joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60f7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push edi
mov edi, ecx
push 1
lea ecx, [esp + 0x18]
lea eax, [edi + 0x30]
push eax
call fcn.0045e264
mov eax, dword [edi + 0x24]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0xc], ebx
jle 0x4d135d
push ebp
push esi
mov ecx, dword [edi + 0x20]
mov ebp, dword [ecx + ebx*4]
mov dword [esp + 0x10], ebp
mov edx, dword [ebp + 4]
mov eax, dword [edx - 8]
test eax, eax
je 0x4d134b
lea esi, [edi + 0x15c]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004edeb0
test eax, eax
je 0x4d134b
mov eax, dword [ebp + 4]
push 0
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.004edf00
mov ebx, eax
test ebx, ebx
je 0x4d1334
cmp dword [ebx], 0x4d465631
jne 0x4d1334
mov eax, dword [ebx + 8]
xor esi, esi
test eax, eax
jle 0x4d1334
lea ebp, [ebx + 0x10]
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00476aa0
add esp, 8
test eax, eax
je 0x4d137f
mov eax, dword [ebx + 8]
inc esi
add ebp, 0x58
cmp esi, eax
jl 0x4d1313
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, edi
call fcn.004d1040
lea ecx, [edi + 0x15c]
call fcn.004edee0
mov ebx, dword [esp + 0x14]
mov eax, dword [edi + 0x24]
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jl 0x4d12c2
pop esi
pop ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.0045e2a0
mov ecx, dword [esp + 0x20]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
lea edx, [esi + esi*4]
lea eax, [esi + edx*2]
lea esi, [ebx + eax*8 + 0x10]
test esi, esi
je 0x4d1330
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
push ebx
call fcn.004ba1a0
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov ecx, dword [edi + 0x10]
xor edx, edx
mov dword [esi + 0x48], ecx
mov dx, word [edi + 0xa8]
add esp, 4
lea ecx, [edi + 0x128]
mov dword [esi + 0x4c], edx
call fcn.004d4950
push 0
lea ecx, [edi + 0x15c]
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 0
call fcn.004edf00
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
jmp 0x4d133c
Function at 0x4d2510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x60f9f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebx, [esi + 0x34]
mov dword [esi], 0x629d48
mov dword [ebx], 0x629d2c
mov dword [esp + 0x2c], 6
call dword [0x629d5c]
lea ebp, [esi + 0x58]
push 1
push ebp
lea ecx, [esp + 0x20]
call fcn.0045e264
mov eax, dword [esi + 0x48]
mov byte [esp + 0x2c], 7
test eax, eax
jle 0x4d258e
lea ecx, [esi + 0x3c]
call fcn.005e6d3e
mov edi, eax
test edi, edi
je 0x4d2587
mov ecx, edi
call fcn.004d3200
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, dword [esi + 0x48]
test eax, eax
jg 0x4d256a
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 6
call fcn.0045e2a0
mov eax, esi
mov ecx, dword [esi + 0xd0]
neg eax
sbb eax, eax
and eax, ebx
push eax
call fcn.004d1a70
lea ecx, [esi + 0xac]
mov byte [esp + 0x2c], 5
call fcn.005e6eb5
lea edi, [esi + 0x8c]
mov byte [esp + 0x2c], 4
lea ecx, [edi + 8]
mov dword [edi], 0x620aac
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, edi
call fcn.0045e4a5
lea ecx, [esi + 0x78]
mov byte [esp + 0x2c], 3
call fcn.005e6eb5
lea edx, [ebp + 8]
mov byte [esp + 0x2c], 2
push edx
mov dword [ebp], 0x620aac
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, ebp
call fcn.0045e4a5
lea ecx, [esi + 0x3c]
mov byte [esp + 0x2c], 1
call fcn.005e6c08
mov ecx, esi
mov byte [esp + 0x2c], 0
neg ecx
sbb ecx, ecx
and ecx, ebx
call fcn.004d37c0
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.004d57e0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x4d2f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60fb4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x629d78
mov eax, dword [esi + 0x38]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], 2
je 0x4d2fc4
push eax
call fcn.005ed483
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x30]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esp + 0x14], 1
call fcn.004964f0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], bl
call fcn.004964f0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004d5970
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d3dc0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x60fcb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
push 1
lea ecx, [esp + 0x18]
lea eax, [edi + 0x80]
push eax
call fcn.0045e264
mov eax, dword [esp + 0x30]
xor ebp, ebp
cmp eax, ebp
mov eax, dword [edi + 0x70]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ebp
je 0x4d3eb9
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x4d3e40
lea esi, [edi + 0x64]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.005e7b33
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
cmp dword [esp + 0x30], ebp
jne 0x4d3e1b
mov eax, dword [edi + 0x70]
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x4d3eaf
push ebx
lea ebx, [edi + 0x64]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, ebx
call fcn.005e7b33
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x28]
cmp ecx, ebp
je 0x4d3e79
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, esi
mov dword [esi + 0x24], ebp
call fcn.00491d50
mov ecx, dword [esp + 0x10]
call fcn.00491e00
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
je 0x4d3e9a
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
je 0x4d3ea8
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x34], ebp
jne 0x4d3e53
pop ebx
lea ecx, [edi + 0x64]
call fcn.005e7960
jmp 0x4d3f31
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x4d3f31
lea esi, [edi + 0x64]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.005e7b33
mov ecx, dword [esp + 0xc]
call fcn.00491e80
test eax, eax
jne 0x4d3f2b
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x20], ebp
jne 0x4d3f2b
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4d3f11
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ecx, ebp
je 0x4d3f23
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.005e7af1
cmp dword [esp + 0x30], ebp
jne 0x4d3ec8
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.0045e2a0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x4d41aa
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x60fd38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x20]
mov dword [esp + 0x10], edi
cmp eax, edi
jne 0x4d41c2
xor eax, eax
jmp 0x4d4286
lea eax, [esi + 0x80]
push 1
push eax
lea ecx, [esp + 0x2c]
call fcn.0045e264
mov eax, dword [esi + 0x70]
mov ebx, dword [esp + 0x40]
neg eax
sbb eax, eax
mov dword [esp + 0x38], edi
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x4d4239
lea ebp, [esi + 0x64]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebp
mov dword [esp + 0x4c], edi
call fcn.005e7b33
mov ecx, dword [esp + 0x40]
cmp dword [ecx + 0x24], edi
je 0x4d4233
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], edi
mov edx, dword [ecx]
lea eax, [esp + 0x24]
push eax
call dword [edx + 0x1c]
cmp bx, word [esp + 0x14]
je 0x4d429b
cmp dword [esp + 0x18], edi
jne 0x4d41ee
push ebx
mov ecx, esi
call fcn.004d40c0
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x4d4271
lea edx, [esp + 0x1c]
lea ecx, [esi + 0x64]
push edx
push eax
mov dword [esp + 0x24], edi
call fcn.005e7a7f
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4d426d
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
mov esi, eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045e2a0
mov eax, esi
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 0x40]
add ecx, 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [esp + 0x10]
jmp 0x4d4273

Function at 0x4d6080
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x60ff5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x62910c]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00480d50
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.00483030
mov ecx, dword [eax]
push 0x66af18
push ecx
call fcn.0046638c
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.00480a70
test edi, edi
je 0x4d6100
push 0x66af18
mov ecx, esi
call fcn.004816b0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x4d6260
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x60ff9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x62910c]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00480d50
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.00483030
mov ecx, dword [eax]
push 0x66af18
push ecx
call fcn.0046638c
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.00480a70
test edi, edi
je 0x4d62e0
push 0x66af18
mov ecx, esi
call fcn.004816b0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x4d7d70
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x6a4664]
test eax, eax
jne 0x4d7e5c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x6a4400
mov dword [0x6a4664], 1
mov dword [0x6a4400], 0x114
call esi
mov edx, dword [0x6a4410]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x689aa0], eax
je 0x4d7e3e
push edi
push 0x6a4518
mov dword [0x6a4518], 0x11c
call esi
push 0x6823d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x6a465c], eax
call edi
mov dword [0x6a4660], eax
mov eax, dword [0x6a465c]
pop edi
test eax, eax
push 0x6a4638
je 0x4d7e0c
call eax
jmp 0x4d7e12
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x6a451c]
cmp eax, 6
jae 0x4d7e2a
cmp eax, 5
jne 0x4d7e3e
cmp dword [0x6a4520], 2
jb 0x4d7e3e
cmp word [0x6a4638], 9
jne 0x4d7e3e
mov dword [0x6a43f4], 1
push 0x6a4408
push 0x6a4404
call fcn.004d8190
add esp, 8
call fcn.004d7e70
mov eax, 1
pop esi
ret
mov eax, 1
ret

Function at 0x4d8e90
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629e50
push 0x466254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x6a4668]
xor ebx, ebx
cmp eax, ebx
jne 0x4d8ff0
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4d8feb
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x66b78c
lea edx, [ebp - 0x42c]
push edx
call fcn.00466dce
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.005ed45a
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x4d8feb
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4d8fe2
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4d8fe2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x6a4668], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x4d8fe2
push esi
call fcn.005ed483
add esp, 4
mov eax, dword [0x6a4668]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d9660
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6103a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x682534]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x682534]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x682534]
mov dword [esi + 0x20], edx
mov eax, dword [0x682534]
mov dword [esi + 0x24], eax
mov ecx, dword [0x682534]
mov dword [esi + 0x28], ecx
mov edx, dword [0x682534]
mov dword [esi + 0x2c], edx
mov eax, dword [0x682534]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.005e65fe
