joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418a2b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x48dd90]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418a6e
cmp word [esi], dx
jne 0x418a6e
or byte [edi + eax + 0x28], 4
jmp 0x418a73
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x418bc6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x418ba6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x418ab5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x418aeb
cmp eax, edx
jae 0x418af7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x418a8d
jmp 0x418bc6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418ba2
cmp dword [ebp - 0x14], 0
je 0x418ba2
mov eax, dword [ebx*4 + 0x48dd90]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x418b7a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x418b43
mov word [esi], cx
jmp 0x418b76
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x48dd90]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x48dd90]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x48dd90]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x418bc6
pop ebx
cmp word [ebp - 4], bx
jne 0x418b8b
cmp esi, dword [ebp + 0xc]
jne 0x418b8b
mov word [esi], bx
jmp 0x418bc3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041945f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x418bc6
push 0xd
jmp 0x418bbf
mov ecx, dword [ebx*4 + 0x48dd90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418bbd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418bc6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x401449
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
dec eax
test edx, edx
je 0x40148c
mov edx, dword [ecx + 0xc]
inc eax
push ebx
push edi
mov dword [ebp + 8], eax
mov eax, dword [ecx + 4]
movzx ebx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ebx
inc esi
shr eax, 8
mov edi, dword [edx + edi*4]
xor eax, edi
dec dword [ebp + 8]
mov dword [ecx + 4], eax
jne 0x401469
pop edi
pop ebx
mov eax, dword [ecx + 4]
pop esi
pop ebp
ret 0xc

Function at 0x401dab
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
call fcn.00401f16
push 4
call fcn.004059cf
test eax, eax
pop ecx
je 0x401e85
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
push dword [0x523a60]
call esi
test eax, eax
je 0x401dfe
push 1
pop eax
jmp 0x401e87
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
jne 0x401e7e
cmp dword [ebp - 4], ebx
je 0x401e7e
push dword [ebp - 4]
call fcn.004af1a1
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x401e25
call fcn.004c23d5
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x523a60]
call esi
push eax
mov ecx, edi
call fcn.00405976
mov esi, eax
cmp esi, ebx
je 0x401e71
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp - 0xc]
call fcn.00401f3c
mov dword [edi + 0x38], ebx
push dword [edi + 0x14]
lea ecx, [edi + 0xc]
call fcn.004c5fe3
push dword [ebp - 0xc]
call fcn.004af0b8
pop ecx
mov eax, esi
jmp 0x401e87
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403fae
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x4d7048
call fcn.004aef44
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x10]
push edi
xor ebx, ebx
push eax
mov dword [esi + 0x28], ebx
call fcn.00403cfa
mov eax, dword [eax]
xor ecx, ecx
cmp dword [eax - 8], ebx
sete cl
mov edi, ecx
lea ecx, [ebp - 0x10]
call fcn.004c5eaa
cmp edi, ebx
je 0x404092
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00403cd6
cmp dword [esi + 0x20], ebx
mov dword [ebp - 4], ebx
jne 0x404022
mov ecx, esi
call fcn.0040523a
test eax, eax
jne 0x404022
cmp dword [esi + 0x28], ebx
lea ecx, [ebp - 0x10]
setge al
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004c5eaa
mov eax, esi
jmp 0x40411f
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x404057
mov eax, dword [eax - 8]
lea ecx, [ebp - 0x10]
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004c2708
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004c5fe3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004c5eaa
mov ecx, esi
call fcn.00405326
push dword [ebp - 0x10]
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
and eax, 0xffff
or eax, 0x80070000
mov ecx, esi
neg edi
sbb edi, edi
and edi, eax
call fcn.0040412e
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], edi
lea ecx, [ebp - 0x10]
jmp 0x404112
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00403cfa
push 2
pop edi
push dword [0x4e6cc0]
mov dword [ebp - 4], edi
push dword [ebp - 0x14]
call fcn.004afa15
pop ecx
test eax, eax
pop ecx
jne 0x4040bf
lea ecx, [ebp - 0x14]
call fcn.004c5e35
cmp dword [esi + 0x24], ebx
jne 0x4040ea
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push ebx
mov ecx, esi
call fcn.00403e6d
test eax, eax
jne 0x4040ea
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
mov ecx, esi
call fcn.00403e6d
test eax, eax
je 0x40410b
push dword [ebp - 0x14]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004c5eaa
xor eax, eax
cmp dword [esi + 0x28], ebx
setge al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4044f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4d70d4
call fcn.004aef44
sub esp, 0x10
push ebx
push esi
push dword [ebp + 0xc]
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp + 0xc]
mov dword [esi + 0x28], ebx
call fcn.004c5f18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp dword [eax - 8], ebx
jne 0x404543
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00403cfa
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.004c5fe3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004c5eaa
push dword [0x4e6cc0]
push dword [ebp + 0xc]
call fcn.004afa15
pop ecx
test eax, eax
pop ecx
jne 0x40455f
lea ecx, [ebp + 0xc]
call fcn.004c5e35
cmp dword [esi + 0x24], ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
jne 0x404599
