joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411404
Capabilities:
Terminate process

Disassembly:
push ebx
push 0
push dword [0x46fd30]
mov byte [0x46fd17], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push dword [0x46fd30]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0x412039
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41207c
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x41207e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412083
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4120da
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4120dc
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4120e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor esi, esi
mov edi, ecx
push esi
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412141
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
test esi, esi
jne 0x412143
lea eax, [ebp - 0x408]
push eax
jmp 0x412148
mov ecx, edi
push 0x463064
call fcn.00402073
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412155
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor edi, edi
mov esi, ecx
push edi
push 0x469758
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4121b2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push eax
jmp 0x4121b7
push 0x463100
mov ecx, esi
call fcn.0040415e
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4121c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
push ebx
mov esi, 0x463064
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412226
cmp dword [ebp - 4], eax
jbe 0x412226
push dword [ebp - 4]
call fcn.00439c66
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call fcn.00434dc0
add esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ecx, edi
call fcn.0040415e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412237
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4122a7
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4122a7
push dword [ebp + 0x18]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0x14]
call fcn.004061cd
push dword [ebp + 0x10]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0xc]
call fcn.00406252
mov al, 1
jmp 0x4122a9
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4122ae
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4122fe
push esi
lea ecx, [ebp + 0xc]
call fcn.0040245c
push eax
lea ecx, [ebp + 0xc]
call fcn.00401f8b
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x412300
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401fb8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41230f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41234d
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x41234f
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x412353
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4123a6
push esi
lea ecx, [ebp + 0xc]
call fcn.0040245c
lea ecx, [ebp + 0xc]
lea eax, [eax*2 + 2]
push eax
call fcn.00401ee4
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x4123a8
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401ee9
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4123b7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4123f9
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4123fb
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4123ff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41243d
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x41243f
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x412443
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x412481
push esi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x412483
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x412563
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41257f
xor al, al
jmp 0x412591
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret
Function at 0x412595
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xabb4
call fcn.00454a20
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x4a0]
push esi
push eax
mov ebx, ecx
call fcn.00434dc0
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x3fff
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x412673
test eax, eax
je 0x412673
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41266d
push 0x463c7c
lea ecx, [ebp - 0x34]
call fcn.0040415e
push eax
lea edx, [ebp - 0x298]
lea ecx, [ebp - 0x68]
call fcn.004042dc
pop ecx
push eax
mov ecx, 0x4723c0
call fcn.0040323d
lea ecx, [ebp - 0x68]
call fcn.00401ee9
lea ecx, [ebp - 0x34]
call fcn.00401ee9
inc esi
cmp esi, dword [ebp - 4]
jb 0x41260d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4127b5
xor esi, esi
test eax, eax
je 0x4127b5
xor eax, eax
mov byte [ebp - 0x5c], 0
lea edi, [ebp - 0x5b]
mov dword [ebp - 0xc], 0x2710
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x3fff
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xabb0], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xabb0]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4127ab
push 0xa
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
call fcn.0043f51a
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x463c7c
call fcn.0040415e
push eax
lea edx, [ebp - 0xabb0]
lea ecx, [ebp - 0x34]
call fcn.004042dc
pop ecx
push eax
mov ecx, 0x4723d8
call fcn.0040323d
lea ecx, [ebp - 0x34]
call fcn.00401ee9
lea ecx, [ebp - 0x80]
call fcn.00401ee9
push 0x463080
lea ecx, [ebp - 0x34]
call fcn.00402073
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.004052dd
pop ecx
push eax
mov ecx, 0x4723f0
call fcn.00403356
lea ecx, [ebp - 0x80]
call fcn.00401fb8
lea ecx, [ebp - 0x34]
call fcn.00401fb8
push str._regsplt_
lea ecx, [ebp - 0x98]
call fcn.00402073
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x2bb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402097
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.00402e81
pop ecx
push eax
mov ecx, 0x472488
call fcn.00403356
lea ecx, [ebp - 0x80]
call fcn.00401fb8
lea ecx, [ebp - 0x34]
call fcn.00401fb8
lea ecx, [ebp - 0x98]
call fcn.00401fb8
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x412688
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413279
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ecx
and dword [ebp], 0
mov dword [esp + 0x14], edx
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x4132f7
cmp word [esi + 8], 2
jne 0x4132d9
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x4132d9
mov edi, dword [esi + 0xc]
jmp 0x4132d3
push dword [eax]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
call fcn.00413212
mov dword [ebp], eax
test eax, eax
je 0x4132f2
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x4132b3
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.0043c393
add esp, 0x10
xor eax, eax
jmp 0x413315
push 8
pop eax
jmp 0x413315
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x413313
sub eax, 1
je 0x413324
sub eax, 1
je 0x41331d
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, 0x2afb
jmp 0x413315
mov eax, 0x2afa
jmp 0x413315

Function at 0x41392b
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
cmp dword [0x473a34], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x4134af
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x413755
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00413474
jne 0x413a82
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x413a78
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.0043f0d7
push str.ws2_32
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.0043f131
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test esi, esi
je 0x4139eb
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4139e7
push esi
call ebp
mov esi, edi
test esi, esi
jne 0x413a3c
lea eax, [esp + 0x134]
mov esi, 0x10c
push eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.0043f0d7
push str.wship6
lea eax, [esp + 0x38]
push esi
push eax
call fcn.0043f131
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x413a74
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x413a38
push esi
call ebp
mov esi, edi
test esi, esi
je 0x413a74
mov ebx, edi
push dword [esp + ebx*8 + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + ebx*8 + 0x14], eax
test eax, eax
je 0x413a59
inc ebx
cmp ebx, 3
jl 0x413a3e
jmp 0x413a5e
push esi
call ebp
mov esi, edi
test esi, esi
je 0x413a74
mov eax, dword [esp + edi + 0x14]
mov dword [edi + 0x46e9ec], eax
add edi, 8
cmp edi, 0x18
jl 0x413a62
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x473a34], 1
mov eax, dword [0x46e9ec]
add esp, 0x22c
ret
Function at 0x415af5
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push str._sysinfo.txt
push str.temp
call fcn.00439fef
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040415e
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.00402ff4
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401ee9
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push ebx
push eax
mov edx, 0x4694d0
lea ecx, [ebp - 0x30]
call fcn.0040a8cc
pop ecx
mov ecx, eax
call fcn.00401ee4
push eax
push str.dxdiag
push 0x4630c0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x30]
call fcn.00401ee9
lea ecx, [ebp - 0x18]
call fcn.004020bf
mov esi, ebx
lea ecx, [ebp - 0x48]
call fcn.00401ee4
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.0041a369
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x18]
inc esi
call fcn.00406131
test al, al
je 0x415b9c
cmp esi, 0x4b0
jl 0x415b6d
lea ecx, [ebp - 0x18]
call fcn.00406131
test al, al
jne 0x415c2c
lea ecx, [ebp - 0x48]
call fcn.00401ee4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea ecx, [ebp - 0xc8]
call fcn.004046d7
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004048a8
test al, al
je 0x415c21
sub esp, 0x18
lea eax, [ebp - 0x18]
mov esi, esp
lea edx, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
push 0x471e78
call fcn.00402f11
pop ecx
mov edx, eax
mov ecx, esi
call fcn.00402ef0
pop ecx
push 0x97
lea ecx, [ebp - 0xc8]
call fcn.00404a81
lea ecx, [ebp - 0x30]
call fcn.00401fb8
lea ecx, [ebp - 0xc8]
call fcn.00404e06
mov bl, 1
lea ecx, [ebp - 0xc8]
call fcn.00404ec2
lea ecx, [ebp - 0x18]
call fcn.00401fb8
lea ecx, [ebp - 0x48]
call fcn.00401ee9
lea ecx, [ebp + 8]
call fcn.00401fb8
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416158
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
lea eax, [ebp + 8]
lea ecx, [ebp - 0x84]
push ebx
push esi
push edi
push eax
push 0x46307c
call fcn.00402073
push eax
push str.Temp
call fcn.00439ffa
pop ecx
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.004052dd
pop ecx
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.00402ef0
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.00401fb8
lea ecx, [ebp - 0x84]
call fcn.00401fb8
push ecx
push ecx
push 0x10
lea ecx, [ebp - 0x18]
call fcn.00401f8b
push eax
lea ecx, [ebp - 0x138]
call fcn.0040e758
lea ecx, [ebp - 0x138]
call fcn.00416395
test al, al
je 0x416289
lea edx, [ebp + 0x20]
lea ecx, [ebp - 0x138]
call fcn.004163a5
lea ecx, [ebp - 0x138]
call fcn.0040e709
and dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x18]
and dword [ebp - 0x48], 0
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
call fcn.00401f8b
movaps xmm0, xmmword [0x469f00]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
movups xmmword [ebp - 0x40], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
mov esi, 0x463064
mov edi, 0x472540
setne bl
cmp dword [ebp - 0x1c], 0
je 0x416273
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402073
push 0x70
mov ecx, edi
call fcn.00404a81
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00401f8b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp bl, 1
jne 0x4162a4
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00402073
push 0x6e
mov ecx, edi
jmp 0x41629f
sub esp, 0x18
mov ecx, esp
push 0x463064
call fcn.00402073
push 0x6f
mov ecx, 0x472540
call fcn.00404a81
lea ecx, [ebp - 0x138]
call fcn.0040debf
lea ecx, [ebp - 0x18]
call fcn.00401fb8
lea ecx, [ebp + 8]
call fcn.00401fb8
lea ecx, [ebp + 0x20]
call fcn.00401fb8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418b8c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x20
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x20
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401ee4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x418bc4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418be2
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418bf3
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x11
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf003f
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401ee4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x418c2e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418c7f
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x418c4f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov bl, 2
jmp 0x418c7f
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x418c4f
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
neg eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 3
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418c90
Capabilities:
Pause service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x40
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401ee4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x418cc8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418ce6
lea eax, [ebp - 0x1c]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418cf7
Capabilities:
Continue service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x40
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401ee4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x418d2f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418d4d
lea eax, [ebp - 0x1c]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418d5e
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
xor ebx, ebx
mov byte [ebp - 1], cl
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 2
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00401ee4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x418d97
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x418ddb
movzx eax, byte [ebp - 1]
or ecx, 0xffffffff
sub eax, ebx
je 0x418db4
sub eax, 1
je 0x418db0
sub eax, 1
jne 0x418db7
push 3
jmp 0x418db6
push 2
jmp 0x418db6
push 4
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.00401ee9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418dfd
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
lea ecx, [esp + 4]
mov dl, 0x30
push esi
push str.alarm.wav
call fcn.0040c5ee
pop ecx
lea ecx, [esp + 8]
call fcn.00401ee4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x418e88
mov esi, 0x472878
mov edx, 0x463064
mov ecx, esi
call fcn.00405ae5
test al, al
je 0x418e76
sub esp, 0x18
cmp byte [0x471a8e], 0
mov ecx, esp
push 0x469640
je 0x418e60
call fcn.00402073
mov ecx, 0x472890
jmp 0x418e6a
call fcn.00402073
mov ecx, 0x4724a8
push 0xa1
call fcn.00404a81
jmp 0x418e98
lea ecx, [esp + 8]
call fcn.00401ee4
mov edx, eax
mov ecx, esi
call fcn.0041a3d6
lea ecx, [esp + 8]
call fcn.00401ee4
mov ecx, eax
call fcn.00418ea6
lea ecx, [esp + 8]
call fcn.00401ee9
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418efb
Capabilities:
Check if file exists

Disassembly:
push ebx
push ecx
mov ecx, 0x472878
mov bl, dl
call fcn.00401fa0
test bl, bl
je 0x418f13
pop ebx
jmp fcn.00418dfd
mov byte [0x471a8f], 1
pop ebx
ret