joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409320
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x110
mov eax, dword [0x4549cc]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebp
push esi
lea eax, [esp + 8]
push eax
xor ebp, ebp
push 0x20119
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x4093ce
mov esi, dword [esp + 8]
push ebx
push edi
push 0xff
lea ecx, [esp + 0x21]
push ebp
mov ebx, esi
mov edi, 0x100
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
mov byte [esp + 0x28], 0
call fcn.00427da0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], edi
call fcn.00408a40
test eax, eax
je 0x4093f9
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.reg.QueryStringValue_fail
call edi
lea ecx, [esp + 0x1c]
push ecx
call edi
cmp esi, ebp
je 0x409473
push esi
jmp 0x40946d
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.reg.Open_fail
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
call esi
pop esi
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00427b64
add esp, 0x110
ret
cmp esi, ebp
je 0x409406
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esp + 0x1c]
push edx
call ebp
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409418
mov ecx, 5
mov esi, str.EnterpriseBrowser.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x1c]
push eax
movsb byte es:[edi], byte [esi]
call ebp
push 1
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x409461
push str.ShellExecute_EnterpriseBrowser.exe_fail
call ebp
call fcn.00408f00
jmp 0x409468
push str.ShellExecute_EnterpriseBrowser.exe_success
call ebp
test ebx, ebx
je 0x409473
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x11c]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.00427b64
add esp, 0x110
ret
Function at 0x409960
Capabilities:
Create process on windows
Get common file path
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x441590
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4549cc]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4549cc]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
push str.http:__mss.hq.ctc.com
push str.iexplore.exe
push str.open
push 0
call ebx
cmp eax, 0x20
jge 0x409b1d
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ShellExecute_fail
call edi
push 0x100
call fcn.0040a82b
push 0x100
mov esi, eax
push 0
push esi
call fcn.00427da0
add esp, 0x10
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4099f2
sub eax, edx
je 0x409b0e
mov dword [esp + 0x4c], 0xf
mov al, byte [esi]
push 0x34
mov byte [esp + 0x3d], cl
push str.:Program_Files__x86_Internet_Exploreriexplore.exe
lea ecx, [esp + 0x3c]
mov dword [esp + 0x64], 0
mov byte [esp + 0x40], al
mov dword [esp + 0x50], 1
call fcn.004096c0
mov eax, dword [esp + 0x38]
mov ebp, 0x10
cmp dword [esp + 0x4c], ebp
jae 0x409a46
lea eax, [esp + 0x38]
push 5
push 0
push str.http:__mss.hq.ctc.com
push eax
push str.open
push 0
call ebx
cmp eax, 0x20
jge 0x409afb
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], ebp
jae 0x409a70
lea eax, [esp + 0x38]
push eax
call edi
push str.ShellExecute_fail
call edi
mov dword [esp + 0x30], 0xf
mov cl, byte [esi]
push 0x2e
mov byte [esp + 0x20], cl
push str.:Program_FilesInternet_Exploreriexplore.exe
lea ecx, [esp + 0x20]
mov byte [esp + 0x64], 1
mov dword [esp + 0x34], 1
mov byte [esp + 0x25], 0
call fcn.004096c0
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x409ab8
lea eax, [esp + 0x1c]
push 5
push 0
push str.http:__mss.hq.ctc.com
push eax
push str.open
push 0
call ebx
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x409ad9
lea eax, [esp + 0x1c]
push eax
call edi
push str.ShellExecute_end
call edi
call fcn.00409320
cmp dword [esp + 0x30], ebp
jb 0x409afb
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040a820
add esp, 4
cmp dword [esp + 0x4c], ebp
jb 0x409b0e
mov eax, dword [esp + 0x38]
push eax
call fcn.0040a820
add esp, 4
test esi, esi
je 0x409b28
push esi
call fcn.0040a820
add esp, 4
jmp 0x409b28
push str.ShellExecute_success
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00427b64
add esp, 0x4c
ret
Function at 0x40a4d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4416cb
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4549cc]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4549cc]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
lea eax, [esp + 0x34]
push eax
push 0x104
mov ebx, ecx
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor esi, esi
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], esi
mov byte [esp + 0x1c], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a540
sub eax, edx
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x20]
call fcn.00402f20
push 0x26
push str._CTCCOfficeClient_CTCCOfficeClient.ini
lea ecx, [esp + 0x20]
mov dword [esp + 0x14c], esi
call fcn.004096c0
mov eax, dword [esp + 0x1c]
mov edi, 0x10
cmp dword [esp + 0x30], edi
jae 0x40a582
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push edx
push str.load
push str.Interface
call fcn.0040a2a0
add esp, 0x10
test al, al
jne 0x40a5a5
push 0xffffffffffffffff
call fcn.00429bfb
cmp dword [esp + 0x14], esi
je 0x40a5fe
mov eax, dword [ebx + 0x1d0]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push esi
push 0x408
push eax
call edi
mov ebp, dword [esp + 0x14c]
mov esi, eax
cmp esi, ebp
jg 0x40a5e6
mov edi, edi
mov ecx, dword [ebx + 0x1d0]
push 0
push esi
push 0x402
push ecx
call edi
inc esi
cmp esi, ebp
jle 0x40a5d0
cmp dword [esp + 0x30], 0x10
jb 0x40a5fa
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040a820
add esp, 4
xor eax, eax
jmp 0x40a616
cmp dword [esp + 0x30], edi
jb 0x40a611
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040a820
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.00427b64
add esp, 0x134
ret 4

Function at 0x411310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x411357
call fcn.00416c7a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411357
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x411373
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00410e8a
mov esi, eax
test edi, edi
je 0x411371
test ebx, ebx
je 0x411371
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4122d3
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x441c3c
call fcn.0042a09b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4122f8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41233e
lea ecx, [ebp - 0x10]
call fcn.00401460
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a91e
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401020
mov eax, esi
call fcn.0042a173
ret 8

Function at 0x41532b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x41534f
cmp dword [edi + 0x54], 0
jne 0x41534f
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00416c7a
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004152ec
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41597c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4159c4
call fcn.00416c7a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4159c4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x415a07
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4159f0
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4159f0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x415a04
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x427b64
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4549cc]
jne 0x427b6e
repz ret
jmp fcn.0042efac
Function at 0x43c81b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042e8f0
and dword [ebp - 4], 0
cmp dword [0x45879c], 0
mov ebx, eax
jne 0x43c8cc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43c97d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x449964
push edi
call esi
test eax, eax
je 0x43c97d
push eax
call fcn.0042e87e
mov dword [esp], 0x449954
push edi
mov dword [0x45879c], eax
call esi
push eax
call fcn.0042e87e
mov dword [esp], 0x449940
push edi
mov dword [0x4587a0], eax
call esi
push eax
call fcn.0042e87e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4587a4], eax
call esi
push eax
call fcn.0042e87e
pop ecx
mov dword [0x4587ac], eax
test eax, eax
je 0x43c8cc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042e87e
pop ecx
mov dword [0x4587a8], eax
mov eax, dword [0x4587a8]
cmp eax, ebx
je 0x43c924
cmp dword [0x4587ac], ebx
je 0x43c924
push eax
call fcn.0042e8f9
push dword [0x4587ac]
mov esi, eax
call fcn.0042e8f9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43c924
test edi, edi
je 0x43c924
call esi
test eax, eax
je 0x43c91b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43c91b
test byte [ebp - 0xc], 1
jne 0x43c924
or dword [ebp + 0x10], 0x200000
jmp 0x43c95d
mov eax, dword [0x4587a0]
cmp eax, ebx
je 0x43c95d
push eax
call fcn.0042e8f9
pop ecx
test eax, eax
je 0x43c95d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43c95d
mov eax, dword [0x4587a4]
cmp eax, ebx
je 0x43c95d
push eax
call fcn.0042e8f9
pop ecx
test eax, eax
je 0x43c95d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45879c]
call fcn.0042e8f9
pop ecx
test eax, eax
je 0x43c97d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43c97f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401255
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40124b
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x401237
mov eax, 1
jmp 0x401257
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401219
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40125b
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405ed2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0x4098c8
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4012d1
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004058be
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
mov eax, dword [ebp - 0x24]
jmp 0x4013e7
push 0x128
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0x128
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4013c2
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
push ecx
lea ecx, [ebp - 0x18]
call fcn.004058b2
lea ecx, [ebp + 8]
call fcn.004026f0
push eax
lea ecx, [ebp - 0x18]
call fcn.00402700
test eax, eax
jne 0x401359
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401359
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4013c2
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
push ecx
lea ecx, [ebp - 0x18]
call fcn.004058b2
lea ecx, [ebp + 8]
call fcn.004026f0
push eax
lea ecx, [ebp - 0x18]
call fcn.00402700
test eax, eax
jne 0x4013c0
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4013be
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4013c2
jmp 0x401359
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004058be
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4022b8
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4060d2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402306
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
jmp 0x402435
push 0x34
lea ecx, [ebp + 8]
call fcn.004026f0
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x402342
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
jmp 0x402435
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40237c
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
jmp 0x402435
cmp dword [ebp - 0x28], 4
jne 0x402387
jmp 0x402412
cmp dword [ebp - 0x28], 1
jne 0x402412
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4023c8
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
jmp 0x402435
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x402412
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x28], 4
jne 0x402410
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
jmp 0x402435
jmp 0x4023c8
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403c1f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4062ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xc
call fcn.004026f0
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0
je 0x403c8d
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
mov eax, dword [ebp - 0x18]
jmp 0x403cfb
mov dword [ebp - 0x10], 1
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp + 8]
call fcn.004026f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x24]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x24]
cmp dword [ecx], 0
jne 0x403ce2
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
mov eax, dword [ebp - 0x1c]
jmp 0x403cfb
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004058be
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4043b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406353
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], 0xff
mov dword [ebp - 0x14], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
lea eax, [ebp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x128]
call fcn.00403c1f
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 1
je 0x404475
cmp dword [ebp - 0x10], 2
je 0x404475
lea edx, [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp - 0x124]
or al, 1
mov dword [ebp - 0x124], eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004058be
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004058be
mov eax, dword [ebp + 8]
jmp 0x4045ac
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push 0
mov ecx, dword [ebp - 0x128]
add ecx, 0xc
call fcn.004026f0
push eax
mov edx, dword [ebp - 0x128]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
mov edx, dword [ebp - 0x128]
cmp dword [edx], 0
je 0x4044ed
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [ebp - 0x124]
or ecx, 1
mov dword [ebp - 0x124], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004058be
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004058be
mov eax, dword [ebp + 8]
jmp 0x4045ac
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp + 0xc]
call fcn.004026f0
push eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
mov edx, dword [ebp - 0x128]
cmp dword [edx], 0
je 0x40452b
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x404573
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [ebp - 0x124]
or edx, 1
mov dword [ebp - 0x124], edx
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004058be
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004058be
mov eax, dword [ebp + 8]
jmp 0x4045ac
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x124]
or ecx, 1
mov dword [ebp - 0x124], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004058be
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004058be
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc