joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4488c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
cmp word [0x59af28], 1
push ebx
push esi
push edi
jne 0x4488fe
mov eax, dword [ecx + 8]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 0x10]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x10], eax
jmp 0x448a01
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
movzx ebx, byte [ecx + 7]
movzx esi, byte [ecx + 0xb]
shl edx, 8
or edx, eax
shl esi, 8
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
movzx edi, byte [ecx + 0x17]
movzx eax, byte [ecx + 6]
or ebx, eax
shl edi, 8
movzx eax, byte [ecx + 5]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 4]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 0xa]
or esi, eax
movzx eax, byte [ecx + 9]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 8]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xe]
mov dword [ebp - 4], esi
movzx esi, byte [ecx + 0xf]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xd]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xc]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x12]
mov dword [ebp - 8], esi
movzx esi, byte [ecx + 0x13]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x11]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x10]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x16]
or edi, eax
movzx eax, byte [ecx + 0x15]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x14]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1a]
mov dword [ebp - 0xc], edi
movzx edi, byte [ecx + 0x1b]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x19]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x18]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1e]
mov dword [ebp - 0x10], edi
movzx edi, byte [ecx + 0x1f]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1d]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1c]
shl edi, 8
or edi, eax
mov ecx, dword [ebp + 8]
mov eax, edx
and eax, 0x3ffffff
shr edx, 0x1a
mov dword [ecx], eax
mov eax, ebx
shl eax, 6
or edx, eax
shr ebx, 0x13
and edx, 0x1ffffff
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 0xd
or eax, ebx
shr edx, 0xd
mov ebx, dword [ebp - 8]
and eax, 0x3ffffff
mov dword [ecx + 8], eax
mov eax, ebx
shl eax, 0x13
or eax, edx
shr ebx, 6
mov edx, dword [ebp - 0xc]
and eax, 0x1ffffff
mov dword [ecx + 0xc], eax
mov eax, esi
and eax, 0x1ffffff
shr esi, 0x19
mov dword [ecx + 0x14], eax
mov eax, edx
shl eax, 7
or esi, eax
mov dword [ecx + 0x10], ebx
mov ebx, dword [ebp - 0x10]
and esi, 0x3ffffff
mov eax, ebx
shr edx, 0x13
shl eax, 0xd
or eax, edx
shr ebx, 0xc
and eax, 0x1ffffff
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
mov eax, edi
shl eax, 0x14
or eax, ebx
shr edi, 6
and eax, 0x3ffffff
and edi, 0x1ffffff
mov dword [ecx + 0x24], edi
pop edi
pop esi
mov dword [ecx + 0x20], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d490
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x456170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x45625f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xa
push str.STEAM_SPLIT_GUID
push esi
call ebx
mov ecx, eax
test ecx, ecx
je 0x4561d9
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4561d9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4561d9
mov edx, dword [ebp + 0x10]
mov edi, 1
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push 0xa
push str.STEAM_GUIDD
push esi
call ebx
test eax, eax
je 0x456218
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456218
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456218
mov edx, dword [ebp + 0xc]
inc edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push 0xa
push str.STEAM_MINSTANCE
push esi
call ebx
pop ebx
test eax, eax
je 0x456258
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456258
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456258
mov edx, dword [ebp + 0x14]
inc edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 3
pop edi
sete al
pop esi
pop ebp
ret
Function at 0x457fb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x114
mov ecx, dword [0x6abc50]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x62d0d0]
cmp eax, dword [ecx + 4]
jg 0x4580f8
mov eax, dword [0x62d0cc]
test eax, eax
jne 0x457feb
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
push esi
call eax
test eax, eax
je 0x4580ef
lea eax, [ebp - 8]
push eax
mov eax, ebx
or eax, 0x20019
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x45802f
xor ecx, ecx
cmp eax, 2
pop edi
pop esi
cmove eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x458034
sub ecx, edx
cmp byte [ecx + edi - 1], 0x5c
lea esi, [ecx + edi]
je 0x45804d
mov byte [esi], 0x5c
inc esi
mov byte [esi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4580ce
jmp 0x458080
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.005767f0
push ebx
push edi
push dword [ebp + 8]
call fcn.00457fb0
add esp, 0x18
test eax, eax
jne 0x4580ce
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x458080
mov byte [esi - 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push ebx
push edi
push dword [ebp + 8]
call dword [0x62d0cc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x62d0d0
call fcn.0056c116
add esp, 4
cmp dword [0x62d0d0], 0xffffffff
jne 0x457fd9
push str.RegDeleteKeyExA
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x62d0d0
mov dword [0x62d0cc], eax
call fcn.0056c0c5
add esp, 4
jmp 0x457fd9
Function at 0x459740
Capabilities:
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590c95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
xor bl, bl
call fcn.0046b8a0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0
push 0
push eax
push ecx
mov eax, esp
mov dword [ebp - 4], 0
mov dword [eax], esi
call fcn.00472500
add esp, 0x10
test al, al
je 0x459986
push 0
lea ecx, [ebp - 0x44]
call fcn.0046c590
push 0
push 0
call fcn.00579d6c
add esp, 8
mov dword [ebp + 8], eax
test esi, esi
mov dword [ebp - 0x1c], 0
mov ecx, 0x593554
mov dword [ebp - 0x18], 0
cmovne ecx, esi
mov dword [ebp - 0x14], 0x4000000
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.004599c0
push 0
push eax
push 0
call fcn.00576d24
add esp, 0xc
mov byte [ebp - 4], 0
cmp byte [ebp - 0x14], 0
mov edi, eax
je 0x459800
push dword [ebp - 0x20]
call fcn.0056be44
add esp, 4
cmp byte [ebp - 0x13], 0
je 0x459811
push dword [ebp - 0x1c]
call fcn.0056be44
add esp, 4
cmp byte [ebp - 0x12], 0
je 0x459822
push dword [ebp - 0x18]
call fcn.0056be44
add esp, 4
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x4000000
je 0x459975
test edi, edi
je 0x459975
push 0x5c
push edi
call fcn.0056e2e7
add esp, 8
test eax, eax
je 0x459975
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
push edi
mov word [eax], cx
call esi
push edi
push str.INSTALLDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [ebp + 0x10]
mov ecx, 0x628070
mov word [0x62808c], 0x3000
mov dword [0x628084], 0
mov byte [0x62808c], al
mov eax, dword [ebp + 0xc]
mov word [0x6280cd], 0
mov byte [0x6280cf], 0
mov dword [0x628088], 0
mov dword [0x628104], 0
mov dword [0x628100], 0
mov dword [0x628084], eax
call fcn.00458940
mov eax, dword [0x628084]
mov ecx, 0x628070
mov edx, dword [ebp - 0x44]
mov dword [0x628088], eax
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [0x6280ec], 0
mov dword [0x6280f0], 0
mov dword [0x6280dc], 0x62808d
mov dword [0x6280d8], 0
mov dword [0x6280e0], 0
mov dword [0x6280e4], 0
mov dword [0x6280d4], 1
mov word [0x6280d0], 0
mov dword [0x6280e8], 0
mov byte [0x62808d], 0
mov dword [0x628074], edx
mov dword [0x628078], edx
mov dword [0x62807c], eax
push 0
mov byte [0x628080], 0
call fcn.00458d60
push dword [ebp + 8]
mov bl, al
call esi
push edi
call fcn.00576914
push dword [ebp + 8]
call fcn.00576914
add esp, 8
cmp dword [ebp - 0x3c], 0
mov dword [ebp - 4], 3
jl 0x4599aa
cmp dword [ebp - 0x44], 0
je 0x4599aa
call fcn.004802a0
push 0
push dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e450
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59103d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], 0x4000000
test eax, eax
mov dword [ebp - 0x1c], edi
mov ebx, 0x593554
mov dword [ebp - 0x18], edi
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
cmp byte [0x62d430], 0
mov dword [ebp - 4], edi
je 0x45e4e3
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046ddc0
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0056be3b
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046ddc0
add esp, 0x24
push 0x200030
push 0x5b178c
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.0057a211
add esp, 4
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x45e52e
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046ddc0
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0056be3b
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046ddc0
mov eax, dword [ebp - 0x10]
add esp, 0x24
push eax
push edi
call fcn.0057a354
add esp, 8
test edi, edi
jne 0x45e573
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046ddc0
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0056be3b
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046ddc0
add esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x62d748], 0
je 0x45e62f
push 0x62d748
lea eax, [ebp - 0x30]
push str._s_service_log.txt
push eax
call fcn.0046a970
add esp, 0xc
cmp byte [ebp - 0x21], 0
jge 0x45e5b1
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45e5b4
mov eax, 0x593554
jmp 0x45e5b4
lea eax, [ebp - 0x30]
push fcn.00576eaf
push 0x5ad174
push eax
call fcn.00482d50
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45e614
lea eax, [ebp - 0x40]
push 0x10
push eax
call fcn.0057a13e
lea eax, [ebp - 0x50]
push 0x10
push eax
call fcn.0057a085
push dword [ebp + 0x18]
cmp byte [ebp + 0x14], 0
mov ecx, 0x593554
mov eax, str.ERROR_
cmove eax, ecx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x50]
push eax
push str._s__s_:__s_s
push esi
call fcn.0045a0b0
push esi
call fcn.00576f54
add esp, 0x2c
cmp byte [ebp - 0x21], 0
mov byte [ebp - 4], 1
jge 0x45e62f
call fcn.004802a0
push 0
push dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp byte [ebp - 0x13], 0
je 0x45e63e
push edi
call fcn.0056be44
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e7d0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e807
test al, 3
je 0x45e7f7
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
jne 0x45e807
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
pop esi
sete al
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x45e810
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e870
test al, 3
je 0x45e838
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
jne 0x45e870
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e85b
test al, 3
je 0x45e85b
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
jne 0x45e870
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
pop edi
sete al
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret
Function at 0x45ef10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0
push dword [ebp + 8]
xor bl, bl
mov byte [ebp - 1], bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x45f055
call fcn.004802a0
mov ecx, eax
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, eax
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45f03d
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push str.StringFileInfo040904b0OriginalFilename
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45f03d
mov ecx, dword [ebp + 0xc]
mov edx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45ef85
sub edx, esi
mov esi, dword [ebp - 8]
sar edx, 1
lea eax, [edx + 1]
cmp esi, eax
jne 0x45f03d
mov edx, dword [ebp - 0xc]
add esi, esi
sub esi, 4
jb 0x45efc1
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x45efc6
add edx, 4
add ecx, 4
sub esi, 4
jae 0x45efb0
cmp esi, 0xfffffffc
je 0x45eff3
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x45f03d
cmp esi, 0xfffffffd
je 0x45eff3
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x45f03d
cmp esi, 0xfffffffe
je 0x45eff3
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x45f03d
cmp esi, 0xffffffff
je 0x45eff3
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x45f03d
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5b1bc4
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45f03d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45f03d
cmp dword [ebp - 8], 0x34
jb 0x45f03d
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov esi, dword [eax + 8]
or ecx, esi
mov byte [ebp - 1], 1
mov dword [edx], 0
mov dword [edx + 4], esi
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
call fcn.004802a0
push 0
push ebx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fc30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5911ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
mov dword [eax], 0
push dword [ebp + 8]
call fcn.00470910
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00472140
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45fc86
test eax, 0x400
je 0x45fc86
mov bl, 1
jmp 0x45fc88
xor bl, bl
lea ecx, [ebp - 0x1c]
call fcn.00470be0
mov ecx, dword [ebp - 0xc]
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4609b0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
test eax, eax
jne 0x460a19
and dword [ebp - 0x48], 0xff0fffff
push str.m_hService__NULL
mov byte [ebp - 0x45], al
and dword [ebp - 0x48], 0xfff00000
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push 1
push 1
push 1
push 4
push 0
push 0
mov dword [ebp - 0x30], 3
call fcn.0045e650
add esp, 0x20
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x460a37
mov eax, dword [ebp - 0x18]
cmp eax, 2
je 0x460a8f
cmp eax, 4
je 0x460a8f
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor esi, esi
push esi
push esi
push dword [ebx + 4]
call edi
test eax, eax
jne 0x460a89
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x460a89
cmp eax, 0x41d
je 0x460a89
cmp eax, 0x41f
jne 0x460ad6
cmp esi, 5
je 0x460ad6
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push dword [ebx + 4]
inc esi
call edi
test eax, eax
je 0x460a50
cmp byte [ebp + 8], 0
jne 0x460a9a
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x460ae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.0045ac90
push esi
push str.Failed_to_query_service__GLE__u_
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045e650
add esp, 0x24
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 8]
mov dword [ebp + 8], eax
cmp ecx, 4
je 0x460b75
jmp 0x460b00
mov eax, 0xcccccccd
mov ecx, 0x2710
mul dword [ebp - 4]
shr edx, 3
cmp edx, 0x3e8
jae 0x460b1f
mov edx, 0x3e8
jmp 0x460b28
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x460b6f
cmp dword [ebp - 8], edi
jbe 0x460b4f
call esi
mov edi, dword [ebp - 8]
mov dword [ebp + 8], eax
jmp 0x460b59
call esi
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
ja 0x460b6f
mov ecx, dword [ebp - 0x18]
cmp ecx, 4
jne 0x460b00
pop edi
cmp ecx, ecx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 4
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x460b90
Capabilities:
Query service status
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
test eax, eax
je 0x460c79
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x460bbf
cmp dword [ebp - 0x18], 1
je 0x460c6e
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
setne al
cmp byte [ebp + 8], 0
je 0x460c7b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x32
xor eax, eax
dec esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x24
lea eax, [ebp - 0x40]
push eax
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp dword [ebp - 0x3c], 1
je 0x460c6e
push 0x64
call edi
test esi, esi
jg 0x460be8
cmp byte [ebp + 0xc], 0
je 0x460c79
test byte [ebp - 0x20], 1
jne 0x460c79
push dword [ebp - 0x24]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x460c79
push 0xf00d
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8