joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428c90
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00472990
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00472990
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x428d02
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00472c24
add esp, 8
jmp 0x428d15
push 0
push 0x10
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
push ecx
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.00472a0a
add esp, 0xc
push 0x49a7b0
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.00472b79
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.00472b79
add esp, 0xc
push 0x49a7b4
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.00472b79
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x428d8f
xor eax, eax
jmp 0x428dab
lea edx, [ebp - 0x418]
push edx
push VariantClear
mov ecx, dword [ebp - 0x41c]
call fcn.00428210
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 8
Function at 0x428dc0
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x624], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00472990
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00472990
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x620], cx
push 0x206
push 0
lea edx, [ebp - 0x61e]
push edx
call fcn.00472990
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x428e51
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00472c24
add esp, 8
jmp 0x428e64
push 0
push 2
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call fcn.00472a0a
add esp, 0xc
push 0x49a7c0
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.00472b79
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call fcn.00472b79
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x620]
push eax
call fcn.00472a0a
add esp, 0xc
push 0x49a7c4
push 0x104
lea ecx, [ebp - 0x620]
push ecx
call fcn.00472b79
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x620]
push eax
call fcn.00472b79
add esp, 0xc
push 0x49a7c8
push 0x104
lea ecx, [ebp - 0x620]
push ecx
call fcn.00472b79
add esp, 0xc
lea edx, [ebp - 0x620]
push edx
mov ecx, dword [ebp - 0x624]
call fcn.00428950
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x210]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x624]
call fcn.00428210
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 0xc

Function at 0x428fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4925ba
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], 0
xor eax, eax
mov word [ebp - 0x424], ax
push 0x40e
push 0
lea ecx, [ebp - 0x422]
push ecx
call fcn.00472990
add esp, 0xc
push 0x207
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x428]
call fcn.0042deb0
mov dword [ebp - 4], 1
push 0x49a7e0
lea ecx, [ebp - 0x428]
call fcn.0042e350
push 0x49a7e4
lea ecx, [ebp - 0x428]
call fcn.0042e180
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042de60
mov edx, dword [ebp - 0x42c]
or edx, 1
mov dword [ebp - 0x42c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x428]
call fcn.0042ed20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
Function at 0x429e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4929a7
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0042de40
mov byte [ebp - 4], 3
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00472990
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.0042de40
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x10]
call fcn.00453990
push eax
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0x49a858
push str.language
push 0x49a87c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0042e120
lea ecx, [ebp - 0x220]
call fcn.0042e260
lea ecx, [ebp - 0x220]
call fcn.0042e1d0
lea ecx, [ebp - 0x220]
call fcn.0042e1b0
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._sunicode__s.ini
lea eax, [ebp - 0x10]
push eax
call fcn.0042e430
add esp, 0x10
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042de60
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.0042ed20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0042ed20
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.0042ed20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0042ed20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret

Function at 0x42a010
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492a0e
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.0042de40
mov byte [ebp - 4], 4
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00472990
add esp, 0xc
lea ecx, [ebp + 0x14]
call fcn.00453990
push eax
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0x49a8b0
lea ecx, [ebp + 0x10]
call fcn.00453990
push eax
lea ecx, [ebp + 0xc]
call fcn.00453990
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0042e120
lea ecx, [ebp - 0x10]
call fcn.0042e260
lea ecx, [ebp - 0x10]
call fcn.0042e1d0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042de60
mov edx, dword [ebp - 0x220]
or edx, 1
mov dword [ebp - 0x220], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.0042ed20
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.0042ed20
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.0042ed20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.0042ed20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
Function at 0x42aa30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492bb4
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
push 0x49aa34
lea ecx, [ebp - 0x238]
call fcn.00401c70
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x23c], 0x104
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x42aacf
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00401f70
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401cb0
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.00401ce0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
Function at 0x431d00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x3c], ecx
cmp dword [0x4c36c8], 1
je 0x431d2b
cmp dword [0x4c36c8], 3
jne 0x431d4c
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x436cc0
push 0
push 0
call fcn.004763d2
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
jmp 0x431d74
cmp dword [0x4c36c8], 2
jne 0x431d74
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x4358d0
push 0
push 0
call fcn.004763d2
add esp, 0x18
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x28], 0
je 0x431de0
cmp dword [ebp + 8], 0
jne 0x431de0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x431dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetExitCodeThread_install_error:0x_x
push 0x49ac50
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4343c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00472990
add esp, 0xc
push 0
push 0
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jbe 0x434435
mov eax, 1
jmp 0x434437
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 4
Function at 0x439280
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], ecx
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00472990
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x424], 3
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x420]
push edx
call fcn.00472a0a
add esp, 0xc
push 0x5c
mov eax, dword [ebp - 0x424]
lea ecx, [ebp + eax*2 - 0x420]
push ecx
call fcn.00408090
add esp, 8
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x43933b
push 0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x439394
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x420]
sub eax, ecx
sar eax, 1
push eax
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00475aa8
add esp, 0x10
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x420]
sub edx, eax
sar edx, 1
add edx, 1
mov dword [ebp - 0x424], edx
jmp 0x439303
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 4
Function at 0x43ac70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493c8d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4c1280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x49e1d4
push 0x49e1e0
lea ecx, [ebp - 0x40]
call fcn.00401c70
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x68]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.00444a70
add esp, 0xc
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x70]
call fcn.00401ff0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x21], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00401ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401ce0
movzx edx, byte [ebp - 0x21]
test edx, edx
je 0x43ad72
mov dword [ebp - 0x20], 4
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x49e228
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ad68
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43b650
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b7958
push 0x476cc0
mov eax, dword fs:[0]
push eax
add esp, 0xfffff98c
mov eax, dword [0x4c1280]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x46c], 2
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x464], 0
xor eax, eax
mov word [ebp - 0x678], ax
push 0x206
push 0
lea ecx, [ebp - 0x676]
push ecx
call fcn.00472990
add esp, 0xc
xor edx, edx
mov word [ebp - 0x460], dx
push 0x206
push 0
lea eax, [ebp - 0x45e]
push eax
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x250], 0
push 0x228
push 0
lea ecx, [ebp - 0x24c]
push ecx
call fcn.00472990
add esp, 0xc
mov dword [ebp - 4], 0
push 0x49e8b8
lea edx, [ebp - 0x678]
push edx
call fcn.00472bf6
add esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffff
jne 0x43b756
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x46c], eax
jmp 0x43b879
mov dword [ebp - 0x250], 0x22c
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x464]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x43b788
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x46c], eax
jmp 0x43b879
push 0x104
lea edx, [ebp - 0x678]
push edx
lea eax, [ebp - 0x22c]
push eax
call fcn.00476c14
add esp, 0xc
test eax, eax
jne 0x43b85e
mov ecx, dword [ebp - 0x248]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x43b852
lea edx, [ebp - 0x67c]
push edx
push 2
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43b837
mov dword [ebp - 0x680], 0
lea ecx, [ebp - 0x680]
push ecx
push 1
push 2
push 0
push 0xf01ff
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x680]
mov dword [eax], ecx
mov dword [ebp - 0x46c], 0
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b879
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x470], eax
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 0x464]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43b788
mov dword [ebp - 4], 0xfffffffe
call fcn.0043b887
jmp 0x43b8b4
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret 4
Function at 0x43c110
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43c16d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49ed90
push 0x49ed78
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43c303
push 0x24
push 0x49edd8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43c18c
jmp 0x43c303
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x7530
lea ecx, [ebp - 0x10]
push ecx
push 0x24
lea edx, [ebp - 0x3c]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x43c1dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49edf0
push 0x49ed84
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43c303
cmp dword [ebp - 0x38], 1
jne 0x43c20f
mov dword [ebp - 0xc], 1
push 0x49ee40
push str._s_is_already_stopped.
push 0x49ee34
call fcn.00401340
add esp, 4
push eax
call fcn.004013f0
add esp, 0xc
jmp 0x43c303
lea ecx, [ebp - 0x3c]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x43c24a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ControlService_failed___d_
push 0x49ee88
call fcn.00401340
add esp, 4
push eax
call fcn.004013f0
add esp, 0xc
jmp 0x43c303
cmp dword [ebp - 0x38], 1
je 0x43c2fb
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
push ecx
push 0x24
lea edx, [ebp - 0x3c]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x43c29c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryServiceStatusEx_failed___d_
push 0x49eecc
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43c2fb
cmp dword [ebp - 0x38], 1
jne 0x43c2cb
mov dword [ebp - 0xc], 1
push 0x49ef28
push str._s_stopped
push 0x49ef1c
call fcn.00401340
add esp, 4
push eax
call fcn.004013f0
add esp, 0xc
jmp 0x43c2fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jbe 0x43c2f6
push str.Wait_timed_out
push 0x49ef58
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 8
jmp 0x43c2fb
jmp 0x43c24a
xor ecx, ecx
jne 0x43c12e
cmp dword [ebp - 8], 0
je 0x43c31a
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x43c331
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x43d180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493d97
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c1280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push 0x49f6b8
push 0x4c36ec
call fcn.00445840
movzx eax, al
test eax, eax
je 0x43d1c5
xor eax, eax
jmp 0x43d2df
mov ecx, 0x4c36ec
call fcn.00453990
push eax
call fcn.00474b5c
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.av:_d
push 0x49f6cc
call fcn.00401340
add esp, 4
push eax
call fcn.004013f0
add esp, 0xc
cmp dword [ebp - 0x10], 1
jne 0x43d2c7
cmp dword [0x4c36bc], 0
je 0x43d26a
push str.x64SAntiVirus.dll
push 0x4c36a0
lea edx, [ebp - 0x18]
push edx
call fcn.0042f3f0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
call fcn.00453990
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 0x11], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042ed20
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x43d268
mov eax, 1
jmp 0x43d2df
jmp 0x43d2c5
push str.SAntiVirus.dll
push 0x4c36a0
lea eax, [ebp - 0x20]
push eax
call fcn.0042f3f0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
call fcn.00453990
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov byte [ebp - 0x19], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0042ed20
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x43d2c5
mov eax, 1
jmp 0x43d2df
jmp 0x43d2dd
cmp dword [ebp - 0x10], 2
jne 0x43d2dd
cmp dword [0x4c36a8], 0
je 0x43d2dd
mov eax, 1
jmp 0x43d2df
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43fd60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x10
push 0x4a09c8
mov eax, dword [ebp + 8]
push eax
call fcn.004754fb
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43fdc3
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0047515f
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00474bde
add esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc