joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fbf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x45fc11
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x45fc0a
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x45fc23
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x45fc1c
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0045f7ec
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x45fc3d
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.0045f8fc
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x45fcc2
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x45fcdf
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0045f87c
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x45fd08
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45fd20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x45fd39
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x45fd32
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x45fd4d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0045f6e4
test bl, bl
jne 0x45fe20
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x481bfc
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x45fd84
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x45fd98
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0045fbf8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x45fdca
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x45fd79
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x45fded
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x45fdfe
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x45fe12
jmp 0x45fedb
cmp bl, 1
jne 0x45fedb
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x481c56
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x45fe40
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x45fe54
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0045fbf8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x45fe86
sub ebx, 6
inc dword [ebp - 8]
jne 0x45fe35
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x45fead
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x45febe
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x45fed2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0045f768
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x460554
Capabilities:
Clear file content
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
xor ebx, ebx
push eax
push edx
mov eax, dword [0x481664]
push eax
call sub.kernel32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x460623
push edi
mov eax, dword [0x481664]
push eax
call sub.kernel32.dll_LoadResource
mov ebp, eax
test ebp, ebp
je 0x460623
push ebp
call sub.kernel32.dll_LockResource
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x4605a5
push ebp
call sub.kernel32.dll_FreeResource
jmp 0x460623
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4605d3
mov eax, ebp
call fcn.00407034
push ebp
call sub.kernel32.dll_FreeResource
jmp 0x460623
push edi
mov eax, dword [0x481664]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push 0
lea eax, [esp + 4]
push eax
push edi
mov eax, dword [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp edi, dword [esp]
je 0x460608
mov eax, ebp
call fcn.00407034
push ebp
call sub.kernel32.dll_FreeResource
jmp 0x460623
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebp
call fcn.00407034
push ebp
call sub.kernel32.dll_FreeResource
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4623e0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x462501
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
mov edx, dword [0x480870]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x480870]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x462518
call fcn.00409608
mov eax, dword [ebp - 4]
call fcn.00476a50
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x480668]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [0x480840]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x462534
call fcn.00409608
mov eax, dword [ebp - 0x10]
call fcn.00476a50
call sub.kernel32.dll_GetCurrentThreadId_1
mov esi, eax
push esi
push 0
push 0x4620b0
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x462554
call fcn.00409608
mov eax, dword [ebp - 0x24]
call fcn.00476a50
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x46256c
call fcn.00409608
mov eax, dword [ebp - 0x28]
call fcn.00476a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462508
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404428
lea eax, [ebp - 0x10]
call fcn.00404404
lea eax, [ebp - 4]
call fcn.00404404
ret

Function at 0x468e6c
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x468eba
mov edx, dword [ebx + 0x48]
cmp dword [edx + 0x140], 0
je 0x468eba
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x140]
mov eax, dword [eax + 0x14]
jmp 0x468eca
mov edx, dword [ebx + 0x48]
mov edx, dword [edx + 0x13c]
test edx, edx
je 0x468eca
mov eax, dword [edx + 0x14]
test eax, eax
je 0x468ee3
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.0046690c
jmp 0x468f26
mov edx, dword [edi + 0x10]
mov eax, dword [ebx + 0x34]
call fcn.0041edc4
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x14]
call fcn.0041e5b8
mov esi, eax
mov eax, dword [ebx + 0x48]
mov edx, dword [eax + 0xa8]
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.0041e2e0
mov edx, esp
mov eax, dword [ebx + 0x34]
call fcn.0041eb08
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
mov edx, esi
call fcn.0041e2e0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x46dd34
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, edx
mov ebp, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00455284
mov ebx, eax
mov dx, word [edi + 4]
mov eax, ebp
call fcn.0046dbe0
mov esi, eax
test esi, esi
je 0x46dd81
mov al, byte [0x46dd94]
cmp al, bl
jne 0x46dd81
mov edx, esi
mov eax, ebp
call fcn.0046db88
mov dword [edi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x46dd89
mov edx, edi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x470c04
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.004090f0
add esp, 0x3ec
pop ebx
ret

Function at 0x471fc4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
call fcn.0045035c
mov edi, eax
dec edi
test edi, edi
jl 0x472077
inc edi
xor esi, esi
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045036c
mov eax, dword [eax + 0xc]
sub eax, 1
jb 0x47200e
je 0x47202f
dec eax
je 0x472050
jmp 0x47206f
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045036c
cmp byte [ebx + 0x15c], 0
setne dl
call fcn.00450288
jmp 0x47206f
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045036c
cmp byte [ebx + 0x15c], 1
setne dl
call fcn.00450288
jmp 0x47206f
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045036c
cmp byte [ebx + 0x15c], 2
setne dl
call fcn.00450288
inc esi
dec edi
jne 0x471fef
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x8c]
cdq
cmp edx, dword [esp + 4]
jne 0x47209c
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4720fd
jmp 0x4720a0
pop edx
pop eax
jge 0x4720fd
mov esi, 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x88], eax
mov eax, dword [ebx + 0x130]
test byte [eax + 0x50], 2
je 0x4720d9
cmp byte [ebx + 0x159], 2
je 0x4720d9
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [ebx + 0xec]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x472119
push 0
mov eax, dword [ebx + 0x124]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebx + 0xfc]
push eax
call sub.user32.dll_TrackPopupMenu
jmp 0x472119
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0042b978
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x124]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x47b538
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b682
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x88], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x47b667
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.004090f0
mov dl, 1
mov eax, dword [0x460fb0]
call fcn.00461008
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dl, 1
mov eax, dword [0x41309c]
call fcn.00403628
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00461084
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x47b664
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, 0x47b698
call fcn.004613d0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404710
xor eax, eax
push ebp
push 0x47b65d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xc]
call fcn.004170fc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0047b6a0
mov eax, dword [ebp - 0xc]
call fcn.00408cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b664
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00403658
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00403658
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b689
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404428
ret
Function at 0x402545
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], eax
mov eax, dword [eax + 0x3c]
mov dword [esp + 4], edx
mov edi, dword [ebx + eax + 0x78]
add edi, ebx
mov esi, dword [edi + 0x1c]
add ebx, dword [edi + 0x20]
mov dword [esp + 0xc], esi
mov esi, dword [edi + 0x24]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 8]
mov edi, dword [esp]
add edi, dword [eax + ebp*4]
xor eax, eax
movzx ebx, byte [edi]
test bl, bl
je 0x4025be
add eax, 1
cmp byte [edi + eax], 0
jne 0x402588
lea esi, [edi + 1]
movsx dx, bl
add edi, eax
xor eax, eax
jmp 0x4025ac
movsx dx, byte [esi]
add esi, 1
mov ebx, dword [ecx + 0x128]
movzx edx, dx
imul eax, ebx
add eax, edx
cmp edi, esi
jne 0x4025a5
cmp dword [esp + 4], eax
je 0x4025c9
add ebp, 1
jmp 0x402575
mov ecx, dword [esp]
mov esi, dword [esp + 0x10]
lea eax, [ecx + ebp*2]
movzx eax, word [eax + esi]
mov esi, dword [esp + 0xc]
lea eax, [ecx + eax*4]
add ecx, dword [eax + esi]
add esp, 0x14
pop ebx
pop esi
pop edi
mov eax, ecx
pop ebp
ret
Function at 0x404f00
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x482524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push esi
call fcn.00404ac0
test al, al
je 0x404f4e
cmp byte [0x487a84], 0
jne 0x404f52
push 0x18
push str.Service_is_not_installed
mov ecx, esi
call fcn.00404010
xor al, al
jmp 0x404fb7
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push esi
push ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00404810
mov edi, dword [ebp - 0x34]
test al, al
je 0x404f99
cmp byte [ebp + 8], 1
jne 0x4050a1
cmp dword [0x487a80], 1
je 0x404fd4
push 0x16
push str.Service_is_not_stopped
mov ecx, esi
call fcn.00404010
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x38]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x404fad
push eax
call esi
test edi, edi
je 0x404fb4
push edi
call esi
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438524
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4050f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00404170
mov byte [ebp - 4], 1
mov edx, str.StartService_failed_with_error
push eax
lea ecx, [ebp - 0x50]
call fcn.00406a40
add esp, 4
mov ecx, esi
push eax
call fcn.00402970
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x40504e
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405044
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405102
push edx
push ecx
call fcn.00438535
add esp, 8
mov edx, dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
cmp edx, 8
jb 0x404f99
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405092
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405107
push edx
push ecx
call fcn.00438535
add esp, 8
jmp 0x404f99
cmp dword [0x487a80], 4
je 0x4050b6
push 0x16
push str.Service_is_not_running
jmp 0x404f92
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 0
push eax
xorps xmm0, xmm0
push 1
push edi
movups xmmword [ebp - 0x2c], xmm0
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4050f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00404170
mov byte [ebp - 4], 2
mov edx, str.ControlService_SERVICE_CONTROL_STOP__failed_with_error
push eax
jmp 0x405001
mov byte [ebp - 0x2d], 1
jmp 0x404f9d
call fcn.004447fc
call fcn.004447fc
int3
Function at 0x405840
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f270
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x482524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00404ac0
test al, al
je 0x40588c
cmp byte [0x487a84], 0
jne 0x4058a2
push 0x18
push str.Service_is_not_installed
mov ecx, esi
call fcn.00404010
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x487a80], 1
je 0x4058b3
push esi
push 0
call fcn.00404f00
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push esi
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.00404810
mov edi, dword [ebp - 0x10]
test al, al
je 0x40599d
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4059cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.00404170
push eax
mov edx, str.DeleteService_failed_with_error
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00406a40
add esp, 4
mov ecx, esi
push eax
call fcn.00402970
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x405953
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405949
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059d0
push edx
push ecx
call fcn.00438535
add esp, 8
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x40599d
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405993
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059d5
push edx
push ecx
call fcn.00438535
add esp, 8
xor bl, bl
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x4059af
push eax
call esi
test edi, edi
je 0x4059b6
push edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, 1
jmp 0x40599f
call fcn.004447fc
call fcn.004447fc
int3
Function at 0x406670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x482524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push edi
push eax
push 0
mov dword [ebp - 0x14], 0
call fcn.00405fa0
test al, al
je 0x4067d3
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea ecx, [eax*2 + 2]
jb 0x4066d3
mov esi, dword [esi]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x14], 8
jb 0x4066de
mov eax, dword [eax]
push ecx
push esi
push 1
push 0
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4067d7
mov edx, esi
lea ecx, [ebp - 0x48]
call fcn.00406e30
push eax
mov edx, str.RegQueryValue_failed_with_error
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406a40
mov esi, eax
add esp, 4
cmp edi, esi
je 0x406753
mov ecx, edi
call fcn.004043b0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x406789
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40677f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4067f6
push edx
push ecx
call fcn.00438535
add esp, 8
mov edx, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
cmp edx, 8
jb 0x4067d3
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4067c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4067fb
push edx
push ecx
call fcn.00438535
add esp, 8
xor al, al
jmp 0x4067d9
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438524
mov esp, ebp
pop ebp
ret 0xc
call fcn.004447fc
call fcn.004447fc
int3