joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov edi, dword [ebp + 0xc]
test byte [section..data], 8
jne 0x402bd0
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x402c9f
mov dword [eax], sym._factory_QueryInterface_12
mov dword [eax + 4], 0x40b940
mov eax, dword [edi]
mov dword [ebx + 0x18], 1
mov dword [ebx + 8], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], 0x408084
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CoGetClassObject]
sub esp, 0x14
mov esi, eax
test eax, eax
jns 0x402b58
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 8
mov dword [esp + 8], 4
add eax, 8
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
sub esp, 0x14
mov esi, eax
test eax, eax
js 0x402b3e
mov eax, dword [ebp + 8]
mov dword [eax + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov edx, dword [ebp + 8]
sub esp, 0x10
mov dword [edx + 0xc], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
test edi, edi
je 0x402c98
mov eax, edi
shr eax, 0x10
je 0x402c80
movzx eax, byte [edi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.__p__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.surrogate_LoadDllServer
mov dword [esp + 4], 0x404000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x402aa9
movzx eax, di
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf
jmp 0x402c45
mov eax, str._null_
jmp 0x402c45
mov esi, 0x8007000e
jmp 0x402b49
Function at 0x4031c0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40324b
cmp ax, 9
je 0x403238
cmp ax, 0x20
je 0x403238
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4032a0
cmp ax, 0x22
je 0x4032b0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40324b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4031f0
test edi, 1
jne 0x4031f0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x403238
cmp ax, 0x20
je 0x403238
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x4032c8
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x40320b
and dword [ebp - 0x54], 1
jne 0x403204
xor edi, 1
jmp 0x40320b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x403264

Function at 0x4032e0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x40662f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x428134], 0
push esi
jne 0x406666
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406640
mov dword [ecx*4 + 0x428130], eax
inc ecx
cmp ecx, 0x100
jl 0x40663b
mov esi, dword [esp + 0x10]
test esi, esi
mov eax, dword [esp + 8]
not eax
jbe 0x406692
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x428130]
inc ecx
dec esi
jne 0x406678
not eax
pop esi
ret 0xc
Function at 0x406490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x40b014]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov dword [esp + 0x40c], 0
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esp + esi*4 + 8], eax
inc esi
cmp esi, 0x100
jb 0x4064b8
mov eax, dword [esp + 0x40c]
xor edx, edx
not eax
movzx ecx, byte [edx + 0x40b568]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [esp + ecx*4 + 8]
movzx ecx, byte [edx + 0x40b569]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [esp + ecx*4 + 8]
movzx ecx, byte [edx + 0x40b56a]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [esp + ecx*4 + 8]
movzx ecx, byte [edx + 0x40b56b]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [esp + ecx*4 + 8]
movzx ecx, byte [edx + 0x40b56c]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [esp + ecx*4 + 8]
movzx ecx, byte [edx + 0x40b56d]
add edx, 6
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [esp + ecx*4 + 8]
cmp edx, 0x18
jb 0x406564
mov ecx, dword [esp + 0x414]
not eax
pop esi
xor ecx, esp
call fcn.0040749f
mov esp, ebp
pop ebp
ret
Function at 0x406600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
xor edx, edx
nop word [eax + eax]
xor ecx, ecx
cmp byte [eax + 0x40b514], cl
cmove eax, ecx
movzx ecx, byte [edx + str._t2_tK]
xor cl, byte [eax + 0x40b514]
inc eax
mov byte [edx + 0x40b568], cl
xor ecx, ecx
cmp byte [eax + 0x40b514], cl
cmove eax, ecx
movzx ecx, byte [edx + 0x409481]
xor cl, byte [eax + 0x40b514]
inc eax
mov byte [edx + 0x40b569], cl
xor ecx, ecx
cmp byte [eax + 0x40b514], cl
cmove eax, ecx
movzx ecx, byte [edx + 0x409482]
xor cl, byte [eax + 0x40b514]
inc eax
mov byte [edx + 0x40b56a], cl
xor ecx, ecx
cmp byte [eax + 0x40b514], cl
cmove eax, ecx
movzx ecx, byte [edx + 0x409483]
xor cl, byte [eax + 0x40b514]
inc eax
mov byte [edx + 0x40b56b], cl
xor ecx, ecx
cmp byte [eax + 0x40b514], cl
cmove eax, ecx
movzx ecx, byte [edx + 0x409484]
xor cl, byte [eax + 0x40b514]
inc eax
mov byte [edx + 0x40b56c], cl
xor ecx, ecx
cmp byte [eax + 0x40b514], cl
cmove eax, ecx
movzx ecx, byte [edx + 0x409485]
xor cl, byte [eax + 0x40b514]
inc eax
mov byte [edx + 0x40b56d], cl
add edx, 6
cmp edx, 0x18
jl 0x406610
call fcn.00406490
cmp eax, 0x5a6aa47d
jne 0x406713
cmp dword [0x40b4ec], 0x16
jne 0x406713
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 1
push 0x28
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push 0
push 0x18
push 0x40b568
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov al, 1
pop ebp
ret
push 0x40
push str.Information
push str.Try_again_
push dword [0x40b4f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop ebp
ret
Function at 0x4070c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x40b014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
push 0
mov dword [esi], vtable.CSkin.0
mov byte [esi + 0x25], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edi, eax
push 0x6e
push edi
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [esi + 0x14], eax
test eax, eax
je 0x407193
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x18]
push 0x4094cc
push 4
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x407193
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x407193
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
cmp dword [esi + 0xc], 0
pop ebx
je 0x407193
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x10], eax
test eax, eax
je 0x407193
push dword [esi + 0x14]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
pop edi
mov eax, esi
pop esi
call fcn.0040749f
mov esp, ebp
pop ebp
ret 8
push 0x409c2c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], str.Unable_to_retrieve_the_skin.
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x407e52
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x407e91
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407e91
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407e91
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407e91
cmp dword [ecx + 0x74], 0xe
jbe 0x407e91
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x159f0cf1
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..tls
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x77a25663
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401050
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401113
push esi
nop dword [eax + eax]
mov eax, str.VPWalletLauncherC.exe
lea ecx, [ebp - 0x20c]
nop dword [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4010d6
test dx, dx
je 0x4010d2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4010d6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4010b0
xor eax, eax
jmp 0x4010db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401100
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401100
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4010a0
pop esi
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00402532
mov esp, ebp
pop ebp
ret

Function at 0x4018d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x401930
mov ecx, dword [edi + 4]
lea eax, [ebp - 0xc]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402532
mov esp, ebp
pop ebp
ret 8

Function at 0x401950
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push str._s_failed_w_err_0x_08lx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00401130
add esp, 0x14
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4019e4
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402532
mov esp, ebp
pop ebp
ret 8
Function at 0x401a40
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401a91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.00401a00
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402532
mov esp, ebp
pop ebp
ret
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x401ac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00401a00
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402532
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x41a7d0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 2
push 0x10
push 4
push str.VPWalletService
push str.VPWalletService
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x401b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
jmp 0x401b12
push str.VPWalletService
push str._s_is_installed._n
call fcn.00401a00
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test edi, edi
je 0x401b2a
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402532
mov esp, ebp
pop ebp
ret
Function at 0x401b40
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push 0
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x401ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00401a00
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402532
mov esp, ebp
pop ebp
ret
push 0x10024
push str.VPWalletService
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x401bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x401c7e
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401c5b
push str.VPWalletService
push str.Stopping__s.
call fcn.00401a00
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x401c37
nop dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, 3
jne 0x401c3a
push 0x41ab30
call fcn.00401a00
add esp, 4
push 0x3e8
call edi
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
jne 0x401c10
mov eax, dword [ebp - 0x1c]
push str.VPWalletService
cmp eax, 1
jne 0x401c4b
push 0x41ab34
jmp 0x401c50
push str._n_s_failed_to_stop._n
call fcn.00401a00
mov ebx, dword [ebp - 0x24]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x401c74
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed_w_err_0x_08lx_n
jmp 0x401c7e
push str.VPWalletService
push str._s_is_removed._n
call fcn.00401a00
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
test esi, esi
je 0x401c96
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402532
mov esp, ebp
pop ebp
ret
Function at 0x401df0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
push edi
mov dword [ebp - 8], 0
push dword [esi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x401e50
mov ecx, dword [esi + 4]
lea eax, [ebp - 0xc]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], str.VPWallet_Demon_in_OnStart
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push 0x41ab30
push 1
call fcn.00401040
push str.___________________________________________________________________
push 1
call fcn.00401040
push str.VPWallet_Demon_in_OnStart
push 1
call fcn.00401040
push str.___________________________________________________________________
push 1
call fcn.00401040
add esp, 0x1c
mov edx, esi
call fcn.004022c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.00402532
mov esp, ebp
pop ebp
ret 8
Function at 0x402160
Capabilities:
Access the windows event log
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
push edi
mov dword [ebp - 8], 0
push dword [esi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x4021c1
mov ecx, dword [esi + 4]
lea eax, [ebp - 0xc]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], str.CppWindowsService_in_OnStop
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.___________________________________________________________________
push 1
call fcn.00401040
push str.VPWallet_Client_in_OnStop
push 1
call fcn.00401040
push str.___________________________________________________________________
push 1
call fcn.00401040
push 0x41ab30
push 1
call fcn.00401040
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
xor edi, edi
mov dword [esi + 0x28], 1
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x30]
test eax, eax
je 0x402275
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x402275
push str._PROCESSDIE__OpenProcess___try.
push 3
call fcn.00401040
add esp, 8
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x402260
cmp dword [ebp - 0x10], 0x103
jne 0x40227a
push str._PROCESSDIE__GetExitCodeProcess_____STILL_ACTIVE.
push 3
call fcn.00401040
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x402275
call ebx
push eax
push dword [esi + 0x30]
push str._PROCESSDIE__GetExitCodeProcess_fail___process__d___errcode_:__u
push 3
call fcn.00401040
add esp, 0x10
cmp edi, 5
jl 0x402206
push 0xffffffffffffffff
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40229f
call fcn.00401050
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402532
mov esp, ebp
pop ebp
ret
call ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0x41c078
push eax
call fcn.00404a38
int3