joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101395b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1017004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [reloc.VERSION.dll_GetFileVersionInfoA], bl
je 0x1013954
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1013a37
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
or edi, 0xffffffff
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x101398d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1013a3e
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013a3e
call fcn.0100320b
mov dword [ebp - 0x10], esp
cmp esp, ebx
jne 0x10139a3
mov eax, 0x8007000e
jmp 0x1013a3e
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push edi
push dword [ebp + 8]
push ebx
push ebx
call esi
test eax, eax
je 0x1013970
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1013970
call fcn.0100320b
mov dword [ebp - 0xc], esp
cmp esp, ebx
je 0x1013999
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push ebx
push ebx
call esi
test eax, eax
je 0x1013970
push ebx
push ebx
push ebx
push ebx
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x1013970
call fcn.0100320b
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x1013999
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 8]
push edi
push dword [ebp + 0x10]
push ebx
push ebx
call esi
test eax, eax
je 0x1013970
push dword [ebp - 0x10]
push dword [ebp + 0x18]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01001335
leave
ret 0x14

Function at 0x1013f1f
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
xor ebx, ebx
dec esi
push esi
push edi
call fcn.0100ce01
add esp, 0x10
test eax, eax
jl 0x1013f1b
cmp eax, esi
ja 0x1013f1b
jne 0x1013f28
jmp 0x1013f20
mov ebx, 0x8007007a
xor eax, eax
mov word [edi + esi*2], ax
mov eax, esi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1013f31
mov dword [ecx], eax
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401039
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401070
lea ebx, [ebx]
cmp esi, eax
jae 0x401074
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401060
cmp esi, eax
jb 0x40107a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x407930
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xa8], 0
je 0x407942
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x4078f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xa8], eax
je 0x40793d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x407aa0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0xfc], 0
jne 0x407b0e
mov eax, dword [esp + 8]
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407b07
mov edx, dword [edi + 0x118]
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x407ae0
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edi
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
ret 4
Function at 0x40d000
Capabilities:
Get common file path

Disassembly:
sub esp, 0xac
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
push edi
mov esi, ecx
call fcn.00407bc0
push 0x9c
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00481f20
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x24]
sub eax, 1
push 0x4cbc80
push 0x200
je 0x40d05f
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40d065
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi + 0xb8]
mov dword [edx + 0x968], 0x6a
mov eax, dword [esi + 0xb8]
mov dword [eax + 0x96c], 0x6b
mov ecx, dword [esi + 0xb8]
mov dword [ecx + 0x970], 0x6c
mov edx, dword [esi + 0xb8]
push 1
lea eax, [esp + 0xc]
push eax
mov dword [edx + 0x974], 0x6d
mov ecx, dword [esi + 0xb8]
push 0x4cbc80
call fcn.0041da90
test eax, eax
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
jne 0x40d0e1
cmp dword [esi + 0xf0], 0
jne 0x40d14b
push 0x30
push 0x4a1a90
push 0x4a1a28
push 0
call edi
jmp 0x40d14b
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb8]
call fcn.0041d990
test eax, eax
je 0x40d14b
mov ecx, dword [esi + 0xb8]
lea edx, [esp + 0xc]
push edx
call fcn.0041dcf0
cmp dword [esp + 0xc], 0x129
je 0x40d140
push 0x30
push 0x4a1a90
push 0x4a19ec
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esi + 0xb8]
call fcn.0041da30
mov ecx, dword [esi + 0xb8]
push 1
call fcn.0041d920
jmp 0x40d246
mov ecx, dword [esi + 0xb8]
call fcn.0041da30
mov ecx, esi
call fcn.00407da0
cmp dword [esi + 0xf0], 0
je case.default.0x40d171
mov eax, dword [esi + 0xf4]
add eax, 0xffffffff
cmp eax, 3
ja case.default.0x40d171
jmp dword [eax*4 + 0x40d284]
push 0x49f858
push 0x4cbe80
push 0x4cbf84
call fcn.00481b55
add esp, 0xc
cmp dword [0x4cbf84], 0
je case.default.0x40d171
mov ecx, esi
call fcn.004082d0
mov eax, dword [0x4cbf84]
push eax
call fcn.00481a15
add esp, 4
jmp case.default.0x40d171
push 0x49f858
push 0x4cbe80
push 0x4cbf84
call fcn.00481b55
add esp, 0xc
cmp dword [0x4cbf84], 0
je case.default.0x40d171
mov ecx, esi
call fcn.00409ec0
mov ecx, dword [0x4cbf84]
push ecx
call fcn.00481a15
add esp, 4
jmp case.default.0x40d171
mov ecx, esi
call fcn.004086c0
jmp case.default.0x40d171
mov ecx, dword [esi + 0xb8]
lea edx, [esp + 8]
push edx
call fcn.0041d990
test eax, eax
je case.default.0x40d171
mov ecx, dword [esi + 0xbc]
push 0
call fcn.00436420
mov ecx, dword [esi + 0xac]
push ecx
mov ecx, eax
call fcn.00434120
mov ecx, dword [esi + 0xb8]
call fcn.0041da30
push 0x30
push 0x4a19e4
push 0x4a19b0
push 0
call edi
call fcn.00407bc0
mov eax, dword [0x4cbf8c]
test eax, eax
pop edi
pop esi
je 0x40d26d
cmp dword [0x4cbf94], 0
je 0x40d26d
mov edx, dword [eax + 0x20]
push 0
push 0
push 0x41f
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.004811b7
add esp, 0xac
ret
Function at 0x40d2c1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xa4], 0
je 0x40d2d2
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x40d2a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xa4], eax
je 0x40d2cd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x40e880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push esi
push edi
mov edi, dword [esp + 0x124]
lea edx, [esp + 8]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40e8f9
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.004811b7
add esp, 0x110
ret 0xc

