joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d48d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x30]
mov dword [edi + 0x2c], eax
cmp dword [ecx], edx
je 0x45d4ad
call fcn.00424195
lea eax, [edi + 0x3c]
push eax
push esi
push edi
push 0x45d590
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x38], eax
test eax, eax
jne 0x45d4dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x45d4dc
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x45e15e
Capabilities:
Reference sql statements

Disassembly:
push 0x18
mov eax, 0x4ad0ab
call fcn.004a956e
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov esi, 0x4b8970
lea ecx, [ebp - 0x10]
push esi
call fcn.00417475
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0xc]
call fcn.0045dac9
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push dword [ebx + 0xc]
call fcn.0045d6c7
mov edi, eax
test edi, edi
js 0x45e2de
cmp dword [ebx + 0x14], 0
je 0x45e1ce
push 5
push 0x40d218
lea ecx, [ebp - 0x10]
call fcn.00416cb5
mov ecx, dword [ebx + 0x14]
call fcn.00417403
push eax
push dword [ebx + 0x14]
lea ecx, [ebp - 0x10]
call fcn.00416cb5
push esi
lea ecx, [ebp - 0x14]
call fcn.00417475
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebx + 0x10]
push dword [ebx + 0x10]
push dword [ebx + 0x10]
push 0x40d6b8
push eax
call fcn.0041a5a1
add esp, 0x14
lea ecx, [ebp - 0x14]
push 0x20
call fcn.0042aaae
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push dword [esi - 0xc]
push esi
call fcn.00416cb5
push 0x29
lea ecx, [ebp - 0x14]
call fcn.0042aaae
mov eax, dword [ebx + 8]
mov edi, dword [ebp - 0x14]
push edi
push 0x41036c
mov ebx, dword [eax]
push eax
mov ecx, dword [ebx + 0x1c]
call dword [0x4bb544]
call dword [ebx + 0x1c]
mov ecx, eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
js 0x45e2a3
xor edx, edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
push ecx
mov eax, dword [eax + 8]
push edx
push 0x40e4dc
push edx
mov ebx, dword [eax]
push eax
mov ecx, dword [ebx + 0x10]
call dword [0x4bb544]
call dword [ebx + 0x10]
mov ecx, eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
js 0x45e285
push dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.0045d8d8
mov ecx, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45e2a3
mov ecx, dword [eax]
push eax
mov ebx, dword [ecx + 8]
mov ecx, ebx
call dword [0x4bb544]
call ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x45e2d1
test byte [eax + 0x1c], 2
je 0x45e2d1
cmp byte [eax + 0x19], 5
jb 0x45e2d1
push ecx
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.0045c7b4
lea ecx, [edi - 0x10]
call fcn.004174b0
mov edi, dword [ebp - 0x18]
jmp 0x45e2e1
mov esi, dword [ebp - 0x10]
lea ecx, [esi - 0x10]
call fcn.004174b0
mov eax, edi
call fcn.004a953c
ret 4
Function at 0x45e2f3
Capabilities:
Reference sql statements

Disassembly:
push 0x1c
mov eax, 0x4ad0e6
call fcn.004a956e
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov ecx, dword [edi]
push ecx
mov dword [ebp - 0x28], ecx
lea eax, [ecx + 0x28]
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push 0x4b8970
call fcn.00417475
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045d801
mov esi, dword [ebp - 0x18]
mov ebx, eax
test ebx, ebx
js 0x45e40a
push 0x40d920
lea ecx, [ebp - 0x10]
call fcn.0041706d
push 5
push 0x40d218
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00416cb5
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.00416cb5
push 0x24
push 0x40db58
lea ecx, [ebp - 0x10]
call fcn.00416cb5
mov eax, dword [edi + 8]
push dword [ebp - 0x10]
push 0x41036c
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
call dword [0x4bb544]
call edi
mov ebx, eax
test ebx, ebx
js 0x45e3ff
xor edx, edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 8]
push edx
push 0x40e4dc
push edx
mov edi, dword [eax]
push eax
mov ecx, dword [edi + 0x10]
call dword [0x4bb544]
call dword [edi + 0x10]
mov ebx, eax
test ebx, ebx
js 0x45e3e4
push dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.0045d8d8
mov ebx, eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x45e3ff
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x4bb544]
call edi
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004174b0
lea ecx, [esi - 0x10]
call fcn.004174b0
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
call fcn.004a953c
ret 4
Function at 0x45e469
Capabilities:
Reference sql statements

Disassembly:
push 0x18
mov eax, 0x4ad119
call fcn.004a956e
mov ebx, ecx
push 0x40dba8
lea ecx, [ebp - 0x14]
call fcn.0041706d
and dword [ebp - 4], 0
xor edi, edi
and dword [ebp - 0x18], edi
xor esi, esi
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x18]
push dword [esi + 0x40e540]
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x1c]
push eax
call fcn.0045e838
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x1c]
