joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c0c0
Capabilities:
Create service
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40c22b
cmp dword [edi + 0x14], 8
jb 0x40c0f8
mov edi, dword [edi]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 3
push 1
push 0x10030
push 0x465e7c
push 0x465e7c
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
je 0x40c1c1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40c21b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x40c21b
call edi
push eax
lea eax, [ebp - 0x1c]
push str.StartService_failed_with__i.
push eax
call fcn.004121b0
add esp, 0xc
mov ecx, ebx
push eax
call fcn.00403240
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40c1a5
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c19b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2cc
push edx
push ecx
call fcn.00434e86
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call edi
push dword [ebp - 0x20]
xor esi, esi
call edi
jmp 0x40c2b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.CreateService_failed_with__i.
push eax
call fcn.004121b0
add esp, 0xc
mov ecx, ebx
push eax
call fcn.00403240
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40c21b
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c211
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2d1
push edx
push ecx
call fcn.00434e86
add esp, 8
push dword [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
jmp 0x40c2b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.OpenSCManager_failed_with__i.
push eax
call fcn.004121b0
mov edi, eax
add esp, 0xc
cmp ebx, edi
je 0x40c281
mov ecx, ebx
call fcn.00401290
mov ecx, dword [edi]
mov dword [ebx], ecx
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], 7
mov word [edi], ax
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40c2b7
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c2ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2d6
push edx
push ecx
call fcn.00434e86
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434e45
mov esp, ebp
pop ebp
ret 8
call fcn.00439dba
call fcn.00439dba
call fcn.00439dba
int3
Function at 0x40cf00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edx
push esi
mov dword [ebp - 4], esi
call fcn.004120c0
add esp, 8
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x40cf1e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov eax, dword [ebx]
mov dword [ebx + 4], eax
test esi, esi
je 0x40d462
cmp dword [edx + 0x10], 0
je 0x40d462
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x40d462
cmp dword [edx + 0x14], 8
jb 0x40d31a
mov edx, dword [edx]
cmp dword [eax + 0x14], 8
jb 0x40d322
mov eax, dword [eax]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40d462
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40d462
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x40d462
mov esi, dword [ebx]
lea eax, [edx + edi]
mov ecx, dword [ebx + 8]
mov dword [ebp - 8], eax
sub ecx, esi
mov eax, dword [ebx + 4]
sub eax, esi
mov dword [ebp + 0xc], eax
cmp edi, ecx
jbe 0x40d409
cmp edi, 0x7fffffff
ja 0x40d46b
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
ja 0x40d3a8
lea eax, [edx + ecx]
mov dword [ebp + 0xc], eax
cmp eax, edi
jae 0x40d3ab
mov dword [ebp + 0xc], edi
test esi, esi
je 0x40d3d7
cmp ecx, 0x1000
jb 0x40d3cd
mov edx, dword [esi - 4]
add ecx, 0x23
sub esi, edx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x40d470
mov esi, edx
push ecx
push esi
call fcn.00434e86
add esp, 8
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.00408e30
mov esi, dword [ebx]
push ecx
lea ecx, [ebp + 0xf]
call fcn.00401d70
mov ecx, dword [ebp - 4]
push edi
push ecx
push esi
call fcn.00436e40
add esp, 0x10
lea eax, [esi + edi]
mov dword [ebx + 4], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, eax
jbe 0x40d448
push eax
push edx
push esi
call fcn.00436e40
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0xf]
add edx, dword [ebp - 4]
add esp, 8
mov esi, dword [ebx + 4]
call fcn.00401d70
mov edi, dword [ebp - 8]
sub edi, edx
push edi
push edx
push esi
call fcn.00436e40
add esp, 0x10
lea eax, [edi + esi]
mov dword [ebx + 4], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push edx
push esi
call fcn.00436e40
add esp, 0xc
lea eax, [esi + edi]
mov dword [ebx + 4], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00401c10
call fcn.00439dba
int3
Function at 0x40ff60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 8
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x410009
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x14
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40ffb6
cmp dword [ebp - 0x24], 0
setne bl
jmp 0x410036
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str._EAC_Service___Error__Failed_to_get_token_info:__i.
push eax
call fcn.004120c0
add esp, 0xc
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
jb 0x40ffda
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x410036
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41002c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410055
jmp 0x41002c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str._EAC_Service___Error__Failed_to_get_process_token:__i.
push eax
call fcn.004120c0
add esp, 0xc
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
jb 0x40ffda
jmp 0x40ffd7
push edx
push ecx
call fcn.00434e86
add esp, 8
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x410044
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
int3
Function at 0x411d10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edx
push esi
mov dword [ebp - 4], esi
call fcn.004121b0
add esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x411d2e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4124e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46f068]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0
jne 0x412509
mov eax, dword [edx]
mov dword [ecx], eax
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push str._EAC_Setup___Error__Only_a_single_setup_action_may_be_selected_for_execution.
push eax
call fcn.004120c0
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
jb 0x412526
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x41255d
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412553
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41256d
push edx
push ecx
call fcn.00434e86
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
int3
Function at 0x416960
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4563a8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x46f068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x98], 3
jne 0x416b81
mov esi, dword [edi + 0x94]
lea ecx, [ebp - 0x70]
push 0xd
push str.Installing...
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.00401590
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0x16
push str.setup.install_progress
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.00401590
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.004035c0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0x68]
call fcn.00402ea0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
jb 0x416a1a
mov edx, dword [ebp - 0x40]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416a33
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004013d0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0xc8]
call esi
cmp dword [ebp - 0x18], 0
je 0x416a85
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x416a6e
mov eax, dword [ebp - 0x28]
push eax
push dword [edi + 0xc8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [edi + 0xc8]
call esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x416abf
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416ab5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416b9c
push edx
push ecx
call fcn.00434e86
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x416b0d
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416b03
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ba1
push edx
push ecx
call fcn.00434e86
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 0x10
jb 0x416b51
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x416b47
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416ba6
push edx
push ecx
call fcn.00434e86
add esp, 8
mov edx, dword [ebp - 0x5c]
cmp edx, 0x10
jb 0x416b81
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x416b77
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416bab
push edx
push ecx
call fcn.00434e86
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
call fcn.00439dba
call fcn.00439dba
call fcn.00439dba
int3
Function at 0x416bc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4563a8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x46f068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x98], 3
jne 0x416de1
mov esi, dword [edi + 0x94]
lea ecx, [ebp - 0x70]
push 0xf
push str.Uninstalling...
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.00401590
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0x18
push str.setup.uninstall_progress
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.00401590
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.004035c0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0x68]
call fcn.00402ea0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
jb 0x416c7a
mov edx, dword [ebp - 0x40]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416c93
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004013d0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0xc8]
call esi
cmp dword [ebp - 0x18], 0
je 0x416ce5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x416cce
mov eax, dword [ebp - 0x28]
push eax
push dword [edi + 0xc8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [edi + 0xc8]
call esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x416d1f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416d15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416dfc
push edx
push ecx
call fcn.00434e86
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x416d6d
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416d63
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416e01
push edx
push ecx
call fcn.00434e86
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 0x10
jb 0x416db1
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x416da7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416e06
push edx
push ecx
call fcn.00434e86
add esp, 8
mov edx, dword [ebp - 0x5c]
cmp edx, 0x10
jb 0x416de1
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x416dd7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416e0b
push edx
push ecx
call fcn.00434e86
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
call fcn.00439dba
call fcn.00439dba
call fcn.00439dba
int3
Function at 0x41cf80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456a48
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x46f068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor eax, eax
mov byte [ebp - 0x45], 1
push eax
push 0x400
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x4c], 0x800
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00407980
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.0041db90
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41cffe
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], 0
mov word [eax], cx
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
jb 0x41d016
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push ecx
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push str.GamesInstalled
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub eax, 0
je 0x41d0dd
sub eax, 2
je 0x41d144
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x44]
push 0x467c14
push eax
call fcn.004121b0
mov edi, eax
add esp, 0xc
cmp esi, edi
je 0x41d099
mov ecx, esi
call fcn.00401290
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x41d0d3
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d0c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d19b
push edx
push ecx
call fcn.00434e86
add esp, 8
mov eax, dword [ebp - 0x18]
xor bl, bl
mov ecx, dword [ebp - 0x2c]
jmp 0x41d14d
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
push 0
shr eax, 1
push eax
call fcn.004011f0
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp eax, 8
jb 0x41d0fd
mov esi, ecx
test esi, esi
je 0x41d14a
mov edi, dword [ebp - 0x50]
cmp word [esi], 0
je 0x41d144
push esi
call fcn.0043d3e8
add esp, 4
test eax, eax
je 0x41d12b
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push edi
push eax
push ecx
lea eax, [ebp - 0x5c]
mov ecx, ebx
push eax
call fcn.0041e230
push 0x467c10
push esi
call fcn.0043651d
mov esi, eax
add esp, 8
test esi, esi
je 0x41d144
add esi, 2
jne 0x41d104
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov bl, byte [ebp - 0x45]
cmp eax, 8
jb 0x41d17d
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d173
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d1a0
push edx
push ecx
call fcn.00434e86
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
call fcn.00439dba
int3
Function at 0x41d860
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x46f068]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, esi
mov dword [esp + 8], edi
cmp dword [esi + 0x14], 8
jb 0x41d888
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], edi
mov word [eax], cx
lea eax, [esp + 8]
push eax
push 0xf003f
push ecx
push str.SoftwareEasyAntiCheat
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d92a
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareEasyAntiCheat
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x41d92f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push str.RegDeleteKeyW_failed_with__i
push eax
call fcn.004121b0
add esp, 0xc
mov ecx, esi
push eax
call fcn.00403240
mov edx, dword [esp + 0x20]
cmp edx, 8
jb 0x41d9a0
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d996
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d9b3
jmp 0x41d996
cmp eax, 2
jne 0x41d947
mov edi, 2
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push str.RegOpenKeyEx_failed_with__i
push eax
call fcn.004121b0
add esp, 0xc
mov ecx, esi
push eax
call fcn.00403240
mov edx, dword [esp + 0x20]
cmp edx, 8
jb 0x41d9a0
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d996
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d9b8
push edx
push ecx
call fcn.00434e86
add esp, 8
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
call fcn.00439dba
int3
Function at 0x41eb50
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x46f068]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, edx
xor bl, bl
push edi
mov edi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41eb77
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], 0
mov word [eax], cx
test edi, edi
jne 0x41eba9
push 0x12
push str.Invalid_parameters
mov ecx, esi
call fcn.004013d0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x28]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41ec3a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x430
je 0x41ec3a
call edi
push eax
lea eax, [esp + 0x14]
push str.DeleteService_failed_with__i
push eax
call fcn.004121b0
add esp, 0xc
mov ecx, esi
push eax
call fcn.00403240
mov edx, dword [esp + 0x24]
cmp edx, 8
jb 0x41ec3c
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ec1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ec50
push edx
push ecx
call fcn.00434e86
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
mov bl, 1
mov ecx, dword [esp + 0x44]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434e45
mov esp, ebp
pop ebp
ret
call fcn.00439dba
int3