joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x1e4]
mov ecx, dword [ebp + 0x1e8]
test eax, eax
jle 0x4013e0
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
shl edi, cl
add esi, 8
mov dword [esp + 0x18], eax
lea esp, [esp]
mov eax, dword [ebp]
lea ebx, [esi - 8]
push ebx
push ebx
push eax
lea eax, [ebp + 0xf4]
push eax
call fcn.00404980
xor dword [esi - 4], edi
xor dword [esi], edi
xor dword [esi + 4], edi
xor dword [ebx], edi
add esp, 0x10
add esi, 0x10
inc edi
sub dword [esp + 0x18], 1
jne 0x4013b0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4014b0
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
mov eax, 0x317d0
call fcn.00405f20
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x317cc], eax
push ebx
push esi
xor esi, esi
push 0xf9c
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x18], esi
call fcn.00405640
push 0x41431c
mov dword [esp + 0x18], esi
xor ebx, ebx
call fcn.00403a50
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0xfa0
lea edx, [esp + 0x14]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x401618
push ebp
call fcn.00403ae0
mov ebp, eax
cmp ebp, esi
je 0x4015fe
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
cmp esi, edi
jae 0x4015da
mov ecx, dword [esp + esi*4 + 0x14]
lea eax, [esp + 0xfb4]
push eax
push ecx
call fcn.00403b40
add esp, 8
test eax, eax
je 0x4015c6
push 0x100
lea edx, [esp + 0x311d8]
push edx
push 0x100
lea eax, [esp + 0x30fe0]
push eax
push 0x100
lea ecx, [esp + 0x315f0]
push ecx
push 3
lea edx, [esp + 0x30fe8]
push edx
lea eax, [esp + 0x10ff0]
push eax
call fcn.00405a51
lea ecx, [esp + 0x311f8]
push ecx
lea edx, [esp + 0x30ffc]
push edx
push 0x4142e8
lea eax, [esp + 0x31404]
push 0x104
push eax
call fcn.00405604
lea ecx, [esp + 0x3140c]
push str.UsbStart.exe
push ecx
call fcn.00405e86
add esp, 0x40
test eax, eax
je 0x4015d5
inc esi
cmp esi, 0x3e8
jb 0x401527
jmp 0x4015da
mov ebx, 1
push ebp
call fcn.00403b20
add esp, 4
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x317cc]
xor ecx, esp
call fcn.00405622
add esp, 0x317d0
ret
pop ebp
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x317cc]
xor ecx, esp
call fcn.00405622
add esp, 0x317d0
ret
mov ecx, dword [esp + 0x317d4]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00405622
add esp, 0x317d0
ret
Function at 0x401640
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x24
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [0x414340]
mov edx, dword [0x414344]
mov eax, dword [esp + 0x28]
mov ax, word [eax]
push esi
push edi
push 0
push 0
push 3
push 0
mov dword [esp + 0x28], ecx
mov ecx, dword [0x414348]
push 3
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
mov dx, word [0x41434c]
push 0x80000000
lea ecx, [esp + 0x30]
push ecx
or edi, 0xffffffff
mov word [esp + 0x40], dx
mov word [esp + 0x3c], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
je 0x4016eb
xor eax, eax
push eax
lea edx, [esp + 0xc]
push edx
push 0xc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x2d1080
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4016e4
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00405622
add esp, 0x24
ret
Function at 0x401a20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x804
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x800], eax
call fcn.00401fa0
test eax, eax
je 0x401a46
push 6
push esi
call dword [sym.imp.UxTheme.dll_EnableThemeDialogTexture]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push 0xf1
push 0x3ef
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
push 0
push 0
push pe_nt_image_headers32
push 0x3ef
push esi
call edi
push eax
call ebx
cmp eax, 1
jne 0x401aa5
push eax
push 0x3f4
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 1
push 0x3f0
push esi
call edi
push eax
call ebp
push 1
jmp 0x401ac7
push 0
push 0x3f4
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0
push 0x3f0
push esi
call edi
push eax
call ebp
push 0
push 0x3f3
push esi
call edi
push eax
call ebp
push 0x3f0
push esi
call edi
push 0
push 9
push 0xc5
push eax
call ebx
push 0x3f3
push esi
call edi
push 0xbebc200
push 2
mov ebp, eax
push 0x46f
push ebp
call ebx
push 1
push 0
push 0x471
push ebp
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x41c728
push 0x400
lea eax, [esp + 0x14]
push eax
push 0x414414
push str.TITLE_GROUPID_INPUT
push str.USB_REGIST
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [esp + 0xc]
push ecx
push esi
call ebp
push 0x41c728
push 0x400
lea edx, [esp + 0x14]
push edx
push 0x414414
push str.NOUSE_GROUPID
push str.USB_REGIST
call ebx
lea eax, [esp + 0xc]
push eax
push 0x3ee
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea ecx, [esp + 0x14]
push ecx
push 0x414414
push str.USE_GROUPID
push str.USB_REGIST
call ebx
lea edx, [esp + 0xc]
push edx
push 0x3ef
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea eax, [esp + 0x14]
push eax
push 0x414414
push str.STATIC_GROUPID
push str.USB_REGIST
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0x3f4
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea edx, [esp + 0x14]
push edx
push 0x414414
push str.BUTTON_OK
push str.USB_REGIST
call ebx
lea eax, [esp + 0xc]
push eax
push 1
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea ecx, [esp + 0x14]
push ecx
push 0x414414
push str.BUTTON_CANCEL
push str.USB_REGIST
call ebx
lea edx, [esp + 0xc]
push edx
push 2
push esi
call edi
push eax
call ebp
push esi
call fcn.00403400
mov ecx, dword [esp + 0x810]
add esp, 4
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00405622
add esp, 0x804
ret
Function at 0x401fa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x401fe9
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00405622
add esp, 0x118
ret
jne 0x401ff6
mov eax, 1
cmp dword [esp + 8], eax
jae 0x401ff8
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00405622
add esp, 0x118
ret

Function at 0x402180
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 0
push 0x41c290
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4021c0
push str.USB_REGIST.log
push 0x104
push 0x41c290
call fcn.00405c71
add esp, 0xc
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp]
push 0x2e
push ecx
call fcn.00405a25
add esp, 8
test eax, eax
je 0x4021e9
xor edx, edx
mov word [eax], dx
push str..ini
lea eax, [esp + 4]
push 0x104
push eax
call fcn.00405c71
add esp, 0xc
lea ecx, [esp]
push ecx
push 0
push 0x41462c
push 0x414624
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov dword [0x41c498], eax
call fcn.00405622
add esp, 0x20c
ret

Function at 0x402230
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x410], eax
lea eax, [esp + 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp]
push ecx
push 0
push 0x414774
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [esp]
push edx
push 0x41c4a0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x414754
push 0x41472c
push 0x41c4a0
call fcn.00404f40
add esp, 0xc
test eax, eax
jne 0x4022c8
xor eax, eax
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00405622
add esp, 0x414
ret
push str.USBENTCGSERVICE2
push str.UsbEntCGService2.exe
push 0x41c4a0
call fcn.00404f40
add esp, 0xc
test eax, eax
je 0x4022b1
push 0x4146bc
push 0x414694
push 0x41c4a0
call fcn.00404f40
add esp, 0xc
test eax, eax
je 0x4022b1
push str.USBENTERRUN
push str.UsbEnterRun.exe
push 0x41c4a0
call fcn.00404f40
mov ecx, dword [esp + 0x41c]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.00405622
add esp, 0x414
ret

Function at 0x402330
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x208], eax
mov ecx, dword [esp + 0x214]
mov eax, dword [esp + 0x210]
push ecx
push eax
lea eax, [esp + 8]
push 0x41477c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00405622
add esp, 0x20c
ret
Function at 0x402390
Capabilities:
Delete directory

Disassembly:
push 0x41472c
push 0x41c4a0
call fcn.00402330
push str.UsbEntCGService2.exe
push 0x41c4a0
call fcn.00402330
push 0x414694
push 0x41c4a0
call fcn.00402330
push str.UsbEnterRun.exe
push 0x41c4a0
call fcn.00402330
add esp, 0x20
push 0x41c4a0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
ret
Function at 0x4028b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x45c
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
mov ebx, dword [esp + 0x464]
push ebp
push ebx
push str._s.
lea eax, [esp + 0x260]
push 0x104
push eax
call fcn.00405604
add esp, 0x10
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402a29
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
lea eax, [esp + 0x3c]
push eax
push 0x41499c
call fcn.004020a0
add esp, 8
mov ecx, 0x414998
lea eax, [esp + 0x3c]
jmp 0x402930
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402956
test dx, dx
je 0x402952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402956
add eax, 4
add ecx, 4
test dx, dx
jne 0x402930
xor eax, eax
jmp 0x40295b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402a0c
mov ecx, 0x414990
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402996
test dx, dx
je 0x402992
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402996
add eax, 4
add ecx, 4
test dx, dx
jne 0x402970
xor eax, eax
jmp 0x40299b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402a0c
lea ecx, [esp + 0x3c]
push ecx
push ebx
push 0x41477c
lea edx, [esp + 0x26c]
push 0x104
push edx
call fcn.00405604
add esp, 0x14
xor esi, esi
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4029f7
lea ecx, [esp + 0x260]
push ecx
push str.DeleteFile_NG__s_
call fcn.004020a0
add esp, 8
push 0x1f4
call edi
inc esi
cmp esi, 6
jl 0x4029c1
jmp 0x402a0c
lea edx, [esp + 0x260]
push edx
push str.DeleteFile_OK__s_
call fcn.004020a0
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402910
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov ecx, dword [esp + 0x460]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00405622
add esp, 0x45c
ret
Function at 0x402a50
Capabilities:
Delete directory
Delete file
Get common file path
Get program files directory
Get startup folder

Disassembly:
sub esp, 0x61c
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x618], eax
push esi
push str.UsbEntCGService_v4
xor esi, esi
call fcn.004038f0
add esp, 4
test eax, eax
je 0x402b4e
push str.UsbEntCGService2_v4
call fcn.004038f0
add esp, 4
test eax, eax
je 0x402b4e
lea eax, [esp + 4]
push eax
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.UsbEnterRun.exe
call fcn.00405230
add esp, 4
push esi
push 0x18
lea ecx, [esp + 0x214]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4149c8
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0x41c]
push 0x4142e8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.KASHU
lea edx, [esp + 8]
push edx
call esi
push 0x41491c
lea eax, [esp + 8]
push eax
call esi
push str.UsbQuickStart
lea ecx, [esp + 8]
push ecx
call esi
lea edx, [esp + 4]
push edx
call fcn.004028b0
add esp, 4
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x618]
xor ecx, esp
call fcn.00405622
add esp, 0x61c
ret
mov ecx, dword [esp + 0x61c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00405622
add esp, 0x61c
ret
Function at 0x402bd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc10
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0xc0c], eax
push str.UsbEntCGService_v4
lea eax, [esp + 0xa08]
push str.SystemCurrentControlSetServices_s
push eax
call fcn.00402b70
add esp, 0xc
lea ecx, [esp]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0xa10]
push edx
push 0x80000002
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402c8e
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00402a50
test eax, eax
jne 0x402c8e
push 0x41c728
push 0x400
lea ecx, [esp + 0xc]
push ecx
push 0x414414
push str.UNINSTALL_NG
push str.USB_REGIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x40010
call fcn.00404240
push eax
lea edx, [esp + 0xc]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xc0c]
xor ecx, esp
call fcn.00405622
add esp, 0xc10
ret
push esi
push 0x41c930
call fcn.00401000
mov esi, eax
add esp, 4
cmp esi, 0x1f6
je 0x402d69
cmp esi, 0x1f5
je 0x402d24
push 0x41c728
push 0x400
lea eax, [esp + 0x10]
push eax
push 0x414414
push str.ERROR_OTHER
push str.USB_REGIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x810]
push str._s__d_
push edx
call fcn.00402b90
add esp, 0x10
push 0x40010
call fcn.00404240
push eax
lea eax, [esp + 0x810]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc0c]
xor ecx, esp
call fcn.00405622
add esp, 0xc10
ret
call fcn.00402230
test eax, eax
jne 0x402d81
push 0x41c728
push 0x400
lea ecx, [esp + 0x10]
push ecx
push 0x414414
push str.CANNOTINSTALL
push str.USB_REGIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x40010
call fcn.00404240
push eax
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc0c]
xor ecx, esp
call fcn.00405622
add esp, 0xc10
ret
xor esi, esi
call fcn.004023e0
push 0x41c728
push 0x400
test eax, eax
je 0x402dce
lea eax, [esp + 0x10]
push eax
push 0x414414
push str.INSTALL_OK
push str.USB_REGIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x40040
call fcn.00404240
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, 1
jmp 0x402e00
lea edx, [esp + 0x10]
push edx
push 0x414414
push str.INSTALL_NG
push str.USB_REGIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x40010
call fcn.00404240
push eax
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00402390
mov ecx, dword [esp + 0xc10]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00405622
add esp, 0xc10
ret
Function at 0x403740
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x80c
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [esp + 0x818]
push ebx
mov ebx, dword [esp + 0x814]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
push edi
xor esi, esi
push 2
push esi
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4037b2
mov ecx, dword [esp + 0x14]
push esi
push esi
push esi
push esi
push esi
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push ebp
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
je 0x4037b2
mov ebp, 1
jmp 0x4037ec
push 0
push 0x400
lea edx, [esp + 0x20]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1010
push 0
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4037f9
push esi
call ebx
test edi, edi
je 0x403800
push edi
call ebx
mov ecx, dword [esp + 0x818]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00405622
add esp, 0x80c
ret

Function at 0x403820
Capabilities:
Start service

Disassembly:
sub esp, 0x804
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x80c]
push ebp
push esi
push edi
push 0x400f003f
xor esi, esi
push esi
push esi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40387d
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40387d
push ebp
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40387d
mov ebp, 1
jmp 0x4038b3
push 0
push 0x400
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1010
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4038c0
push esi
call ebx
test edi, edi
je 0x4038c7
push edi
call ebx
mov ecx, dword [esp + 0x810]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00405622
add esp, 0x804
ret
Function at 0x4038f0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x824
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x838]
push 2
xor esi, esi
push esi
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
je 0x403984
push 0xf01ff
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x403984
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x14]
push eax
push esi
call ebx
test eax, eax
je 0x403984
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x18], 1
je 0x4039eb
lea ecx, [esp + 0x14]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x403984
push 0x1f4
call edi
lea edx, [esp + 0x14]
push edx
push esi
call ebx
test eax, eax
jne 0x403954
push 0
push 0x400
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1010
push 0
lea ecx, [esp + 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4039c7
push esi
call edi
test ebp, ebp
je 0x4039ce
push ebp
call edi
mov ecx, dword [esp + 0x830]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405622
add esp, 0x824
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x403984
mov dword [esp + 0x10], 1
jmp 0x4039ba
Function at 0x403ef0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x908
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x904], eax
push ebx
push ebp
push edi
mov ebx, ecx
call fcn.00401fa0
test eax, eax
je 0x403f1b
push 6
push esi
call dword [sym.imp.UxTheme.dll_EnableThemeDialogTexture]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x14
push 0xc5
push 0x3ea
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebp
push ebx
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
push 0xd2
push 0x3ea
push esi
call edi
push eax
call ebp
add ebx, 0x40
mov word [0x41c9bc], ax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f67
sub eax, edx
je 0x403f95
push 0x3ea
push esi
call edi
mov ebp, eax
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.00405160
lea ecx, [esp + 0x18]
push ecx
push ebp
call fcn.00405280
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x41c728
push 0x400
lea edx, [esp + 0x118]
push edx
push 0x414414
push str.TITLE_ADMIN_PWINPUT
push str.USB_REGIST
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x110]
push eax
push esi
call ebp
push 0x41c728
push 0x400
lea ecx, [esp + 0x118]
push ecx
push 0x414414
push str.STATIC_PASSWORD
push str.USB_REGIST
call ebx
lea edx, [esp + 0x110]
push edx
push 0x3e9
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea eax, [esp + 0x118]
push eax
push 0x414414
push str.CHECK_DISPPASS
push str.USB_REGIST
call ebx
lea ecx, [esp + 0x110]
push ecx
push 0x3eb
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea edx, [esp + 0x118]
push edx
push 0x414414
push str.BUTTON_OK
push str.USB_REGIST
call ebx
lea eax, [esp + 0x110]
push eax
push 1
push esi
call edi
push eax
call ebp
push 0x41c728
push 0x400
lea ecx, [esp + 0x118]
push ecx
push 0x414414
push str.BUTTON_CANCEL
push str.USB_REGIST
call ebx
lea edx, [esp + 0x110]
push edx
push 2
push esi
call edi
push eax
call ebp
push esi
call fcn.00403400
add esp, 4
pop edi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x904]
xor ecx, esp
call fcn.00405622
add esp, 0x908
ret
Function at 0x4040d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x44
mov eax, dword [0x41b00c]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
sub eax, 1
push esi
push edi
mov esi, ecx
je 0x40417b
sub eax, 1
je 0x404161
sub eax, 0x3e9
jne 0x404150
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebp
push eax
push eax
push pe_nt_image_headers32
push 0x3eb
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebp
test eax, eax
je 0x404123
xor ebx, ebx
jmp 0x40412a
movzx ebx, word [0x41c9bc]
push 0x3ea
push esi
call edi
mov esi, eax
test esi, esi
je 0x40414e
push 0
push ebx
push 0xcc
push esi
call ebp
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebp
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00405622
add esp, 0x44
ret
push 2
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00405622
add esp, 0x44
ret
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0x40
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x3ea
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 8]
push ecx
push 0x40
push edi
call fcn.0040559c
add esp, 0xc
push 1
push esi
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
xor ecx, esp
call fcn.00405622
add esp, 0x44
ret