joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bdf4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x42be77
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040483c
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.00404e08
push 0x104
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x42be61
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404cd8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00404a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42be7e
lea eax, [ebp - 4]
call fcn.0040483c
ret

Function at 0x42cd9c
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404cc8
mov eax, dword [ebp + 8]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x42ceb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x42ced0
call fcn.0041b624
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.00404cd8
push eax
push 1
push 3
push 1
push 0xf01ff
mov eax, dword [ebp - 0xc]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42ce30
mov ecx, 0x42cefc
mov dl, 1
mov eax, dword [0x42c950]
call fcn.0042d7d0
call fcn.004041ac
xor eax, eax
push ebp
push 0x42ce93
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x42ce70
mov ecx, 0x42cf3c
mov dl, 1
mov eax, dword [0x42c950]
call fcn.0042d7d0
call fcn.004041ac
xor edx, edx
mov eax, 0x42cf5c
call fcn.0041b624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ce9a
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x42d1c4
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d402
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x42d418
call fcn.0041b624
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
mov ecx, 0x42d440
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042ca88
xor eax, eax
push ebp
push 0x42d3d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42d335
xor eax, eax
push ebp
push 0x42d32e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x422
jne 0x42d302
xor edx, edx
mov eax, 0x42d46c
call fcn.0041b624
xor eax, eax
push ebp
push 0x42d2ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042d564
xor edx, edx
mov eax, 0x42d4b4
call fcn.0041b624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d302
cmp byte [ebp - 0x11], 0
je 0x42d317
call fcn.00404258
call fcn.00404258
jmp 0x42d3df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d335
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, 0x42d52c
call fcn.00404dc0
test eax, eax
jle 0x42d359
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.004048d4
jmp 0x42d37c
lea eax, [ebp - 0x24]
call fcn.004188b8
push dword [ebp - 0x24]
push 0x42d538
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b98
mov eax, dword [ebp - 0x10]
call fcn.00408644
test al, al
jne 0x42d3ac
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov edx, 0x42d544
call fcn.00404b24
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x42c9b0]
call fcn.0040c230
call fcn.004041ac
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042cd9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d3df
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d409
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404860
lea eax, [ebp - 0x10]
call fcn.0040483c
ret
Function at 0x42d564
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d6d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x42d6ec
mov edx, 0x14
mov eax, 2
call fcn.0041e830
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x42d6f8
call fcn.00404b24
mov eax, dword [ebp - 0x30]
mov dl, 1
call fcn.0041b624
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x42d5d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xffffffff
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
mov ecx, 0x42d728
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042ca88
xor eax, eax
push ebp
push 0x42d6b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
mov ecx, 0x42d754
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042ca88
xor eax, eax
push ebp
push 0x42d699
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42d67b
mov ecx, 0x42d7a4
mov dl, 1
mov eax, dword [0x42c950]
call fcn.0042d7d0
call fcn.004041ac
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d6a0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x42e580
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xffff
mov eax, dword [ebp - 0xc]
call fcn.004029e4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_ZwQuerySystemInformation
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc0000004
jne 0x42e5f5
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00402a34
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_ZwQuerySystemInformation
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc0000004
je 0x42e5c1
cmp dword [ebp - 0x14], 0
jne 0x42e603
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x42e60b
mov eax, dword [ebp - 0x10]
call fcn.00402a14
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42e614
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push esi
push edi
xor edx, edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42e74d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x70]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
mov dword [ebp - 0x7c], 0xc
lea eax, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403344
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 8]
mov edx, 0x42e764
call fcn.004048d4
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x42e76c
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x42e6bf
mov eax, dword [ebp - 4]
mov edi, eax
lea esi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x42e721
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x94]
call fcn.0040b8d8
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.0040633c
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
lea eax, [ebp - 0x8c]
push eax
push 1
mov ecx, 0x42e788
mov dl, 1
mov eax, dword [0x406dc4]
call fcn.0040c278
call fcn.004041ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e754
lea eax, [ebp - 0x94]
call fcn.0040483c
lea eax, [ebp - 0x90]
call fcn.0040483c
lea eax, [ebp - 8]
call fcn.0040483c
ret
Function at 0x42f808
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x42f8bf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x42f83f
mov eax, dword [ebp - 8]
call fcn.0040483c
jmp 0x42f8a1
mov eax, dword [ebp - 4]
call fcn.00404ad8
dec eax
jne 0x42f857
lea eax, [ebp - 4]
mov edx, 0x42f8d4
call fcn.00404ae0
lea eax, [ebp - 0xc]
mov edx, 0x7f
call fcn.00404e08
lea eax, [ebp - 0xc]
call fcn.00404d30
mov edx, 0x7f
call fcn.00406a14
push 0x7f
lea eax, [ebp - 0xc]
call fcn.00404d30
push eax
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
call sub.kernel32.dll_QueryDosDeviceA
mov eax, dword [ebp - 0xc]
call fcn.00404cd8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00404a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f8c6
lea eax, [ebp - 0xc]
call fcn.0040483c
lea eax, [ebp - 4]
call fcn.0040483c
ret

Function at 0x431f94
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x432085
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x432043
push 0
push 0
push 0
push 0
push 0x432094
mov eax, dword [ebp - 4]
push eax
push 1
push 2
push 0x10
push 0xf0000
push 0x43209c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateServiceA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x432011
mov byte [ebp - 9], 1
jmp 0x432038
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x1c]
call fcn.00418e60
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4320c0
call fcn.00404b24
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0041b624
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
jmp 0x43206a
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x24]
call fcn.00418e60
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4320c0
call fcn.00404b24
mov eax, dword [ebp - 0x20]
xor edx, edx
call fcn.0041b624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43208c
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404860
ret
Function at 0x4320d8
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x43219c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x432152
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService_1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
cmp dword [ebp - 0x14], 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x432179
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x1c]
call fcn.00418e60
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4321b4
call fcn.00404b24
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0041b624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4321a3
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404860
lea eax, [ebp - 4]
call fcn.0040483c
ret

