joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100082a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0xf0000000
push 1
xor edi, edi
mov dword [ebp - 0xc], ecx
push edi
push edi
lea eax, [ebp - 4]
mov ebx, edx
push eax
mov dword [ebp - 8], ebx
call dword [0x1000a014]
test eax, eax
je 0x10008392
xor ecx, ecx
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x1a
jb 0x100082d0
push 0x40
push 0x3000
inc ebx
push ebx
push 0
call dword [0x1000a144]
mov esi, eax
test esi, esi
je 0x1000839b
cmp dword [ebp - 8], ebx
jae 0x1000839b
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x70797243
push eax
mov dword [ebp - 0x28], 0x6e654774
mov dword [ebp - 0x24], 0x646e6152
mov word [ebp - 0x20], 0x6d6f
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x1c], 0x61766441
mov dword [ebp - 0x18], 0x32336970
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
call dword [0x1000a140]
test eax, eax
jne 0x10008355
lea eax, [ebp - 0x1c]
push eax
call dword [0x1000a0fc]
test eax, eax
je 0x10008379
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [0x1000a148]
test eax, eax
je 0x10008379
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call eax
test eax, eax
mov ecx, 1
cmovne edi, ecx
push 0
push dword [ebp - 4]
call dword [0x1000a01c]
push 0x8000
push 0
push esi
call dword [0x1000a104]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 4]
call dword [0x1000a01c]
push 0x8000
push 0
push esi
call dword [0x1000a104]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401090
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov ebx, ecx
xorps xmm0, xmm0
push eax
push ebx
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40126d
cmp dword [ebp - 0x1c], 0
jl 0x40126b
jg 0x4010cf
cmp dword [ebp - 0x20], 0x40
jb 0x40126b
push 0x108
call fcn.0047657a
mov edi, eax
add esp, 4
test edi, edi
je 0x40126b
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x10], xmm0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov esi, eax
test esi, esi
je 0x401259
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x401259
cmp dword [ebp - 4], 0x40
jne 0x4011c3
test esi, esi
je 0x401259
mov eax, 0x5a4d
xor esi, esi
cmp ax, word [edi]
jne 0x401259
mov eax, dword [edi + 0x3c]
mov dword [ebp - 8], eax
test eax, eax
jle 0x401259
cdq
mov ecx, edx
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 0x24], ecx
add edx, 0x108
adc ecx, esi
cmp dword [ebp - 0x1c], ecx
jl 0x401259
jg 0x401181
cmp dword [ebp - 0x20], edx
jb 0x401259
push 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 4], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov esi, eax
test esi, esi
je 0x401259
push 0
lea eax, [ebp - 4]
push eax
push 0x108
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x401259
cmp dword [ebp - 4], 0x108
je 0x4011d7
push edi
xor esi, esi
call fcn.0047367f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x401259
xor esi, esi
cmp dword [edi], 0x4550
jne 0x401259
movzx eax, word [edi + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x40120f
mov ebx, dword [ebp - 0xc]
mov ecx, 0x98
mov esi, dword [edi + 0x9c]
add ebx, 0x58
mov edx, dword [edi + 0x98]
mov eax, dword [ebp - 8]
jmp 0x401230
mov ecx, 0x20b
cmp ax, cx
jne 0x401259
mov eax, dword [ebp - 8]
mov ecx, 0xa8
mov esi, dword [edi + 0xac]
mov edx, dword [edi + 0xa8]
lea ebx, [eax + 0x58]
add eax, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], esi
cmp eax, dword [ebp - 0x1c]
jl 0x401254
jg 0x40124e
cmp edx, dword [ebp - 0x20]
jbe 0x401254
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov esi, 1
push edi
call fcn.0047367f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 4], edx
mov edi, ecx
movlpd qword [ebp - 0x14], xmm0
xor esi, esi
mov dword [ebp - 8], edi
xor ebx, ebx
movups xmmword [ebp - 0x24], xmm0
test edx, edx
je 0x401e4e
lea edx, [ebp - 0x24]
call fcn.00401090
mov esi, eax
test esi, esi
je 0x401e4e
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, eax
test esi, esi
je 0x401e4e
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov edi, dword [ebp - 0x10]
lea eax, [ecx + 0x298]
test edi, edi
jl 0x401e4e
mov edx, dword [ebp - 0x14]
jg 0x401ddb
cmp edx, eax
jbe 0x401e4e
mov eax, 0xfffffd68
sub eax, ecx
mov ecx, 0xffffffff
push 0x4b8
sbb ecx, ebx
add edx, eax
mov dword [ebp - 0x14], edx
adc edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0047657a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x401e4e
push 0
push 0
push dword [ebp - 0x10]
lea edi, [ebx + 0x220]
mov dword [ebp - 0xc], esi
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov esi, eax
test esi, esi
je 0x401e4e
push 0
lea eax, [ebp - 0xc]
push eax
push 0x298
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x401e4e
cmp dword [ebp - 0xc], 0x298
je 0x401e6d
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [edi], 0
test ebx, ebx
je 0x401e64
push ebx
call fcn.0047367f
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x401e4e
xor esi, esi
cmp dword [edi], 0x63576c6f
jne 0x401e4e
cmp dword [edi + 0x290], esi
jne 0x401e4e
cmp dword [edi + 0x294], 0x6232383d
jne 0x401e4e
cmp dword [edi + 0x84], 1
jne 0x401e4e
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
push 0x4d9af0
push ecx
lea ecx, [ebx + 0x20]
mov dword [ebp - 0xc], 0x200
mov dword [eax], 3
lea eax, [edi + 0x90]
push eax
call fcn.004023c0
add esp, 0xc
test eax, eax
jne 0x401e4e
cmp dword [ebp - 0xc], 0x2f
jne 0x401f78
lea ecx, [ebx + 0x20]
mov edx, str.0_0_t
lea esi, [eax + 0xb]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x401f78
add ecx, 4
add edx, 4
sub esi, 4
jae 0x401ee0
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x401f78
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x401f78
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x24]
push ebx
call fcn.00401630
mov esi, eax
add esp, 8
test esi, esi
je 0x401e4e
lea edx, [ebx + 0x2f]
mov ecx, ebx
mov esi, 0x1c
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x401f58
add ecx, 4
add edx, 4
sub esi, 4
jae 0x401f30
push ebx
mov esi, 1
call fcn.0047367f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, 1
push ebx
mov dword [eax], 1
call fcn.0047367f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, 1
push ebx
mov dword [eax], 0
call fcn.0047367f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403a70
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, dword [edi + 0x20]
and esi, 0x3f
mov byte [esi + edi + 0x28], 0x80
inc esi
cmp esi, 0x38
je 0x403aa7
nop dword [eax]
and esi, 0x3f
jne 0x403a9c
mov ecx, edi
call fcn.00402ca0
mov byte [esi + edi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x403a90
mov edx, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
shld ecx, edx, 3
mov eax, ecx
shl edx, 3
shr eax, 0x18
mov byte [edi + 0x60], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 0x61], al
mov eax, ecx
shr eax, 8
mov byte [edi + 0x62], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 0x64], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0x65], al
mov eax, edx
mov byte [edi + 0x63], cl
mov ecx, edi
shr eax, 8
mov byte [edi + 0x66], al
mov byte [edi + 0x67], dl
call fcn.00402ca0
mov esi, dword [ebp - 4]
xor ebx, ebx
add esi, 6
nop dword [eax]
mov ecx, dword [edi + ebx*4]
lea esi, [esi + 8]
mov edx, dword [edi + ebx*4 + 4]
mov eax, ecx
shr eax, 0x18
add ebx, 2
mov byte [esi - 0xe], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 0xd], al
mov eax, ecx
shr eax, 8
mov byte [esi - 0xc], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 0xa], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 9], al
mov eax, edx
shr eax, 8
mov byte [esi - 0xb], cl
mov byte [esi - 8], al
mov byte [esi - 7], dl
cmp ebx, 8
jb 0x403b00
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00408f10
push 1
push 3
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.004090e0
lea eax, [ebp - 0xbc]
push 0x4b980c
push eax
call fcn.00406330
add esp, 8
mov ecx, eax
push 0x4070a0
call fcn.00409910
push 0x4070a0
mov ecx, eax
call fcn.00409910
push esi
lea eax, [ebp - 0xbc]
push str.Library_:
push eax
call fcn.00406330
add esp, 8
push eax
call fcn.00406330
add esp, 8
mov ecx, eax
push 0x4070a0
call fcn.00409910
push 0x4070a0
mov ecx, eax
call fcn.00409910
push 0
push str.Error
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0040dae0
mov ecx, eax
call fcn.0040cbd0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x1c]
call fcn.004053c0
push 0xffffffffffffffff
call fcn.00473af6
int3
Function at 0x40e130
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 1
je 0x40e188
mov ebx, dword [ebp + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3c]
push eax
push 0x24
push esi
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40e19b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx]
cmp eax, 0x7530
ja 0x40e2d8
cmp dword [esi + 4], 1
jne 0x40e152
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x20
mov dword [ebp - 0x38], eax
call fcn.00445142
movups xmm0, xmmword [str.QueryServiceStatusEx_failed:]
mov dword [ebp - 0xc], 0x1d
add esp, 4
mov dword [ebp - 8], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x4ba304]
movq qword [eax + 0x10], xmm0
mov ecx, dword [0x4ba30c]
mov dword [eax + 0x18], ecx
mov cl, byte [0x4ba310]
mov byte [eax + 0x1c], cl
lea ecx, [ebp - 0x1c]
push 1
mov byte [eax + 0x1d], 0
push 0x4b941c
mov dword [ebp - 0x1c], eax
call fcn.00405d50
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00406ec0
add esp, 8
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x40e216
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405d50
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x40e254
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e24a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e2eb
push edx
push ecx
call fcn.00445172
add esp, 8
cmp dword [ebp - 8], 0x10
lea esi, [ebp - 0x1c]
mov edi, dword [ebp - 0xc]
cmovae esi, dword [ebp - 0x1c]
push 0x4b93f8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40e2a8
push str.writeLog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e2a8
push edi
push esi
push str.queryStatus
push 0x11
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 4
call eax
add esp, 0x18
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x40e2d8
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e2ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e2eb
push edx
push ecx
call fcn.00445172
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044518e
mov esp, ebp
pop ebp
ret
call fcn.0047357c
int3
Function at 0x40e300
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 1
je 0x40e358
mov ebx, dword [ebp + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3c]
push eax
push 0x24
push esi
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40e36b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx]
cmp eax, 0x7530
ja 0x40e4a8
cmp dword [esi + 4], 1
jne 0x40e322
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x20
mov dword [ebp - 0x38], eax
call fcn.00445142
movups xmm0, xmmword [str.QueryServiceStatusEx_failed:]
mov dword [ebp - 0xc], 0x1d
add esp, 4
mov dword [ebp - 8], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x4ba304]
movq qword [eax + 0x10], xmm0
mov ecx, dword [0x4ba30c]
mov dword [eax + 0x18], ecx
mov cl, byte [0x4ba310]
mov byte [eax + 0x1c], cl
lea ecx, [ebp - 0x1c]
push 1
mov byte [eax + 0x1d], 0
push 0x4b941c
mov dword [ebp - 0x1c], eax
call fcn.00405d50
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00406ec0
add esp, 8
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x40e3e6
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405d50
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x40e424
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e41a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e4bb
push edx
push ecx
call fcn.00445172
add esp, 8
cmp dword [ebp - 8], 0x10
lea esi, [ebp - 0x1c]
mov edi, dword [ebp - 0xc]
cmovae esi, dword [ebp - 0x1c]
push 0x4b93f8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40e478
push str.writeLog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e478
push edi
push esi
push str.queryStatus
push 0x11
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 4
call eax
add esp, 0x18
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x40e4a8
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e49e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e4bb
push edx
push ecx
call fcn.00445172
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044518e
mov esp, ebp
pop ebp
ret
call fcn.0047357c
int3
Function at 0x40e9e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0x2c], ebx
mov byte [ebx], 0
call fcn.0040f150
add esp, 8
test al, al
jne 0x40ea1f
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 1
jne 0x40ea58
push str.service_is_already_stoped
push str.doRestartService
push 0x9a
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 2
call fcn.0040e610
add esp, 0x14
mov byte [ebx], 1
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], esi
cmp eax, 3
jne 0x40eac6
mov ecx, 0x2710
mov eax, 0xcccccccd
mul dword [ebp - 0x10]
shr edx, 3
cmp edx, 0x3e8
jae 0x40ea8d
mov edx, 0x3e8
jmp 0x40ea96
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0040f150
add esp, 8
test al, al
je 0x40eb02
call ebx
sub eax, esi
cmp eax, 0x7530
ja 0x40eb02
mov eax, dword [ebp - 0x24]
mov ecx, 0x2710
cmp eax, 3
je 0x40ea73
cmp eax, 1
jne 0x40eb16
push str.wait_stoped
push str.doRestartService
push 0xa9
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 2
call fcn.0040e8a0
mov eax, dword [ebp - 0x2c]
add esp, 0x14
mov byte [eax], 1
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
push str.wait_stop_pending_failed
push str.doRestartService
push 0xa4
jmp 0x40eba0
lea eax, [ebp - 0x28]
push eax
push 0xcc
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40eb78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push str.__error_code:
