joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41275e
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x424c95
call fcn.00415558
sub esp, 0x80
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], 0xf
call fcn.004021c0
push str.FSSYNC
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00401ed0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x429364
call fcn.00401d50
lea eax, [ebp - 0x8c]
push eax
call fcn.004050d0
add esp, 0x20
push 0xffffffffffffffff
push ebx
add eax, 0x1c
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00402520
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.00401250
cmp dword [ebp - 0x3c], 0x10
mov eax, dword [ebp - 0x50]
jae 0x4127e8
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
cmp edi, ebx
je 0x412914
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x1c]
call fcn.0040d941
mov ecx, dword [esi + 0x1c]
lea eax, [ebp - 0x38]
push eax
call fcn.0040dbb3
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00401fb0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x14]
lea ecx, [ebp - 0x18]
call fcn.00401fb0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
call fcn.00412730
add esp, 0x18
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
call fcn.00401fb0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4128d9
push ebx
lea ecx, [ebp - 0x18]
call fcn.00401ff0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401d90
call fcn.004102da
add esp, 0x20
lea ecx, [ebp - 0x18]
cmp al, bl
jne 0x4128b6
call fcn.00401ff0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401d90
mov ecx, dword [esi + 0x1c]
call fcn.0040db6f
jmp 0x4128d1
call fcn.00401ff0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401d90
mov ecx, dword [esi + 0x1c]
call fcn.0040daf5
lea ecx, [ebp - 0x18]
call fcn.00402020
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.00401fb0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401dc0
test al, al
je 0x412873
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [ebp - 0x38]
call fcn.0040b4b4
push dword [ebp - 0x38]
call fcn.004136f1
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00401f00
lea ecx, [ebp + 8]
call fcn.0040b4b4
push dword [ebp + 8]
call fcn.004136f1
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x18

Function at 0x4170aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e27c]
jne 0x4170b4
repz ret
jmp fcn.00420735
Function at 0x422937
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419b87
and dword [ebp - 4], 0
cmp dword [0x42ffe0], 0
mov ebx, eax
jne 0x4229e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422a99
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422a99
push eax
call fcn.00419b15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42ffe0], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42ffe4], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42ffe8], eax
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42fff0], eax
test eax, eax
je 0x4229e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42ffec], eax
mov eax, dword [0x42ffec]
cmp eax, ebx
je 0x422a40
cmp dword [0x42fff0], ebx
je 0x422a40
push eax
call fcn.00419b90
push dword [0x42fff0]
mov esi, eax
call fcn.00419b90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422a40
test edi, edi
je 0x422a40
call esi
test eax, eax
je 0x422a37
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422a37
test byte [ebp - 0xc], 1
jne 0x422a40
or dword [ebp + 0x10], 0x200000
jmp 0x422a79
mov eax, dword [0x42ffe4]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422a79
mov eax, dword [0x42ffe8]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ffe0]
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a99
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422a9b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011e0
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov dword [edx], 0
mov dword [ecx], 0
mov dword [ebp - 0x1c], edx
xor edx, edx
mov dword [ebp - 0x20], ecx
call dbg.chomp
cmp word [ebx], 0
mov edx, eax
je 0x40121f
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x401210
sub eax, ebx
sar eax, 1
add edx, eax
lea eax, [edx + edx + 2]
mov dword [esp + 4], 0
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], eax
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x4012d7
mov dword [ebp - 0x28], eax
mov eax, ebx
call dbg.chomp
mov dword [esp + 4], 0
lea ecx, [eax*4 + 4]
mov ebx, eax
mov dword [esp + 8], ecx
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x4012eb
mov ecx, dword [ebp - 0x24]
mov esi, eax
lea ecx, [eax + ecx - 4]
test ebx, ebx
jle 0x4012e7
lea esi, [esi]
cmp word [edx], 0
mov dword [esi], edx
je 0x4012e0
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4012b0
sub eax, edx
add eax, 2
add esi, 4
add edx, eax
cmp ecx, esi
jne 0x4012a0
mov eax, dword [ebp - 0x1c]
mov dword [ecx], 0
mov dword [eax], ebx
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x4012be
mov ecx, eax
jmp 0x4012c7
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4012d7
Function at 0x4014c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
xor ecx, ecx
sub esp, 0x18
test eax, eax
je 0x40153a
cmp word [edi], 0
mov edx, eax
je 0x401610
mov eax, edi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x401520
sub eax, edi
sar eax, 1
lea ecx, [edx - 1]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
cmp dword [ebp - 0x1c], eax
jbe 0x401548
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx + edx]
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x18
call dword [sym.imp.kernel32.dll_GetThreadLocale]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CompareStringW]
mov ecx, dword [ebp - 0x24]
sub esp, 0x18
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor ecx, ecx
sub esp, 0xc
cmp ebx, 2
sete cl
lea esp, [ebp - 0xc]
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40152d
Function at 0x4016b0
Capabilities:
Create service
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x260
mov dword [esp + 8], 2
mov dword [esp + 4], str.ServicesActive
mov dword [esp], 0
call sym._OpenSCManagerW_12
sub esp, 0xc
test eax, eax
je 0x4017e8
lea esi, [ebp - 0x228]
mov dword [esp + 4], 0x104
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edx, 0x5c
lea ecx, [esi + eax*2]
sub esp, 8
xor eax, eax
jmp 0x401717
movzx edx, word [eax + str.msiexec__V]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x401710
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], 0x10000000
mov dword [esp + 8], 0x407066
mov dword [esp + 4], 0x407066
mov dword [esp], ebx
call sym._CreateServiceW_52
sub esp, 0x34
test eax, eax
je 0x4017b0
mov dword [esp], eax
xor esi, esi
call sym._CloseServiceHandle_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseServiceHandle_4
mov eax, esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor esi, esi
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x431
je 0x40179b
mov dword [esp], 2
mov esi, 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_create_MSI_service_n
mov dword [esp], eax
call sym._fprintf
jmp 0x40179b
mov dword [esp], 2
mov esi, 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_open_the_service_control_manager._n
mov dword [esp], eax
call sym._fprintf
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret

Function at 0x401820
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
movzx ecx, word [eax]
and ecx, 0xfffffffd
cmp cx, 0x2d
je 0x401830
xor eax, eax
ret
add eax, 2
jmp dbg.msi_strequal
Function at 0x401d50
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x10
cmp word [edx], 0
je 0x401de0
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401d68
sub eax, esi
add eax, 6
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x401de7
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ecx + eax + 4], dx
add eax, 2
test dx, dx
jne 0x401da8
mov eax, dword [ebx]
mov dword [ecx], 0
test eax, eax
je 0x401dd0
lea esi, [esi]
mov ebx, eax
mov eax, dword [eax]
test eax, eax
jne 0x401dc8
mov dword [ebx], ecx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, 6
jmp 0x401d76
test byte [section..data], 2
jne 0x401dfd
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.StringListAppend
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401df0

Function at 0x401f00
Capabilities:
Access peb ldr_data
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x401f4d
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x401f84
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unable_to_load_dll__s_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Dll__s_does_not_implement_function__s_n
mov dword [esp], eax
call sym._fprintf
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push eax
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x401fd0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x24
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 8], eax
mov dword [ebp - 0xc], edx
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
lea eax, [ebp - 0x18]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call sym.___wine_msi_call_dll_function
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 4

Function at 0x402040
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
cmp word [eax], 0
je 0x402148
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402058
sub eax, esi
add eax, 0xa
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x402180
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x4020a0
movzx edx, word [ebx]
test dx, dx
je 0x402140
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x4020c0
sub eax, ebx
sar eax, 1
jne 0x4020e3
jmp 0x402138
cmp cx, 0x5c
je 0x4020f0
sub eax, 1
je 0x402138
movzx ecx, word [ebx + eax*2]
lea esi, [ecx - 0x2e]
cmp si, 1
ja 0x4020d8
cmp cx, 0x2e
je 0x402158
mov edx, ebx
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x402100
xor eax, eax
mov ecx, 0x2e
jmp 0x40211f
movzx ecx, word [eax + str..msi]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402118
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ecx, edx
jmp 0x4020f0
mov edx, ebx
jmp 0x402109
mov eax, 0xa
jmp 0x402066
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x40212b
test byte [section..data], 2
je 0x40212b
mov dword [esp + 0xc], str.No_memory._n
mov dword [esp + 8], str.get_path_with_extension
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x40212b
Function at 0x404ae0
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
mov dword [esp + 4], dbg.ServiceCtrlHandler
mov dword [esp], str.MSIServer
call sym._RegisterServiceCtrlHandlerA_8
mov dword [0x40900c], eax
sub esp, 8
test eax, eax
je 0x404c70
mov eax, 2
call sym._UpdateSCMStatus.constprop.0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x409004], eax
sub esp, 0x10
test eax, eax
je 0x404c20
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.ServiceExecutionThread
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x409008], eax
sub esp, 0x18
test eax, eax
je 0x404bd0
mov eax, 4
call sym._UpdateSCMStatus.constprop.0
mov eax, dword [0x409008]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, 1
sub esp, 8
call sym._UpdateSCMStatus.constprop.0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_create_thread_n
mov dword [esp], eax
call dbg.fprintf
test byte [0x406010], 8
jne 0x404c46
mov eax, dword [0x409004]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, 1
sub esp, 4
call sym._UpdateSCMStatus.constprop.0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_create_event_n
mov dword [esp], eax
call dbg.fprintf
test byte [0x406010], 8
je 0x404bf6
mov dword [esp + 0xc], str.Killing_service_n
mov dword [esp + 8], str.KillService
mov dword [esp + 4], 0x406010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x404bf6
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_register_service_ctrl_handler_n
mov dword [esp], eax
call dbg.fprintf
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 8

Function at 0x404e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x404ecb
cmp byte [esi + ebx - 1], 0xa
je 0x404e9f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4053e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x4090b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x4055a0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4090b4]
movzx eax, al
bt eax, esi
jae 0x405600
mov ecx, dword [0x4090a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x4054a6
test byte [0x406028], 8
jne 0x405540
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x406038], 8
jne 0x4054f0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x405475
cmp esi, 3
jbe 0x4054b0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x407ae4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x405475
mov ecx, dword [0x4090b4]
test ecx, ecx
je 0x4055e0
mov dword [esp], 0x406038
call dword [0x4090b4]
test al, 8
je 0x40544c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x40544c
mov ebx, dword [0x4090b4]
test ebx, ebx
je 0x4055c0
mov dword [esp], 0x406028
call dword [0x4090b4]
test al, 8
je 0x405439
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x40543f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4090b4
call sym._load_func.part.0
jmp 0x405400
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4090b4
call sym._load_func.part.0
jmp 0x40554a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4090b4
call sym._load_func.part.0
jmp 0x4054fe
mov eax, 0xffffffff
jmp 0x4054a6
Function at 0x405760
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x405820
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4058af
cmp al, 9
je 0x4058a0
cmp al, 0x20
je 0x4058a0
mov dword [ebp - 0x6c], 0
xor esi, esi
lea esi, [esi]
cmp al, 0x5c
je 0x405908
cmp al, 0x22
je 0x405918
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x4058af
cmp al, 9
sete dl
cmp al, 0x20
sete cl
or dl, cl
je 0x405860
test esi, 1
jne 0x405860
lea esi, [esi]
nop
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x4058a0
cmp al, 0x20
je 0x4058a0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x4058ca
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x405877
and dword [ebp - 0x6c], 1
jne 0x405870
xor esi, 1
jmp 0x405877