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 7
call fcn.005e65fe
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x629e5c
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.005ecf28
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4d9810
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x610483
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x682534]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x682534]
mov dword [esp + 0x18], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x682534]
mov dword [esi + 0x20], edx
mov eax, dword [0x682534]
mov dword [esi + 0x24], eax
mov ecx, dword [0x682534]
lea ebx, [esi + 0x28]
mov dword [ebx], ecx
mov edx, dword [0x682534]
mov dword [esi + 0x2c], edx
mov eax, dword [0x682534]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 6
call fcn.005e65fe
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 7
call fcn.005e65fe
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x10], ecx
push edx
mov ecx, edi
mov byte [esp + 0x1c], 8
mov dword [esi], 0x629e5c
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x14], 1
call fcn.005ecf28
mov eax, dword [esp + 0x28]
mov ecx, ebx
push eax
call fcn.005ecf28
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x4db1b0
Capabilities:
Delete service

Disassembly:
sub esp, 0x20
push edi
call fcn.004d8310
test eax, eax
je 0x4db1ce
mov dword [0x6a4674], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x4db1e9
mov dword [0x6a4674], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
push esi
push 0xf003f
push edi
push edi
mov dword [0x6a4674], edi
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x4db21e
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x4db226
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp esi, edi
je 0x4db24b
mov eax, dword [esp + 0x34]
push 0xf01ff
push eax
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x4db29e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x4db2b8
jne 0x4db29e
test esi, esi
jne 0x4db283
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x4db277
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x4db27f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x4db29e
mov ecx, dword [esp + 0x34]
push 0xf01ff
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x4db29e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebp, eax
test ebp, ebp
jne 0x4db2dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6a4674], eax
jmp 0x4db2bc
mov ebp, dword [esp + 0x10]
mov eax, dword [0x6a4674]
test eax, eax
jne 0x4db2dc
test ebx, ebx
je 0x4db2d1
mov dword [0x6a4674], ebx
jmp 0x4db2dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6a4674], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4db2e9
push edi
call ebx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4db2f8
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test esi, esi
je 0x4db2ff
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x4db310
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.004d8310
test eax, eax
je 0x4db32e
mov dword [0x6a4674], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x4db349
mov dword [0x6a4674], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push esi
push 2
push edi
push edi
mov dword [0x6a4674], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x4db378
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
je 0x4db39a
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4db3d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x4db40f
jne 0x4db3d8
test esi, esi
jne 0x4db3be
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x4db3be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x4db3d8
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4db3d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
jne 0x4db42f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x6a4674], eax
jne 0x4db418
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x4db42f
mov eax, dword [0x6a4674]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x4db42f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4db42a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6a4674], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4db43c
push edi
call ebx
test esi, esi
je 0x4db443
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x4db650
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.004d8310
test eax, eax
je 0x4db66c
mov dword [0x6a4674], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x6a4674], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebp
jne 0x4db6ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x4db6c9
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4db703
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x4db71f
jne 0x4db703
test esi, esi
jne 0x4db6ed
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4db6ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4db703
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4db703
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x4db73c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4db723
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x4db72f
mov dword [0x6a4674], ebx
jmp 0x4db746
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6a4674], eax
jmp 0x4db746
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4db753
push edi
call ebx
test esi, esi
je 0x4db75a
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret