joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44755b
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
cmp dword [edi + 0x48], ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
je 0x447676
mov edx, dword [edi + 0x18]
test edx, edx
je 0x447676
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x420]
jne 0x447599
sub ecx, esi
sar ecx, 1
cmp ecx, 6
jbe 0x447676
push 0x5c
push edx
call dword [sym.imp.msvcrt.dll_wcsrchr]
push dword [edi + 0x18]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push 0x41edc8
push 4
pop esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
call fcn.00440126
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
add esp, 0x10
test eax, eax
je 0x4475f0
xor ecx, ecx
mov word [eax], cx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x447676
lea ecx, reloc.ADVAPI32.dll_TraceMessage
test ecx, ecx
je 0x447618
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [edi + 0x18]
mov eax, esi
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c88c
mov eax, esi
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x44763f
xor ecx, ecx
mov word [eax + 2], cx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x44766d
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [edi + 0x18]
call fcn.004425ca
push dword [edi + 0x18]
jmp 0x447674
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call ebx
xor esi, esi
cmp dword [edi + 0x4c], esi
je 0x447690
cmp dword [ebp + 8], esi
je 0x447690
cmp dword [edi + 0x1c], esi
je 0x447690
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x50], esi
je 0x4476aa
mov edx, dword [edi + 0x28]
test edx, edx
je 0x4476aa
call fcn.00440b2f
test eax, eax
je 0x4476aa
push dword [edi + 0x28]
call ebx
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4
Function at 0x4477d3
Capabilities:
Get common file path
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push edi
lea edi, [esi + 4]
call fcn.0044056c
mov ebx, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
test ebx, ebx
js 0x4478d8
mov eax, esi
call fcn.004476bf
cmp dword [esi + 0x84], 0
je 0x4478d8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4478d8
lea ecx, reloc.ADVAPI32.dll_TraceMessage
test ecx, ecx
je 0x447844
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [edi]
mov eax, 0x104
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8f1
mov eax, edi
push eax
call fcn.00440bc3
test eax, eax
je 0x4478d8
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, reloc.ADVAPI32.dll_TraceMessage
je 0x4478d2
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x4478cb
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor ecx, ecx
or ecx, eax
or edx, edi
cmp ecx, dword [esi + 0x70]
jne 0x4478cb
cmp edx, dword [esi + 0x74]
jne 0x4478cb
lea edi, [esi + 0x1c]
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0044056c
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [ebp - 8]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4
Function at 0x447d37
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea edi, [esi + 0x68]
cmp dword [edi], 0
jne 0x447de6
cmp dword [edi + 4], 0
jne 0x447de6
mov eax, dword [esi + 0x2c]
cmp eax, 1
je 0x447d91
jle 0x447de6
cmp eax, 4
jle 0x447d6d
cmp eax, 6
jne 0x447de6
mov ebx, dword [esi + 0x18]
test ebx, ebx
je 0x447d83
mov ecx, dword [esi + 0x14]
call fcn.00458c20
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x447de6
push 0x41ee64
push 2
call fcn.004400fc
jmp 0x447de6
push dword [esi + 0x18]
and dword [ebp - 4], 0
call fcn.00440bc3
test eax, eax
je 0x447de6
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, reloc.ADVAPI32.dll_TraceMessage
je 0x447de6
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x447ddf
mov edx, dword [ebp - 4]
xor ecx, ecx
or ecx, eax
mov dword [edi], ecx
mov dword [edi + 4], edx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x54], 0
jne 0x447e16
cmp dword [esi + 0x18], 0
je 0x447e16
push dword [esi + 0x18]
call fcn.00440bc3
test eax, eax
jne 0x447e16
push dword [esi + 0x1c]
call fcn.00440bc3
test eax, eax
jne 0x447e16
push 0x41eea0
push 4
call fcn.004400fc
cmp dword [ebp + 8], 0
je 0x447e23
mov eax, dword [edi]
mov edx, dword [edi + 4]
jmp 0x447e2e
mov eax, dword [esi + 0x78]
add eax, dword [edi]
mov edx, dword [esi + 0x7c]
adc edx, dword [edi + 4]
pop edi
pop ebx
leave
ret 4
Function at 0x44948f
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + reloc.ADVAPI32.dll_TraceMessage], 0
je 0x4494b4
xor eax, eax
jmp 0x44953a
push esi
push 0x208
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x449530
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x44951f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x186a0
div ecx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov eax, 0x104
push edx
push ecx
push 0x41f5b0
mov ecx, esi
call fcn.0042c99c
add esp, 0xc
test eax, eax
js 0x44951f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44951f
mov dword [edi + reloc.ADVAPI32.dll_TraceMessage], esi
cmp dword [edi + reloc.ADVAPI32.dll_TraceMessage], 0
jne 0x449537
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, 0x80004005
jmp 0x449539
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004655f1
leave
ret
Function at 0x44af52
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 0x24]
xor esi, esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
test ebx, ebx
jne 0x44af85
mov eax, 0x80004005
jmp 0x44b129
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x44af9e
cmp eax, 1
je 0x44af9e
cmp eax, 2
je 0x44af9e
xor esi, esi
inc esi
jmp 0x44b127
push esi
push 0xc
push 0x4044e8
mov eax, 0x208
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c99c
add esp, 0xc
test eax, eax
js 0x44b122
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44b122
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
push 0x41fb4c
push dword [ebp - 0x294]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b08b
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x44b08b
lea eax, [ebp - 0x88]
call fcn.0044060c
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
call fcn.0044060c
mov ecx, edx
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
cmp ecx, edx
jb 0x44b0c8
ja 0x44b08b
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp eax, ecx
jbe 0x44b0ce
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44b090
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push esi
push 0x41fb4c
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
jb 0x44b114
ja 0x44b0dc
cmp eax, ecx
jb 0x44b114
mov edx, dword [edi + 0x28]
test edx, edx
je 0x44b114
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44b0e8
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push esi
push 0x41fb64
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44b127
mov esi, 0x80004005
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret
Function at 0x44ba2f
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
test ebx, ebx
je 0x44bb5b
xor eax, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push 0
push 0
push 0
push 0
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44bb5b
inc dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor ecx, ecx
push 0x2001f
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44bb5b
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x4044c0
push dword [ebp - 0x318]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44bb2e
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x44bb2e
lea eax, reloc.ADVAPI32.dll_TraceMessage
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x44bb2e
inc eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov edi, eax
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
je 0x44ba61
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004655f1
leave
ret
Function at 0x44dd48
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4202e0
push 4
xor ebx, ebx
pop esi
inc ebx
call fcn.00440126
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x44ddab
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44dd92
push 0x57
pop eax
push eax
push edi
push 0x420300
push 2
pop esi
call fcn.00440126
add esp, 0xc
xor eax, eax
jmp 0x44df11
push 0xf01ff
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
jne 0x44ddeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44ddce
push 0x57
pop eax
push eax
push edi
push 0x420334
push 2
pop esi
call fcn.00440126
add esp, 0xc
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x44dda4
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x44de33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x44de09
push 0x57
pop ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x28]
call esi
cmp ebx, 0x420
jne 0x44de27
xor eax, eax
inc eax
jmp 0x44df11
push ebx
push edi
push 0x42036c
jmp 0x44dd99
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x30], 0x927c0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x44de55
push edi
push 0x4203a4
jmp 0x44ded2
mov ecx, dword [ebp - 0x1c]
cmp ecx, 4
je 0x44dee1
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
add eax, 0x7530
mov dword [ebp - 0x34], eax
cmp eax, dword [ebp - 0x30]
jle 0x44de7d
mov dword [ebp - 0x30], eax
test eax, eax
jle 0x44deba
cmp ecx, 4
je 0x44deb7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44df1f
mov eax, dword [ebp - 0x34]
mov ecx, 0x1f4
add dword [ebp - 0x24], ecx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
test eax, eax
jg 0x44de81
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x30]
jg 0x44decc
cmp ecx, 4
je 0x44dee1
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xc]
jne 0x44de64
push edi
push 0x4203ec
push 2
pop esi
