joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x405880
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4058bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4058bc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405993
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4058e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4058f0
movsx eax, bl
jmp 0x405928
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x405952
sub eax, 1
je 0x405952
sub eax, 2
jne 0x405993
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405970
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x405993
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407870
mov esp, ebp
pop ebp
ret 4
Function at 0x406100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4061bc
cmp byte [esi + 0x3d], 0
je 0x4061bc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4061aa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x406171
sub eax, 1
je 0x406175
sub eax, 2
jne 0x4061aa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406193
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4061aa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407870
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00407870
mov esp, ebp
pop ebp
ret

Function at 0x4084f2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408531
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408531
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408531
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408531
cmp dword [ecx + 0x74], 0xe
jbe 0x408531
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x410d4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov esi, dword [ebp + 0x1c]
push 0xa
pop ecx
xor eax, eax
push 0xa
mov ebx, dword [ebp + 0x24]
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
pop ecx
mov edx, dword [ebp + 0x18]
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x58]
push eax
push 0x410a1e
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp + 0x28]
push esi
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x410e1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x410df4
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x410dff
mov ebx, 0x80004005
push ebx
push 0x417
push str.elevation.cpp
call fcn.0043166e
push str.Failed_to_create_elevated_cache_thread.
push ebx
call fcn.0042eef6
pop ecx
pop ecx
jmp 0x410e65
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x410acb
push dword [ebp + 0xc]
call fcn.004033fe
mov ebx, eax
cmp ebx, esi
jge 0x410e48
push str.Failed_to_pump_messages_in_child_process.
push ebx
call fcn.0042eef6
pop ecx
pop ecx
jmp 0x410e5e
push edi
call fcn.0040e5ff
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x34
Function at 0x4311b1
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x431274
cmp word [eax], bx
je 0x431274
push ebx
push eax
lea eax, [ebp - 4]
push eax
call fcn.004304a4
mov esi, eax
cmp esi, ebx
jl 0x4312f7
lea eax, [ebp - 4]
push eax
call fcn.0043115c
mov esi, eax
cmp esi, ebx
jl 0x4312f7
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
cmp dword [ebp + 0x10], edi
jb 0x4312eb
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.00430aad
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4312f7
push dword [ebp - 8]
push dword [ebp - 4]
push str._s_s
push ebx
call fcn.00430aad
mov esi, eax
add esp, 0x10
test esi, esi
js 0x4312f7
xor esi, esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4312eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4312cc
inc edi
mov esi, 0x800700b7
cmp edi, dword [ebp + 0x10]
jbe 0x43120c
jmp 0x4312f7
mov edi, 0x104
push edi
lea eax, [ebp - 4]
push eax
call fcn.0042f547
mov esi, eax
cmp esi, ebx
jl 0x4312f7
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4311fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4312af
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x4312ba
mov esi, 0x80004005
push esi
push 0x2cf
push str.pathutil.cpp
call fcn.0043166e
jmp 0x4312f7
cmp eax, 3
jne 0x4312db
push esi
push dword [ebx]
call fcn.004358e5
jmp 0x4312e9
cmp eax, esi
jle 0x4312e9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x4312f7
push ebx
call fcn.0043115c
mov esi, eax
cmp dword [ebp - 8], 0
je 0x431305
push dword [ebp - 8]
call fcn.0042f657
cmp dword [ebp - 4], 0
je 0x431313
push dword [ebp - 4]
call fcn.0042f657
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x402aac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x2c
push 1
mov ebx, 0x1bc
call fcn.004286c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402af8
push ebx
call fcn.00427715
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x402b09
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402b30
push 0x36
push 0x40101bc
push 6
call fcn.00427721
add esp, 0xc
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402b55
mov eax, 0x45c3a6
push eax
push 3
mov ebx, 0x19c
call fcn.004287f0
add esp, 0x28
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, 0x80000101
jne 0x402b89
and eax, 0xff
jmp 0x402bde
cmp ecx, 0x80000201
jne 0x402b94
cwde
jmp 0x402bde
cmp ecx, 0x80000301
je 0x402bde
cmp ecx, 0x80000401
je 0x402bde
mov dword [ebp - 0x1c], eax
cmp ecx, 0x80000501
je 0x402bce
cmp ecx, 0x80000601
je 0x402bd3
push 0x69
push 0x40101bc
push 2
call fcn.00427721
add esp, 0xc
fld dword [ebp - 0x1c]
jmp 0x402bd9
mov dword [ebp - 0x18], edx
fld qword [ebp - 0x1c]
call fcn.00402a85
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
je 0x402bf9
cmp dword [ebp - 8], 9
je 0x402bf9
xor eax, eax
jmp 0x402bfe
mov eax, 1
jmp 0x402c03
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402c14
push ebx
call fcn.00427715
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x403855
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00428b80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40389a
push ebx
call fcn.00427715
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4038b1
mov eax, 0x45c309
push eax
push 1
mov ebx, 0x130
call fcn.00428b20
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4038f7
push 0x73
push 0x401045c
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403925
mov eax, dword [ebp - 4]
test eax, eax
je 0x403920
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.0042770f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40392f
mov eax, 0x45c309
jmp 0x40392f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403940
push ebx
call fcn.00427715
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x40845d
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0xf0000000
push 0x18
push 0x45c309
push 0x45c309
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4084b5
push 0x24
push 0x40103aa
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40851a
mov dword [ebp - 0xc], esp
push 0
push 0x18
push 0x45c309
push 0x45c309
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x408503
push 0x7d
push 0x40103aa
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40851a
mov eax, 0x45c3a6
jmp 0x408593
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004085ab
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40853f
push ebx
call fcn.00427715
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x408574
push 0x120
push 0x40103aa
push 6
call fcn.00427721
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x40858e
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0042770f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x408593
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4085a4
push ebx
call fcn.00427715
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40ce6d
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x1c
call fcn.0042770f
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push closesocket
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40cee0
push 0x19
push 0x4010057
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cfd0
mov dword [ebp - 0x14], esp
push closesocket
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40cf23
push 0x93
push 0x4010057
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40cfa4
mov dword [ebp - 0x14], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40cf5f
push 0x102
push 0x4010057
push 6
call fcn.00427721
add esp, 0xc
test eax, eax
je 0x40cf78
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40cfa4
push 0x150
push 0x4010057
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40cfd0
push 0x16c
push 0x4010057
push 6
call fcn.00427721
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x40cfd8
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00427715
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40d709
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40d75f
push 0x19
push 0x401006b
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d86d
push 0x80000301
push 0
push 0x10000
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 3
mov ebx, 0xc8
call fcn.00428990
add esp, 0x28
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40d7d9
push 0xbe
push 0x401006b
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d841
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40d812
push 0x13d
push 0x401006b
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40d841
push 0x158
push 0x401006b
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40d86d
push 0x174
push 0x401006b
push 6
call fcn.00427721
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x40d875
mov esp, ebp
pop ebp
ret 4
Function at 0x40db64
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40dbba
push 0x19
push 0x4010069
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ddb4
mov dword [ebp - 0x10], esp
push 0xf01ff
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40dbfd
push 0x97
push 0x4010069
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40dd88
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00429860
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00429860
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00429860
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00429860
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00429860
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0xffffffff
push 0xffffffff
push 0xffffffff
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x40dd03
push 0x1c5
push 0x4010069
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40dd16
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40dd26
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40dd36
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40dd46
push ebx
call fcn.00427715
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40dd56
push ebx
call fcn.00427715
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40dd88
push 0x1e3
push 0x4010069
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ddb4
push 0x1ff
push 0x4010069
push 6
call fcn.00427721
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x40ddbc
mov esp, ebp
pop ebp
ret 8
Function at 0x40ddc2
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40de18
push 0x19
push 0x4010066
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40def9
mov dword [ebp - 0x10], esp
push 0x10
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40de5b
push 0x97
push 0x4010066
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40decd
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40de9e
push 0x10d
push 0x4010066
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40decd
push 0x13a
push 0x4010066
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40def9
push 0x156
push 0x4010066
push 6
call fcn.00427721
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x40df01
mov esp, ebp
pop ebp
ret 4
Function at 0x40df07
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x28], 0
mov eax, 0
sete al
test eax, eax
je 0x40df3c
mov eax, 0x10
jmp 0x40df3f
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
test eax, eax
je 0x40df60
mov eax, 3
jmp 0x40df63
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
mov dword [ebp - 0xc], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40df9e
push 0xc7
push 0x4010065
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e0e9
cmp dword [ebp + 0x1c], 0
je 0x40dfe0
push 0x80000301
push 0
push 0x100
push 0x80000301
push 0
push dword [ebp + 0x24]
push 2
mov ebx, 0xc8
call fcn.00428990
add esp, 0x1c
mov dword [ebp + 0x24], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00429860
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x44]
push dword [ebx]
mov ebx, dword [ebp + 0x3c]
push dword [ebx]
mov ebx, dword [ebp + 0x34]
push dword [ebx]
push 0
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 1
push dword [ebp + 0x2c]
push dword [ebp + 0x24]
push 0xf01ff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40e063
push 0x1e0
push 0x4010065
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40e076
push ebx
call fcn.00427715
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e091
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040e100
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e0bd
push 0x275
push 0x4010065
push 6
call fcn.00427721
add esp, 0xc
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e0e9
push 0x28f
push 0x4010065
push 6
call fcn.00427721
add esp, 0xc
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x40e0fa
mov esp, ebp
pop ebp
ret 0x44