joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__spawnvpe
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__spawnvpe
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret

Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__spawnvpe
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__spawnvpe
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret

Function at 0x7815f002
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x7815f011
pop dword [ebp - 0x50]
mov eax, 0x6da063a9
add eax, 0xa758c68
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x41121
push 0
mov eax, 0xf32b22bb
add eax, 0x84ee1e05
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x42f5
xor edi, edi
add edi, eax
mov ebx, 0x781cb000
add ebx, dword [ebp - 0x50]
mov edx, 0x87424121
mov dword [ebp - 8], 0x21d3f35a
mov esi, dword [ebx]
sub dword [ebp - 0x2c], 0x77c3b655
add esi, edx
xor dword [ebp - 0x40], edi
mov dword [edi], esi
mov dword [ebp - 0x48], 0x32f06125
add edi, 0x8528cd45
sub edi, 0x8528cd41
add ebx, 0x6ceadd37
sub ebx, 0x6ceadd33
loop 0x7815f060
add eax, 0x5705f978
add eax, 0xa8fb052f
mov ebx, eax
add eax, 0x6aecf3ee
sub eax, 0x6aecf3e9
mov ecx, 0x78130000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401fb4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x2c
push 1
mov ebx, 0x1bc
call fcn.00427a00
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402000
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x402011
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402038
push 0x36
push 0x40101bc
push 6
call fcn.00426cc5
add esp, 0xc
push 0
push 0
push 0
push 0x80000301
push 0
push 3
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40205d
mov eax, 0x45134f
push eax
push 3
mov ebx, 0x19c
call fcn.00427b30
add esp, 0x28
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, 0x80000101
jne 0x402091
and eax, 0xff
jmp 0x4020e6
cmp ecx, 0x80000201
jne 0x40209c
cwde
jmp 0x4020e6
cmp ecx, 0x80000301
je 0x4020e6
cmp ecx, 0x80000401
je 0x4020e6
mov dword [ebp - 0x1c], eax
cmp ecx, 0x80000501
je 0x4020d6
cmp ecx, 0x80000601
je 0x4020db
push 0x69
push 0x40101bc
push 2
call fcn.00426cc5
add esp, 0xc
fld dword [ebp - 0x1c]
jmp 0x4020e1
mov dword [ebp - 0x18], edx
fld qword [ebp - 0x1c]
call fcn.00401f8d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
je 0x402101
cmp dword [ebp - 8], 9
je 0x402101
xor eax, eax
jmp 0x402106
mov eax, 1
jmp 0x40210b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40211c
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x402d5d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00427ec0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402da2
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402db9
mov eax, 0x45131a
push eax
push 1
mov ebx, 0x130
call fcn.00427e60
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402dff
push 0x73
push 0x401045c
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402e2d
mov eax, dword [ebp - 4]
test eax, eax
je 0x402e28
push eax
mov ebx, eax
call fcn.0040109d
inc eax
push eax
call fcn.00426cb9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x402e37
mov eax, 0x45131a
jmp 0x402e37
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402e48
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4078dc
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0xf0000000
push 0x18
push 0x45131a
push 0x45131a
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x407934
push 0x24
push 0x40103aa
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x407999
mov dword [ebp - 0xc], esp
push 0
push 0x18
push 0x45131a
push 0x45131a
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x407982
push 0x7d
push 0x40103aa
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x407999
mov eax, 0x45134f
jmp 0x407a12
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00407a2a
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4079be
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4079f3
push 0x120
push 0x40103aa
push 6
call fcn.00426cc5
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x407a0d
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00426cb9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407a12
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x407a23
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41065e
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x1c
call fcn.00426cb9
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push closesocket
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4106d1
push 0x19
push 0x4010057
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4107c1
mov dword [ebp - 0x14], esp
push closesocket
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410714
push 0x93
push 0x4010057
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410795
mov dword [ebp - 0x14], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410750
push 0x102
push 0x4010057
push 6
call fcn.00426cc5
add esp, 0xc
test eax, eax
je 0x410769
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410795
push 0x150
push 0x4010057
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4107c1
push 0x16c
push 0x4010057
push 6
call fcn.00426cc5
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x4107c9
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00426cbf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41359a
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4135f0
push 0x19
push 0x401006b
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4136fe
push 0x80000301
push 0
push 0x10000
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 3
mov ebx, 0xc8
call fcn.00427cd0
add esp, 0x28
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41366a
push 0xbe
push 0x401006b
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4136d2
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4136a3
push 0x13d
push 0x401006b
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4136d2
push 0x158
push 0x401006b
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4136fe
push 0x174
push 0x401006b
push 6
call fcn.00426cc5
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x413706
mov esp, ebp
pop ebp
ret 4
Function at 0x4139f5
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413a4b
push 0x19
push 0x4010069
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413c45
mov dword [ebp - 0x10], esp
push 0xf01ff
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413a8e
push 0x97
push 0x4010069
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x413c19
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00428e30
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00428e30
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00428e30
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00428e30
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00428e30
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0xffffffff
push 0xffffffff
push 0xffffffff
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x413b94
push 0x1c5
push 0x4010069
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x413ba7
push ebx
call fcn.00426cbf
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x413bb7
push ebx
call fcn.00426cbf
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x413bc7
push ebx
call fcn.00426cbf
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x413bd7
push ebx
call fcn.00426cbf
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x413be7
push ebx
call fcn.00426cbf
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413c19
push 0x1e3
push 0x4010069
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413c45
push 0x1ff
push 0x4010069
push 6
call fcn.00426cc5
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x413c4d
mov esp, ebp
pop ebp
ret 8
Function at 0x413c53
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413ca9
push 0x19
push 0x4010066
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413d8a
mov dword [ebp - 0x10], esp
push 0x10
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413cec
push 0x97
push 0x4010066
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x413d5e
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413d2f
push 0x10d
push 0x4010066
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413d5e
push 0x13a
push 0x4010066
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413d8a
push 0x156
push 0x4010066
push 6
call fcn.00426cc5
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x413d92
mov esp, ebp
pop ebp
ret 4
Function at 0x413d98
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x28], 0
mov eax, 0
sete al
test eax, eax
je 0x413dcd
mov eax, 0x10
jmp 0x413dd0
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
test eax, eax
je 0x413df1
mov eax, 3
jmp 0x413df4
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
mov dword [ebp - 0xc], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x413e2f
push 0xc7
push 0x4010065
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413f7a
cmp dword [ebp + 0x1c], 0
je 0x413e71
push 0x80000301
push 0
push 0x100
push 0x80000301
push 0
push dword [ebp + 0x24]
push 2
mov ebx, 0xc8
call fcn.00427cd0
add esp, 0x1c
mov dword [ebp + 0x24], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00428e30
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x44]
push dword [ebx]
mov ebx, dword [ebp + 0x3c]
push dword [ebx]
mov ebx, dword [ebp + 0x34]
push dword [ebx]
push 0
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 1
push dword [ebp + 0x2c]
push dword [ebp + 0x24]
push 0xf01ff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x413ef4
push 0x1e0
push 0x4010065
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x413f07
push ebx
call fcn.00426cbf
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x413f22
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00413f91
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x413f4e
push 0x275
push 0x4010065
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x413f7a
push 0x28f
push 0x4010065
push 6
call fcn.00426cc5
add esp, 0xc
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x413f8b
mov esp, ebp
pop ebp
ret 0x44
Function at 0x413f91
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 0x20000000
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x413fee
push 0x19
push 0x4010068
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414109
mov dword [ebp - 0x14], esp
push 2
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x414031
push 0x93
push 0x4010068
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4140dd
mov dword [ebp - 0x14], esp
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyn]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x414076
push 0x109
push 0x4010068
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4140ae
push 0x14d
push 0x4010068
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4140dd
push 0x178
push 0x4010068
push 6
call fcn.00426cc5
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x414109
push 0x194
push 0x4010068
push 6
call fcn.00426cc5
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x414111
mov esp, ebp
pop ebp
ret 8