add edi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esi, 4
cmp esi, 0x10
jb 0x45e495
test edi, edi
mov edi, dword [ebp - 0x20]
je 0x45e554
and dword [ebp - 0x18], edi
lea ecx, [ebp - 0x14]
push 6
push 0x40d384
call fcn.00416cb5
xor esi, esi
cmp esi, 0x10
jae 0x45e545
push dword [esi + 0x40e540]
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x24]
push eax
call fcn.0045e838
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jbe 0x45e525
cmp dword [ebp - 0x18], 0
jbe 0x45e516
push 4
push 0x40ba08
lea ecx, [ebp - 0x14]
call fcn.00416cb5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045d801
mov edi, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add eax, dword [ecx + 4]
mov byte [ebp - 4], 0
push dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esi, 4
test edi, edi
jns 0x45e4dd
push 1
push 0x408344
lea ecx, [ebp - 0x14]
call fcn.00416cb5
test edi, edi
js 0x45e5ee
mov eax, dword [ebx + 0x10]
push dword [ebp - 0x14]
push 0x41036c
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x4bb544]
call esi
mov edi, eax
test edi, edi
js 0x45e5ee
xor edx, edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x10]
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov esi, dword [eax]
push edx
push 0x40e4dc
push edx
mov ecx, dword [esi + 0x10]
push eax
call dword [0x4bb544]
call dword [esi + 0x10]
mov edi, eax
test edi, edi
js 0x45e5d3
lea eax, [ebx + 0x18]
push eax
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.0045dd81
mov edi, eax
test edi, edi
js 0x45e5d3
mov eax, dword [ebp - 0x18]
lea ecx, [ebx + 0x14]
cmp dword [ecx], eax
je 0x45e5d6
mov edx, eax
call fcn.00424195
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
test eax, eax
je 0x45e5ee
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4bb544]
call esi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004174b0
mov eax, edi
call fcn.004a953c
ret 4
Function at 0x45f282
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4b8bd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [eax]
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
push dword [eax - 0xc]
push eax
call fcn.00416cb5
push 1
push 0x407278
mov ecx, edi
call fcn.00416cb5
mov ebx, dword [esi]
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x45f2c4
sub ecx, edx
mov eax, 0x811c9dc5
sar ecx, 1
xor edx, edx
lea esi, [ecx + ecx]
test esi, esi
je 0x45f2f2
movzx ecx, byte [edx + ebx]
imul eax, eax, 0x1000193
xor eax, ecx
inc edx
cmp edx, esi
jb 0x45f2e1
push 0x10
push 0x21
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.msvcrt.dll__ultow_s]
lea edx, [ebp - 0x48]
add esp, 0x10
lea esi, [edx + 2]
xor ecx, ecx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x45f30c
sub edx, esi
lea eax, [ebp - 0x48]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00416cb5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8f70
leave
ret 0xc
Function at 0x46e85f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
call fcn.00416afa
mov esi, eax
test esi, esi
js 0x46e90e
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20219
push ebx
push 0x40eb60
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46e902
mov esi, ebx
cmp dword [edi + 0x48], ebx
je 0x46e8b0
push dword [edi + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x48], eax
test esi, esi
jne 0x46e902
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x54], eax
test eax, eax
je 0x46e8fb
mov ecx, edi
call fcn.0046f28c
mov esi, eax
test esi, esi
js 0x46e90d
push ebx
mov ecx, edi
call fcn.0046eb2f
mov esi, eax
test esi, esi
js 0x46e90d
push ebx
push ebx
push edi
push 0x46f2d0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x58], eax
jmp 0x46e90d
mov esi, 0x8000ffff
jmp 0x46e90d
jle 0x46e90d
movzx esi, si
or esi, 0x80070000
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x46f315
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 8]
xor ecx, ecx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push ecx
mov bh, cl
mov dword [ebp - 8], ecx
call dword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
cmp dword [ebp - 4], 0
mov esi, eax
je 0x46f349
push dword [ebp - 4]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test esi, esi
jne 0x46f355
cmp dword [ebp - 8], 3
jne 0x46f355
mov bh, 1
lea eax, [ebp - 0xc]
mov bl, bh
push eax
push 0x20019
push 0
push 0x40eda8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46f3b5
push 4
pop esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0x10
push 0x40edf4
push 0x40ee10
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x46f3ac
cmp dword [ebp - 4], esi
jne 0x46f3ac
cmp dword [ebp - 0x10], eax
sete bl
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x46f445
Capabilities:
Create thread
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov esi, ebx
call fcn.00417403
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0041738c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
