joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487714
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x487740
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040479c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x487765
call fcn.0040e234
xor eax, eax
push ebp
push 0x48779c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x487785
call fcn.0040e234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4877a3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x48adb0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48adde
mov eax, ebx
call fcn.0048b864
cmp dword [ebx + 0x40], 0
je 0x48add7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48ae4f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48ae41
cmp dword [ebx + 8], 0
je 0x48ae00
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48ae12
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48ae41
cmp dword [ebx + 8], 0
je 0x48adf3
cmp eax, 3
je 0x48ae25
dec eax
jne 0x48adf3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48adf3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48adf3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48ae6d
cmp dword [ebx + 0x14], 0xcc
je 0x48ae6d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048ae78
pop ebx
ret

Function at 0x49b5e4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x49b6b5
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x49b66e
dec ecx
jne 0x49b6b0
cmp eax, 4
jg 0x49b624
mov eax, 4
jmp 0x49b6b8
cmp eax, 5
jne 0x49b637
test edx, edx
jne 0x49b637
mov eax, 5
jmp 0x49b6b8
cmp eax, 5
jne 0x49b648
cmp edx, 1
jne 0x49b648
mov eax, 6
jmp 0x49b6b8
cmp eax, 5
jne 0x49b659
cmp edx, 2
jne 0x49b659
mov eax, 7
jmp 0x49b6b8
cmp eax, 6
jne 0x49b669
test edx, edx
jne 0x49b669
mov eax, 8
jmp 0x49b6b8
or eax, 0xffffffff
jmp 0x49b6b8
cmp eax, 4
jne 0x49b67b
test edx, edx
jne 0x49b67b
xor eax, eax
jmp 0x49b6b8
cmp eax, 4
jne 0x49b69a
cmp edx, 0xa
jne 0x49b69a
cmp byte [esp + 0x15], 0x41
jne 0x49b693
mov eax, 2
jmp 0x49b6b8
mov eax, 1
jmp 0x49b6b8
cmp eax, 4
jne 0x49b6ab
cmp edx, 0x5a
jne 0x49b6ab
mov eax, 3
jmp 0x49b6b8
or eax, 0xffffffff
jmp 0x49b6b8
or eax, 0xffffffff
jmp 0x49b6b8
or eax, 0xffffffff
add esp, 0x94
ret
Function at 0x49bbd4
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
xor ebx, ebx
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov eax, 2
mov edx, eax
cmp edx, 0x1f
ja 0x49bbee
bt esi, edx
jb 0x49bbf3
lea ebx, [eax + 0x41]
inc eax
cmp eax, 0x1a
jne 0x49bbe4
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x49be94
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49bf7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404364
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00408b98
cmp dword [ebp - 0x44], 0
je 0x49bf5c
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402eb0
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, 0x49bf8c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.0040479c
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x49bf5c
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
call fcn.004096b4
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00408928
mov eax, dword [ebp - 0x48]
mov edx, 0x49bf9c
call fcn.004046e8
jne 0x49bf5c
push 1
push 0x49bfa4
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bf86
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.004042f0
lea eax, [ebp - 4]
call fcn.004042cc
ret

Function at 0x49c0c0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043bc
mov eax, dword [esi]
call fcn.0040459c
cmp eax, 1
jle 0x49c11e
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x5c
je 0x49c10d
test bl, bl
je 0x49c11e
mov eax, esi
mov edx, 0x49c130
call fcn.004045a4
jmp 0x49c11e
test bl, bl
jne 0x49c11e
mov edx, esi
mov ecx, 1
xchg edx, eax
call fcn.0040483c
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x49c134
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043bc
mov eax, dword [esi]
call fcn.0040459c
cmp eax, 1
jle 0x49c192
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x5c
je 0x49c181
test bl, bl
je 0x49c192
mov eax, esi
mov edx, 0x49c1a4
call fcn.004045a4
jmp 0x49c192
test bl, bl
jne 0x49c192
mov edx, esi
mov ecx, 1
xchg edx, eax
call fcn.0040483c
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x49c1a8
Capabilities:
Get file size

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
push 0
push 0x80
push 3
push 0
push 7
push 0x80
mov eax, ebx
call fcn.0040479c
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x49c215
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 8]
xor edx, edx
mov edx, eax
xor eax, eax
or eax, dword [esp]
or edx, dword [esp + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop ebx
ret

Function at 0x49c224
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, eax
xor ebx, ebx
push esi
call sub.kernel32.dll_GetFileAttributesA
test ah, 8
je 0x49c2b2
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49c2a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 2
lea eax, [ebp - 6]
push eax
push 0x9c040
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x49c290
call fcn.00403d30
jmp 0x49c2b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c2ae
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov bl, 1
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49c45c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040478c
xor eax, eax
push ebp
push 0x49c4a1
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.0040479c
push eax
call sub.kernel32.dll_MoveFileExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c4a8
lea eax, [ebp - 4]
call fcn.004042cc
ret

Function at 0x49c5c0
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov byte [esp], 0
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov eax, 2
mov edx, eax
cmp edx, 0x1f
ja 0x49c5df
bt esi, edx
jb 0x49c5ee
lea edx, [eax + 0x41]
cmp bl, dl
jne 0x49c5ee
mov byte [esp], 1
jmp 0x49c5f4
inc eax
cmp eax, 0x1a
jne 0x49c5d5
mov al, byte [esp]
pop edx
pop esi
pop ebx
ret
Function at 0x49c5fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49c7ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor eax, eax
push ebp
push 0x49c784
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
mov dl, 1
mov eax, dword [0x438c0c]
call fcn.00438d78
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x49c773
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.00438e54
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00438f98
test al, al
je 0x49c75d
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.0040479c
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x49c75d
cmp dword [ebp - 8], 7
jne 0x49c72c
mov eax, dword [ebp - 0xc]
call fcn.004027f4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49c725
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0x10]
jmp 0x49c70a
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004044d4
mov edx, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x49c6ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c75d
mov eax, dword [ebp - 0x10]
call fcn.00402814
ret
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x20]
call fcn.0040c2ec
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x49c7c8
call fcn.004045e8
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x438bac]
call fcn.0040cb24
call fcn.00403c84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c77a
mov eax, dword [ebp - 0x14]
call fcn.004034b8
ret
Function at 0x49c8b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x808], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49ca2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x804]
xor ecx, ecx
mov edx, 0x800
call fcn.00402eb0
mov eax, ebx
call fcn.0040479c
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push 0x49ca3c
mov eax, dword [ebp - 4]
call fcn.0040479c
push eax
push 0x49ca40
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x804]
mov eax, esi
call fcn.004043bc
mov eax, dword [esi]
mov edx, 0x49ca50
call fcn.004046e8
jne 0x49c969
lea eax, [ebp - 0x808]
mov ecx, dword [ebp - 4]
mov edx, 0x49ca5c
call fcn.004045e8
mov ecx, dword [ebp - 0x808]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb24
call fcn.00403c84
mov edx, dword [esi]
mov ecx, 1
mov eax, 0x49ca7c
call fcn.00436334
mov ebx, eax
test ebx, ebx
jle 0x49ca0f
mov eax, dword [esi]
call fcn.0040459c
cmp ebx, eax
jne 0x49c9af
lea eax, [ebp - 0x80c]
