joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f30
Capabilities:
Start http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430bcb
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x104
lea eax, [ebp - 0x160]
push 0
push eax
mov dword [ebp - 0x1a4], 2
mov dword [ebp - 0x48], 0x32
mov dword [ebp - 0x164], 0
mov dword [ebp - method.CertStore.virtual_0], vtable.CertStore.0
call fcn.0041ce40
add esp, 0xc
lea eax, [ebp - 0x160]
push 0x104
push 0x439760
push eax
call fcn.0041bcba
add esp, 0xc
push 0
push 3
mov dword [ebp - 4], 0
push dword [ebp - 0x1a4]
call dword [sym.imp.HTTPAPI.dll_HttpInitialize]
mov esi, eax
test esi, esi
je 0x402fee
push esi
push esi
push 0x438be8
push 0x362
push 0x438c08
call fcn.00405530
add esp, 0x14
jmp 0x40318e
push 0
lea eax, [ebx + 0x54]
push eax
call dword [sym.imp.HTTPAPI.dll_HttpCreateHttpHandle]
mov esi, eax
test esi, esi
je 0x40301e
push esi
push esi
push 0x438c64
push 0x36d
push 0x438c8c
call fcn.00405530
add esp, 0x14
jmp 0x40318e
xorps xmm0, xmm0
push 0x438ce0
movq qword [ebp - 0x58], xmm0
movq qword [ebp - 0x50], xmm0
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x54], eax
mov eax, 2
push 0x9b29
mov word [ebp - 0x58], ax
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [ebp - 0x168]
mov word [ebp - 0x56], ax
call fcn.00403cd0
mov esi, eax
test esi, esi
je 0x403080
push esi
push esi
push 0x438d2c
push 0x37f
push 0x438d4c
call fcn.00405530
add esp, 0x14
jmp 0x40318e
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push ecx
lea ecx, [ebp - 0x168]
call fcn.00403d80
mov esi, eax
test esi, esi
je 0x4030b8
push esi
push esi
push 0x438da0
push 0x389
push 0x438dc0
call fcn.00405530
add esp, 0x14
jmp 0x40318e
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x4030d5
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov dword [ebp - 0x164], 0
movq xmm0, qword [0x439570]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x19c], eax
push 0
lea eax, [ebp - 0x44]
push 0x38
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x1a0]
push eax
movq qword [ebp - 0x194], xmm0
movq xmm0, qword [0x439578]
push 1
push 0
movq qword [ebp - 0x18c], xmm0
mov dword [ebp - 0x184], 0x439754
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
call dword [sym.imp.HTTPAPI.dll_HttpDeleteServiceConfiguration]
mov esi, eax
test esi, esi
je 0x40318c
push esi
push esi
push str.error_delete_entry__d__0x_X_
push 0x3a9
push 0x438ec0
call fcn.00405530
add esp, 0x14
jmp 0x40318e
xor esi, esi
mov eax, dword [ebp - 0x164]
mov dword [ebp - method.CertStore.virtual_0], vtable.CertStore.0
test eax, eax
je 0x4031ab
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419355
mov esp, ebp
pop ebp
ret
Function at 0x4036a0
Capabilities:
Receive http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x443230]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
push 0x9d8
mov esi, ecx
push 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], 0x9d8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x403717
push 8
push str.not_enough_memory__d_
push 0x48e
push 0x439328
call fcn.00405530
add esp, 0x10
lea eax, [edi + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00419355
mov esp, ebp
pop ebp
ret
push 0x9d8
xorps xmm0, xmm0
push 0
push edi
movlpd qword [esp + 0x1c], xmm0
call fcn.0041ce40
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push eax
push 0x9d8
push edi
push 0
push 0
push 0
push dword [esi + 0x54]
call dword [sym.imp.HTTPAPI.dll_HttpReceiveHttpRequest]
mov ecx, dword [esp + 0x18]
mov esi, eax
cmp dword [ecx + 0x58], 1
je 0x403854
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
test esi, esi
jne 0x40377b
push dword [esp + 0xc]
mov ecx, dword [ecx + 0x54]
mov edx, edi
call fcn.00404070
add esp, 4
jmp 0x4037f8
cmp esi, 0xea
jne 0x4037e8
mov esi, dword [edi + 0x14]
mov ebx, dword [edi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
mov dword [esp + 0x24], esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x20]
push eax
push 0
mov dword [esp + 0x14], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40380d
lea esi, [eax + 8]
push esi
push str.not_enough_memory_error__d_
push 0x4c2
push 0x4393a4
call fcn.00405530
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00419355
mov esp, ebp
pop ebp
ret
cmp esi, 0x4cd
jne 0x40385d
test ebx, ebx
jne 0x4037f8
test eax, eax
je 0x40385d
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
push dword [esp + 0xc]
push 0
push edi
call fcn.0041ce40
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push eax
push dword [esp + 0x14]
push edi
push 0
push esi
mov esi, dword [esp + 0x30]
push ebx
push dword [esi + 0x54]
call dword [sym.imp.HTTPAPI.dll_HttpReceiveHttpRequest]
mov ecx, dword [esp + 0x18]
mov esi, eax
cmp dword [ecx + 0x58], 1
je 0x40384e
mov eax, dword [esp + 0x1c]
jmp 0x403764
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ecx + 0x58], 0
jmp 0x403863
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00419355
mov esp, ebp
pop ebp
ret
Function at 0x404070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x14
mov edi, edx
mov ebx, ecx
call fcn.0040892f
mov esi, eax
add esp, 4
test esi, esi
je 0x4040c0
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi], vtable.HttpClient.0
call fcn.00408d32
mov ecx, eax
test ecx, ecx
je 0x40412c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], ebx
jmp 0x4040c2
xor esi, esi
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.00404140
test eax, eax
je 0x4040e4
push eax
push eax
push str.create_http_client_object_error__d__0x_X_
push 0xc4
push 0x439ea8
jmp 0x404113
push 0
push 0
push esi
push 0x404020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x404127
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push eax
push str.create_http_client_thread_error__d__0x_X_
push 0xcf
push 0x439f18
call fcn.00405530
add esp, 0x14
test esi, esi
je 0x404127
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x80004005
call fcn.00401010
int3
Function at 0x404f70
Capabilities:
Receive http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.00405970
push 0x400
lea ecx, [ebp - 0x34]
mov dword [ebp - 0xc], 0
call fcn.00403b50
mov edi, eax
test edi, edi
jne 0x4050b8
mov ebx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
push ebx
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.HTTPAPI.dll_HttpReceiveRequestEntityBody]
mov edi, eax
test edi, edi
jne 0x40509b
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x40506c
cmp dword [esi + 4], 0
jne 0x405020
push edi
mov ecx, esi
call fcn.00403b50
test eax, eax
jne 0x40506c
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add eax, edi
cmp eax, ecx
jbe 0x405058
lea eax, [ecx + 0x5000]
push eax
push dword [esi + 4]
mov dword [esi + 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
jne 0x405055
add dword [esi + 0xc], 0xfffffc00
jmp 0x40506c
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
push edi
push ebx
push eax
call fcn.00422160
add esp, 0xc
add dword [esi + 8], edi
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
push ebx
push 0
push dword [eax + 0x14]
mov dword [ebp - 0xc], 0
push dword [eax + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.HTTPAPI.dll_HttpReceiveRequestEntityBody]
mov edi, eax
test edi, edi
je 0x405007
cmp edi, 0x26
jne 0x4050b4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4050b0
push eax
push ebx
mov ecx, esi
call fcn.00403be0
xor edi, edi
jmp 0x4050d1
test edi, edi
je 0x4050d1
push edi
push edi
push str.readReqPostdata_error__d__0x_X_
push 0x2f1
push 0x43a52c
call fcn.00405530
add esp, 0x14
lea ecx, [ebp - 0x34]
call fcn.00405a30
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419355
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4050f0
Capabilities:
Send http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push 0x120
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x164]
push 0
push eax
mov dword [ebp - 0x24], 0
call fcn.0041ce40
mov ax, word [ebp + 0x10]
add esp, 0xc
mov word [ebp - 0x15c], ax
mov dword [ebp - 0x158], esi
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x405150
sub esi, ecx
mov word [ebp - 0x15a], si
mov eax, 1
test edi, edi
je 0x405209
push dword [edi + 8]
mov word [ebp - 0x154], ax
lea eax, [ebp - 0x20]
push 0x43a55c
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x14]
push 0xb
push eax
mov dword [ebp - 0x1c], 0x43a53c
mov dword [ebp - 0x20], 0x1001b
mov dword [ebp - 0x18], 0x43a558
call fcn.0041a3bc
lea eax, [ebp - 0x14]
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0xe8], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4051b6
mov eax, 0x10
mov word [ebp - 0xe4], ax
mov eax, 8
mov word [ebp - 0x144], ax
mov eax, 0x23
sub ecx, edx
mov word [ebp - 0x7c], ax
mov word [ebp - 0xec], cx
mov dword [ebp - 0xe0], 0x43a560
mov dword [ebp - 0x140], 0x43a574
mov dword [ebp - 0x78], 0x43a580
mov eax, 2
jmp 0x40521a
mov dword [ebp - 0xe8], 0x43a5a4
mov word [ebp - 0xec], ax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0
lea ecx, [ebp - 0x164]
push ecx
push eax
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebp - 0x168]
call dword [sym.imp.HTTPAPI.dll_HttpSendHttpResponse]
mov esi, eax
test esi, esi
jne 0x40527f
test edi, edi
je 0x405298
push esi
push esi
push esi
mov dword [ebp - 0x44], eax
mov eax, dword [edi + 4]
push esi
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 8]
push esi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x44]
push eax
push 1
push esi
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebp - 0x168]
call dword [sym.imp.HTTPAPI.dll_HttpSendResponseEntityBody]
mov esi, eax
test esi, esi
je 0x405298
push esi
push esi
push 0x43a5a8
push 0x363
push 0x43a5d0
call fcn.00405530
add esp, 0x14
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419355
mov esp, ebp
pop ebp
ret 0x14
Function at 0x405680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430d4b
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x104
call fcn.0041ce40
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push str.path
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40574e
mov eax, dword [ebp - 0x118]
dec eax
push eax
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x11c]
call fcn.004052b0
push eax
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00402110
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x11c]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40574c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419355
mov esp, ebp
pop ebp
ret 8

Function at 0x405770
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x4057cf
push 0x104
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0041ce40
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4057c9
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419355
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x108]
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4057d5
sub ecx, edi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push 0x43aa40
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00419355
mov esp, ebp
pop ebp
ret 4
Function at 0x406070
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
mov edi, dword [ebp + 8]
je 0x4060a7
mov eax, 0xb7
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419355
mov esp, ebp
pop ebp
ret 4
push 0x104
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0041ce40
add esp, 0xc
lea eax, [ebp - 0x120]
push edi
push str..pipe_s
push 0x104
push eax
call fcn.0041cb0f
add esp, 0x10
lea eax, [ebp - 0x18]
push 1
push eax
mov dword [ebp - 0x12c], 0xc
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x128], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x400
push 0x400
push 1
push 0
push 3
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x40616d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push esi
push str.CreateNamedPipe_error__d__0x_X_
push 0x52
push 0x43addc
call fcn.00405530
add esp, 0x14
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419355
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00419355
mov esp, ebp
pop ebp
ret 4

Function at 0x4062d0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
call fcn.0041ce40
add esp, 0xc
lea eax, [ebp - 0x10f]
push 0x103
push eax
push 0
mov byte [ebp - 0x110], 0x22
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x110]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x406320
mov ax, word [0x43b194]
push 2
push 0
push 0
mov word [edi], ax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40634f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x406393
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x43b22c
push 0x43b220
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x40638a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x406393
push eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x40639e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00419355
mov esp, ebp
pop ebp
ret
Function at 0x4065a0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xorps xmm0, xmm0
lea eax, [ebp - 0x24]
xor ebx, ebx
push eax
mov edi, 0x1e
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x20], xmm0
movq qword [ebp - 0x18], xmm0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 0x28], ebx
call fcn.00406500
mov esi, eax
test esi, esi
jne 0x406674
cmp dword [ebp - 0x20], 4
je 0x406672
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x40660b
lea esi, [edi - 0x18]
jmp 0x406674
push 0x14
push 0x43b38c
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x406637
call esi
mov esi, eax
test esi, esi
jne 0x406674
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40664c
call esi
mov esi, eax
jmp 0x406674
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
call fcn.00406500
cmp dword [ebp - 0x20], 4
je 0x406672
push 0x3e8
call esi
dec edi
jne 0x406652
mov esi, 0x102
jmp 0x406674
xor esi, esi
mov eax, dword [ebp - 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x406684
push eax
call edi
test ebx, ebx
je 0x40668b
push ebx
call edi
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419355
mov esp, ebp
pop ebp
ret 4
Function at 0x4066a0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
mov edi, 0x1e
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x1c], xmm0
movq qword [ebp - 0x14], xmm0
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x24], ebx
call fcn.00406500
mov esi, eax
test esi, esi
jne 0x40676e
cmp dword [ebp - 0x1c], 1
je 0x40676c
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x406707
lea esi, [edi - 0x18]
jmp 0x40676e
push 0xf01ff
push 0x43b3c0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x406736
call esi
mov esi, eax
test esi, esi
jne 0x40676e
mov eax, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40674d
call esi
mov esi, eax
jmp 0x40676e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
call fcn.00406500
cmp dword [ebp - 0x1c], 1
je 0x40676c
push 0x3e8
call esi
dec edi
jne 0x406753
xor esi, esi
mov eax, dword [ebp - 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40677e
push eax
call edi
test ebx, ebx
je 0x406785
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419355
mov esp, ebp
pop ebp
ret 8
Function at 0x4067a0
Capabilities:
Pause service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x443230]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xorps xmm0, xmm0
lea eax, [ebp - 0x24]
xor ebx, ebx
push eax
mov edi, 0x1e
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x20], xmm0
movq qword [ebp - 0x18], xmm0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 0x28], ebx
call fcn.00406500
mov esi, eax
test esi, esi
jne 0x40686e
cmp dword [ebp - 0x20], 7
je 0x40686c
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x406807
lea esi, [edi - 0x18]
jmp 0x40686e
push 0xf01ff
push 0x43b428
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x406836
call esi
mov esi, eax
test esi, esi
jne 0x40686e
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x24]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40684d
call esi
mov esi, eax
jmp 0x40686e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
call fcn.00406500
cmp dword [ebp - 0x20], 7
je 0x40686c
push 0x3e8
call esi
dec edi
jne 0x406853
xor esi, esi
mov eax, dword [ebp - 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40687e
push eax
call edi
test ebx, ebx
je 0x406885
push ebx
call edi
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419355
mov esp, ebp
pop ebp
ret 4