test eax, eax
jne 0x46f495
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x46f48f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x46f548
push 0x13
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
jne 0x46f4bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x46f4c1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x46f548
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x403d4c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
js 0x46f53b
push 0x13
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [edi + 0x10], eax
cmp eax, 0xffffffff
jne 0x46f50b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x46f50d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x46f53b
push ebx
push ebx
push edi
push 0x46fb10
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
test eax, eax
jne 0x46f53b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x46f53b
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jns 0x46f574
or ebx, 0xffffffff
cmp dword [edi + 0xc], ebx
je 0x46f55c
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x10], ebx
je 0x46f56d
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [edi + 0x10], ebx
mov ecx, edi
call fcn.0046fec5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x4874ac
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, edx
mov eax, ecx
push esi
xor edx, edx
mov dword [ebp - 4], eax
mov esi, 0x80070057
mov dword [ebx], edx
push edi
test eax, eax
je 0x4875a5
push 6
pop ecx
xor eax, eax
mov dword [ebp - 8], edx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x800
lea eax, [ebp - 0x2c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov esi, eax
mov edi, 0x10000000
or esi, edi
jl 0x4875a5
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push SysReAllocStringLen
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov esi, eax
or esi, edi
jl 0x48759c
mov eax, dword [ebp - 4]
cmp dword [eax], 7
je 0x487585
cmp dword [eax], 8
je 0x487585
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, eax
push esi
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov edi, eax
test edi, edi
je 0x48757e
mov eax, dword [ebp - 4]
push dword [eax + 4]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x48756d
mov dword [ebx], edi
xor edi, edi
xor esi, esi
jmp 0x487575
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x48758a
mov esi, 0x8007000e
jmp 0x48758a
mov esi, 0x80004005
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_LsaClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49345a
Capabilities:
Get routing table

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x493493
test byte [eax + 0x1c], 1
je 0x493493
cmp byte [eax + 0x19], 5
jb 0x493493
push dword [ebp + 8]
mov edx, 0x41008c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x41
pop ecx
call fcn.0041610f
or dword [ebp - 0xc], 0xffffffff
xor edi, edi
or dword [ebp - 0x10], 0xffffffff
mov ebx, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
jne 0x4934b4
mov esi, 0x80004003
jmp 0x49357c
push 0x3c
call fcn.004a8468
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4934cc
mov esi, 0x8007000e
jmp 0x49357c
push edi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
mov esi, eax
cmp esi, 0x7a
jne 0x49350d
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [ebp - 4]
call fcn.004a8468
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4934c2
push edi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
mov esi, eax
test esi, esi
je 0x493517
jle 0x493515
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x49357c
mov ecx, dword [ebx]
test ecx, ecx
je 0x493542
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 8]
cmp dword [eax - 4], edi
jne 0x49353a
cmp dword [eax], edi
jne 0x49353a
cmp dword [eax + 0x20], edx
jae 0x49353a
mov edx, dword [eax + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x20]
add eax, 0x38
sub ecx, 1
jne 0x493523
push edi
push 2
lea edx, [ebp - 8]
pop ecx
call fcn.0049e839
mov edi, dword [ebp - 8]
mov esi, eax
test esi, esi
js 0x49357c
mov eax, edi
test eax, eax
je 0x493577
mov ecx, dword [ebp - 0xc]
cmp dword [eax + 4], ecx
je 0x4935d0
cmp ecx, 0xffffffff
jne 0x493570
cmp dword [eax + 0x44], 1
je 0x4935d0
mov eax, dword [eax + 8]
test eax, eax
jne 0x493560
mov esi, 0x80004005
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov edi, dword [0x4b70c8]
cmp edi, 0x4b70c8
je 0x4935c7
test byte [edi + 0x1c], 1
je 0x4935c7
movzx eax, byte [edi + 0x19]
mov ecx, esi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x4935c7
push esi
push dword [edi + 0x14]
mov edx, 0x41008c
push dword [edi + 0x10]
push 0x42
pop ecx
call fcn.0041610f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
mov eax, dword [eax + 0x10]
jmp 0x4935ee
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4935eb
mov ecx, dword [eax + 0x10]
test ecx, ecx
jle 0x4935eb
cmp ecx, 0x80
jbe 0x4935f4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4935d5
jmp 0x493577
push ecx
push edx
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x49357c
Function at 0x493d8b
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x4b70c8]
mov esi, 0x4b70c8
push 2
pop ebx
cmp eax, esi
je 0x493dea
test byte [eax + 0x1c], 1
je 0x493dc6
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x1a
pop ecx
call fcn.00416054
mov eax, dword [0x4b70c8]
cmp eax, esi
je 0x493dea
test byte [eax + 0x1c], bl
je 0x493dea
cmp byte [eax + 0x19], 4
jb 0x493dea
push 1
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x1b
pop ecx
call fcn.0041610f
push 1
mov ecx, edi
call fcn.00494114
mov esi, eax
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x493e20
test byte [eax + 0x1c], bl
je 0x493e20
cmp byte [eax + 0x19], 4
jb 0x493e20
push esi
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x1c
pop ecx
call fcn.0041610f
xor eax, eax
inc eax
cmp esi, eax
jne 0x493ebe
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 3
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov esi, eax
cmp esi, 1
je 0x493e6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4b70c8]
cmp ecx, 0x4b70c8
je 0x493ebe
test byte [ecx + 0x1c], bl
je 0x493ebe
cmp byte [ecx + 0x19], bl
jb 0x493ebe
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1d
jmp 0x493eb3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push 0xffffffffffffffff
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, eax
cmp esi, 1
je 0x493ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4b70c8]
cmp ecx, 0x4b70c8
je 0x493ebe
test byte [ecx + 0x1c], bl
je 0x493ebe
cmp byte [ecx + 0x19], 4
jb 0x493ebe
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1e
mov edx, 0x4100c0
pop ecx
call fcn.0041610f
mov ecx, edi
call fcn.00494362
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x493ef1
test byte [eax + 0x1c], 1
je 0x493ef1
cmp byte [eax + 0x19], 5
jb 0x493ef1
push esi
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x1f
pop ecx
call fcn.0041610f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x493efa
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x4b70c8]
mov ebx, 0x4b70c8
cmp eax, ebx
je 0x493f28
test byte [eax + 0x1c], 1
je 0x493f28
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x20
pop ecx
call fcn.00416054
push 0
mov ecx, edi
call fcn.00494114
mov esi, eax
mov eax, dword [0x4b70c8]
cmp eax, ebx
je 0x493f5c
test byte [eax + 0x1c], 2
je 0x493f5c
cmp byte [eax + 0x19], 4
jb 0x493f5c
push esi
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x21
pop ecx
call fcn.0041610f
cmp esi, 1
jne 0x493fa5
push 0
push 0
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, eax
cmp esi, 1
je 0x493fa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4b70c8]
cmp ecx, ebx
je 0x493fa5
test byte [ecx + 0x1c], 2
je 0x493fa5
cmp byte [ecx + 0x19], 4
jb 0x493fa5
push eax
push dword [ecx + 0x14]
mov edx, 0x4100c0
push dword [ecx + 0x10]
push 0x22
pop ecx
call fcn.0041610f
mov ecx, edi
call fcn.00494362
mov eax, dword [0x4b70c8]
cmp eax, ebx
je 0x493fd5
test byte [eax + 0x1c], 1
je 0x493fd5
cmp byte [eax + 0x19], 5
jb 0x493fd5
push esi
push dword [eax + 0x14]
mov edx, 0x4100c0
push dword [eax + 0x10]
push 0x23
pop ecx
call fcn.0041610f
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x493fdb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4b70c8]
mov ebx, 0x4b70c8
mov edi, 0x4100c0
cmp eax, ebx
je 0x49401a
test byte [eax + 0x1c], 1
je 0x49401a
cmp byte [eax + 0x19], 5
jb 0x49401a
push 2
push dword [eax + 0x14]
mov edx, edi
push dword [eax + 0x10]
push 0x33
pop ecx
call fcn.0041610f
push ecx
push ecx
push 0x2011f
push ecx
push ecx
xor eax, eax
lea ecx, [esp + 0x28]
push 0x4043b8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.004249e6
mov esi, eax
mov edx, dword [0x4b70c8]
cmp edx, ebx
je 0x494073
test byte [edx + 0x1c], 2
je 0x494073
cmp byte [edx + 0x19], 4
jb 0x494073
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, edi
push 0x34
pop ecx
call fcn.0041610f
mov edx, dword [0x4b70c8]
mov edi, dword [esp + 0x14]
test esi, esi
jne 0x4940cc
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 2
push eax
push 4
push 0
push 0x4100ac
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov edx, dword [0x4b70c8]
cmp edx, ebx
je 0x4940fe
test byte [edx + 0x1c], 2
je 0x4940cc
cmp byte [edx + 0x19], 4
jb 0x4940cc
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x4100c0
push 0x35
pop ecx
call fcn.0041610f
mov edx, dword [0x4b70c8]
cmp edx, ebx
je 0x4940fe
test byte [edx + 0x1c], 1
je 0x4940fe
movzx ecx, byte [edx + 0x19]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x4940fe
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x4100c0
push 0x36
pop ecx
call fcn.0041610f
test edi, edi
je 0x494109
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4