mov ecx, dword [ebp - 4]
mov edx, 0x49ca88
call fcn.004045e8
mov eax, dword [ebp - 0x80c]
call fcn.0049bbb0
jmp 0x49ca0f
mov eax, dword [esi]
mov al, byte [eax + ebx]
cmp al, 0x64
je 0x49c9f6
cmp al, 0x73
je 0x49c9f6
cmp al, 0x6e
je 0x49c9f6
cmp al, 0x44
je 0x49c9f6
cmp al, 0x53
je 0x49c9f6
cmp al, 0x4e
je 0x49c9f6
mov edx, 0x49ca88
lea eax, [ebp - 0x810]
mov ecx, dword [ebp - 4]
call fcn.004045e8
mov ecx, dword [ebp - 0x810]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb24
call fcn.00403c84
lea ecx, [ebx + 1]
mov edx, dword [esi]
mov eax, 0x49ca7c
call fcn.00436334
mov ebx, eax
test ebx, ebx
jg 0x49c984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ca34
lea eax, [ebp - 0x810]
mov edx, 3
call fcn.004042f0
ret
Function at 0x4a2cb8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov ebx, eax
mov ax, word [edx]
mov word [esp + 4], ax
mov ax, word [edx + 2]
mov word [esp + 6], ax
mov ax, word [edx + 4]
mov word [esp + 8], ax
mov ax, word [edx + 6]
mov word [esp + 0xa], ax
mov esi, 8
lea eax, [esp + 4]
mov dx, word [ebx]
call fcn.004a28d0
add ebx, 2
mov ax, word [ebx]
add word [esp + 6], ax
add ebx, 2
mov ax, word [ebx]
add word [esp + 8], ax
add ebx, 2
lea eax, [esp + 0xa]
mov dx, word [ebx]
call fcn.004a28d0
add ebx, 2
mov bp, word [esp + 8]
mov ax, word [esp + 4]
xor word [esp + 8], ax
lea eax, [esp + 8]
mov dx, word [ebx]
call fcn.004a28d0
add ebx, 2
mov di, word [esp + 6]
mov ax, word [esp + 0xa]
xor word [esp + 6], ax
mov ax, word [esp + 8]
add word [esp + 6], ax
lea eax, [esp + 6]
mov dx, word [ebx]
call fcn.004a28d0
add ebx, 2
mov ax, word [esp + 6]
add word [esp + 8], ax
mov ax, word [esp + 6]
xor word [esp + 4], ax
mov ax, word [esp + 8]
xor word [esp + 0xa], ax
xor word [esp + 6], bp
xor word [esp + 8], di
dec esi
test esi, esi
jne 0x4a2cec
lea eax, [esp + 4]
mov dx, word [ebx]
call fcn.004a28d0
add ebx, 2
mov ax, word [ebx]
add word [esp + 8], ax
add ebx, 2
mov ax, word [ebx]
add word [esp + 6], ax
add ebx, 2
lea eax, [esp + 0xa]
mov dx, word [ebx]
call fcn.004a28d0
mov eax, dword [esp]
mov dx, word [esp + 4]
mov word [eax], dx
mov eax, dword [esp]
mov dx, word [esp + 8]
mov word [eax + 2], dx
mov eax, dword [esp]
mov dx, word [esp + 6]
mov word [eax + 4], dx
mov eax, dword [esp]
mov dx, word [esp + 0xa]
mov word [eax + 6], dx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a3324
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
push ecx
shr ecx, 2
je 0x4a333e
cld
mov eax, dword [edi]
xor dword [esi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x4a3331
pop ecx
and ecx, 3
je 0x4a334d
mov al, byte [edi]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x4a3344
pop edi
pop esi
ret
Function at 0x4a3350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov esi, 0x4e8b0c
mov edx, dword [esp + 0xc]
xor eax, eax
mov al, byte [esp + 8]
mov ebx, eax
add ebx, ebx
lea ebx, [ebx + ebx*2]
mov eax, dword [esi + ebx*8]
mov ecx, dword [esp]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esi + ebx*8 + 4]
mov edi, dword [esp]
mov eax, dword [edi + eax*4]
mov ebx, dword [esi + ebx*8 + 8]
mov edi, dword [esp]
mov ebx, dword [edi + ebx*4]
add edx, ebx
add ebx, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add eax, ecx
add ecx, eax
mov edi, eax
shr edi, 0x11
xor eax, edi
add ebx, eax
add eax, ebx
mov edi, ebx
shl edi, 9
xor ebx, edi
add edx, ebx
add ebx, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
mov edx, ecx
shl edx, 7
xor ecx, edx
add eax, ecx
mov edx, ebx
shr edx, 0xf
xor eax, edx
add ebx, eax
mov eax, ebx
shl eax, 0xb
xor ebx, eax
mov eax, dword [esp + 0x10]
xor eax, ebx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
add esi, 0xc
dec dword [esp + 0x14]
jne 0x4a3383
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x4a3a84
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x4a3ca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor eax, eax
push ebp
push 0x4a3c7a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a3c69
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a3b31
mov eax, 0x4a3cc0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x40]
call fcn.0040c2ec
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [0x4e97f0]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
push 0xf0015
push 0x4a3cc8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a3b8f
mov eax, 0x4a3cc0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x44]
call fcn.0040c2ec
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [0x4e9bc8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4a3be2
mov eax, 0x4a3cc0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x48]
call fcn.0040c2ec
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [0x4e94f4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
cmp dword [ebp - 0x28], 4
je 0x4a3c3d
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x4a3c3d
mov eax, 0x4a3cc0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x4c]
call fcn.0040c2ec
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [0x4e99fc]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3c70
cmp dword [ebp - 8], 0
je 0x4a3c59
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0xc], 0
je 0x4a3c68
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4a3cd0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4a3df9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e8b6c], 0xffffffff
je 0x4a3cfc
mov bl, 1
jmp 0x4a3de3
push 0
push 0
push 3
push 0
push 0
push 0
push 0x4a3e0c
call sub.kernel32.dll_CreateFileA
mov dword [0x4e8b6c], eax
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp dword [0x4e8b6c], 0xffffffff
jne 0x4a3d99
call fcn.0049bb80
test al, al
jne 0x4a3d99
xor edi, edi
push 4
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x4a3d85
push 4
push 0x4a3e18
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x4a3d85
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4a3d85
cmp dword [ebp - 0x18], 4
je 0x4a3d85
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jae 0x4a3d85
push 0x7d0
call sub.kernel32.dll_Sleep_1
jmp 0x4a3cfc
test edi, edi
je 0x4a3d8f
push edi
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
je 0x4a3d99
push esi
call sub.advapi32.dll_CloseServiceHandle
cmp dword [0x4e8b6c], 0xffffffff
jne 0x4a3de1
mov eax, 0x4a3e28
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0040c2ec
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea eax, [ebp - 0x2c]
push eax
push 1
mov ecx, dword [0x4e983c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3e00
lea eax, [ebp - 0x30]
call fcn.004042cc
ret
Function at 0x4a4658
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a48d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a4869
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov al, 1
call fcn.0049c134
push dword [ebp - 0x14]
push 0x4a48f0
push 0x4a4904
push 0x4a4914
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040465c
mov eax, dword [ebp - 0x10]
call fcn.0040479c
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004044d4
mov ecx, dword [ebp - 0xc]
mov edx, 0x4a4924
mov eax, 0x4a4930
call fcn.0049bfd4
test al, al
jne 0x4a471d
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x20]
call fcn.0040c2ec
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x4e9a38]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
test bl, bl
je 0x4a4728
mov ebx, 3
jmp 0x4a472a
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a4856
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a479b
mov eax, 0x4a4904
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x34]
call fcn.0040c2ec
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea eax, [ebp - 0x30]
push eax
push 1
mov ecx, dword [0x4e97f0]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040479c
push eax
push 1
push ebx
push 1
push 0xf01ff
push 0x4a4938
push 0x4a4938
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp dword [ebp - 8], 0
jne 0x4a482a
cmp ebx, 0x420
je 0x4a482a
cmp ebx, 0x431
je 0x4a482a
mov eax, 0x4a4904
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0040c2ec
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea eax, [ebp - 0x30]
push eax
push 1
mov ecx, dword [0x4e9b7c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a485d
cmp dword [ebp - 8], 0
je 0x4a4846
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 4], 0
je 0x4a4855
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret