joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5062b4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50645f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x506440
mov dl, 1
mov eax, dword [0x43a2a0]
call fcn.00448780
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00406bc8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x50642f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00493e0c
test al, al
je 0x506422
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x506470
lea eax, [ebp - 0x394]
call fcn.0041f524
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x506422
xor eax, eax
push ebp
push 0x50641b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5064e0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x506404
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004077a4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x506404
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004077a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506422
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x506325
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004486bc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506466
lea eax, [ebp - 0x3a0]
call fcn.00406bc8
ret

Function at 0x507018
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5252fc]
cmp byte [eax + 0xb1], 0
jne 0x50708a
cmp dword [0x52531c], 0
jne 0x50704a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x51f53c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x52531c], eax
cmp dword [0x525318], 0
jne 0x507065
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x525318], eax
cmp dword [0x525320], 0
jne 0x50708a
push esp
push 0
push 0
mov eax, dword [0x51f538]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x525320], eax
pop edx
ret
Function at 0x5073a4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5073bb
add esp, 0xfffffff0
call fcn.00405588
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0045134c
mov eax, dword [0x51f5b4]
cmp byte [eax], 0
jne 0x5073e8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x51f890]
cmp word [eax + 2], 0
jne 0x507402
mov eax, dword [0x51f890]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00509598
mov eax, dword [0x51f9b4]
cmp word [eax + 2], 0
jne 0x50741c
mov eax, dword [0x51f9b4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0050979c
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x45fc30]
call fcn.00465c30
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x509d14
mov dl, 1
mov eax, dword [0x436b2c]
call fcn.00404f4c
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x436b2c]
call fcn.00404f4c
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x464510]
call fcn.0046f27c
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x507600
mov eax, dword [0x51f76c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0046f70c
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x509ffc
mov dl, 1
mov eax, dword [0x436b2c]
call fcn.00404f4c
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x51f76c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0041f338
test eax, eax
je 0x507530
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0041f0e8
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041f31c
test eax, eax
je 0x507548
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004077a4
push ebx
push 0x508f70
call fcn.004fcf5c
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x51f5b4]
cmp byte [eax], 0
jne 0x507599
mov eax, ebx
call fcn.005077c0
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.0050a244
mov eax, ebx
call fcn.0050ae70
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5075f6
call fcn.004055e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x507af8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x507ba4
cmp dword [ebx + 0x98], 0
jne 0x507b9e
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x507a30
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x507b9e
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x507b64
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x507b9e
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00444154
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x507b73
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x507dc4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5252fc]
cmp dword [eax + 0x178], 0
je 0x507f29
test bl, bl
jne 0x507e77
cmp dword [esi + 0xa0], 0
jne 0x507e6c
mov eax, esi
call fcn.0050acc0
push eax
push 0x507cd0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x507e3d
mov eax, dword [0x5252fc]
cmp byte [eax + 0xd7], 0
je 0x507e3d
mov eax, dword [esi + 0xdc]
call fcn.00408880
mov edi, eax
cmp edi, 0
jl 0x507e3d
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x507e26
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x507e6c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00444154
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x507e4c
inc dword [esi + 0xa0]
jmp 0x507f29
cmp dword [esi + 0xa0], 0
jle 0x507f29
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x507f29
cmp dword [esi + 0x48], 0
je 0x507ed4
mov eax, dword [0x5252fc]
cmp byte [eax + 0xd7], 0
je 0x507ed4
mov eax, dword [esi + 0xdc]
call fcn.00408880
mov edi, eax
cmp edi, 0
jl 0x507ed4
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x507ebd
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x507f03
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00444154
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x507ee3
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4f9ebc]
call fcn.00408a2c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x508b7c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x508be7
cmp byte [ebx + 0xd7], 0
jne 0x508be7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406d50
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x508bd4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x508bf4
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00406fa8
jmp 0x508bf4
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00406fa8
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x50a42c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x50a49a
mov eax, esi
call fcn.0048de34
test al, al
je 0x50a49a
mov eax, dword [ebx + 0x88]
call fcn.0048da80
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50a49a
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x50a48e
push 0
mov eax, dword [ebx + 0x88]
call fcn.0048da80
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.0048489c
jmp 0x50a49a
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.0050a264
pop esi
pop ebx
ret
Function at 0x50ebf4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x50ec6e
mov eax, dword [ebx + 8]
call fcn.0048da80
mov ecx, eax
mov dl, 1
mov eax, dword [0x4998cc]
call fcn.00487ea4
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0049df64
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x50e4ec
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0048da80
