joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c185
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [0x413004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov edi, ecx
push str.FILES
push dword [ebx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00403b20
add esp, 0xc
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0xb4]
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
push 0
push 0
push 0xc
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, eax
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
call esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
movups xmm0, xmmword [ebp - 0x48]
push eax
push edi
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x94]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x38]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push 0x411d58
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x411d5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011d2
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411dfc
push 0x411e0c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e1c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dcc
push 0x411dec
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4011f1
lea eax, [esp + 4]
push eax
push 0x411dcc
push 0x411dec
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411ddc
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
mov esp, ebp
pop ebp
ret 0x10

Function at 0xf07cc0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf07cca
pushal
call 0xf07cd0
pop ebp
sub ebp, 0x10
sub ebp, 0xb07cc0
jmp 0xf07ce6
mov eax, 0xb07cc0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cb
mov edx, 0x112260f
xor byte [eax], dl
inc eax
dec ecx
jne 0xf07cfd
jmp 0xf07d10
test dl, al
test byte [esi + 0xf0f0f33], al
mov cs, esi
test dword [edi], 0xc20c0f0f
mov bh, 0xb
invalid
Function at 0x4076c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push edi
push eax
call fcn.004095f0
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.004072b0
lea eax, [ebp - 0x20c]
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x407756
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_open_file_mapping_object.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x410], eax
xor eax, eax
jmp 0x407820
push 0x1e78
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4077aa
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_map_view_of_file.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x410], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40774f
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x4077c6
call fcn.0040d306
mov dword [eax], 0x16
call fcn.0040d23a
jmp 0x4077d5
push 0x1034
push edi
push eax
call fcn.00408e00
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str.ReadSharedMemory__:
push ecx
mov edx, 0x82
mov ecx, esi
call fcn.00403b0e
lea eax, [ebp - 0x20c]
push eax
push str.succeeded._mapping_obj_name:__s
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00406b11
and dword [esi + 0x410], 0
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407989
leave
ret

Function at 0x4134ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0041304b
retf
Function at 0x413554
Capabilities:
Inspect section memory permissions

Disassembly:
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x413844
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00412fbc
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x4135bb
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
rcl dword [eax], 0x8d
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00412fbc
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x413588
call fcn.0041304b
jns 0x41357f
jae 0x413629
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x41383a
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x4135f0
cmp dword [eax + 0xc], ebx
je 0x413693
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0041304b
cmp edi, ecx
cli
or edi, dword [ecx]
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
lea edi, [ecx + esi]
jne 0x413633
mov dword [ebp + 0x10], edi
jmp 0x413638
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.0041304b
mov dl, 0xbf
xor ch, byte [eax - 0x75]
inc ebp
adc byte [ebx + 0x74c33b00], cl
aaa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x413681
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x41365c
and eax, 0xffff
push eax
jmp 0x413660
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00413010
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x41383a
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x413641
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
invalid
Function at 0x413594
Capabilities:
Inspect section memory permissions

Disassembly:
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x413844
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00412fbc
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x4135bb
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
rcl dword [eax], 0x8d
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00412fbc
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x413588
call fcn.0041304b
jns 0x41357f
jae 0x413629
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x41383a
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x4135f0
cmp dword [eax + 0xc], ebx
je 0x413693
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0041304b
cmp edi, ecx
cli
or edi, dword [ecx]
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
lea edi, [ecx + esi]
jne 0x413633
mov dword [ebp + 0x10], edi
jmp 0x413638
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.0041304b
mov dl, 0xbf
xor ch, byte [eax - 0x75]
inc ebp
adc byte [ebx + 0x74c33b00], cl
aaa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x413681
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x41365c
and eax, 0xffff
push eax
jmp 0x413660
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00413010
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x41383a
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x413641
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
invalid
Function at 0x41373a
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x413722
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x413740
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41379e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x413785
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41378e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x413798
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41377a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x413704
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4137eb
dec eax
je 0x4137e2
sub eax, 3
je 0x4137d9
mov dword [ebp - 4], 0x40
jmp 0x413808
mov dword [ebp - 4], 4
jmp 0x4137ee
mov dword [ebp - 4], 0x20
jmp 0x4137ee
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41383a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4137ba
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041304b
inc ebp
add eax, 0x75ff6511
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x413846
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40fe8d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40fea2
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040dcde
jmp 0x40ff25
inc edi
cmp al, 0x8b
push esp
pop es
js 0x40febc
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.0040dcde
sub al, 0xdb
int 0xfa
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40fecb
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40fecb
call fcn.0040dcde
sbb al, 0xe3
fdivr qword [ebx + 0x3245a8b]
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040dcde
invalid
jmp 0x40feb2

Function at 0x414600
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421014]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x414638
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
push esi
push 0xf01ff
push str.StiSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x41466a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esi + 1]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x41469a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x4146f9
cmp eax, 3
je 0x4146c4
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4146f9
call ebx
sub eax, dword [ebp - 0x24]
cmp eax, 0xc350
jae 0x4146f9
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x414725
cmp dword [ebp - 0x1c], 1
je 0x4146f9
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, dword [ebp - 0x24]
cmp eax, 0xc350
jb 0x4146d0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
call ebx
sub eax, dword [ebp - 0x24]
mov ecx, 0xc350
cmp ecx, eax
pop ebx
sbb eax, eax
pop esi
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
pop esi
xor ecx, ebp
pop edi
call fcn.00403a28
mov esp, ebp
pop ebp
ret
Function at 0x414750
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421014]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x414788
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
push esi
push 0xf01ff
push str.StiSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4147ba
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esi + 1]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4147ea
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1c], 1
jne 0x4147fb
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x24], eax
call ebx
sub eax, dword [ebp - 0x24]
cmp eax, 0xc350
jae 0x41483c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x414868
cmp dword [ebp - 0x1c], 4
je 0x41483c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, dword [ebp - 0x24]
cmp eax, 0xc350
jb 0x414813
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
call ebx
sub eax, dword [ebp - 0x24]
mov ecx, 0xc350
cmp ecx, eax
pop ebx
sbb eax, eax
pop esi
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
pop esi
xor ecx, ebp
pop edi
call fcn.00403a28
mov esp, ebp
pop ebp
ret
Function at 0x415320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41884b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x421014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x14]
sub eax, 1
jne 0x41537e
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x41539f
mov ecx, dword [ebp + 8]
push 0
push 0x41e8d4
call fcn.00401630
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
lea ecx, [ebp - 0x20]
call fcn.00401390
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
push esi
call fcn.00406927
mov ecx, dword [ebp + 8]
add esp, 8
push eax
push esi
call fcn.00401630
lea ecx, [ebp - 0x20]
call fcn.00401320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417b30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418bec
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x421014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x828], eax
mov esi, ecx
mov dword [ebp - 0x824], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x82c], ecx
lea ecx, [ebp - 0x824]
push ecx
push eax
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x824], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x417bbe
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x41e8d4
mov word [esi], ax
call fcn.00401630
jmp 0x417cb2
lea eax, [edi + 2]
push eax
lea ecx, [ebp - 0x838]
call fcn.00401390
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x838]
push ebx
push edi
push 0
push dword [ebp - 0x828]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x417bf8
push 0x41e8d4
jmp 0x417ca0
push 0x800
lea eax, [ebp - 0x814]
mov dword [ebp - 0x81c], 0
push 0
push eax
mov dword [ebp - 0x818], 0
call fcn.00405b60
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x81c]
add esp, 0xc
push eax
lea eax, [ebp - 0x818]
push eax
push str.VarFileInfoTranslation
push ebx
call edi
test eax, eax
je 0x417bee
mov ecx, dword [ebp - 0x818]
push dword [ebp - 0x82c]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
lea eax, [ebp - 0x814]
push 0x400
push eax
call fcn.00401040
add esp, 0x18
mov dword [ebp - 0x820], 0
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
call edi
test eax, eax
je 0x417bee
push dword [ebp - 0x820]
mov ecx, esi
call fcn.004017c0
lea ecx, [ebp - 0x838]
call fcn.00401320
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00403a28
mov esp, ebp
pop ebp
ret