Function at 0x413ce0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x413cf5
xor eax, eax
pop esi
add esp, 0x10
ret 8
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x413d08
pop ebx
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov cl, byte [esi + 0xe]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
mov edi, 1
push esi
shl edi, cl
mov word [esp + 0x14], 0x4d42
call ebp
add eax, 0xe
mov dword [esp + 0x12], eax
xor eax, eax
push ebx
mov word [esp + 0x1a], ax
mov word [esp + 0x1c], ax
mov eax, dword [esi]
push 0xe
lea edx, [esp + 0x18]
lea ecx, [eax + edi*4 + 0xe]
push 1
push edx
mov dword [esp + 0x2a], ecx
call fcn.00482d19
add esp, 0x10
push ebx
push esi
call ebp
push eax
push 1
push esi
call fcn.00482d19
add esp, 0x10
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x41d810
Capabilities:
Check os version

Disassembly:
sub esp, 0xc8
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
push edi
push 0x9c
lea eax, [esp + 0x34]
push 0
push eax
mov edi, ecx
call fcn.00481f20
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x9c
call esi
test eax, eax
jne 0x41d87f
push 0x94
push eax
lea edx, [esp + 0x38]
push edx
call fcn.00481f20
add esp, 0xc
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 0x94
call esi
test eax, eax
je 0x41d909
mov ecx, dword [esp + 0x40]
push ebp
mov dword [edi + 0x950], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4a0810
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41d908
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push esi
call ebx
test eax, eax
je 0x41d900
lea edx, [esp + 0x14]
push edx
call eax
movzx eax, word [esp + 0x14]
cmp eax, 9
mov dword [edi + 0x95c], eax
jne 0x41d8f1
push str.IsWow64Process
push esi
call ebx
test eax, eax
je 0x41d900
lea ecx, [esp + 0x10]
push ecx
push ebp
call eax
test eax, eax
je 0x41d900
mov edx, dword [esp + 0x10]
mov dword [edi + 0x954], edx
jmp 0x41d900
cmp eax, 6
jne 0x41d900
mov dword [edi + 0x958], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop ebp
mov ecx, dword [esp + 0xcc]
pop edi
pop esi
xor ecx, esp
call fcn.004811b7
add esp, 0xc8
ret
Function at 0x41da90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x214]
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push ebp
push ebx
mov esi, ecx
push str.bInitDriver__s___d__n
push esi
mov dword [esp + 0x24], eax
call fcn.00495a80
add esp, 0x10
lea edi, [esi + 4]
push edi
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
push str.GetCurrentDirectory___s_n
push esi
call fcn.00495a80
add esp, 0xc
push 0x200
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
push edx
push str.GetModuleFileName___s_n
push esi
call fcn.00495a80
mov eax, dword [esi + 0x960]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.cpuz
push 0
push 0
mov dword [esi + 0x960], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
push str.m_hDriverMutex___X
push esi
mov dword [esi + 0x960], eax
call fcn.00495a80
add esp, 0xc
cmp dword [esi + 0x960], 0
jne 0x41db6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__err_d
push esi
call fcn.00495a80
add esp, 0xc
push 0x4a0854
push esi
call fcn.00495a80
add esp, 8
test ebx, ebx
mov dword [esi + 0x20c], ebp
lea edi, [esi + 0x410]
je 0x41db9e
push ebx
push 0x200
push edi
call fcn.00481ba5
add esp, 0xc
jmp 0x41dbaa
push edi
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
push str.m_szPath___s_n
push esi
call fcn.00495a80
push str.cpuz
lea edi, [esi + 0x810]
push 0x100
push edi
call fcn.00481ba5
add esp, 0x18
mov ecx, esi
call fcn.0041d810
mov eax, dword [esi + 0x950]
sub eax, 1
je 0x41dc68
sub eax, 1
je 0x41dbf9
mov dword [esp + 0x10], 0x5002
xor edi, edi
jmp 0x41dca8
push str.cpuz129
lea ecx, [esi + 0x910]
push 0x40
push ecx
call fcn.00481ba5
add esp, 0xc
cmp dword [esi + 0x954], 0
je 0x41dc1f
push str.cpuz_x64.sys
jmp 0x41dc34
cmp dword [esi + 0x958], 0
je 0x41dc2f
push str.cpuz_ia64.sys
jmp 0x41dc34
push str.cpuz_x32.sys
push 0x100
push edi
call fcn.00481ba5
add esp, 0xc
push edi
push str.m_szFilename___s_n
push esi
call fcn.00495a80
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0041d990
mov ecx, esi
mov edi, eax
call fcn.0041da30
jmp 0x41dca8
push str.cpuz.vxd
push 0x100
push edi
call fcn.00481ba5
push str.cpuz
lea eax, [esi + 0x910]
push 0x40
push eax
call fcn.00481ba5
push edi
push str.m_szFilename___s_n
push esi
call fcn.00495a80
add esp, 0x24
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0041dfd0
mov edi, eax
mov edx, dword [esp + 0x10]
push edx
push str.bInitDriver_returned__d_n
push esi
call fcn.00495a80
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
test edi, edi
mov dword [ecx], eax
jne 0x41dcd2
push 1
mov ecx, esi
call fcn.0041d920
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004811b7
add esp, 0x20c
ret 0xc
Function at 0x41df00
Capabilities:
Set current directory

