joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409100
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442499
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov edx, dword [esi]
cmp edx, 0xffffffff
je 0x4091ed
cmp byte [esi + 0x18], 0
jne 0x4091ed
cmp byte [esi + 0x20], 0
je 0x4091ed
cmp byte [esi + 0x21], 0
je 0x4091ed
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x4091ed
cmp dword [esi + 0x58], 0x10
push edi
jb 0x40915b
mov eax, dword [esi + 0x44]
jmp 0x40915e
lea eax, [esi + 0x44]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4091ac
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x2733
jne 0x409192
pop edi
mov byte [esi + 0x21], 0
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov byte [esi + 0x18], 1
call edi
pop edi
mov dword [esi + 0x1c], eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
test eax, eax
jle 0x4091ec
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ecx]
push edx
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [esi + 0x40]
mov dword [esp + 0x30], 0
call dword [0x451a38]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4092d0
Capabilities:
Connect socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x409358
cmp byte [esi + 0x18], 0
jne 0x409358
cmp byte [esi + 0x20], 0
jne 0x409358
mov ecx, dword [esi + 4]
push 0x23
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x409309
mov byte [esi + 0x18], 1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1c], eax
pop esi
ret 8
mov ecx, dword [esp + 8]
lea eax, [esi + 8]
mov edx, 2
push 0x10
mov word [eax], dx
mov dx, word [esp + 0x10]
push eax
mov eax, dword [esi]
push eax
mov dword [esi + 0xc], ecx
mov word [esi + 0xa], dx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x409358
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x2734
je 0x409357
call edi
cmp eax, 0x2733
je 0x409357
mov byte [esi + 0x18], 1
call edi
mov dword [esi + 0x1c], eax
pop edi
pop esi
ret 8
Function at 0x409400
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
je 0x4094c9
cmp byte [esi + 0x18], 0
jne 0x4094c9
push edi
mov eax, 2
lea edi, [esi + 8]
push str.127.0.0.1
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0
mov dword [esi + 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi]
push 0x10
push edi
push ecx
mov word [esi + 0xa], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x409485
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 8
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x409475
mov byte [esi + 0x18], 1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1c], eax
pop edi
xor al, al
pop esi
pop ecx
ret
mov ecx, dword [esi]
push 1
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x409498
mov byte [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
pop edi
xor al, al
pop esi
pop ecx
ret
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push edi
push eax
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x40946f
mov edx, dword [0x454564]
mov cx, word [esi + 0xa]
add edx, 6
xchg word [edx], cx
pop edi
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret
Function at 0x40b8c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454118]
jne 0x40b8cb
repz ret
jmp fcn.0040b9db
Function at 0x42096c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
fld dword [ebp + 4]
mov esi, dword [ebp]
test esi, esi
jle 0x4209b2
mov edi, dword [ebp + 0x2c]
xor edx, edx
fld dword [ecx + edx*8 + 4]
movsx eax, word [edi + edx*2]
add eax, eax
add eax, eax
add eax, eax
add eax, ebx
fld dword [ecx + edx*8]
fmul st(2)
fstp dword [eax]
fmul st(1)
fstp dword [eax + 4]
add edx, 1
cmp edx, esi
jne 0x42098b
fstp st(0)
jmp 0x4209b4
fstp st(0)
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004209d0
Function at 0x443c49
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, dword [0x4544b8]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push 0x454230
push 0x40
push edi
push esi
push ebx
call sub.KERNEL32.dll_VirtualProtectEx
cmp eax, 1
jb 0x443c99
push 0
push edi
push ebp
push esi
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
cmp eax, 1
jb 0x443c99
push 0x454234
push dword [0x454230]
push edi
push esi
push ebx
call sub.KERNEL32.dll_VirtualProtectEx
cmp eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40611c
pop dword [ebp - 0xc]
mov eax, 0x1e947b35
sub eax, 0x1e541a19
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x8955fa38
sub dword [ebp - 0x1c], 0x3b03b4ed
mov dword [ebp - 0x18], 0x3a34749c
sub dword [ebp - 0x18], 0x8012857
mov dword [ebp - 0x14], 0x11ecc408
sub dword [ebp - 0x14], 0xc5a07fda
mov dword [ebp - 0x10], 0x34cd1e2a
sub dword [ebp - 0x10], 0x34cd1e2a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4224ede5
sub eax, 0x41e47d85
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x974a6d24
add dword [ebp - 0x1c], 0xdd27fc32
mov dword [ebp - 0x18], 0x250dd9ae
sub dword [ebp - 0x18], 0xe3a17839
mov dword [ebp - 0x14], 0x28677e29
add dword [ebp - 0x14], 0x3b07ee43
mov dword [ebp - 0x10], 0xd6a545fb
add dword [ebp - 0x10], 0x295aba05
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35493
push 0
call eax
mov ecx, 0xd1605b86
sub ecx, 0xd16018d0
xor esi, esi
add esi, eax
mov edx, 0xb4e48c79
sub edx, 0xb4a38c79
add edx, dword [ebp - 0xc]
mov ebx, 0xd9f48c8b
add ebx, 0xc9fad3c9
sub dword [ebp - 4], eax
mov edi, dword [edx]
sub dword [ebp - 4], edx
xor edi, ebx
add dword [ebp - 8], 0x6234c207
mov dword [esi], edi
mov dword [ebp - 8], 0xfc2a9fc7
add esi, 0xdc945d70
sub esi, 0xdc945d6c
add edx, 4
loop 0x40623b
add eax, 0xfdab
xor ebx, ebx
add ebx, eax
