joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ca0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x46da56
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x25]
push ebx
push eax
mov byte [esp + 0x2c], bl
call fcn.00446e10
add esp, 0xc
lea edi, [esp + 0x20]
call fcn.004016a0
test eax, eax
je 0x402e2d
mov edx, dword [0x4863c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x4863c4
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, edi
push ecx
push str._slabel.dat
lea edi, [esp + 0x20]
mov dword [esp + 0x138], ebx
call fcn.004035e0
mov ebp, dword [esp + 0x20]
add esp, 8
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402e06
mov edx, dword [0x4863c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x4863c4
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
push ecx
lea esi, [ebp - 0x10]
mov eax, esi
mov byte [esp + 0x138], 1
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.00403350
add eax, 0x10
mov dword [edi], eax
call fcn.00402950
mov edi, dword [esp + 0x14]
push 0x473420
push edi
call fcn.004429b9
add esp, 8
cmp eax, ebx
mov byte [esp + 0x130], bl
lea eax, [edi - 0x10]
jne 0x402ded
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402dc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x130], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402de6
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, 1
jmp 0x402e2f
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x130], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.004426a0
add esp, 0x120
ret
Function at 0x402e60
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x402e7b
pop edi
add esp, 0x1c
ret
push esi
push 4
push str.RsMgrSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x402e9f
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x402ec3
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
call esi
push edi
call esi
xor eax, eax
cmp dword [esp + 0xc], 4
pop esi
sete al
pop edi
add esp, 0x1c
ret

Function at 0x402ee0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x46d15b
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push edi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.00446e10
add esp, 0xc
lea esi, [esp + 0x10]
call fcn.00405a50
cmp byte [esp + 0x10], 0
je 0x403036
mov eax, esi
lea edx, [eax + 1]
jmp 0x402f50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402f50
sub eax, edx
cmp byte [esp + eax + 0xf], 0x5c
jne 0x402f74
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402f67
sub eax, edx
mov byte [esp + eax + 0xf], cl
push str.RisingRSD
lea ecx, [esp + 0x14]
push ecx
mov eax, 0x104
call fcn.00401170
mov edx, dword [0x4863c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x4863c4
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
push str._sdata_rav_rav.ini
lea edi, [esp + 0x14]
mov dword [esp + 0x128], 0
call fcn.004035e0
mov esi, dword [esp + 0x14]
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40300f
push esi
push 0
push str.WILLREBOOT
push str.SETUP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
lea eax, [esi - 0x10]
mov dword [esp + 0x120], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40300b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
jmp 0x403038
lea eax, [esi - 0x10]
mov dword [esp + 0x120], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403036
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004426a0
add esp, 0x118
ret
Function at 0x403d60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46c1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor ecx, ecx
xor edx, edx
mov word [esp + 0xc], cx
mov word [esp + 0xe], dx
mov dword [esp + 0x28], edx
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push 6
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
test esi, esi
je 0x403dd0
lea ecx, [esp + 0xc]
call fcn.004145d0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
mov ax, word [esp + 0xc]
cmp ax, 0xb
jne 0x403e02
cmp word [esp + 0x14], 0
setne cl
mov byte [edi], cl
lea ecx, [esp + 0xc]
call fcn.004145d0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
test ax, ax
jne 0x403e25
lea ecx, [esp + 0xc]
mov byte [edi], al
call fcn.004145d0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0xc]
call fcn.004145d0
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret

Function at 0x405a50
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405ab9
push edi
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x14]
push str.ProgramFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x405ade
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 2
jbe 0x405ae7
push str.Program_Files
push esi
mov eax, 0x104
mov byte [esi + 2], 0
call fcn.00401170
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x405e40
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, 1
cmp ecx, 0xffffffff
jne 0x405e55
mov ecx, esi
add esp, 4
jmp 0x405e80
cmp ecx, 1
jne 0x405e7a
push esi
call fcn.00406250
mov eax, dword [esi]
mov dword [esp], str.setup
test eax, eax
je 0x405e78
lea ecx, [esp]
push ecx
call fcn.004060c0
pop ecx
ret
xor eax, eax
pop ecx
ret
push 0xffffffffffffffff
push 0x46d98b
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov eax, dword [0x4863c4]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x4863c4
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x128], eax
push 0x103
push eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x21]
push eax
call fcn.00446e10
lea eax, [esp + 0x24]
call fcn.00405af0
mov ecx, dword [esi + 4]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x473930
lea edi, [esp + 0x2c]
call fcn.004035e0
mov ebp, dword [esp + 0x2c]
add esp, 0x18
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405fde
mov edi, dword [esi]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
test edi, edi
je 0x405fde
mov ebx, dword [esi + 0x1c]
push ebx
push eax
mov eax, dword [esi + 0x18]
push ecx
push ebp
push eax
mov eax, dword [esi + 0x14]
push eax
push edx
call fcn.00406350
test eax, eax
je 0x405fde
push esi
call fcn.00406030
cmp eax, 1
jne 0x405faf
mov esi, dword [esi]
mov dword [esp + 0x14], str.setup
test esi, esi
je 0x405faf
lea ecx, [esp + 0x14]
push ecx
mov eax, esi
call fcn.004060c0
test eax, eax
je 0x405faf
add ebp, 0xfffffff0
mov dword [esp + 0x128], 0xffffffff
lea edx, [ebp + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x405fa8
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, 1
jmp 0x406004
add ebp, 0xfffffff0
mov dword [esp + 0x128], 0xffffffff
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405fd7
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov eax, 1
jmp 0x406004
add ebp, 0xfffffff0
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
mov dword [esp + 0x128], ecx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406002
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004426a0
add esp, 0x118
ret
Function at 0x405e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov eax, 1
cmp ecx, 0xffffffff
jne 0x405e55
mov ecx, esi
add esp, 4
jmp 0x405e80
cmp ecx, 1
jne 0x405e7a
push esi
call fcn.00406250
mov eax, dword [esi]
mov dword [esp], str.setup
test eax, eax
je 0x405e78
lea ecx, [esp]
push ecx
call fcn.004060c0
pop ecx
ret
xor eax, eax
pop ecx
ret
push 0xffffffffffffffff
push 0x46d98b
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x483390]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov eax, dword [0x4863c4]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x4863c4
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x128], eax
push 0x103
push eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x21]
push eax
call fcn.00446e10
lea eax, [esp + 0x24]
call fcn.00405af0
mov ecx, dword [esi + 4]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x473930
lea edi, [esp + 0x2c]
call fcn.004035e0
mov ebp, dword [esp + 0x2c]
add esp, 0x18
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405fde
mov edi, dword [esi]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
test edi, edi
je 0x405fde
mov ebx, dword [esi + 0x1c]
push ebx
push eax
mov eax, dword [esi + 0x18]
push ecx
push ebp
push eax
mov eax, dword [esi + 0x14]
push eax
push edx
call fcn.00406350
test eax, eax
je 0x405fde
push esi
call fcn.00406030
cmp eax, 1
jne 0x405faf
mov esi, dword [esi]
mov dword [esp + 0x14], str.setup
test esi, esi
je 0x405faf
lea ecx, [esp + 0x14]
push ecx
mov eax, esi
call fcn.004060c0
test eax, eax
je 0x405faf
add ebp, 0xfffffff0
mov dword [esp + 0x128], 0xffffffff
lea edx, [ebp + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x405fa8
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, 1
jmp 0x406004
add ebp, 0xfffffff0
mov dword [esp + 0x128], 0xffffffff
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405fd7
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov eax, 1
jmp 0x406004
add ebp, 0xfffffff0
or ecx, 0xffffffff
lea eax, [ebp + 0xc]
mov dword [esp + 0x128], ecx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406002
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004426a0
add esp, 0x118
ret
Function at 0x406030
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
xor eax, eax
test edi, edi
je 0x4060b0
push esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x406093
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
or eax, 0xffffffff
pop edi
add esp, 0x1c
ret 4
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [esp + 0xc]
pop esi
pop edi
add esp, 0x1c
ret 4
Function at 0x4060c0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x20
push esi
mov esi, eax
cmp byte [esi], 0
jne 0x4060d4
xor eax, eax
pop esi
add esp, 0x20
ret 4
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
xor eax, eax
mov dword [esp + 8], edi
test edi, edi
je 0x406242
push 0xf01ff
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x406134
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret 4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x10]
push eax
push esi
call ebx
cmp dword [esp + 0x14], 4
jne 0x406164
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x30]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x406182
lea edx, [esp + 0x10]
push edx
push esi
call ebx
test eax, eax
jne 0x406199
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call ebx
cmp dword [esp + 0x18], 2
mov ebp, dword [esp + 0x28]
mov edi, eax
jne 0x406210
nop
mov eax, 0xcccccccd
mul dword [esp + 0x2c]
shr edx, 3
cmp edx, 0x3e8
jae 0x4061cb
mov edx, 0x3e8
jmp 0x4061d8
cmp edx, 0x2710
jbe 0x4061d8
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x406210
cmp dword [esp + 0x28], ebp
jbe 0x4061ff
call ebx
mov ebp, dword [esp + 0x28]
mov edi, eax
jmp 0x406209
call ebx
sub eax, edi
cmp eax, dword [esp + 0x2c]
ja 0x406210
cmp dword [esp + 0x18], 2
je 0x4061b0
cmp dword [esp + 0x18], 4
pop ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x406233
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret 4
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x406250
Capabilities:
Modify service
Query service configuration

Disassembly:
push ecx
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40626c
pop edi
pop ecx
ret 4
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x406295
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
pop ecx
ret 4
push ebx
lea ecx, [esp + 0xc]
push ecx
xor ebx, ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x406336
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4062ca
mov ebp, dword [esp + 0x10]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
jmp 0x4062ce
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push ebp
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
pop ebp
test eax, eax
je 0x406336
cmp dword [ebx + 4], 2
je 0x40631e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40633d
call esi
push edi
call esi
pop ebx
pop esi
mov eax, 1
pop edi
pop ecx
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop esi
mov eax, 1
pop edi
pop ecx
ret 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
pop esi
xor eax, eax
pop edi
pop ecx
ret 4

Function at 0x4064d0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406535
push ebp
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x14]
push str.ProgramFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
pop ebp
je 0x406553
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 2
jbe 0x40655c
push str.Program_Files
push esi
mov eax, edi
mov byte [esi + 2], 0
call fcn.00401170
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x4065d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x358
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x354], eax
push ebx
mov ebx, dword [esp + 0x360]
push ebp
push esi
push edi
push 0x208
lea eax, [esp + 0x155]
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.00446e10
add esp, 0xc
test ebx, ebx
je 0x406764
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
test eax, eax
jle 0x406764
push ebx
call esi
cmp eax, 0x209
jbe 0x40663b
mov eax, 0x6f
jmp 0x406767
push ebx
push 0x473a2c
mov ecx, 0x209
lea edi, [esp + 0x158]
call fcn.00401200
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406760
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x473a34
lea eax, [esp + 0x3c]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4066a0
test dl, dl
je 0x40669c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4066a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x406680
xor eax, eax
jmp 0x4066a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40672f
mov ecx, 0x473a38
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4066d6
test dl, dl
je 0x4066d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4066d6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4066b6
xor eax, eax
jmp 0x4066db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40672f
lea eax, [esp + 0x3c]
push eax
push ebx
push 0x473930
mov ecx, 0x209
lea edi, [esp + 0x15c]
call fcn.00401200
add esp, 0xc
cmp dword [esp + 0x10], 0x10
jne 0x406712
mov ecx, edi
push ecx
call fcn.004065d0
add esp, 4
jmp 0x40672f
push 0x80
lea edx, [esp + 0x154]
push edx
call ebp
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406674
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x406674
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x406767
or eax, 0xffffffff
mov ecx, dword [esp + 0x364]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004426a0
add esp, 0x358
ret

Function at 0x406780
Capabilities:
Create directory

Disassembly:
sub esp, 0x10c
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push 0x104
lea eax, [esp + 9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x10], 0
call fcn.00446e10
add esp, 0xc
push 0x104
push esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + 4]
push 0x5c
push edx
call fcn.004432ae
mov esi, eax
add esp, 8
test esi, esi
je 0x406802
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ecx]
push 0
lea eax, [esp + 0xc]
push eax
mov byte [esi], 0
call edi
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.004432ae
mov esi, eax
add esp, 8
test esi, esi
jne 0x4067e0
pop edi
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.004426a0
add esp, 0x10c
ret
Function at 0x407080
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp edi, 0xffffffff
jne 0x4070ad
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp ebx, eax
ja 0x4070a4
push esi
xor esi, esi
push esi
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x100000
push 0x4872b0
push edi
call ebx
test eax, eax
je 0x40711c
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x40711c
push 0
lea edx, [esp + 0x14]
push edx
push eax
push 0x4872b0
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [esp + 0x10]
push 0
lea eax, [esp + 0x10]
push eax
push 0x100000
push 0x4872b0
push edi
call ebx
test eax, eax
jne 0x4070e4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x407130
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ecx
push esi
push 0
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 8]
push eax
push 0x100000
push 0x4872b0
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407163
or eax, 0xffffffff
pop esi
pop ecx
ret
mov ecx, 0x5a4d
cmp cx, word [0x4872b0]
jne 0x40715d
mov eax, dword [0x4872ec]
cmp dword [eax + 0x4872b0], 0x4550
jne 0x40715d
movzx esi, word [eax + 0x4872b6]
push edi
xor edi, edi
xor edx, edx
test esi, esi
jle 0x4071ae
lea ecx, [eax + 0x4873b8]
mov eax, dword [ecx + 4]
add eax, dword [ecx]
cmp eax, edi
jbe 0x4071a3
mov edi, eax
inc edx
movsx eax, dx
add ecx, 0x28
cmp eax, esi
jl 0x407198
push edi
push str.GetPEsiez__d
push 0x80
call fcn.00431310
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ecx
ret