call fcn.00440126
mov esi, dword [ebp - 0x2c]
pop ecx
pop ecx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x28]
call esi
mov eax, 0x4202a0
test ebx, ebx
jne 0x44defd
mov eax, 0x4202b4
push eax
push edi
push 0x420404
push 4
pop esi
call fcn.00440126
add esp, 0xc
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret
push edi
push 0x4203c8
jmp 0x44ded2
Function at 0x44df2c
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
inc edi
test esi, esi
je 0x44dff9
cmp dword [ebp + 8], 0
je 0x44dff9
cmp dword [ebp + 0xc], 0
je 0x44dff9
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
test eax, eax
je 0x44dfd6
push ebx
push 0x420420
push dword [ebp + 0x10]
push ebx
push ebx
push dword [ebp + 0xc]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0xf003f
push dword [ebp + 8]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x44dfae
push eax
call ebx
push 0x4202a0
push esi
push 0x420454
push 4
jmp 0x44dfc6
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44dfbd
push 0x57
pop eax
push eax
push esi
push 0x420470
push 2
pop esi
call fcn.00440126
add esp, 0xc
push dword [ebp - 4]
call ebx
jmp 0x44dffb
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44dfe5
push 0x57
pop eax
push eax
push esi
push 0x420300
push 2
pop esi
call fcn.00440126
add esp, 0xc
jmp 0x44dffb
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x44e009
Capabilities:
Delete service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
inc ebx
push esi
test edi, edi
jne 0x44e020
xor ebx, ebx
jmp 0x44e0f4
push edi
xor esi, esi
push esi
call fcn.0044db14
test eax, eax
je 0x44e0d3
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
je 0x44e0bb
push 0xf003f
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
test eax, eax
je 0x44e0a0
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x44e085
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44e073
push 0x57
pop eax
push eax
push edi
push 0x4204a8
push 2
pop esi
call fcn.00440126
add esp, 0xc
push edi
push 0x4204e4
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x44e0b0
push edi
push 0x42050c
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x44e0f4
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44e0ca
push 0x57
pop eax
push eax
push edi
push 0x420300
jmp 0x44e0e9
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44e0e2
push 0x57
pop eax
push eax
push edi
push 0x4204a8
push 2
pop esi
call fcn.00440126
add esp, 0xc
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x44e783
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
push ebx
push 0x4205c0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
push 4
xor edi, edi
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
inc edi
call fcn.00440126
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x44e7d9
xor edi, edi
jmp 0x44e8a0
push 0xf01ff
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x44e7f3
xor edi, edi
jmp 0x44e885
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44e7ec
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push 2
push 0x40
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x44e885
lea eax, [ebp - 0x28]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x44e87a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x44e87a
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x28]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x44e885
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x44e865
xor edi, edi
jmp 0x44e87a
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x2c]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x44e87a
xor esi, esi
test esi, esi
je 0x44e885
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test ebx, ebx
je 0x44e897
push ebx
call esi
mov eax, 0x4202a0
test edi, edi
jne 0x44e8a5
mov eax, 0x4202b4
push eax
push dword [ebp - 0x30]
push 0x4205dc
push 4
pop esi
call fcn.00440126
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 8
Function at 0x44ebbd
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor esi, esi
push 0x104
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x44ec54
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x186a0
div ecx
push 0x4049b0
lea eax, reloc.ADVAPI32.dll_TraceMessage
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push edx
push eax
push 0x4206bc
mov eax, 0x208
call fcn.0042c99c
add esp, 0x10
test eax, eax
js 0x44ec54
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44ec54
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0044056c
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret

Function at 0x44eda2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test edx, edx
je 0x44eddd
push esi
mov ecx, edx
push edi
lea esi, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x44edb4
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 8