joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c89b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x224], esi
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
push dword [eax + 4]
call fcn.0046ee40
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push edi
mov dword [eax + 4], eax
mov eax, dword [esi]
push edi
mov dword [ebp - 0x21c], 0x104
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [esi + 4], 0
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44e7c3
jmp 0x44e710
push dword [0x4bc124]
lea eax, [ebp - 0x218]
push 0x4a4424
push eax
call fcn.00471574
add esp, 0xc
test eax, eax
jne 0x44e792
mov eax, dword [0x4bc124]
lea esi, [ebp - 0x218]
lea esi, [esi + eax*2]
push esi
call fcn.0046b670
push eax
push esi
call fcn.0046b800
add esp, 0xc
mov dword [ebp - 0x220], eax
movzx eax, byte [0x4bebdf]
mov ecx, dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.0041ce00
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x44e792
call fcn.0046b840
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x44e710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret 4

Function at 0x453c40
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4bec00]
test eax, eax
je 0x453c6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4bec00], 0
push dword [0x4bde3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
call fcn.0043af40
add esp, 8
cmp byte [0x4bdfb4], 0
jne 0x453cef
push 0x38
lea eax, [ebp - 0x244]
mov dword [ebp - 0x24c], 0x40
push 0
push eax
mov dword [ebp - 0x248], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push str.Out_of_memory:_Unable_to_allocate_a_memory_block_of_size__Iu
push eax
call fcn.00401fc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x10
push 0x49794c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x465240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4c3434], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x464d50
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x464ff0
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.00464d00
jne 0x4653c2
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4653b8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474e85
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474eda
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x465318
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x46536d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474e85
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474eda
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4653b5
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x46536d
push edi
call esi
jmp 0x4653b5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x4653ae
inc esi
cmp esi, 3
jl 0x465370
mov eax, dword [ebp - 0x22c]
mov dword [0x4bc19c], eax
mov eax, dword [ebp - 0x224]
mov dword [0x4bc1a4], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00464d00], eax
jmp 0x4653b5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x4c3434], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
mov eax, dword [eax*8 + 0x4bc19c]
call fcn.00470e77
mov esp, ebp
pop ebp
ret 4
Function at 0x469440
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov esi, dword [edi + 0x3d8]
neg eax
mov ecx, dword [edi + 0x3dc]
cdq
and edx, dword [edi + 0x26c]
mov ebx, eax
and ebx, dword [edi + 0x268]
sub esi, ebx
mov dword [ebp - 4], ecx
push esi
push ebx
push edx
push 4
push dword [edi + 0x3d0]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [edi + 0x560], ecx
test ecx, ecx
jne 0x4694a6
mov dword [edi + 0x564], eax
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x268]
sub ecx, ebx
add eax, ecx
lea ecx, [edi + 0x4fc]
push eax
mov dword [edi + 0x564], eax
call fcn.00443430
mov eax, dword [edi + 0x270]
lea ecx, [edi + 0x4c8]
sub eax, dword [edi + 0x268]
add eax, dword [edi + 0x564]
push eax
call fcn.0040dcc0
mov eax, dword [edi + 0x278]
lea ecx, [edi + 0x52c]
sub eax, dword [edi + 0x268]
add eax, dword [edi + 0x564]
push eax
call fcn.0042e060
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46d400
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x4c36e8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4c3678], esi
je 0x46d479
cmp dword [0x4c3684], esi
je 0x46d479
push 0x12237
call dword [0x4c368c]
push esi
push esi
push edi
call dword [0x4c3678]
cmp dword [0x4c36d0], 0
mov esi, eax
je 0x46d479
push 0x400
lea eax, [ebp - 0x804]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x804]
push eax
push edi
call dword [0x4c36d0]
push 0x4c36e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x46d4a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
xor bl, bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.00471b44
add esp, 4
mov dword [ebp - 4], eax
push eax
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
mov eax, dword [ebp - 4]
je 0x46d4f0
cmp dword [eax + 0x30], 0x60000
mov ecx, 1
movzx ebx, bl
cmovae ebx, ecx
push eax
call fcn.00471b0c
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x481f06
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00479aab
mov dword [ebp - 0x14], eax
cmp dword [0x4c4690], esi
jne 0x481ff9
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x481f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4820d9
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4820d9
push 0x4b01f4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4820d9
push eax
call ebx
push 0x4b0200
push edi
mov dword [0x4c4690], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4c4694], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c4698], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c46a0], eax
test eax, eax
je 0x481ff6
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c469c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x48201e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x482011
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x482033
push 4
pop eax
jmp 0x4820db
cmp dword [ebp - 0x14], esi
je 0x482033
push dword [0x4c4690]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x482018
mov eax, dword [0x4c469c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x482091
cmp dword [0x4c46a0], edi
je 0x482091
push eax
call ebx
push dword [0x4c46a0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x482091
test eax, eax
je 0x482091
call ecx
test eax, eax
je 0x482086
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x482086
test byte [ebp - 8], 1
jne 0x482091
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4820c1
mov eax, dword [0x4c4694]
cmp eax, edi
je 0x4820be
push eax
call ebx
test eax, eax
je 0x4820be
call eax
mov esi, eax
test esi, esi
je 0x4820be
mov eax, dword [0x4c4698]
cmp eax, edi
je 0x4820be
push eax
call ebx
test eax, eax
je 0x4820be
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c4690]
call ebx
test eax, eax
je 0x4820d9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4820db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470e77
mov esp, ebp
pop ebp
ret
Function at 0x401520
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.softwareSafeNet_SentinelSentinelProtectionServer
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401590
lea ecx, [esp + 8]
push esi
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.HTTPPort
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test esi, esi
pop esi
je 0x401595
mov eax, 0x1772
add esp, 0x10
ret
Function at 0x401d10
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
mov eax, 0x17dc
call fcn.0041f960
push ebx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x255]
mov byte [esp + 0x254], bl
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x50], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x454], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x455]
mov byte [esp + 0x7e4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x7e5]
mov byte [esp + 0x150], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x151]
mov edx, dword [0x42c030]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x654]
mov dword [esp + 8], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x150]
push eax
push ecx
push edx
mov dword [esp + 0x18], 0x104
call sub.WSOCK32.dll_accept
mov edi, eax
cmp edi, 0xffffffff
je 0x401f15
push ebx
lea eax, [esp + 0x7e8]
push 0x1000
push eax
push edi
call sub.WSOCK32.dll_recv
cmp byte [esp + 0x7e4], 0x23
jne 0x401e59
cmp dword [0x430438], 1
jne 0x401f0f
lea ecx, [esp + 8]
lea edx, [esp + 0x654]
push ecx
lea eax, [esp + 0x7e8]
push edx
push eax
call fcn.0040ccf0
mov ecx, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0x654]
push ebx
push ecx
push edx
push edi
call sub.WSOCK32.dll_send
push edi
call sub.WSOCK32.dll_closesocket
pop edi
pop ebx
add esp, 0x17dc
ret
lea eax, [esp + 0x7e4]
push str.shutdown
push eax
call fcn.00424ee0
add esp, 8
test eax, eax
je 0x401f0f
lea ecx, [esp + 0x254]
push esi
push ecx
lea edx, [esp + 0x7ec]
push str.___n_
push edx
call fcn.0041edb0
lea eax, [esp + 0x60]
lea ecx, [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x26c]
push str._s___
push edx
call fcn.0041edb0
lea eax, [esp + 0x474]
lea ecx, [esp + 0x70]
push eax
push str.______HTTP_
push ecx
call fcn.0041edb0
add esp, 0x28
mov esi, 0x42c220
lea eax, [esp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401ef4
cmp cl, bl
je 0x401ef0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401ef4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401ed0
xor eax, eax
jmp 0x401ef9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
pop esi
jne 0x401f0f
lea eax, [esp + 0x454]
push edi
push eax
call fcn.004015a0
add esp, 8
push edi
call sub.WSOCK32.dll_closesocket
pop edi
pop ebx
add esp, 0x17dc
ret
Function at 0x402a70
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [esp + 0x108]
mov eax, ebx
push esi
and eax, 0xc0000000
push edi
cmp eax, 0x40000000
jne 0x402a95
mov edi, 4
jmp 0x402aa6
cmp eax, 0x80000000
mov edi, 2
je 0x402aa6
mov edi, 1
mov eax, dword [0x42ffbc]
test eax, eax
jne 0x402b12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.SentinelProtectionServer
push 0
mov dword [0x42ffb8], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [0x42ffb8]
push eax
push str.SentinelProtectionServer
lea ecx, [esp + 0x14]
push str._s_error:__d
push ecx
call fcn.0041ecde
add esp, 0x10
test esi, esi
je 0x402b12
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push 0
push edx
push 0
push eax
push 0
push ebx
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x402d90
Capabilities:
Get session user name

Disassembly:
sub esp, 0x124
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
mov byte [esp + 0xc], 0
mov dword [esp + 8], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call fcn.0041b540
lea edx, [esp + 0x44]
push edx
push 0
push eax
lea eax, [esp + 0x10]
push eax
push 0x43c880
push 0
push 0
push 6
call fcn.00410a90
lea ecx, [esp + 0x64]
push ecx
call fcn.0041bdc0
push 1
call fcn.0041b410
push 2
call fcn.0041b410
add esp, 0x2c
call fcn.0040e380
call fcn.0040f570
call fcn.0040f6e0
call fcn.0040f510
call fcn.004029a0
call fcn.004024f0
mov eax, dword [0x43c9fc]
test eax, eax
je 0x402e1e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x42fe10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