add eax, 0x89423a23
add eax, 0x76bdc5e2
mov ecx, 0x6f1ecac1
add ecx, 0x9121353f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401bd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x200
push esi
push str.FTSafeNetRockey6Service_pkpm
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
mov esi, eax
test si, si
je 0x401c2a
mov ecx, dword [esp + 0x208]
lea eax, [esp + 4]
push 0x200
push eax
push 0x1f5
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x401c1e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor eax, eax
pop esi
add esp, 0x200
ret 0x10
push ebx
push ebp
push str.FTSafeNetRockey6Service_pkpm
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ebp, eax
call fcn.00401000
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x401c9d
push edi
lea eax, [esp + 0x10]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push str.__start
push ecx
call ebx
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 1
push 0x1f4
call edi
call fcn.00401000
test eax, eax
mov dword [0x41d1c8], eax
jne 0x401c9c
mov eax, esi
inc esi
cmp eax, 0x14
jl 0x401c7f
pop edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [esp + 0x210]
lea ecx, [esp + 0xc]
push 0x200
push ecx
mov dword [0x41d1b0], esi
call fcn.00401f20
add esp, 8
test eax, eax
je 0x401cef
lea edx, [esp + 0xc]
push 0x5c
push edx
call fcn.0040d190
add esp, 8
test eax, eax
je 0x401cdc
mov byte [eax], 0
lea eax, [esp + 0xc]
push 0x419110
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
jmp 0x401cf4
push str..SvrCfg6.ini
mov ecx, 0x41c3f8
call fcn.004062b0
push 0
push 0x402090
push 0
push 0x81
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
call fcn.00401050
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x200
ret 0x10
Function at 0x401f20
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [0x41d344]
sub esp, 0x20c
test eax, eax
je 0x401fe2
lea eax, [esp + 0xc]
push str.SYSTEMControlSet001Services_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xc]
push 0x41918c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp]
lea eax, [esp + 0xc]
push edx
push 0x20019
push 0
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401f7c
xor eax, eax
add esp, 0x20c
ret
mov ecx, dword [esp + 0x214]
mov eax, dword [esp + 0x210]
lea edx, [esp + 4]
mov dword [esp + 4], ecx
push edx
mov edx, dword [esp + 4]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push str.ImagePath
push edx
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401fcb
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x20c
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x20c
ret
lea edx, [esp + 0xc]
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp]
lea ecx, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40201b
xor eax, eax
add esp, 0x20c
ret
mov edx, dword [esp + 0x214]
mov ecx, dword [esp + 0x210]
lea eax, [esp + 8]
mov dword [esp + 8], edx
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0x41918c
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40206a
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x20c
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x20c
ret

Function at 0x402da0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0
push 0
push 0
push bind
push 0
push bind
push 0xcf0000
push 0x41d2dc
push 0x41d1d4
push 0
mov dword [0x41d2d8], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x402dda
ret
push 0
push eax
mov dword [0x41d340], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
Function at 0x403050
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x40c
push esi
push edi
lea eax, [esp + 0x14]
push 0x200
push eax
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, dword [esp + 0x41c]
test edi, edi
je 0x4030a7
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push 0x4192cc
push ecx
call esi
lea edx, [esp + 0x14]
push edi
push edx
call esi
lea eax, [esp + 8]
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4030e1
lea ecx, [esp + 8]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x403233
lea edx, [esp + 0xc]
lea eax, [esp + 0x214]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.FTSafeNetRockey6Service_pkpm
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [esp + 0x418]
test eax, eax
jne 0x4031af
lea esi, [esp + 0x14]
lea eax, [esp + 0x214]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403153
test cl, cl
je 0x40314f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403153
add eax, 2
add esi, 2
test cl, cl
jne 0x40312f
xor eax, eax
jmp 0x403158
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4031af
test edi, edi
jne 0x403191
mov eax, dword [esp + 8]
push str.FTSafeNetRockey6Service_pkpm
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403228
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x40c
ret
cmp edi, 1
jne 0x4031af
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x40c
ret
test edi, edi
jne 0x4031e0
mov ecx, dword [esp + 8]
push str.FTSafeNetRockey6Service_pkpm
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403196
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x40c
ret
cmp edi, 1
jne 0x403228
mov edx, dword [esp + 8]
lea ecx, [esp + 0x14]
push 0x80
push ecx
push edi
push 0
push str.FTSafeNetRockey6Service_pkpm
push edx
mov dword [esp + 0x24], 0x80
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403178
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x40c
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x40c
ret
Function at 0x404bd0
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [0x420878]
sub esp, 0x108
test eax, eax
push esi
jne 0x404c4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.FTSafeNetRockey6Service_pkpm
push 0
mov dword [0x420874], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [0x420874]
push eax
push str.FTSafeNetRockey6Service_pkpm
lea ecx, [esp + 0x14]
push str._s_error:__d
push ecx
call fcn.0040d280
mov eax, dword [esp + 0x120]
add esp, 0x10
lea edx, [esp + 0xc]
mov dword [esp + 8], eax
test esi, esi
mov dword [esp + 4], edx
je 0x404c4f
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x108
ret

Function at 0x404c60
Capabilities:
Create service
Delete service
Persist via windows service
Print debug messages

Disassembly:
sub esp, 0x204
lea eax, [esp + 4]
push edi
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404c92
push 0x1ff
call fcn.00403240
add esp, 4
pop edi
add esp, 0x204
ret
lea ecx, [esp + 8]
push str.__dispatch
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x404d8e
push ebp
push esi
push str.Create_Service
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xf01ff
push str.FTSafeNetRockey6Service_pkpm
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x404cef
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebp
push 0
push 0
push 0x42087c
push 0
lea edx, [esp + 0x20]
push 0
push edx
push 1
push 2
push 0x10
push 0xf01ff
push str.Nr6Service_pkpm
push str.FTSafeNetRockey6Service_pkpm
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x404d74
push ebx
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x404d63
push str.ChangeServiceConfig2A
push ebx
mov dword [esp + 0x18], str.FT_NetROCKEY6_pkpm_service_program
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x42086c], eax
je 0x404d5c
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call ebp
pop ebx
push edi
call ebp
pop esi
pop ebp
pop edi
add esp, 0x204
ret
push 0x200
call fcn.00403240
add esp, 4
push edi
call ebp
pop esi
pop ebp
pop edi
add esp, 0x204
ret
push 0x201
call fcn.00403240
add esp, 4
pop edi
add esp, 0x204
ret
Function at 0x404db0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x404e78
push 0xf01ff
push str.FTSafeNetRockey6Service_pkpm
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x404e6e
push 0x420850
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404e4c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x420850
push esi
call ebx
test eax, eax
je 0x404e34
cmp dword [0x420854], 3
jne 0x404e34
push 0x3e8
call edi
push 0x420850
push esi
call ebx
test eax, eax
jne 0x404e18
mov eax, dword [0x420854]
pop ebx
cmp eax, 1
je 0x404e4c
push 0x202
call fcn.00403240
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x404e64
push 0x203
call fcn.00403240
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
ret
push 0x201
call fcn.00403240
add esp, 4
pop edi
pop esi
ret
Function at 0x404ed0
Capabilities:
Modify service
Print debug messages
Start service

Disassembly:
sub esp, 0x200
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x405092
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0xf003f
push str.FTSafeNetRockey6Service_pkpm
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x40503f
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x10]
push 0x200
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404f4b
push 0x1ff
call fcn.00403240
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Module_FileName:
call edi
lea ecx, [esp + 0x10]
push str.__dispatch
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push 0
push edx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x404f91
push str.change_service_config
jmp 0x404ff4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x421
ja 0x404fc9
je 0x404fc2
sub eax, 5
je 0x404fbb
dec eax
je 0x404fb4
sub eax, 0x51
jne 0x404fda
push 0x419a3c
jmp 0x404ff4
push 0x419a38
jmp 0x404ff4
push 0x419a34
jmp 0x404ff4
push 0x419a30
jmp 0x404ff4
sub eax, 0x423
je 0x404fef
sub eax, 0xd
je 0x404fe8
sub eax, 6
je 0x404fe1
push 0x419a2c
jmp 0x404ff4
push 0x419a28
jmp 0x404ff4
push 0x419a24
jmp 0x404ff4
push 0x419a20
call edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push 0x20000000
push str.FTSafeNetRockey6Service_pkpm
push ebx
call ebp
mov ecx, dword [esp + 0x214]
mov edi, eax
mov eax, dword [esp + 0x218]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x405081
call fcn.00404e90
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
call esi
call fcn.00404c60
push 0x20000000
push str.FTSafeNetRockey6Service_pkpm
push ebx
call ebp
mov edi, eax
test edi, edi
je 0x405084
mov edx, dword [esp + 0x218]
mov eax, dword [esp + 0x214]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x405081
call fcn.00404e90
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
push 0x201
call fcn.00403240
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
Function at 0x4050b0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
push 0xa0000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x405172
push esi
push 0xa0000000
push str.FTSafeNetRockey6Service_pkpm
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40515b
push 0x420850
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40514a
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x420850
push esi
call ebx
test eax, eax
je 0x405131
cmp dword [0x420854], 3
jne 0x405131
push 0x3e8
call edi
push 0x420850
push esi
call ebx
test eax, eax
jne 0x405115
mov eax, dword [0x420854]
pop edi
cmp eax, 1
pop ebx
je 0x40514a
push 0x202
call fcn.00403240
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x201
call fcn.00403240
add esp, 4
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x201
call fcn.00403240
add esp, 4
pop ebp
ret