joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d433
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41d4d0
push ebx
push esi
call fcn.0041d3fc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041c25e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41d47d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41d4cf
push edi
push eax
call fcn.00415a05
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41d49d
call fcn.004159cb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41d4ce
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041c25e
add esp, 0x20
test eax, eax
jne 0x41d4bc
push edi
call fcn.004159cb
jmp 0x41d4c4
push ebx
call fcn.004159cb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41fd1a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004156e0
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41fd89
cmp esi, dword [ebp - 4]
je 0x41fd84
cmp dword [ebp + 0xc], 0
je 0x41fd84
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41fd61
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0041f86c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x41fd8b
xor eax, eax
inc eax
jmp 0x41fd8b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x41fdf0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x431040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004156e0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004156e0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41fe67
cmp word [ecx], dx
je 0x41fe67
mov eax, dword [0x42ae0c]
push edi
dec eax
push eax
push 0x42acf8
call fcn.0041fd8f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x41feda
cmp word [eax], dx
je 0x41feda
mov eax, dword [edi]
test eax, eax
je 0x41fe8b
cmp word [eax], dx
je 0x41fe8b
lea eax, [ebp - 0x10]
push eax
call fcn.0041f772
jmp 0x41fe94
lea eax, [ebp - 0x10]
push eax
call fcn.0041f80d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41ff04
mov eax, dword [0x42acf4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42a9e8
call fcn.0041fd8f
add esp, 0xc
test al, al
je 0x41ff04
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41fecf
cmp word [eax], di
je 0x41fecf
lea eax, [ebp - 0x10]
push eax
call fcn.0041f772
pop ecx
jmp 0x41ff06
lea eax, [ebp - 0x10]
push eax
call fcn.0041f80d
jmp 0x41fecc
mov eax, dword [edi]
test eax, eax
je 0x41fef1
cmp word [eax], dx
je 0x41fef1
lea eax, [ebp - 0x10]
push eax
call fcn.0041f727
pop ecx
jmp 0x41ff04
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41ffcf
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041fc14
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41ffcf
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41ffcf
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41ffcf
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41ff5c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00417306
test ebx, ebx
je 0x41ffca
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00417306
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41ffcf
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41ffcf
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0040caed
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41ffd1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004082a2
leave
ret
Function at 0x425300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42532d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42532d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x779b7712
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1d4066c1
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x18c028a7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x169e59fc
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x404430
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412f68
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x41d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004014d0
mov ecx, ebx
call fcn.00404330
mov edi, eax
test edi, edi
jne 0x4044b0
push 0x415e70
push str.WARN:__s__GetServiceConfig_FAIL_
push 1
push 0x53
push 0x415eb8
push 0x415edc
call fcn.00406550
add esp, 0x18
xor esi, esi
test edi, edi
je 0x4044c0
cmp dword [edi + 4], 2
je 0x40456b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 2
cmovae eax, dword [ebp + 8]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x404508
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x415f00
push str.WARN:__s__OpenService_FAIL__0x_x
push 1
push 0x63
push 0x415f48
push 0x415f6c
call fcn.00406550
add esp, 0x1c
jmp 0x4045d3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x40454b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:ChangeServiceConfig_failed___d__n
push 1
push 0x75
push 0x415fb8
push 0x415fdc
call fcn.00406550
add esp, 0x18
jmp 0x4045c8
push 2
push dword [edi + 4]
push str.Success_set_start_type_from__d_to__s
push 1
push 0x78
push 0x416028
push 0x41604c
call fcn.00406550
add esp, 0x1c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x4045aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:Fail_set_delay_auto_start__err0x_x
push 1
push 0x87
push 0x416098
push 0x4160bc
call fcn.00406550
add esp, 0x18
jmp 0x4045c8
push str.SUCCESS_set_delay_auto_start_
push 1
push 0x8b
push 0x416100
push str.CServiceObj::SetServiceAutoStart
call fcn.00406550
add esp, 0x14
test esi, esi
je 0x4045d3
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x4045ef
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x404610
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
push str.Create_Service_:__s...
push 1
push 0x9a
push 0x416178
push 0x4161c0
call fcn.004068e0
add esp, 0x18
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 8]
lea eax, [ebp + 0x20]
cmovae esi, dword [ebp + 8]
cmovae edx, dword [ebp + 8]
cmp dword [ebp + 0x34], 8
push 0
cmovae eax, dword [ebp + 0x20]
push 0
push 0
push 0
push 0
push eax
push 2
push 2
push pe_nt_image_headers32
push 0xf01ff
push edx
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x4046d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:CreateService_fail_0x_x
push 1
push 0xbb
push 0x416204
push 0x416228
jmp 0x4047d2
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0x15180
movdqu xmmword [ebp - 0x3c], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push 2
push esi
mov dword [ebp - 0x24], 0xea60
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0xea60
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 0xea60
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x38], 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404760
push str.ChangeConfig2:__SERVICE_CONFIG_FAILURE_ACTIONS__SUCCESS_
push 1
push 0xd6
push 0x416278
push 0x41629c
call fcn.00406550
add esp, 0x14
jmp 0x404781
call edi
push eax
push str.ERR:ChangeServiceConfig2_fail_0x_x
push 1
push 0xda
push 0x4162d4
push 0x4162f8
call fcn.00406550
add esp, 0x18
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x4047b9
push str.ChangeConfig2:__SERVICE_CONFIG_DELAYED_AUTO_START_INFO__SUCCESS_
push 1
push 0xe2
push 0x416354
push 0x416378
call fcn.00406550
add esp, 0x14
jmp 0x4047da
call edi
push eax
push str.ERR:ChangeServiceConfig2_Fail_set_delay_auto_start__0x_x
push 1
push 0xe6
push 0x4163c8
push str.CServiceObj::Create
call fcn.00406550
add esp, 0x18
cmp dword [ebp + 0x1c], 8
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x4047ee
push dword [ebp + 8]
call edi
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x404810
push dword [ebp + 0x20]
call edi
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004122f2
mov esp, ebp
pop ebp
ret 0x30
Function at 0x404830
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push ecx
push 0x24
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
push 0
push eax
movdqu xmmword [ebp - 0x24], xmm0
movdqu xmmword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40490c
mov eax, dword [ebp - 0x24]
cmp eax, 1
jne 0x404888
mov ecx, str.SERVICE_STOPPED
jmp 0x4048d4
cmp eax, 2
jne 0x404894
mov ecx, str.SERVICE_START_PENDING
jmp 0x4048d4
cmp eax, 3
jne 0x4048a0
mov ecx, str.SERVICE_STOP_PENDING
jmp 0x4048d4
cmp eax, 4
jne 0x4048ac
mov ecx, str.SERVICE_RUNNING
jmp 0x4048d4
cmp eax, 5
jne 0x4048b8
mov ecx, str.SERVICE_CONTINUE_PENDING
jmp 0x4048d4
cmp eax, 6
jne 0x4048c4
mov ecx, str.SERVICE_PAUSE_PENDING
jmp 0x4048d4
cmp eax, 7
mov ecx, str.SERVICE_PAUSED
mov edx, str.UNKNOWN_SERVICE_STATE
cmovne ecx, edx
push ecx
push eax
push str.QueryServiceStatus:0x_x__s_
push 1
push 0xf6
push 0x416438
push 0x416480
call fcn.004068e0
add esp, 0x1c
cmp dword [ebp - 0x24], 4
jne 0x404931
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004122f2
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:QueryServiceStatusEx_fail_0x_x
push 1
push 0xfe
push 0x4164e0
push str.CServiceObj::ServiceIsRunning
call fcn.00406550
add esp, 0x18
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.004122f2
mov esp, ebp
pop ebp
ret 4
Function at 0x404950
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412fe8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x41d034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str._DoInstall__begin...
push 1
push 0x105
push 0x41653c
push 0x416560
mov dword [ebp - 4], 1
call fcn.00406550
add esp, 0x14
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push 0xf01ff
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
test eax, eax
jne 0x404a8e
call edi
cmp eax, 0x424
jne 0x404a73
push 0x416578
push 1
push 0x10b
push 0x4165a4
push 0x4165c8
call fcn.00406550
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
lea eax, [ebp + 0x20]
push eax
call fcn.004014d0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004014d0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00404610
mov dword [esi + 4], eax
test eax, eax
jne 0x404a8e
push 0x4165e0
push 1
push 0x10f
push 0x4165fc
push 0x416620
call fcn.00406550
add esp, 0x14
jmp 0x404b10
call edi
push eax
push 0x416638
push 1
push 0x115
push 0x416680
push 0x4166a4
jmp 0x404b08
push dword [esi + 4]
call fcn.00404830
test al, al
je 0x404abc
push str.Check_Service_already_running_
push 1
push 0x11d
push 0x4166dc
push 0x416700
call fcn.00406550
add esp, 0x14
mov bl, 1
jmp 0x404b12
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x404aef
push 0x416718
push 1
push 0x123
push 0x416730
push 0x416754
call fcn.00406550
add esp, 0x14
mov bl, 1
jmp 0x404b12
call edi
push eax
push 0x41676c
push 1
push 0x128
push 0x416784
push str.CServiceObj::DoInstall
call fcn.00406550
add esp, 0x18
xor bl, bl
cmp dword [ebp + 0x1c], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x404b26
push dword [ebp + 8]
call esi
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x404b48
push dword [ebp + 0x20]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x404b60
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413018
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.DoUninstall...
push 1
push 0x130
push 0x4167d0
push 0x4167f4
mov dword [ebp - 4], 0
call fcn.00406550
add esp, 0x14
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push 0xf01ff
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [edi + 4], eax
test eax, eax
jne 0x404c24
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x424
jne 0x404c06
push str.WARN:The_specified_service_does_not_exist_as_an_installed_service.
push 1
push 0x136
push 0x416854
push 0x416878
call fcn.00406550
add esp, 0x14
mov bl, 1
jmp 0x404cda
call esi
push eax
push str.ERR:OpenService_fail_0x_x_n
push 1
push 0x139
push 0x4168b0
push 0x4168d4
jmp 0x404cd0
push eax
call fcn.00404830
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x404c88
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404c67
push str.SERVICE_CONTROL_STOP_SUCCESS
push 1
push 0x142
push 0x416910
push 0x416934
call fcn.00406550
add esp, 0x14
jmp 0x404c88
call esi
push eax
push str.ERR:ControlService_fail_0x_x_n
push 1
push 0x146
push 0x416970
push 0x416994
call fcn.00406550
add esp, 0x18
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x404cb7
push str.DeleteService__SUCCESS
push 1
push 0x14b
push 0x4169c8
push 0x4169ec
call fcn.00406550
add esp, 0x14
mov bl, 1
jmp 0x404cda
call esi
push eax
push str.ERR:DeleteService_fail_0x_x
push 1
push 0x150
push 0x416a24
push str.CServiceObj::DoUninstall
call fcn.00406550
add esp, 0x18
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x404cec
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004122f2
mov esp, ebp
pop ebp
ret 0x18
Function at 0x405860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 8
jb 0x405871
mov eax, dword [ebx]
jmp 0x405873
mov eax, ebx
push 0x405a70
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [ebx + 0x34], eax
test eax, eax
jne 0x4058ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVC___ERR:RegisterServiceCtrlHandler_fail__0x_x_n
push 1
push 0x3d
push 0x41775c
push 0x417784
call fcn.00406550
add esp, 0x18
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push str._SVC___initial_status_to_SERVICE_START_PENDING...
push 1
push 0x46
push 0x4177dc
lea edi, [ebx + 0x18]
mov dword [ebx + 0x28], 0
mov dword [edi], 0x10
push 0x417804
call fcn.00406550
mov eax, dword [0x41d04c]
add esp, 0x14
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebx + 0x2c], eax
inc eax
mov dword [ebx + 0x1c], 2
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0xbb8
mov dword [ebx + 0x20], 0
mov dword [0x41d04c], eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push ebx
push 0x405a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp - 4]
mov dword [ebx + 0x38], eax
push str._SVC___Success_create_work_thread_:__d
push 1
push 0x4e
push 0x417850
push 0x417878
call fcn.00406550
push str._SVC___initialization_is_complete__set_status_SERVICE_RUNNING
push 1
push 0x51
push 0x4178dc
push 0x417904
call fcn.00406550
add esp, 0x2c
mov dword [ebx + 0x1c], 4
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x20], 1
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x2c], 0
call esi
push str._SVC___Perform_work_until_service_stops...
push 1
push 0x55
push 0x417954
push 0x41797c
call fcn.00406550
add esp, 0x14
push 0xffffffffffffffff
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str._SVC___Work_thread_has_exit__set_status_SERVICE_STOPPED
push 1
push 0x58
push 0x4179d8
push str.CServiceTemplate::OnMainCallback
call fcn.00406550
add esp, 0x14
mov dword [ebx + 0x1c], 1
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x20], 1
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x2c], 0
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ab0
Capabilities:
Terminate thread

Disassembly:
push esi
push str._SVC__handle_SERVICE_CONTROL_STOP...
push 1
push 0x81
push 0x417bf8
push 0x417c20
mov esi, ecx
call fcn.00406550
add esp, 0x14
call fcn.00405680
mov ecx, dword [0x41d04c]
mov dword [eax + 0x2c], ecx
inc ecx
mov dword [0x41d04c], ecx
lea ecx, [eax + 0x18]
push ecx
push dword [eax + 0x34]
mov dword [eax + 0x1c], 3
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x405b18
call eax
cmp dword [esi + 0x38], 0
je 0x405b4e
push str.kill_work_thread...
push 1
push 0x8d
push str..._srcServiceUtilServiceTemplate.cpp
push str.CServiceTemplate::OnHandleServiceStop
call fcn.00406550
add esp, 0x14
push 0xfffffffffffffffe
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x38], 0
push 0
push ecx
push dword [esi + 0x1c]
call fcn.00405680
mov ecx, eax
call fcn.00405b70
pop esi
ret