add esp, 0x124
ret
Function at 0x4033c0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x20
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
push 0xf01ff
push str.SentinelProtectionServer
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40347f
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x403462
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
xor edi, edi
cmp edi, 5
jge 0x403440
push 0x3e8
call ebp
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40343b
cmp dword [esp + 0x18], 1
jne 0x40343b
mov ebx, 1
inc edi
test ebx, ebx
je 0x403413
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 1
pop ebx
je 0x40345e
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
mov edi, dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40347f
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x20
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
Function at 0x404840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x178
xor ecx, ecx
xor eax, eax
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
push esi
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov ecx, 0xc
lea edi, [esp + 0x40]
mov dword [esp + 0x30], eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x74]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], edx
lea ecx, [esp + 0x74]
mov dword [esp + 0x38], edx
stosw word es:[edi], ax
lea eax, [esp + 0x12]
mov dword [esp + 0x3c], edx
mov word [esp + 0x12], dx
push eax
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x19c]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
push 6
push 0x42cb50
call fcn.0041d610
add esp, 0x24
test ax, ax
je 0x4048df
pop edi
pop esi
pop ebp
mov eax, 0x71
pop ebx
add esp, 0x178
ret
lea ecx, [esp + 0x28]
push ecx
call fcn.0041fe17
lea edx, [esp + 0x20]
mov esi, eax
push edx
call fcn.0041fe17
mov ebx, eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041fd8c
lea ecx, [esp + 0x4c]
mov edi, eax
push ecx
call fcn.0041fe17
lea edx, [esp + 0x22]
mov ebp, eax
push edx
call fcn.0041fe17
mov byte [esp + 0x2c], al
lea eax, [esp + 0x28]
push eax
push ebx
push esi
call fcn.00406ee0
add esp, 0x20
test ax, ax
je 0x404941
pop edi
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x178
ret
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebp
lea edx, [esp + 0x78]
push ecx
push edx
push edi
push eax
call fcn.00416510
mov ebp, eax
test bp, bp
je 0x4049ef
cmp bp, 3
jne 0x4049dd
mov ecx, dword [esp + 0x14]
xor esi, esi
mov edi, dword [ecx + 0x418]
push edi
call fcn.0041af00
add esp, 4
test eax, eax
jne 0x4049a6
push edi
call fcn.0041af10
mov esi, eax
add esp, 4
cmp word [esi], bx
je 0x4049a6
push edi
call fcn.0041af20
mov edi, eax
push edi
call fcn.0041af00
add esp, 8
test eax, eax
je 0x404981
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0xd0]
lea edx, [esp + 0xa8]
push edx
push eax
lea edx, [esi + 0x10]
push ecx
add esi, 0x50
push edx
push esi
push 0
push 3
push 4
call fcn.00410a90
lea eax, [esp + 0xc8]
push eax
call fcn.0041bdc0
add esp, 0x24
pop edi
mov eax, ebp
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x178
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x178
ret
Function at 0x407e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x128
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], eax
xor edx, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x18], ecx
push ebx
mov dword [esp + 0x38], eax
push ebp
mov dword [esp + 0x4c], edx
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x44], eax
lea edx, [esp + 0x48]
push edi
mov dword [esp + 0x30], ecx
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x140]
lea ecx, [esp + 0x38]
push eax
push ecx
push edx
push 3
push 0x42cb50
call fcn.0041d610
add esp, 0x18
test ax, ax
je 0x407f07
pop edi
pop esi
pop ebp
mov eax, 0x71
pop ebx
add esp, 0x128
ret
lea eax, [esp + 0x34]
push eax
call fcn.0041fe17
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
call fcn.0041fe17
lea edx, [esp + 0x54]
mov ebx, eax
push edx
call fcn.0041fe17
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push ebx
push esi
call fcn.00406ee0
add esp, 0x18
test ax, ax
je 0x407f4f
pop edi
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x128
ret
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push edi
push eax
call fcn.00401360
mov ebp, eax
test bp, bp
je 0x407ff6
cmp bp, 3
jne 0x407fe4
mov ecx, dword [esp + 0x10]
xor esi, esi
mov edi, dword [ecx + 0x418]
push edi
call fcn.0041af00
add esp, 4
test eax, eax
jne 0x407fb3
push edi
call fcn.0041af10
mov esi, eax
add esp, 4
cmp word [esi], bx
je 0x407fb3
push edi
call fcn.0041af20
mov edi, eax
push edi
call fcn.0041af00
add esp, 8
test eax, eax
je 0x407f8e
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0xd0]
lea edx, [esp + 0x58]
push edx
push eax
lea edx, [esi + 0x10]
push ecx
add esi, 0x50
push edx
push esi
push 0
push 3
push 4
call fcn.00410a90
lea eax, [esp + 0x78]
push eax
call fcn.0041bdc0
add esp, 0x24
pop edi
mov eax, ebp
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x128
ret
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x40]
and ecx, 0xffff
push ecx
push 0x42cb3c
push edx
call fcn.0041ecde
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x34]
and eax, 0xff
push eax
push 0x42cb3c
push ecx
call fcn.0041ecde
lea edx, [esp + 0x40]
lea eax, [esp + 0x58]
push edx
push eax
push 2
push 0x42cb50
call fcn.0041d1b0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x16c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041e880
add esp, 0x2c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret