joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456e26
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x456e49
push 1
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [edi], eax
lea edi, [esi + 0x4c]
push edi
push ebx
push ebx
push ebx
push 2
push dword [esi + 0x10]
call fcn.00456138
add esp, 0x18
test eax, eax
je 0x456eee
push dword [edi]
call fcn.004342c0
pop ecx
cmp eax, ebx
setne cl
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov byte [ebp - 0xc], cl
push eax
lea ecx, [esi + 0x44]
call fcn.0044bb36
cmp byte [ebp - 0xc], bl
je 0x456e92
push dword [ebp - 8]
call fcn.004338ba
pop ecx
mov eax, dword [esi + 0x48]
push edi
push eax
push ebx
push ebx
push 2
push dword [esi + 0x10]
call fcn.00456138
add esp, 0x18
test eax, eax
je 0x456eee
lea eax, [ebp - 4]
push ebx
push eax
push 4
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push edi
push dword [edi]
push dword [esi + 0x48]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test byte [ebp + 0x10], 1
jne 0x456efb
mov eax, dword [esi + 0xc]
push ebx
push dword [ebp + 8]
push 1
push 1
push 0x10001
push eax
call fcn.00456388
add esp, 0x18
test eax, eax
jne 0x456efb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x54], eax
xor al, al
jmp 0x456f15
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x456f13
push 1
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [esi]
mov dword [esi], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x458bd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push str.SOFTWAREInstallShield15.0Professional
push 0x80000001
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x458c5a
mov esi, dword [esp + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.DoVerboseLogging
push esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x458c4f
mov ecx, dword [esp + 8]
push ebx
cmp ecx, 1
sete bl
test esi, esi
je 0x458c47
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop esi
add esp, 0x10
ret
test esi, esi
je 0x458c5a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
add esp, 0x10
ret
Function at 0x401e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp + 0x4f]
push esi
lea eax, [ebp - 0x78]
push 0x78
call 0x68ca06ab
add byte [eax], al
mov ecx, dword [ebp + 8]
cld
adc eax, 0xf740c0c8
push eax
push ecx
add edx, 0x40
push 0xa843d408
push edx
add al, 0x51
add cl, 0x40
add byte [ecx + 0x1c02ac], ah
add esp, 0x14
xchg eax, eax
je 0x401e8c
push eax
push 0xe3d254
jmp [esi + 0x2fc164]
push esi
add eax, 0x9ab97015
add al, dh
nop
nop
nop
nop
nop
nop
arpl word [eax - 0x6fb96f70], dx
inc esi
nop
push ebp
mov ebp, esp
sub esp, 0
push ebx
push esi
mov esi, dword [ebp + 8]
xor word [eax + 0x14], ax
xor dword [eax + 0x14], eax
mov dword [ebp + 8], eax
call fcn.00406a00
mov dword [0x41e414], eax
mov dword [0xe10be8], edx
mov ecx, dword [0x85a6928b]
aam 0x8b
cli
jne 0x401ea8
mov ecx, dword [esi + 4]
push 0xffffffffffffffc0
push 0
inc ebp
call 0x16408c6c
xchg edi, eax
sahf
in eax, dx
or byte [eax], al
add byte [ecx + 0x83c40], cl
add bh, al
inc esi
sbb byte [eax], al
add byte [eax], al
add byte [ebx + 0x4117ec15], cl
add byte [ecx + 0x60a11456], cl
add al, byte [ecx]
test edx, eax
je 0x401f3a
mov eax, dword [0x410270]
mov ecx, edx
jo 0x401ed0
mov dword [esi + 0x14], ecx
jmp 0x401f3a
mov edx, dword [esi + 0x18]
mov ebx, dword [0x402f30]
mov ecx, dword [ecx + 0x84d8d04]
add edx, ebx
push ecx
push edx
push eax
call fcn.00408ac0
test eax, eax
je 0x401f8a
cmp eax, 0xb
je 0x401f8a
cmp eax, 0x180a1168
sbb al, 0x27
cmp eax, 0xafc35
je 0x401f8a
iretd
inc bp
or byte [ebx + 0x4102a01d], cl
add byte [ebx + 0x4102a43d], cl
add byte [ebx], al
fadd dword [ebx + 0x1d07d6d7]
mov al, byte [0x897f4102]
cmp eax, 0x4102a4
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
add edx, eax
sub ecx, eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], ecx
jne 0x401eac
mov dword [esi + 0x5c], 0x6a000003
call fcn.00406a00
mov dword [0x1b415da0], eax
mov dword [0x410ba4], edx
mov edi, dword [esp + eax - 0x77]
xchg byte [eax + 8], al
add byte [eax], al
mov ecx, dword [0x410ba4]
mov eax, 1
mov dword [ebp - 0x10], eax
mov cx, di
hlt

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
das
jge 0x407f09
dec edi
push ss
pop es
cli
inc ebp
adc byte [esi], cl
add byte [eax], al
fld qword [ebp + 8]
fcomp qword [0x40c295]
add byte [ebx - 0x3dacc2c8], cl
xlatb
and byte [esi + 0x33], dl
and edx, dword [edi - 0x21]
loopne 0x407ea3
adc eax, 0xf631892d

Function at 0x40a8bb
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040a79c
sub ecx, ecx
sub cx, 0xff3a
call 0x40a8bb
rcr byte [esi - 0x7f], 0x76
push cs
adc byte [ecx], bl
and cl, byte [edi]
xor dword [esi + 0xe], 0xf221910
sub esi, 0xfffffffc
loop 0x40a8be
in al, dx
mov byte [0x90e3c097], al
leave
add ecx, dword [esi + 0x4f]
adc edx, dword [ecx]
mov ebp, 0xd08ae118
insb byte es:[edi], dx
aad 0xcc
clc
neg ch
invalid
Function at 0x40b110
Capabilities:
Read file on windows

Disassembly:
test eax, eax
je 0x40b137
jmp 0xc9c4b984
mov eax, dword [esi + 0xc]
mov edx, dword [ebp - 0x67]
push ebx
lea ecx, [ebp + 0x10]
push eax
mov eax, dword [esi + 4]
insb byte es:[edi], dx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
adc eax, 0x330774c0
shr cl, 0x2b
add dword [eax], eax
add byte [edx - 0x47], ah
cwde
rol byte [eax], 0xff
xlatb
test eax, eax
je 0x56b285
dec dword [eax + 0xcefc80]
stosb byte es:[edi], al
mov eax, 0xff40b00
test ebx, esp
add byte [eax], al
add byte [edx + 0x1d], bl
pushfd
rol byte [eax], 0x8b
dec esi
insb byte es:[edi], dx
mov ecx, dword [esi + 0x6c]
mov eax, dword [esi + 0x10]
out dx, al
mov edx, 0x47f167c
test eax, eax
jbe 0x40b1a2
push 0x56
push 0xf80003e8
push ecx
push eax
call 0xf140b590
mov eax, dword [0x83c1230d]
mov edi, 0xd96d75ef
shr bl, 2
xor edi, dword [edx + 0x50f84e5f]
and eax, ecx
cmp dword [edi - 0x26928a11], 0xffffffc0
jmp 0x40b1af
pop edi
dec esi
clc
push eax
mov edx, dword [ecx + 0xc]
push edx
call ebx
mov edi, eax
cmp edi, 0x8880
je 0x40b182
sahf
push dword [ecx + esi - 0x33]
pushal
or dword [ecx - 0x4b], eax
mov ebx, dword [esi + 4]
dec esp
cmp al, 0x75
sbb byte [eax - 0x54], dl
in al, dx
push eax
inc ecx
mov byte [eax - 0x18], dl
popal
push edx
invalid
Function at 0x401170
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x4011c5
mov esi, dword [esp + 0x34]
test esi, esi
je 0x40121f
push str.Error_opening_Service_Control_Manager:
push esi
call fcn.00401a6a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ebx, dword [esp + 0x38]
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
jne 0x40122a
mov esi, dword [esp + 0x34]
test esi, esi
je 0x401202
push str.Error_opening_Service_Control_Manager:
push esi
call fcn.00401a6a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40121f
test esi, esi
je 0x40121f
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret
lea eax, [esp + 0x14]
xor edi, edi
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, dword [esp + 0x34]
test eax, eax
jne 0x4012aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x426
je 0x401273
test esi, esi
je 0x401270
mov ecx, dword [esp + 0x38]
push ecx
push str.Error_stopping_service__s:
push esi
call fcn.00401a6a
push esi
push ebx
call fcn.00401790
add esp, 0x14
or edi, 0xffffffff
mov ebx, dword [esp + 0x38]
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4012bf
test esi, esi
je 0x4012a5
push ebx
push str.Error_deleting_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or edi, 0xffffffff
jmp 0x4012d2
test esi, esi
je 0x401277
push ebx
push str.Service__s_successfully_stopped_n
push esi
call fcn.00401a6a
add esp, 0xc
jmp 0x401277
test esi, esi
je 0x4012d2
push ebx
push str.Service__s_successfully_deleted_n
push esi
call fcn.00401a6a
add esp, 0xc
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebp
test eax, eax
jne 0x401305
test esi, esi
je 0x401302
push ebx
push str.Error_closing_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or edi, 0xffffffff
mov edx, dword [esp + 0x10]
push edx
call ebp
test eax, eax
jne 0x401325
test esi, esi
je 0x401322
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x401330
Capabilities:
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x401385
mov esi, dword [esp + 0x34]
test esi, esi
je 0x4013e0
push str.Error_opening_Service_Control_Manager:
push esi
call fcn.00401a6a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ebp, dword [esp + 0x38]
push 0xf01ff
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4013eb
mov esi, dword [esp + 0x34]
test esi, esi
je 0x4013c3
push ebp
push 0x408358
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4013e0
test esi, esi
je 0x4013e0
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, dword [esp + 0x34]
test eax, eax
jne 0x40142b
test esi, esi
je 0x401426
push ebp
push str.Error_stopping_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or ebx, 0xffffffff
jmp 0x40143e
test esi, esi
je 0x40143e
push ebp
push str.Service__s_successfully_stopped_n
push esi
call fcn.00401a6a
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test eax, eax
jne 0x401471
test esi, esi
je 0x40146e
push ebp
push str.Error_closing_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or ebx, 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call edi
test eax, eax
jne 0x401491
test esi, esi
je 0x40148e
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
or ebx, 0xffffffff
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4014a0
Capabilities:
Start service

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x4014f1
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40154c
push str.Error_opening_Service_Control_Manager:
push esi
call fcn.00401a6a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebp, dword [esp + 0x1c]
push 0xf01ff
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x401555
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40152f
push ebp
push str.Error_opening_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40154c
test esi, esi
je 0x40154c
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x401590
test esi, esi
je 0x40158b
push ebp
push str.Error_starting_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or ebx, 0xffffffff
jmp 0x4015a3
test esi, esi
je 0x4015a3
push ebp
push str.Service__s_successfully_started_n
push esi
call fcn.00401a6a
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test eax, eax
jne 0x4015c6
test esi, esi
je 0x4015c3
push ebp
push str.Error_closing_service__s_n
push esi
call fcn.00401a6a
add esp, 0xc
or ebx, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call edi
test eax, eax
jne 0x4015e6
test esi, esi
je 0x4015e3
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
or ebx, 0xffffffff
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x4015f0
Capabilities:
Create service

Disassembly:
sub esp, 8
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x401643
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4016bb
push str.Error_opening_Service_Control_Manager:
push esi
call fcn.00401a6a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x28]
push 0
mov ecx, dword [esp + 0x24]
push 0
mov ebp, dword [esp + 0x24]
push 0x40ada8
push 0
push 0
push eax
push 1
push 3
push 0x10
push 0xf01ff
push ecx
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x4016c5
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40169e
push ebp
push str.Error_creating_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4016bb
test esi, esi
je 0x4016bb
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4016dd
push ebp
push str.Service__s_successfully_created._n
push ebx
call fcn.00401a6a
add esp, 0xc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40173d
push str.ChangeServiceConfig2A
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401736
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
mov dword [esp + 0x1c], edx
call eax
test eax, eax
jne 0x401736
test ebx, ebx
je 0x401736
push str.Error_setting_service_description:
push ebx
call fcn.00401a6a
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
call esi
test eax, eax
jne 0x401762
test ebx, ebx
je 0x40175f
push ebp
push str.Error_closing_service__s._n
push ebx
call fcn.00401a6a
add esp, 0xc
or edi, 0xffffffff
mov edx, dword [esp + 0x14]
push edx
call esi
test eax, eax
jne 0x401782
test ebx, ebx
je 0x40177f
push str.Error_closing_Service_control_Manager_n
push ebx
call fcn.00401a6a
add esp, 8
or edi, 0xffffffff
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x401820
Capabilities:
Modify service

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x401871
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4018cc
push str.Error_opening_Service_Control_Manager:
push esi
call fcn.00401a6a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebp, dword [esp + 0x1c]
push 0xf01ff
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4018d5
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4018af
push ebp
push str.Error_opening_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4018cc
test esi, esi
je 0x4018cc
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
xor ebx, ebx
mov eax, dword [esp + 0x20]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x40191e
test esi, esi
je 0x401919
push ebp
push str.Error_changing_start_type_for_service__s:
push esi
call fcn.00401a6a
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401790
add esp, 8
or ebx, 0xffffffff
jmp 0x401931
test esi, esi
je 0x401931
push ebp
push str.Successfully_changed_start_type_for_service__s_n
push esi
call fcn.00401a6a
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test eax, eax
jne 0x401954
test esi, esi
je 0x401951
push ebp
push str.Error_closing_service__s_n
push esi
call fcn.00401a6a
add esp, 0xc
or ebx, 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call edi
test eax, eax
jne 0x401974
test esi, esi
je 0x401971
push str.Error_closing_Service_control_Manager_n
push esi
call fcn.00401a6a
add esp, 8
or ebx, 0xffffffff
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x4032f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408838
cmp edx, dword [eax]
je 0x403317
add eax, 8
inc ecx
cmp eax, 0x4088c8
jl 0x403308
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408838]
jne 0x403445
mov eax, dword [0x40adb8]
cmp eax, 1
je 0x40341f
test eax, eax
jne 0x403348
cmp dword [0x408784], 1
je 0x40341f
cmp edx, 0xfc
je 0x403445
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40337f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004049d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4033c2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40746c
push edi
call fcn.00405650
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004049d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004049e0
lea eax, [ebp - 0xa0]
push 0x40744c
push eax
call fcn.004049e0
push dword [esi + 0x40883c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004049e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004055bf
add esp, 0x2c
pop edi
jmp 0x403445
lea eax, [ebp + 8]
lea esi, [esi + 0x40883c]
push 0
push eax
push dword [esi]
call fcn.00403520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x432440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x432493
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43247a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446d20
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x487c18
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x446d59
inc eax
mov dword [esi + 0x10], eax
jmp 0x446e6c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x446d6d
mov eax, 0xffffffc7
jmp 0x446e6e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x446d7e
cmp dword [esi + 8], eax
jne 0x446d6d
cmp dword [esi + 8], eax
jne 0x446d97
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x446d97
mov eax, 0xffffffc7
jmp 0x446e6e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x446dab
push eax
mov ecx, ebx
call fcn.00446550
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004132f0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x446ddc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00413310
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00445cc0
test eax, eax
mov dword [esp + 0x38], eax
je 0x446e0f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5773d0
call fcn.004134f0
mov eax, dword [esp + 0x38]
jmp 0x446e6e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00446b80
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x446e53
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00446ba0
mov esi, eax
test esi, esi
jne 0x446e83
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00446b80
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x446e25
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5773d0
call fcn.004134f0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5773d0
call fcn.004134f0
mov eax, esi
jmp 0x446e6e