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0xcc
push eax
push str.control_service_fail__ctl_code:
push str.doRestartService
push 0xaf
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 2
call fcn.0040e750
add esp, 0x20
xor al, al
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0040e300
add esp, 0xc
test al, al
jne 0x40eaef
push str.wait_stop_timeout_failed
push str.doRestartService
push 0xb4
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 4
call fcn.0040e4d0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor al, al
pop esi
pop edi
pop ebx
call fcn.0044518e
mov esp, ebp
pop ebp
ret
Function at 0x40ef80
Capabilities:
Check for time delay via gettickcount
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0040f150
add esp, 8
test al, al
jne 0x40efb4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 1
jne 0x40efe6
push str.service_is_already_stoped
push str.doStopService
push 0x73
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 2
call fcn.0040e610
add esp, 0x14
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
mov esi, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], esi
cmp eax, 3
jne 0x40f055
mov ecx, 0x2710
mov eax, 0xcccccccd
mul dword [ebp - 0x10]
shr edx, 3
cmp edx, 0x3e8
jae 0x40f01c
mov edx, 0x3e8
jmp 0x40f025
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0040f150
add esp, 8
test al, al
je 0x40f08b
call ebx
sub eax, esi
cmp eax, 0x7530
ja 0x40f08b
mov eax, dword [ebp - 0x24]
mov ecx, 0x2710
cmp eax, 3
je 0x40f002
cmp eax, 1
jne 0x40f09c
push str.wait_stoped
push str.doStopService
push 0x81
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 2
call fcn.0040e8a0
add esp, 0x14
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
push str.wait_stop_pending_failed
push str.doStopService
push 0x7c
jmp 0x40f123
lea eax, [ebp - 0x28]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40f0fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push str.__error_code:
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
push str.control_service_fail__ctl_code:
push str.doStopService
push 0x86
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 2
call fcn.0040e750
add esp, 0x20
xor al, al
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0040e130
add esp, 0xc
test al, al
jne 0x40f078
push str.wait_stop_timeout_failed
push str.doStopService
push 0x8b
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 4
call fcn.0040e4d0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor al, al
pop esi
pop ebx
pop edi
call fcn.0044518e
mov esp, ebp
pop ebp
ret
Function at 0x40f150
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4d9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x3c]
mov ecx, dword [ebp + 8]
push edx
push 0x24
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x40f2d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x20
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.00405c90
movups xmm0, xmmword [str.QueryServiceStatusEx_failed:]
mov edx, eax
mov dword [ebp - 0xc], 0x1d
mov dword [ebp - 8], 0x1f
push 1
push 0x4b941c
movups xmmword [edx], xmm0
movq xmm0, qword [0x4ba304]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x4ba30c]
mov dword [edx + 0x18], ecx
lea ecx, [ebp - 0x1c]
mov al, byte [0x4ba310]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
mov dword [ebp - 0x1c], edx
call fcn.00405d50
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00406ec0
add esp, 8
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x40f20c
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405d50
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x40f24a
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40f240
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f2e0
push edx
push ecx
call fcn.00445172
add esp, 8
cmp dword [ebp - 8], 0x10
push esi
push edi
mov edi, dword [ebp - 0xc]
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push 0x4b93f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40f28e
push str.writeLog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f28e
push edi
push esi
push str.queryStatus
push 0x11
push str.c:jks_qsafeworkspacexwolfqaxdefenderHelper_trayinstall_functions.cpp
push 4
call eax
add esp, 0x18
mov edx, dword [ebp - 8]
pop edi
pop esi
cmp edx, 0x10
jb 0x40f2c0
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40f2b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f2e5
push edx
push ecx
call fcn.00445172
add esp, 8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0044518e
mov esp, ebp
pop ebp
ret
call fcn.0047357c
call fcn.0047357c
int3