Disassembly:
sub esp, 0x204
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
mov esi, ecx
push str.Win9x_hCreateServiceHandle_n
push esi
call fcn.00495a80
lea eax, [esi + 0x910]
push eax
push str.._s.vxd
lea ecx, [esp + 0x20]
push 0x200
push ecx
xor ebx, ebx
call fcn.004310e0
add esp, 0x18
lea edi, [esi + 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
lea edx, [esp + 0x14]
push edx
push str.Win9x_hCreateServiceHandle_service___s__path___s__n
push esi
call fcn.00495a80
add esp, 0x10
push ebx
push 0x4000000
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41dfa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebx, eax
push ebx
push str.Win9x_hCreateServiceHandle_CreateFile_error___d__handle___X_n
push esi
call fcn.00495a80
add esp, 0x10
add esi, 4
push esi
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004811b7
add esp, 0x204
ret 4

Function at 0x41e0e0
Capabilities:
Create service

Disassembly:
sub esp, 0x204
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
mov ebx, dword [esp + 0x20c]
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x410]
push eax
lea ecx, [esp + 0x10]
push 0x200
push ecx
xor edi, edi
call fcn.00481ba5
lea eax, [esp + 0x18]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41e122
sub eax, edx
cmp byte [esp + eax + 0xb], 0x5c
lea eax, [esp + eax + 0xc]
je 0x41e13e
mov byte [eax], 0x5c
mov byte [eax + 1], cl
lea edx, [esi + 0x810]
push edx
lea eax, [esp + 0x10]
push 0x200
push eax
call fcn.00430eb0
push str.WinNT_bCreateService_n
push esi
call fcn.00495a80
lea ecx, [esp + 0x20]
push ecx
push str.szDestName___s_n
push esi
call fcn.00495a80
add esp, 0x20
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
push 1
push 3
push 1
push 0xf01ff
lea eax, [esi + 0x910]
push eax
push eax
mov eax, dword [esi + 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x41e1db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.CreateService_failed__error_code___d_n
push esi
call fcn.00495a80
mov eax, edi
add esp, 0xc
sub eax, 0x430
je 0x41e1d7
sub eax, 1
mov dword [ebx], edi
je 0x41e1d0
xor eax, eax
jmp 0x41e1eb
mov eax, 1
jmp 0x41e1eb
xor eax, eax
jmp 0x41e1e9
push eax
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov dword [ebx], edi
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004811b7
add esp, 0x204
ret 4
Function at 0x41e210
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push str.WinNT_dwDeleteService_n
push esi
xor ebx, ebx
call fcn.00495a80
mov ecx, dword [esi + 0x208]
add esp, 8
push 0xf01ff
lea eax, [esi + 0x910]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x41e261
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.WinNT_dwDeleteService_:_Openservice_failed__errorcode___d_n
push esi
call fcn.00495a80
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41e283
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.WinNT_dwDeleteService_:_DeleteService_failed__errorcode___d_n
push esi
call fcn.00495a80
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x41e290
Capabilities:
Start service

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
push str.WinNT_bStartService_n
push esi
call fcn.00495a80
mov ecx, dword [esi + 0x208]
add esp, 8
push 0xf01ff
lea eax, [esi + 0x910]
push eax
push ecx
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
jne 0x41e2e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.OpenService_failed__error_code___d_n
push esi
call fcn.00495a80
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test edi, edi
jne 0x41e325
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.StartService_failed__error_code___d_n
push esi
call fcn.00495a80
add esp, 0xc
cmp ebx, 0x420
ja 0x41e323
je 0x41e33b
mov eax, ebx
sub eax, 2
je 0x41e323
sub eax, 0x23f
xor edi, edi
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [edx], ebx
pop ebx
ret 4
mov edi, 1
jmp 0x41e325
Function at 0x41e350
Capabilities:
Continue service
Stop service

Disassembly:
sub esp, 0x20
push esi
push edi
mov esi, ecx
push str.WinNT_dwStopService_n
push esi
mov dword [esp + 0x10], 0
call fcn.00495a80
mov ecx, dword [esi + 0x208]
add esp, 8
push 0xf01ff
lea eax, [esi + 0x910]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x41e3ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.WinNT_dwStopService_:_OpenService_failed__errorcode___d_n
push esi
call fcn.00495a80
add esp, 0xc
mov eax, edi
pop edi
pop esi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [esp + 0x14]
push edx
push 1
push edi
call ebp
cmp dword [esp + 0x18], 3
mov ebx, eax
jne 0x41e3f8
mov eax, dword [esi + 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
mov dword [esi + 0x204], 0xffffffff
call ebp
mov ebx, eax
push ebx
push str.WinNT_dwStopService_:_ControlService_failed__pending__result___d_n
push esi
call fcn.00495a80
add esp, 0xc
test ebx, ebx
jne 0x41e424
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.WinNT_dwStopService_:_ControlService_failed__errorcode___d_n
push esi
call fcn.00495a80
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x20
ret
mov ebx, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x41e4f0
Capabilities:
Get hostname

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
push str.WinNT_bInstallDriver_n
push esi
call fcn.00495a80
add esp, 8
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0x210]
push edi
xor ebx, ebx
mov dword [esp + 0x18], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
push str.szMachineName___s_n
push esi
call fcn.00495a80
add esp, 0xc
cmp byte [edi], bl
je 0x41e537
mov ebx, edi
push 0xf003f
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esi + 0x208], eax
jne 0x41e577
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.OpenSCManager_failed__error_code___d_n
push esi
call fcn.00495a80
mov ecx, dword [esp + 0x24]
add esp, 0xc
mov dword [ecx], edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp dword [esi + 0x20c], 0
je 0x41e5d9
cmp dword [esi + 0x954], 0
je 0x41e592
mov edx, dword [esi + 0x970]
push edx
jmp 0x41e5ab
cmp dword [esi + 0x958], 0
je 0x41e5a4
mov eax, dword [esi + 0x974]
push eax
jmp 0x41e5ab
mov ecx, dword [esi + 0x96c]
push ecx
mov ecx, esi
call fcn.0041eb50
test eax, eax
jne 0x41e5d9
push 0x4a4840
push esi
call fcn.00495a80
mov edx, dword [esp + 0x20]
add esp, 8
pop edi
pop esi
mov dword [edx], 0x5001
xor eax, eax
pop ebx
add esp, 8
ret 4
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0041e0e0
mov edi, eax
test edi, edi
je 0x41e604
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0041e290
mov edi, eax
test edi, edi
jne 0x41e604
mov ecx, esi
call fcn.0041e210
mov eax, dword [esi + 0x208]
test eax, eax
je 0x41e615
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esi + 0x20c], 0
je 0x41e625
mov ecx, esi
call fcn.0041e750
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x41e750
Capabilities:
Delete file

Disassembly:
sub esp, 0x204
mov eax, dword [0x4ca09c]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, ecx
lea ecx, [eax + 0x810]
push ecx
add eax, 0x410
push eax
push str._s_s
lea edx, [esp + 0xc]
push 0x200
push edx
call fcn.004310e0
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.004811b7
add esp, 0x204
ret