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push ebx
mov ecx, esi
call fcn.00403e6d
test eax, eax
jne 0x404599
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
mov ecx, esi
call fcn.00403e6d
test eax, eax
je 0x404653
lea eax, [ebp - 0x10]
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push ebx
call fcn.004c62da
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push dword [esi + 0x24]
call edi
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
push 0xffffffffffffffff
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
lea ecx, [ebp + 0xc]
call fcn.004c6329
cmp dword [esi + 0x28], ebx
jl 0x404653
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x4045ef
cmp eax, dword [ebp - 0x18]
je 0x4045ef
mov dword [esi + 0x28], 0x8007000d
cmp dword [esi + 0x28], ebx
jl 0x404653
cmp dword [ebp + 8], ebx
je 0x40465f
cmp dword [ebp - 0x10], ebx
jbe 0x404653
push dword [ebp - 0x10]
call fcn.004c512e
pop ecx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x18]
lea ecx, [ebp + 0xc]
push eax
push ebx
push ebx
call fcn.004c62da
push eax
push dword [esi + 0x24]
call edi
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
push 0xffffffffffffffff
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
lea ecx, [ebp + 0xc]
call fcn.004c6329
cmp dword [esi + 0x28], ebx
jge 0x404653
push dword [ebp - 0x14]
call fcn.004c5157
pop ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40465f
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
pop edi
cmp eax, ebx
je 0x40466c
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x404678
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
cmp dword [esi + 0x28], ebx
lea ecx, [ebp + 0xc]
setge al
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004c5eaa
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x4046a0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4d70f0
call fcn.004aef44
push ecx
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [esi + 0x28], ebx
call fcn.004c5f18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp dword [eax - 8], ebx
jne 0x4046ed
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00403cfa
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004c5fe3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004c5eaa
push dword [0x4e6cc0]
push dword [ebp + 8]
call fcn.004afa15
pop ecx
test eax, eax
pop ecx
jne 0x404709
lea ecx, [ebp + 8]
call fcn.004c5e35
cmp dword [esi + 0x24], ebx
jne 0x404737
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push 1
mov ecx, esi
call fcn.00403e6d
test eax, eax
jne 0x404737
push ebx
push ebx
push ebx
push ebx
push 2
push 1
mov ecx, esi
call fcn.00403e6d
test eax, eax
je 0x404762
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
xor eax, eax
cmp dword [esi + 0x28], ebx
lea ecx, [ebp + 8]
setge al
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004c5eaa
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x40495b
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4d712f
call fcn.004aef44
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [0x51f03c]
mov dword [ebp - 0x10], eax
cmp dword [esi + 0x24], ebx
mov dword [ebp - 4], 1
jne 0x4049b1
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push ebx
call fcn.00403e6d
test eax, eax
jne 0x4049b1
push ebx
push ebx
push ebx
push ebx
push 8
push ebx
mov ecx, esi
call fcn.00403e6d
test eax, eax
je 0x404a50
push edi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
mov eax, 0x12c
push ebx
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004c62da
push eax
push dword [ebp + 0xc]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, 0xffff
mov ecx, eax
and eax, edi
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
and ecx, edi
cmp ecx, 0xea
jne 0x404a3d
push ebx
lea ecx, [ebp - 0x10]
call fcn.004c6329
mov ecx, esi
call fcn.004048cb
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
inc eax
push ebx
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004c62da
push eax
push dword [ebp + 0xc]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, eax
and eax, edi
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x28], ebx
pop edi
jl 0x404a47
push 0xffffffffffffffff
jmp 0x404a48
push ebx
lea ecx, [ebp - 0x10]
call fcn.004c6329
cmp dword [esi + 0x28], ebx
jl 0x404a6a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004c5c1f
mov dword [ebp - 0x18], 1
jmp 0x404a7e
mov ecx, dword [ebp + 8]
push 0x523a30
call fcn.004c5f18
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004c5eaa
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x404a9c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4d715b
call fcn.004aef44
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [0x51f03c]
mov dword [ebp - 0x10], eax
cmp dword [esi + 0x24], ebx
mov dword [ebp - 4], 1
jne 0x404af2
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push ebx
call fcn.00403e6d
test eax, eax
jne 0x404af2
push ebx
push ebx
push ebx
push ebx
push 9
push ebx
mov ecx, esi
call fcn.00403e6d
test eax, eax
je 0x404baf
push edi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
mov eax, 0x12c
push ebx
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004c62da
push eax
push dword [ebp + 0xc]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, 0xffff
mov ecx, eax
and eax, edi
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
and ecx, edi
cmp ecx, 0xea
jne 0x404b7e
push ebx
lea ecx, [ebp - 0x10]
call fcn.004c6329
mov ecx, esi
call fcn.0040492b
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
inc eax
push ebx
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004c62da
push eax
push dword [ebp + 0xc]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, eax
and eax, edi
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
cmp dword [esi + 0x28], ebx
pop edi
jl 0x404ba6
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004c6329
