
cmp esi, ecx
jae 0x404036
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404060
cmp esi, ecx
jae 0x404036
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x40419a
test eax, 0xffff0000
jne 0x40419a
push esi
push edi
movzx edi, ax
push edi
call fcn.00414427
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x404196
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x404196
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404196
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404196
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404129
cmp esi, ecx
jae 0x404196
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404117
cmp esi, ecx
jae 0x404196
movzx eax, word [esi]
test ax, ax
je 0x404196
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40415c
push edi
mov ecx, ebx
call fcn.004045a0
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40415f
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0055960c
add esp, 0x10
cmp eax, 0x50
ja case.0x40417d.1
movzx eax, byte [eax + 0x4041c8]
jmp dword [eax*4 + 0x4041b8]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4041ad
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004141b3
call fcn.00414199
push 0x80070057
call fcn.00404530
nop
test byte [ecx + 0x40], al
add byte [ebx - 1476378559], ah
inc ecx
inc eax
add byte [eax + 0x4041], ch
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x404c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e788
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x634f58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x218], esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], 2
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404e18
push 0x200
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.005552b0
add esp, 0xc
mov dword [ebp - 0x218], 0
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x21c]
lea eax, [ebp + 0x20]
mov dword [ebp - 0x21c], 0x1ff
cmovae eax, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404e18
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x404d10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], 0
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x210]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d30
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00402ed0
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x404d88
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404d7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404e69
push edx
push ecx
call fcn.0054cfd9
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x404dd6
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404dcc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404e6e
push edx
push ecx
call fcn.0054cfd9
add esp, 8
mov edx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp edx, 8
jb 0x404e4d
mov ecx, dword [ebp + 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404e43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404e73
jmp 0x404e43
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x404e33
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], 0
lea eax, [ebp + 0x38]
mov ecx, esi
push eax
call fcn.00403f20
jmp 0x404d4e
push edx
push ecx
call fcn.0054cfd9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret
call fcn.00558f09
call fcn.00558f09
call fcn.00558f09
int3
Function at 0x410e80
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea edi, [ecx + 4]
mov dword [ebp - 8], 0
push edi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x410ed1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x410ee0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x634f58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
lea eax, [ebp - 0x20c]
push str._s_failed_w_err_0x_08lx
push eax
call fcn.00410f80
add esp, 0x10
mov dword [ebp - 0x214], 0
add edi, 4
mov dword [ebp - 0x210], 0
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x410f6d
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret 8
Function at 0x4112a0
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58005b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x634f58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x234], ebx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005552b0
add esp, 0xc
mov dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
push 1
push 0x6110cc
call fcn.00402ed0
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x411355
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.004102f0
add esp, 8
jmp 0x41145f
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x411380
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x615de0
call fcn.004102f0
add esp, 8
jmp 0x41145f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402a10
push 0x6110cc
lea ecx, [ebp - 0x230]
call fcn.00402a10
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0
cmovae eax, dword [ebp - 0x230]
push 0
push 0x610bd8
push 0
push 0
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x4113fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.004102f0
jmp 0x411452
push esi
call ebx
mov esi, dword [ebp - 0x234]
push esi
push str._s_is_installed._n
call fcn.004102f0
add esp, 8
push 0x114
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x411432
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x41144d
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x411455
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartService_failed_w_err_0x_08lx_n
call fcn.00404640
add esp, 8
push edi
call ebx
test esi, esi
je 0x41145f
push esi
call ebx
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x41149b
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411491
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4114b7
push edx
push ecx
call fcn.0054cfd9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret
call fcn.00558f09
int3
Function at 0x4114c0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov bl, dl
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4114fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed___d__n
call fcn.004047e0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x411530
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed___d__n
call fcn.004047e0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
movzx eax, bl
add eax, 2
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x41157b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig_failed___d__n
call fcn.004047e0
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Service_disabled_successfully._n
call fcn.004047e0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411770
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x634f58]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4117d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TraverseProcessID_CreateToolhelp32Snapshot_GetLastError___d
call fcn.00404640
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x411822
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TraverseProcessID_Process32First_GetLastError___d
call fcn.00404640
add esp, 8
test esi, esi
je 0x411809
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax + eax]
push dword [esp + 0x14]
lea eax, [esp + 0x40]
push eax
call fcn.00559690
add esp, 8
test eax, eax
jne 0x411872
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x411862
cmp dword [esp + 0x10], edi
je 0x4118a8
call ebx
push eax
push str.TraverseProcessID_ProcessIdToSessionId_GetLastError___d
call fcn.00404640
add esp, 8
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x411830
xor ebx, ebx
test esi, esi
je 0x41188f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [esp + 0x20]
jmp 0x411884
Function at 0x412b00
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x634f58]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00412a30
test eax, eax
je 0x412b42
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x218]
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x412b50
lea ecx, [esp + 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412b70
sub ecx, edx
mov edx, 0x2f2f
sar ecx, 1
movzx eax, word [esp + ecx*2 + 0x216]
cmp ax, dx
je 0x412b96
cmp eax, 0x2f
jne 0x412ba3
mov eax, 0x2f30
mov word [esp + ecx*2 + 0x216], ax
lea ebx, [esp + 0x218]
lea ecx, [ebx + 2]
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x412bb0
push 0x100
lea eax, [esp + 0x1c]
sub ebx, ecx
push 0
push eax
sar ebx, 1
call fcn.005552b0
xor esi, esi
add esp, 0xc
mov dword [esp + 0x14], esi
test ebx, ebx
jle 0x412cbf
mov edx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov word [esp + 0x12], ax
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [esp + esi*2 + 0x218]
mov esi, 0x2f2f
cmp ax, si
je 0x412c19
mov word [esp + 0x10], ax
jmp 0x412c3d
push 0
lea eax, [esp + 0x1c]
push eax
call edx
test eax, eax
je 0x412c32
push 0x80
lea eax, [esp + 0x1c]
push eax
call edi
mov edx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esp + 0x10], si
lea eax, [esp + 0x10]
mov esi, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412c43
lea edi, [esp + 0x18]
sub eax, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x412c60
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx - 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
cmp esi, eax
jne 0x412ca6
push 0
lea eax, [esp + 0x1c]
push eax
call edx
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x412cac
push 0x80
lea eax, [esp + 0x1c]
push eax
call edi
jmp 0x412cac
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc esi
mov dword [esp + 0x14], esi
cmp esi, ebx
jl 0x412c00
lea ecx, [esp + 0x18]
call fcn.00412a30
mov ecx, dword [esp + 0x424]
neg eax
pop edi
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.0054cfc8
mov esp, ebp
pop ebp
ret