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0048da80
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x50ece4
mov eax, dword [ebx + 8]
call fcn.0048da80
mov ecx, eax
mov dl, 1
mov eax, dword [0x4998cc]
call fcn.00487ea4
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0049df64
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x50e538
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0048da80
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0048da80
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x50ed50
mov eax, dword [ebx + 8]
call fcn.0048da80
mov ecx, eax
mov dl, 1
mov eax, dword [0x49a308]
call fcn.00487ea4
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0048da80
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0048da80
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x511778
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffcc
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x51179a
mov eax, 0xfffffffe
jmp 0x511811
lea eax, [esp + 8]
push eax
push 0x511818
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5117bc
mov eax, 0xfffffffd
jmp 0x511811
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_2
test eax, eax
je 0x51180f
mov eax, 0xfffffffc
jmp 0x511811
xor eax, eax
add esp, 0x34
ret

Function at 0x51183c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406cac
lea edi, [ebp - 0x234]
xor eax, eax
push ebp
push 0x5119bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
mov eax, 2
call fcn.00511718
mov esi, eax
mov dword [edi], 0x22c
mov edx, edi
mov eax, esi
call fcn.00511738
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x51198b
lea eax, [ebp - 0x240]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004077a4
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.0041ef20
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.0041d9cc
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.0041d9cc
mov edx, dword [ebp - 0x244]
pop eax
call fcn.00407a8c
je 0x51195e
lea eax, [ebp - 0x24c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004077a4
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.0041d9cc
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.0041d9cc
mov edx, dword [ebp - 0x250]
pop eax
call fcn.00407a8c
jne 0x51197c
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov edx, edi
mov eax, esi
call fcn.00511758
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x5118bf
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5119c6
lea eax, [ebp - 0x250]
mov edx, 7
call fcn.00406c28
lea eax, [ebp - 4]
call fcn.00406bc8
ret
Function at 0x5119d4
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406cac
xor eax, eax
push ebp
push 0x511acd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x511ab7
xor eax, eax
push ebp
push 0x511ab0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00407710
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x511a99
xor eax, eax
push ebp
push 0x511a92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DeleteService
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511a99
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511ab7
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511ad4
lea eax, [ebp - 4]
call fcn.00406bc8
ret
Function at 0x511adc
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406cac
mov eax, dword [ebp - 8]
call fcn.00406cac
mov eax, dword [ebp - 0xc]
call fcn.00406cac
xor eax, eax
push ebp
push 0x511c4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005119d4
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
setne byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
je 0x511c2f
xor eax, eax
push ebp
push 0x511c28
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00407710
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00407710
push eax
mov eax, dword [ebp - 4]
call fcn.00407710
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x511bac
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x424
jne 0x511bac
mov ecx, 0x511c68
mov dl, 1
mov eax, dword [0x418d70]
call fcn.00423a0c
cmp dword [ebp - 0x18], 0
je 0x511c11
xor eax, eax
push ebp
push 0x511c0a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_StartServiceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x511bf3
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x420
jne 0x511bf3
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511c11
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511c2f
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511c51
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406c28
ret
Function at 0x511cb4
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406cac
xor eax, eax
push ebp
push 0x511e76
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x511e53
xor eax, eax
push ebp
push 0x511e4c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00407710
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp dword [ebp - 0x10], 0
jne 0x511dd0
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x424
jne 0x511dd0
lea edx, [ebp - 0x1c]
mov eax, dword [0x51f980]
mov eax, dword [eax]
call fcn.00509c8c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0041eee4
lea eax, [ebp - 0x18]
mov edx, 0x511e94
call fcn.004078fc
mov ecx, dword [ebp - 0x18]
mov edx, 0x511ec4
mov eax, 0x511f04
call fcn.00511adc
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00407710
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp dword [ebp - 0x10], 0
jne 0x511dd0
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x424
jne 0x511dd0
mov ecx, 0x511f2c
mov dl, 1
mov eax, dword [0x418d70]
call fcn.00423a0c
cmp dword [ebp - 0x10], 0
je 0x511e35
xor eax, eax
push ebp
push 0x511e2e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x511e17
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x420
jne 0x511e17
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511e35
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511e53
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511e7d
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406c28
lea eax, [ebp - 4]
call fcn.00406bc8
ret
Function at 0x511f78
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406cac
xor eax, eax
push ebp
push 0x5120c3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x5120ad
xor eax, eax
push ebp
push 0x5120a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00407710
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x51208f
xor eax, eax
push ebp
push 0x512088
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
jmp 0x512054
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x51f980]
mov eax, dword [eax]
call fcn.00509148
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
call sub.kernel32.dll_GetTickCount_1
lea edx, [ebx + 0x1d4c0]
cmp eax, edx
jae 0x512069
cmp dword [ebp - 0x44], 1
jne 0x512031
cmp dword [ebp - 0x44], 1
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51208f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5120ad
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5120ca
lea eax, [ebp - 4]
call fcn.00406bc8
ret