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
jne 0x404baf
push dword [0x4e6cc0]
lea ecx, [ebp - 0x10]
call fcn.004c6033
jmp 0x404baf
push ebx
lea ecx, [ebp - 0x10]
call fcn.004c6329
cmp dword [esi + 0x28], ebx
jl 0x404bc9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004c5c1f
mov dword [ebp - 0x18], 1
jmp 0x404bdd
mov ecx, dword [ebp + 8]
push 0x523a30
call fcn.004c5f18
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004c5eaa
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x405581
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x405597
call fcn.00405611
test eax, eax
je 0x405609
cmp dword [ebp + 0x10], 0
lea edi, [esi + 0xc]
je 0x4055a5
push dword [ebp + 0x10]
jmp 0x4055a8
push dword [ebp + 0xc]
mov ecx, edi
call fcn.004c6033
push 0xf003f
call fcn.004059cf
test eax, eax
pop ecx
je 0x405609
push dword [ebp + 0x34]
mov edi, dword [edi]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 8]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
push dword [0x523a60]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
xor ecx, ecx
mov dword [esi + 4], eax
test eax, eax
setne cl
push ecx
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x405609
push 1
pop eax
jmp 0x40560b
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x30
Function at 0x40566a
Capabilities:
Start service

Disassembly:
push esi
mov esi, ecx
push 0x10
call fcn.00405992
test eax, eax
je 0x40569a
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x40569a
push 1
pop eax
jmp 0x40569c
xor eax, eax
pop esi
ret 8

Function at 0x4056a0
Capabilities:
Pause service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x4056d2
lea eax, [esp + 4]
push eax
push 2
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x4056d2
push 1
pop eax
jmp 0x4056d4
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x4056a3
Capabilities:
Pause service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x4056d2
lea eax, [esp + 4]
push eax
push 2
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x4056d2
push 1
pop eax
jmp 0x4056d4
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x4056d9
Capabilities:
Continue service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x40570b
lea eax, [esp + 4]
push eax
push 3
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x40570b
push 1
pop eax
jmp 0x40570d
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x4056dc
Capabilities:
Continue service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x40
call fcn.00405992
test eax, eax
je 0x40570b
lea eax, [esp + 4]
push eax
push 3
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x40570b
push 1
pop eax
jmp 0x40570d
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x405712
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x20
call fcn.00405992
test eax, eax
je 0x405744
lea eax, [esp + 4]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x405744
push 1
pop eax
jmp 0x405746
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x405715
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push 0x20
call fcn.00405992
test eax, eax
je 0x405744
lea eax, [esp + 4]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
mov ecx, esi
call fcn.00405976
test eax, eax
je 0x405744
push 1
pop eax
jmp 0x405746
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x405a43
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405a78
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov esi, eax
test esi, esi
je 0x405a78
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.004c6033
mov eax, esi
pop esi
leave
ret 4
Function at 0x405a7f
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405abd
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
test esi, esi
je 0x405abd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.004c6033
mov eax, esi
pop esi
leave
ret 4

Function at 0x405c5d
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x4d72d4
call fcn.004aef44
sub esp, 0x2a4
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x405dc0
push str.WS2_32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x405dc0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edi
push str.WSAStartup
push eax
call esi
push str.gethostname
mov edi, eax
push dword [ebp - 0x10]
call esi
push str.gethostbyname
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
call esi
push str.WSACleanup
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
call esi
push str.inet_ntoa
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call esi
cmp edi, ebx
mov dword [ebp - 0x20], eax
je 0x405db1
cmp dword [ebp - 0x1c], ebx
je 0x405db1
cmp dword [ebp - 0x18], ebx
je 0x405db1
cmp dword [ebp - 0x14], ebx
je 0x405db1
cmp eax, ebx
je 0x405db1
lea eax, [ebp - 0x2b0]
push eax
push 0x101
call edi
cmp eax, ebx
jne 0x405db1
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x405d3c
lea eax, [ebp - 0x120]
push 0xff
push eax
call dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x120]
je 0x405dae
push eax
call dword [ebp - 0x18]
mov edi, eax
cmp edi, ebx
je 0x405dae
mov eax, dword [edi + 0xc]
cmp dword [eax], ebx
je 0x405dab
xor esi, esi
mov eax, dword [esi + eax]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
add ecx, edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
shl ecx, 8
add ecx, edx
shl ecx, 8
add ecx, eax
push ecx
call dword [ebp - 0x20]
push eax
lea ecx, [ebp + 0x10]
call fcn.004c5f18
mov edx, dword [ebp + 8]
push eax
mov dword [ebp - 4], ebx
mov ecx, dword [edx + 8]
push ecx
mov ecx, edx
call fcn.004c3dff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004c5eaa
cmp dword [ebp + 0xc], ebx
jne 0x405dab
mov eax, dword [edi + 0xc]
add esi, 4
cmp dword [esi + eax], ebx
jne 0x405d4f
push 1
pop ebx
call dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
mov eax, ebx
pop esi
jmp 0x405dc2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc