joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424d00
Capabilities:
Delete directory

Disassembly:
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
xor ebx, ebx
lea ebx, [ebx]
mov eax, dword [esi + 0x418]
test eax, eax
je 0x424e10
mov ecx, dword [esi + 0x41c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x424e10
mov eax, dword [esi + 0x418]
test eax, eax
je 0x424d6a
mov ecx, dword [esi + 0x41c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x424d6f
call fcn.004402b5
mov eax, dword [esi + 0x418]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x424d82
mov eax, dword [eax + 4]
jmp 0x424d85
add eax, 4
push 0x478810
push eax
call fcn.0042dcb0
add esp, 8
test al, al
je 0x424e09
mov eax, dword [esi + 0x418]
test eax, eax
je 0x424dbc
mov ecx, dword [esi + 0x41c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, 1
mov ecx, edi
test ecx, ecx
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
jge 0x424dd3
fadd qword [0x464168]
test eax, eax
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
jge 0x424de5
fadd qword [0x464168]
fdivp st(1)
fmul qword [0x464160]
call fcn.004427b0
mov edx, 0x1e
sub edx, eax
push edx
mov ecx, esi
call fcn.004247b0
add ebx, 0x1c
jmp 0x424d10
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
xor edi, edi
xor ebx, ebx
jmp 0x424e20
mov eax, dword [esi + 0x438]
test eax, eax
je 0x424eb2
mov ecx, dword [esi + 0x43c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x424eb2
mov eax, dword [esi + 0x438]
test eax, eax
je 0x424e76
mov ecx, dword [esi + 0x43c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x424e7b
call fcn.004402b5
mov eax, dword [esi + 0x438]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x424e8e
mov eax, dword [eax + 4]
jmp 0x424e91
add eax, 4
push 0x478810
push eax
call fcn.0042dd10
add esp, 8
test al, al
je 0x424e09
add edi, 1
add ebx, 0x1c
jmp 0x424e20
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edi, edi
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [esi + 0x428]
test eax, eax
je 0x424f44
mov ecx, dword [esi + 0x42c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x424f44
mov eax, dword [esi + 0x428]
test eax, eax
je 0x424f12
mov ecx, dword [esi + 0x42c]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x424f17
call fcn.004402b5
mov eax, dword [esi + 0x428]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x424f33
mov eax, dword [eax + 4]
push eax
call ebp
add edi, 1
add ebx, 0x1c
jmp 0x424ec0
add eax, 4
push eax
call ebp
add edi, 1
add ebx, 0x1c
jmp 0x424ec0
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret
Function at 0x428100
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45f278
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4772c4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.CUninstLog.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x78], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x88], ecx
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x90], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x42cc80
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jbe 0x42ccff
push edi
push esi
call fcn.004420a5
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x42ccf5
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x42ccf5
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42ccec
mov edx, dword [esp + 0x10]
movzx eax, word [edx]
sub eax, 0x401
je 0x42ccea
sub eax, 0xc
jne 0x42ccec
mov bl, 1
push edi
call fcn.00440743
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x42cd10
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4772c4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
xor ebx, ebx
mov byte [esp + 7], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42ce36
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 2
push eax
mov dword [esp + 0x24], ebx
call edi
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004420a5
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x42ce15
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 2
push ecx
call edi
test eax, eax
je 0x42ce0c
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x42ce0c
xor edi, edi
cmp dword [esi], ebx
jbe 0x42ce01
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push ebp
lea ebp, [esi + 4]
jmp 0x42cde0
mov ecx, dword [ebp]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call ebx
test eax, eax
jne 0x42cdfb
add edi, 1
add ebp, 8
cmp edi, dword [esi]
jb 0x42cde0
jmp 0x42ce00
mov byte [esp + 0x13], 1
pop ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call fcn.00440743
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044017c
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0044017c
add esp, 0x1c
ret
Function at 0x42ce50
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
cmp esi, edi
jl 0x42d00d
lea eax, [esp + 0x10]
push eax
push 0x468b58
push 1
push edi
push 0x468b78
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x42cfad
cmp eax, edi
jl 0x42cfad
mov edx, dword [ecx]
lea eax, [esp + 0x14]
push eax
push 0x468b68
push ecx
mov ecx, dword [edx]
call ecx
cmp dword [esp + 0x14], edi
je 0x42cfa1
cmp eax, edi
jl 0x42cfa1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x50]
push ecx
push eax
call edx
mov esi, eax
cmp esi, edi
jl 0x42cf60
mov ecx, dword [esp + 0x24]
cmp ecx, edi
je 0x42cef3
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
cmp esi, edi
jl 0x42cf60
mov ecx, dword [esp + 0x28]
cmp ecx, edi
je 0x42cf0e
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x2c]
call eax
mov esi, eax
cmp esi, edi
jl 0x42cf60
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x42cf29
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x24]
call eax
mov esi, eax
cmp esi, edi
jl 0x42cf60
mov ecx, dword [esp + 0x30]
cmp ecx, edi
je 0x42cf49
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
mov edx, dword [eax]
push esi
push ecx
push eax
mov eax, dword [edx + 0x44]
call eax
mov esi, eax
cmp esi, edi
jl 0x42cf60
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
mov esi, eax
mov ebx, dword [esp + 0x1c]
push edi
push edi
push 0xffffffffffffffff
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebp, [eax + 1]
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042f22e
mov edi, eax
add esp, 4
test edi, edi
jne 0x42cfb7
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
push ebp
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x42cfd1
mov esi, 0x80004005
jmp 0x42cfe6
test esi, esi
jl 0x42cfe6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push edi
push eax
call edx
mov esi, eax
push edi
call fcn.0042f233
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 4
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
test esi, esi
pop esi
pop ebp
setge al
pop ebx
add esp, 8
ret
Function at 0x42d0c0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x4772c4]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push esi
lea ecx, [esp + 8]
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d11f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esp, [esp]
test byte [esp + 0xc], 0x10
je 0x42d115
lea edx, [esp + 0xc]
push edx
push esi
call edi
test eax, eax
jne 0x42d100
jmp 0x42d117
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [esp + 0x148]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0044017c
add esp, 0x144
ret

Function at 0x42d140
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x148
mov eax, dword [0x4772c4]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
mov esi, dword [esp + 0x150]
push esi
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x3a
jne 0x42d187
mov al, 1
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0044017c
add esp, 0x148
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42d1c3
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0xc], 0x10
jne 0x42d1b6
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
test eax, eax
jne 0x42d1a1
jmp 0x42d1bb
mov byte [esp + 0xb], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [esp + 0x148]
mov al, byte [esp + 7]
pop esi
xor ecx, esp
call fcn.0044017c
add esp, 0x148
ret

Function at 0x42d240
Capabilities:
Get disk size

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x2c
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x42d295
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
push 0
push 0
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x42d295
mov ecx, dword [esp + 0xc]
cmp ecx, esi
ja 0x42d295
jb 0x42d28d
mov edx, dword [esp + 8]
cmp edx, edi
jae 0x42d295
pop edi
xor al, al
pop esi
add esp, 0x2c
ret
pop edi
mov al, 1
pop esi
add esp, 0x2c
ret
Function at 0x42d2a0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x818
mov eax, dword [0x4772c4]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [str.WININIT.INI]
mov ecx, dword [0x464a18]
mov edx, dword [0x464a1c]
push ebx
mov ebx, dword [esp + 0x824]
mov dword [esp + 0x10], eax
movzx eax, byte [0x464a20]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov byte [esp + 0x24], al
movzx eax, byte [0x464a10]
mov dword [esp + 0x1c], ecx
mov ecx, dword [str._rename_]
mov dword [esp + 0x20], edx
mov edx, dword [0x464a0c]
push 0x464a04
push esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], al
call edi
test eax, eax
je 0x42d372
push str.DIRNUL
push esi
call edi
test eax, eax
je 0x42d372
push 0x104
lea ecx, [esp + 0x130]
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
test eax, eax
je 0x42d358
push 0x104
lea edx, [esp + 0x234]
push edx
push ebx
call esi
test eax, eax
jne 0x42d381
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.0044017c
add esp, 0x818
ret
push esi
lea eax, [esp + 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x42d358
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x28]
push 0x4649f8
push ecx
call fcn.00442e82
mov edi, eax
add esp, 8
test edi, edi
je 0x42d4c5
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x338]
push 0x4649f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x340]
push 0x4649f0
push ecx
call fcn.00442e82
add esp, 0x14
mov esi, eax
test esi, esi
push edi
je 0x42d4b8
lea edx, [esp + 0x43c]
push 0x3e8
push edx
call fcn.00442c37
add esp, 0xc
test eax, eax
je 0x42d471
lea eax, [esp + 0x438]
push esi
push eax
call fcn.00442af5
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x444]
push edx
call fcn.00442920
add esp, 0x10
test eax, eax
je 0x42d457
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x130]
push ecx
push str._s_s_n
push esi
call fcn.004429a6
add esp, 0x10
push edi
lea edx, [esp + 0x43c]
push 0x3e8
push edx
call fcn.00442c37
add esp, 0xc
test eax, eax
jne 0x42d412
push esi
call fcn.00441305
push edi
call fcn.00441305
add esp, 8
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x338]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.0044017c
add esp, 0x818
ret
call fcn.00441305
add esp, 4
jmp 0x42d358
lea eax, [esp + 0x28]
push 0x4649f0
push eax
call fcn.00442e82
mov esi, eax
add esp, 8
test esi, esi
je 0x42d358
lea ecx, [esp + 0xc]
push ecx
push 0x4649e4
push esi
call fcn.004429a6
lea edx, [esp + 0x23c]
push edx
lea eax, [esp + 0x13c]
push eax
push str._s_s_n
push esi
call fcn.004429a6
push esi
call fcn.00441305
mov ecx, dword [esp + 0x840]
add esp, 0x20
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0044017c
add esp, 0x818
ret
Function at 0x42d560
Capabilities:
Create service

Disassembly:
push ebx
push esi
push 0xf003f
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x42d5c2
mov cl, byte [esp + 0x18]
mov eax, dword [esp + 0x14]
push edi
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
push 0
neg cl
push eax
mov eax, dword [esp + 0x28]
push 1
sbb ecx, ecx
add ecx, 3
push ecx
push 0x10
push 0xf01ff
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x42d5be
push eax
call edi
mov bl, 1
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x42d5d0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x34
push ebx
push esi
push 0xf003f
push 0
push 0
mov byte [esp + 0x17], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x42d6f0
mov eax, dword [esp + 0x40]
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x42d6e9
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x42d629
pop esi
xor al, al
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0x10]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42d621
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
cmp dword [esp + 0x24], 2
mov edi, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
jne 0x42d6d4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xcccccccd
mul dword [esp + 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x42d67e
mov edx, 0x3e8
jmp 0x42d68b
cmp edx, 0x2710
jbe 0x42d68b
mov edx, 0x2710
push edx
call ebx
lea ecx, [esp + 0x18]
push ecx
push 0x24
lea edx, [esp + 0x28]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42d6d0
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x34], eax
jbe 0x42d6bf
call ebp
mov ecx, dword [esp + 0x34]
mov edi, eax
mov dword [esp + 0x14], ecx
jmp 0x42d6c9
call ebp
sub eax, edi
cmp eax, dword [esp + 0x38]
ja 0x42d6d0
cmp dword [esp + 0x24], 2
je 0x42d663
mov ebx, dword [esp + 0x1c]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x24], 4
pop edi
pop ebp
jne 0x42d6e9
mov byte [esp + 0xb], 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x34
ret
Function at 0x42d700
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x20
push ebx
push 0xf003f
push 0
push 0
mov byte [esp + 0x13], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x42d7c1
mov eax, dword [esp + 0x28]
push esi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x42d7b4
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x42d78c
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea edx, [esp + 0x14]
push edx
push esi
call ebp
test eax, eax
je 0x42d78a
lea ecx, [ecx]
cmp dword [esp + 0x18], 3
jne 0x42d78a
push 0x3e8
call edi
lea eax, [esp + 0x14]
push eax
push esi
call ebp
test eax, eax
jne 0x42d770
pop edi
pop ebp
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x42d79c
mov byte [esp + 0xb], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x20
ret
push ebx
mov byte [esp + 0xf], 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov al, byte [esp + 7]
pop ebx
add esp, 0x20
ret

Function at 0x42d820
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push esi
push 0xf003f
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x42d87c
mov eax, dword [esp + 0x28]
push ebp
push edi
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x42d877
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x42d874
cmp dword [esp + 0x14], 4
jne 0x42d874
mov bl, 1
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
add esp, 0x1c
ret
Function at 0x42d890
Capabilities:
Modify service
Query service configuration

Disassembly:
sub esp, 8
push ebx
push 0xf003f
push 0
push 0
mov byte [esp + 0x13], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x42d960
mov eax, dword [esp + 0x10]
push esi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x42d958
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push esi
mov dword [esp + 0x20], 0
call ebp
test eax, eax
jne 0x42d950
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42d950
mov edx, dword [esp + 0x10]
push edi
push edx
call fcn.0042f22e
mov ecx, dword [esp + 0x18]
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push esi
call ebp
test eax, eax
je 0x42d946
mov eax, dword [esp + 0x20]
cmp dword [edi + 4], eax
je 0x42d941
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x42d946
mov byte [esp + 0x13], 1
push edi
call fcn.0042f233
add esp, 4
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov al, byte [esp + 7]
pop ebx
add esp, 8
ret

Function at 0x42dba0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x4772c4]
xor eax, esp
mov dword [esp + 0x104], eax
push edi
mov edi, dword [esp + 0x110]
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.00440530
push edi
call fcn.0042d140
add esp, 0x10
test al, al
je 0x42dbf2
mov al, 1
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044017c
add esp, 0x108
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x42dbda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x42dc89
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
test eax, eax
jle 0x42dc6a
lea ebp, [esp + 0x10]
mov esi, edi
sub ebp, edi
mov al, byte [esi]
cmp al, 0x5c
je 0x42dc2f
test al, al
jne 0x42dc51
lea ecx, [esp + 0x10]
push ecx
call fcn.0042d140
add esp, 4
test al, al
jne 0x42dc51
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42dc85
mov al, byte [esi]
mov byte [esi + ebp], al
push edi
add ebx, 1
add esi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
cmp ebx, eax
jl 0x42dc25
mov al, 1
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044017c
add esp, 0x108
ret
xor al, al
jmp 0x42dc6c
mov ecx, dword [esp + 0x108]
pop edi
xor ecx, esp
xor al, al
call fcn.0044017c
add esp, 0x108
ret