joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425065
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00424fe1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4251d4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4251d4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x425189
jg 0x4250c1
test eax, eax
je 0x42517f
push 1
push 0x1000
call fcn.0041bc68
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4250e4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x425176
push 0x8000
push ebx
call fcn.0041778b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x42510d
jg 0x425108
cmp ecx, 0x1000
jb 0x42510d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041a4e6
add esp, 0x10
cmp eax, 0xffffffff
je 0x425152
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x425108
jl 0x425139
test ecx, ecx
jne 0x4250fa
push dword [ebp - 0xc]
push ebx
call fcn.0041778b
push esi
call fcn.0041826d
add esp, 0xc
xor ebx, ebx
jmp 0x4251e2
cmp byte [edi + 0x24], 0
je 0x425169
cmp dword [edi + 0x20], 5
jne 0x425169
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x425174
mov ebx, dword [edi + 0x18]
jmp 0x425176
xor ebx, ebx
push esi
call fcn.0041826d
pop ecx
jmp 0x4251e2
test ecx, ecx
jg 0x42514b
jl 0x425189
test eax, eax
jae 0x42514b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004199aa
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4251a9
cmp byte [edi + 0x1c], 0
je 0x42514b
jmp 0x4251da
push ebx
call fcn.004164b2
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42514b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4251e2
cmp byte [edi + 0x1c], 0
je 0x4251df
mov ebx, dword [edi + 0x18]
jmp 0x4251e2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004199aa
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426e50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426e7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426e7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403247
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x2c
push 1
mov ebx, 0x1bc
call fcn.00449630
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403293
push ebx
call fcn.00448209
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x4032a4
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4032c1
push 6
call fcn.004481f1
add esp, 4
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push reloc.WSOCK32.dll_getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4032e6
mov eax, 0x48c3a9
push eax
push 3
mov ebx, 0x19c
call fcn.00449490
add esp, 0x28
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, 0x80000101
jne 0x40331a
and eax, 0xff
jmp 0x403365
cmp ecx, 0x80000201
jne 0x403325
cwde
jmp 0x403365
cmp ecx, 0x80000301
je 0x403365
cmp ecx, 0x80000401
je 0x403365
mov dword [ebp - 0x1c], eax
cmp ecx, 0x80000501
je 0x403355
cmp ecx, 0x80000601
je 0x40335a
push 2
call fcn.004481f1
add esp, 4
fld dword [ebp - 0x1c]
jmp 0x403360
mov dword [ebp - 0x18], edx
fld qword [ebp - 0x1c]
call fcn.00402ffd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
je 0x403380
cmp dword [ebp - 8], 9
je 0x403380
xor eax, eax
jmp 0x403385
mov eax, 1
jmp 0x40338a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40339b
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40392e
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0xf0000000
push 0x18
push 0x48c313
push 0x48c313
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40397c
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4039d7
mov dword [ebp - 0xc], esp
push 0
push 0x18
push 0x48c313
push 0x48c313
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4039c0
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4039d7
mov eax, 0x48c3a9
jmp 0x403a46
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00403a5e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4039fc
push ebx
call fcn.00448209
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403a27
push 6
call fcn.004481f1
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x403a41
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004481fd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x403a46
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403a57
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x404f4b
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00449d00
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x404f90
push ebx
call fcn.00448209
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x404fa7
mov eax, 0x48c313
push eax
push 1
mov ebx, 0x130
call fcn.00449800
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404fe3
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x405011
mov eax, dword [ebp - 4]
test eax, eax
je 0x40500c
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.004481fd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40501b
mov eax, 0x48c313
jmp 0x40501b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40502c
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4053ca
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x1c
call fcn.004481fd
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push connect
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x405433
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4054fb
mov dword [ebp - 0x14], esp
push connect
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40546c
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4054d9
mov dword [ebp - 0x14], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40549e
push 6
call fcn.004481f1
add esp, 4
test eax, eax
je 0x4054b7
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4054d9
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4054fb
push 6
call fcn.004481f1
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x405503
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x405a5c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x405a77
call fcn.00405ae7
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x405aa3
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405acd
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x405ae1
mov esp, ebp
pop ebp
ret 8
Function at 0x405dd9
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405e25
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405ff7
mov dword [ebp - 0x10], esp
push 0xf01ff
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405e5e
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405fd5
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00449d40
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00449d40
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00449d40
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00449d40
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00449d40
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0xffffffff
push 0xffffffff
push 0xffffffff
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x405f5a
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x405f6d
push ebx
call fcn.00448209
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x405f7d
push ebx
call fcn.00448209
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x405f8d
push ebx
call fcn.00448209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405f9d
push ebx
call fcn.00448209
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x405fad
push ebx
call fcn.00448209
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405fd5
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405ff7
push 6
call fcn.004481f1
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x405fff
mov esp, ebp
pop ebp
ret 8
Function at 0x406005
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x406051
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40610a
mov dword [ebp - 0x10], esp
push 0x10
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40608a
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4060e8
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4060c3
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4060e8
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40610a
push 6
call fcn.004481f1
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x406112
mov esp, ebp
pop ebp
ret 4
Function at 0x406118
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x28], 0
mov eax, 0
sete al
test eax, eax
je 0x40614d
mov eax, 0x10
jmp 0x406150
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
test eax, eax
je 0x406171
mov eax, 3
jmp 0x406174
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
mov dword [ebp - 0xc], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4061a5
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4062d2
cmp dword [ebp + 0x1c], 0
je 0x4061e7
push 0x80000301
push 0
push 0x100
push 0x80000301
push 0
push dword [ebp + 0x24]
push 2
mov ebx, 0xc8
call fcn.00449660
add esp, 0x1c
mov dword [ebp + 0x24], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00449d40
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x44]
push dword [ebx]
mov ebx, dword [ebp + 0x3c]
push dword [ebx]
mov ebx, dword [ebp + 0x34]
push dword [ebx]
push 0
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 1
push dword [ebp + 0x2c]
push dword [ebp + 0x24]
push 0xf01ff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x406260
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x406273
push ebx
call fcn.00448209
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40628e
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004062e9
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4062b0
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4062d2
push 6
call fcn.004481f1
add esp, 4
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x4062e3
mov esp, ebp
pop ebp
ret 0x44
Function at 0x4062e9
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 0x20000000
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40633c
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406425
mov dword [ebp - 0x14], esp
push 2
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x406375
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406403
mov dword [ebp - 0x14], esp
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyn]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4063b0
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4063de
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x406403
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x406425
push 6
call fcn.004481f1
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x40642d
mov esp, ebp
pop ebp
ret 8
Function at 0x4182aa
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x4182e3
cmp dword [ebp + 0xc], 1
je 0x4182e3
mov eax, 1
jmp 0x4182e8
mov eax, 0
test eax, eax
je 0x4182fa
mov eax, 0
jmp 0x4184a4
cmp dword [ebp + 0xc], 1
jne 0x41832c
push dword [ebp + 8]
call fcn.004184bc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x418323
push ebx
call fcn.00448209
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x41835d
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x418348
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004481fd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x418359
push ebx
call fcn.00448209
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0
push 0x18
push 0x48c313
push 0x48c313
lea eax, [ebp - 8]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x418394
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4183ef
mov dword [ebp - 0x10], esp
push 8
push 0x18
push 0x48c313
push 0x48c313
lea eax, [ebp - 8]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4183d8
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4183ef
mov eax, 0
jmp 0x4184a4
push reloc.WSOCK32.dll_getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x418402
mov eax, 0x48c3a9
push eax
push 1
mov ebx, 0x194
call fcn.00449860
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
test eax, eax
je 0x418436
add eax, 8
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x418456
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x418494
mov dword [ebp - 0x10], esp
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41848a
push 6
call fcn.004481f1
add esp, 4
mov eax, 0
jmp 0x4184a4
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.0041814d
jmp 0x4184a4
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4184b5
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41d7cc
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0x1c
call fcn.004481fd
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], esp
push 1
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d835
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d8ec
mov dword [ebp - 0x14], esp
push 0x20
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d86e
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x41d8ca
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
push 1
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d8a5
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d8ca
push 6
call fcn.004481f1
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d8ec
push 6
call fcn.004481f1
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x41d8f4
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x427584
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x28
call fcn.004481fd
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
nop
nop
cmp dword [ebp - 8], esp
je 0x4275cc
push 6
call fcn.004481f1
add esp, 4
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
jmp 0x4275df
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00448209
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret