joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f529
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push edi
mov byte [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.___dump_memory_leaks_start________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x808]
push eax
mov ecx, 0x4a5170
call fcn.0041f6d0
push eax
lea ecx, [ebp - 0x804]
call fcn.0041f810
jmp 0x41f58a
push 0
lea ecx, [ebp - 0x80c]
push ecx
lea ecx, [ebp - 0x804]
call fcn.0041f850
lea edx, [ebp - 0x810]
push edx
mov ecx, 0x4a5170
call fcn.0041f700
push eax
lea ecx, [ebp - 0x804]
call fcn.0041f880
and eax, 0xff
test eax, eax
je 0x41f612
lea ecx, [ebp - 0x804]
call fcn.0041f830
mov eax, dword [eax]
mov ecx, dword [eax + 0x108]
push ecx
lea ecx, [ebp - 0x804]
call fcn.0041f830
mov edx, dword [eax]
mov eax, dword [edx + 0x104]
push eax
lea ecx, [ebp - 0x804]
call fcn.0041f830
mov ecx, dword [eax]
push ecx
push str.__s__d___threadid:__d__n
push 0x7ff
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x41f576
push str.___dump_memory_leaks_end__________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4263dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x4263f1
cmp dword [ebp + 8], 0xffffffff
jne 0x4263f5
xor eax, eax
jmp 0x426419
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4
Function at 0x426914
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
jne 0x426952
jmp 0x426a2c
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x426985
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x426a2c
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x4269a6
mov dword [ebp - 0x10], 0xe8
jmp 0x426a2c
push 0x2ef
push str.C:Phenix_Headphenix_sources_frames_scrtobjScriptBuffer.cpp
mov edx, dword [ebp - 0xc]
push edx
call fcn.00401244
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4269d4
mov dword [ebp - 0x10], 0xe
jmp 0x426a2c
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426a12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x426a2c
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00425ddd
xor eax, eax
test eax, eax
jne 0x426947
cmp dword [ebp - 0x14], 0xffffffff
je 0x426a3c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x426a6f
cmp dword [ebp - 8], 0
je 0x426a61
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040120d
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x426a6f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x42aefe
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42af45
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42afcb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42b0da
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42b11f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 3
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42b164
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42b1aa
cmp dword [ebp + 0x14], 0
je 0x42b1aa
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42b207
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42b2a3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x42b2c9
mov eax, dword [ebp + 0x14]
push eax
push 0x57
call fcn.0042bb58
add esp, 8
jmp 0x42b313
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42b319
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push edi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
jne 0x42b349
mov eax, dword [ebp + 0x14]
push eax
push 0x57
call fcn.0042bb58
add esp, 8
jmp 0x42b3e7
mov word [ebp - 0x424], 0
mov ecx, 0x104
xor eax, eax
lea edi, [ebp - 0x422]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x424]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0042bb58
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42b4ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x42b515
mov eax, dword [ebp + 0x14]
push eax
push 0x57
call fcn.0042bb58
add esp, 8
jmp 0x42b586
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b56e
cmp dword [ebp + 0xc], 0
je 0x42b56e
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0xc]
jbe 0x42b56e
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
sub eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42b58c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x30]
push eax
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x34]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0x30
Function at 0x42ba6f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42baa4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
call fcn.0042aeb8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 8

Function at 0x42baba
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 8

Function at 0x42c1de
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460915
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea ecx, [ebp - 0x1c]
call fcn.004010eb
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042c92e
add esp, 0xc
test eax, eax
jne 0x42c245
mov eax, dword [ebp + 0xc]
push eax
push 0x57
call fcn.0042bb58
add esp, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401005
mov eax, dword [ebp - 0x28]
jmp 0x42c281
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.0042bb58
add esp, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401005
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42ccca
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 2
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0042bb58
add esp, 8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42e360
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e39b
jmp 0x42e451
push 0xf01ff
mov ecx, dword [ebp - 0x10]
add ecx, 4
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42e3cc
mov dword [ebp - 8], 1
jmp 0x42e451
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x42e3db
jmp 0x42e451
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x28]
sub ecx, 0x110
neg ecx
sbb ecx, ecx
and ecx, 0xfffffef1
add ecx, 0x110
push ecx
push 0xf01ff
mov ecx, dword [ebp - 0x10]
add ecx, 4
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e440
jmp 0x42e451
mov dword [ebp - 8], 1
xor eax, eax
test eax, eax
jne 0x42e37e
cmp dword [ebp - 8], 0
jne 0x42e46e
cmp dword [ebp + 0x10], 0
je 0x42e468
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x42e457
cmp dword [ebp - 4], 0
je 0x42e47e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x42e48d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x24], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42e496
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
jmp 0x42e4b8
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1e
jae 0x42e4ef
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e4da
jmp 0x42e4ef
cmp dword [ebp - 0x1c], 1
jne 0x42e4e2
jmp 0x42e4ef
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42e4af
cmp dword [ebp - 4], 0
jne 0x42e50c
cmp dword [ebp + 8], 0
je 0x42e506
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x42e4f5
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x42e746
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x24], 0
jne 0x42e76c
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.0042e850
test eax, eax
jne 0x42e76c
xor eax, eax
jmp 0x42e7cc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x42e78e
cmp dword [ebp - 0x18], 1
jne 0x42e78e
mov eax, 1
jmp 0x42e7cc
lea edx, [ebp - 0x1c]
push edx
push 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x42e7b3
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.0042e496
jmp 0x42e7cc
cmp dword [ebp + 8], 0
je 0x42e7c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x42e7b3
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4308e9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x430905
mov eax, 1
jmp 0x430a57
mov dword [ebp - 4], 0
push 0x4a1764
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x43092b
jmp 0x430a2e
push 0x4a1770
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x430951
jmp 0x430a2e
push str.NtQueryInformationProcess
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x430977
jmp 0x430a2e
push str.RtlCreateQueryDebugBuffer
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43099d
jmp 0x430a2e
push str.RtlQueryProcessDebugInformation
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x14], 0
jne 0x4309c0
jmp 0x430a2e
push str.RtlDestroyQueryDebugBuffer
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0
jne 0x4309e3
jmp 0x430a2e
push str.NtWow64QueryInformationProcess64
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x20], eax
push str.NtWow64ReadVirtualMemory64
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov dword [ebp - 4], 1
mov edx, dword [ebp - 8]
mov dword [edx + 4], 1
xor eax, eax
test eax, eax
jne 0x43090c
cmp dword [ebp - 4], 0
jne 0x430a54
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x430a54
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x430fb4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x430fec
jmp 0x431053
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x14]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43101a
jmp 0x431053
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x431049
jmp 0x431053
xor edx, edx
test edx, edx
jne 0x430fcb
cmp dword [ebp - 4], 0
jne 0x431070
cmp dword [ebp + 8], 0
je 0x43106a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
test edx, edx
jne 0x431059
cmp dword [ebp - 8], 0
je 0x431080
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4