joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4109ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
push ebx
mov esi, 0x460734
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410a4e
cmp dword [ebp - 4], eax
jbe 0x410a4e
push dword [ebp - 4]
call fcn.0043776e
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.00432d80
add esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ecx, edi
call fcn.00404260
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410a5f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410acf
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x410acf
push dword [ebp + 0x18]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0x14]
call fcn.00405c28
push dword [ebp + 0x10]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0xc]
call fcn.00405caf
mov al, 1
jmp 0x410ad1
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410ad6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x410b26
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247b
push eax
lea ecx, [ebp + 0xc]
call fcn.00401f87
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x410b28
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401fb9
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410b37
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x410b75
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x410b77
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x410b7b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x410bce
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247b
lea ecx, [ebp + 0xc]
lea eax, [eax*2 + 2]
push eax
call fcn.00401edd
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x410bd0
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401ee2
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410bdf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x410c21
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x410c23
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x410c27
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x410c65
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x410c67
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x410c6b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x410ca9
push esi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x410cab
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x410d8b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x410da7
xor al, al
jmp 0x410db9
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret
Function at 0x410dbd
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xabb4
call fcn.00451ed0
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x4a0]
push esi
push eax
mov ebx, ecx
call fcn.00432d80
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x3fff
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x410e9b
test eax, eax
je 0x410e9b
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x410e95
push 0x46112c
lea ecx, [ebp - 0x34]
call fcn.00404260
push eax
lea edx, [ebp - 0x298]
lea ecx, [ebp - 0x68]
call fcn.004043e6
pop ecx
push eax
mov ecx, 0x46e768
call fcn.00403303
lea ecx, [ebp - 0x68]
call fcn.00401ee2
lea ecx, [ebp - 0x34]
call fcn.00401ee2
inc esi
cmp esi, dword [ebp - 4]
jb 0x410e35
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410fdd
xor esi, esi
test eax, eax
je 0x410fdd
xor eax, eax
mov byte [ebp - 0x5c], 0
lea edi, [ebp - 0x5b]
mov dword [ebp - 0xc], 0x2710
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x3fff
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xabb0], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xabb0]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x410fd3
push 0xa
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
call fcn.0043cda6
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x46112c
call fcn.00404260
push eax
lea edx, [ebp - 0xabb0]
lea ecx, [ebp - 0x34]
call fcn.004043e6
pop ecx
push eax
mov ecx, 0x46e780
call fcn.00403303
lea ecx, [ebp - 0x34]
call fcn.00401ee2
lea ecx, [ebp - 0x80]
call fcn.00401ee2
push 0x460750
lea ecx, [ebp - 0x34]
call fcn.00402076
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.004053f2
pop ecx
push eax
mov ecx, 0x46e798
call fcn.00403428
lea ecx, [ebp - 0x80]
call fcn.00401fb9
lea ecx, [ebp - 0x34]
call fcn.00401fb9
push str._regsplt_
lea ecx, [ebp - 0x98]
call fcn.00402076
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x2bb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040209d
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.00402f0f
pop ecx
push eax
mov ecx, 0x46e830
call fcn.00403428
lea ecx, [ebp - 0x80]
call fcn.00401fb9
lea ecx, [ebp - 0x34]
call fcn.00401fb9
lea ecx, [ebp - 0x98]
call fcn.00401fb9
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x410eb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411a94
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
and dword [eax], 0
push edi
push ecx
mov dword [ebp - 4], edx
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x411b14
cmp word [esi + 8], 2
jne 0x411af6
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x411af6
mov edi, dword [esi + 0xc]
jmp 0x411af0
push dword [eax]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.00411a2b
mov ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
test ecx, ecx
je 0x411b0f
lea eax, [ecx + 0x1c]
add edi, 4
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
test eax, eax
jne 0x411acc
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.00439d83
add esp, 0x10
xor eax, eax
jmp 0x411b32
push 8
pop eax
jmp 0x411b32
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x411b30
sub eax, 1
je 0x411b42
sub eax, 1
je 0x411b3b
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x2afb
jmp 0x411b32
mov eax, 0x2afa
jmp 0x411b32
Function at 0x41212a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x46fcf4], 0
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x411ce2
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x411f62
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.00411ca4
jne 0x41228c
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x412282
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
mov ebx, 0x10c
push eax
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.0043caac
push str.ws2_32
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.0043cb06
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
xor edi, edi
test esi, esi
je 0x4121e9
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4121e5
push esi
call ebx
mov esi, edi
test esi, esi
jne 0x412243
lea eax, [ebp - 0x22c]
mov esi, 0x10c
push eax
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.0043caac
push str.wship6
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.0043cb06
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41227f
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41223f
push esi
call ebx
mov esi, edi
test esi, esi
je 0x41227f
mov ebx, edi
push dword [ebp + ebx*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + ebx*8 - 0x14], eax
test eax, eax
je 0x412260
inc ebx
cmp ebx, 3
jl 0x412245
jmp 0x412269
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, edi
test esi, esi
je 0x41227f
mov eax, dword [ebp + edi - 0x14]
mov dword [edi + 0x46c9ec], eax
add edi, 8
cmp edi, 0x18
jl 0x41226d
pop edi
pop esi
pop ebx
mov dword [0x46fcf4], 1
mov eax, dword [0x46c9ec]
mov esp, ebp
pop ebp
ret
Function at 0x414091
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push str._sysinfo.txt
push str.temp
call fcn.00437aef
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.00404260
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00403098
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee2
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push ebx
push eax
mov edx, 0x4669d4
lea ecx, [ebp - 0x30]
call fcn.00409e9e
pop ecx
mov ecx, eax
call fcn.00401edd
push eax
push str.dxdiag
push 0x46075c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x30]
call fcn.00401ee2
lea ecx, [ebp - 0x18]
call fcn.004020c7
mov esi, ebx
lea ecx, [ebp - 0x48]
call fcn.00401edd
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.004183cc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x18]
inc esi
call fcn.00409dea
test al, al
je 0x414138
cmp esi, 0x4b0
jl 0x414109
lea ecx, [ebp - 0x18]
call fcn.00409dea
test al, al
jne 0x4141c8
lea ecx, [ebp - 0x48]
call fcn.00401edd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea ecx, [ebp - 0xc8]
call fcn.004047ef
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004049de
test al, al
je 0x4141bd
sub esp, 0x18
lea eax, [ebp - 0x18]
mov esi, esp
lea edx, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
push 0x46e250
call fcn.00402fa9
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00402f85
pop ecx
push 0x97
lea ecx, [ebp - 0xc8]
call fcn.00404bb7
lea ecx, [ebp - 0x30]
call fcn.00401fb9
lea ecx, [ebp - 0xc8]
call fcn.00404f18
mov bl, 1
lea ecx, [ebp - 0xc8]
call fcn.00404fd6
lea ecx, [ebp - 0x18]
call fcn.00401fb9
lea ecx, [ebp - 0x48]
call fcn.00401ee2
lea ecx, [ebp + 8]
call fcn.00401fb9
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414719
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
lea eax, [ebp + 8]
lea ecx, [ebp - 0x84]
push ebx
push esi
push edi
push eax
push str._nF2
call fcn.00402076
push eax
push str.Temp
call fcn.00437afa
pop ecx
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.004053f2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00402f85
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.00401fb9
lea ecx, [ebp - 0x84]
call fcn.00401fb9
push ecx
push ecx
push 0x10
lea ecx, [ebp - 0x18]
call fcn.00401f87
push eax
lea ecx, [ebp - 0x138]
call fcn.0040d58e
lea ecx, [ebp - 0x138]
call fcn.00414956
test al, al
je 0x41484a
lea edx, [ebp + 0x20]
lea ecx, [ebp - 0x138]
call fcn.00414966
lea ecx, [ebp - 0x138]
call fcn.0040d53f
and dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x18]
and dword [ebp - 0x48], 0
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
call fcn.00401f87
movaps xmm0, xmmword [0x4671b0]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
movups xmmword [ebp - 0x40], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
mov esi, 0x460734
mov edi, 0x46e8e0
setne bl
cmp dword [ebp - 0x1c], 0
je 0x414834
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402076
push 0x70
mov ecx, edi
call fcn.00404bb7
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00401f87
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp bl, 1
jne 0x414865
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402076
push 0x6e
mov ecx, edi
jmp 0x414860
sub esp, 0x18
mov ecx, esp
push 0x460734
call fcn.00402076
push 0x6f
mov ecx, 0x46e8e0
call fcn.00404bb7
lea ecx, [ebp - 0x138]
call fcn.0040cc8c
lea ecx, [ebp - 0x18]
call fcn.00401fb9
lea ecx, [ebp + 8]
call fcn.00401fb9
lea ecx, [ebp + 0x20]
call fcn.00401fb9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416141
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4b4
push ebx
push esi
push edi
mov edi, ecx
mov bl, dl
push 0x466a54
push edi
lea ecx, [esp + 0x48]
call fcn.00404260
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00403098
pop ecx
lea ecx, [esp + 0x40]
call fcn.00401ee2
push 0
mov dl, bl
lea ecx, [esp + 0x6c]
call fcn.004152ea
pop ecx
lea ecx, [esp + 0x68]
call fcn.0040247b
push eax
lea ecx, [esp + 0x6c]
call fcn.00401f87
push eax
call dword [0x46dd00]
push ecx
mov esi, eax
lea ecx, [esp + 0x5c]
push esi
call fcn.00414e19
lea edx, [esp + 0x80]
mov ecx, str.image_png
call fcn.00415656
push ecx
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x30]
call fcn.00401edd
push eax
lea ecx, [esp + 0x64]
call fcn.00414e91
mov eax, dword [esi]
push esi
call dword [eax + 8]
push 0x1b
mov ecx, 0x46e3a4
call fcn.00401e3b
mov ecx, eax
call fcn.00401f87
cmp byte [eax], 1
jne 0x4162e9
lea ecx, [esp + 0x10]
call fcn.004020c7
lea ecx, [esp + 0x28]
call fcn.00401edd
lea edx, [esp + 0x10]
mov ecx, eax
call fcn.004183cc
test al, al
je 0x4162e0
lea ecx, [esp + 0x28]
call fcn.00401edd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x46e5f0
mov ecx, esi
call fcn.0040247b
push eax
mov ecx, esi
call fcn.00401f87
push eax
lea ecx, [esp + 0xc8]
call fcn.00405c28
lea ecx, [esp + 0x10]
call fcn.0040247b
push eax
lea ecx, [esp + 0x14]
call fcn.00401f87
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0xcc]
call fcn.00405d50
push 0x466a70
push edi
lea ecx, [esp + 0xb0]
call fcn.00404260
mov edx, eax
lea ecx, [esp + 0x94]
call fcn.00403098
pop ecx
lea ecx, [esp + 0xa8]
call fcn.00401ee2
lea ecx, [esp + 0x90]
call fcn.00401edd
sub esp, 0x18
mov esi, eax
lea eax, [esp + 0x58]
mov ecx, esp
push eax
call fcn.004020de
mov ecx, esi
call fcn.0041843e
add esp, 0x18
lea ecx, [esp + 0x90]
call fcn.00401ee2
lea ecx, [esp + 0x40]
call fcn.00401fb9
lea ecx, [esp + 0x10]
call fcn.00401fb9
lea ecx, [esp + 0x58]
call fcn.00414e3f
lea ecx, [esp + 0x68]
call fcn.00401fb9
lea ecx, [esp + 0x28]
call fcn.00401ee2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416dcf
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x20
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x20
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401edd
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416e07
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x416e25
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416e36
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x11
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf003f
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401edd
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416e71
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x416ec2
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x416e92
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov bl, 2
jmp 0x416ec2
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x416e92
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
neg eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 3
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416ed3
Capabilities:
Pause service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x40
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401edd
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416f0b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x416f29
lea eax, [ebp - 0x1c]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416f3a
Capabilities:
Continue service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x40
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401edd
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416f72
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x416f90
lea eax, [ebp - 0x1c]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416fa1
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
xor ebx, ebx
mov byte [ebp - 1], cl
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 2
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401edd
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416fda
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x41701e
movzx eax, byte [ebp - 1]
or ecx, 0xffffffff
sub eax, ebx
je 0x416ff7
sub eax, 1
je 0x416ff3
sub eax, 1
jne 0x416ffa
push 3
jmp 0x416ff9
push 2
jmp 0x416ff9
push 4
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee2
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417043
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
lea ecx, [esp]
mov dl, 0x30
push esi
push edi
push str.alarm.wav
call fcn.004189ff
pop ecx
lea ecx, [esp + 8]
call fcn.00401edd
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4170dc
mov edi, 0x46eb48
mov edx, 0x460734
mov ecx, edi
call fcn.00405c1b
test al, al
je 0x4170bc
sub esp, 0x18
cmp byte [0x46de9b], 0
mov ecx, esp
push 0x466b0c
je 0x4170a6
call fcn.00402076
mov ecx, 0x46eb60
jmp 0x4170b0
call fcn.00402076
mov ecx, 0x46e848
push 0xa1
call fcn.00404bb7
jmp 0x4170ec
lea ecx, [esp + 8]
call fcn.00401edd
sub esp, 0x18
mov esi, eax
mov ecx, esp
push edi
call fcn.004020de
mov ecx, esi
call fcn.0041843e
add esp, 0x18
lea ecx, [esp + 8]
call fcn.00401edd
mov ecx, eax
call fcn.004170fb
lea ecx, [esp + 8]
call fcn.00401ee2
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417150
Capabilities:
Check if file exists

Disassembly:
push ebx
push ecx
mov ecx, 0x46eb48
mov bl, dl
call fcn.00401f9f
test bl, bl
je 0x417168
pop ebx
jmp fcn.00417043
mov byte [0x46de98], 1
pop ebx
ret