Function at 0x4321cc
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x432268
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 1
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x43224c
push 4
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x432243
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x43223a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43226f
lea eax, [ebp - 4]
call fcn.0040483c
ret
Function at 0x432278
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
mov eax, dword [ebp - 8]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x432442
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x34], 1
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
call sub.advapi32.dll_OpenSCManagerA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4323eb
push 0x14
mov eax, dword [ebp - 8]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4323b9
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA_1
test eax, eax
je 0x432387
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x43235e
jmp 0x432356
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4323ae
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
jb 0x4323ae
cmp dword [ebp - 0x34], 4
jne 0x43232e
jmp 0x4323ae
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x40]
call fcn.00418e60
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x432458
call fcn.00404b24
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.0041b624
jmp 0x4323ae
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x48]
call fcn.00418e60
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
mov edx, 0x432458
call fcn.00404b24
mov eax, dword [ebp - 0x44]
xor edx, edx
call fcn.0041b624
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
jmp 0x4323e0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x50]
call fcn.00418e60
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x432458
call fcn.00404b24
mov eax, dword [ebp - 0x4c]
xor edx, edx
call fcn.0041b624
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
jmp 0x432412
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x58]
call fcn.00418e60
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x432458
call fcn.00404b24
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.0041b624
cmp dword [ebp - 0x34], 4
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432449
lea eax, [ebp - 0x58]
mov edx, 8
call fcn.00404860
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404860
ret
Function at 0x432470
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
mov eax, dword [ebp - 8]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x43255f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
call sub.advapi32.dll_OpenSCManagerA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x43253c
push 0x24
mov eax, dword [ebp - 8]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x432533
lea eax, [ebp - 0x34]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ControlService_1
test eax, eax
je 0x43252a
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x43252a
jmp 0x432524
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x43252a
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x18]
jb 0x43252a
cmp dword [ebp - 0x30], 1
jne 0x4324fc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
cmp dword [ebp - 0x30], 1
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432566
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404860
ret
Function at 0x432570
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x432578
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
mov eax, dword [ebp - 8]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x4326e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4325e1
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20]
call fcn.00418e60
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4326fc
call fcn.00404b24
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.0041b624
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_LockServiceDatabase
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43261a
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x28]
call fcn.00418e60
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x432738
call fcn.00404b24
mov eax, dword [ebp - 0x24]
xor edx, edx
call fcn.0041b624
push 2
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43265e
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x30]
call fcn.00418e60
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x432778
call fcn.00404b24
mov eax, dword [ebp - 0x2c]
xor edx, edx
call fcn.0041b624
mov eax, dword [ebp - 8]
call fcn.00404cd8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ChangeServiceConfig2A
test eax, eax
jne 0x4326a3
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x38]
call fcn.00418e60
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4327b0
call fcn.00404b24
mov eax, dword [ebp - 0x34]
xor edx, edx
call fcn.0041b624
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_UnlockServiceDatabase
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4326ed
lea eax, [ebp - 0x38]
mov edx, 8
call fcn.00404860
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404860
ret
Function at 0x10002f79
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.100106d0
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.1000b000
mov edx, dword [esp]
push edx
call fcn.10010530
pop edx
push eax
push edx
call fcn.10010570
lea eax, [esp + 8]
push eax
call fcn.100105d0
push edx
call fcn.10010530
pop edx
push eax
push edx
call fcn.10010530
pop edx
push eax
push dword [esp + 0xc]
call fcn.1000e17a
call fcn.10010660
lea edx, [0x10014028]
call fcn.1000b0b0
mov ecx, eax
call fcn.1000b0c0
je 0x10003005
mov edx, dword [esp + 4]
push edx
call fcn.10010530
pop edx
push eax
push edx
call fcn.10010570
lea edx, str..dll
push edx
call fcn.10010570
lea eax, [esp + 8]
push eax
call fcn.100105d0
cmp dword [esp + 0x18], 0
je 0x100030b8
push dword [0x100170fc]
lea edx, [0x10014028]
pop ecx
call fcn.1000b0c0
je 0x10003084
push edx
call fcn.10010530
pop edx
push eax
push edx
call fcn.10010530
pop edx
push eax
push 0x104
call fcn.1000d210
push 0x100170fc
call fcn.100105d0
push 0x104
mov eax, dword [0x100170fc]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.10010530
pop edx
push eax
push edx
call fcn.10010530
pop edx
push eax
lea eax, [0x10014418]
push eax
push dword [0x100170fc]
call fcn.1000d260
push 0x100170fc
call fcn.100105d0
mov edx, dword [0x100170fc]
push edx
call fcn.10010530
pop edx
push eax
push edx
call fcn.10010570
lea edx, [0x10014418]
push edx
call fcn.10010570
mov edx, dword [esp + 8]
push edx
call fcn.10010570
lea eax, [esp + 8]
push eax
call fcn.100105d0
push dword [esp + 4]
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x1000312c
push edx
call fcn.10010530
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.10010530
pop edx
push eax
lea edx, str.Failed_load_original_dll_n
push edx
call fcn.10010570
mov edx, dword [esp + 0x10]
push edx
call fcn.10010570
call fcn.10010660
push 0
call fcn.1000b112
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.1000b130
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, dword [esp + 8]
jmp 0x10003134
push dword [esp + 4]
call fcn.10010730
push dword [esp]
call fcn.10010730
add esp, 0xc
pop ebx
ret 8