joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4364
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov dword [0x540320], 0x834
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push eax
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x4f4482
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
and al, 0xdf
mov bl, al
cmp bl, 0x41
jb 0x4f447b
cmp bl, 0x43
jb 0x4f445d
mov esi, ebx
and esi, 0xff
cmp byte [esi + 0x54a7a5], 3
je 0x4f445d
xor eax, eax
push ebp
push 0x4f4453
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDriveTypeA
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 5
jne 0x4f4403
mov byte [esi + 0x54a7a5], 3
jmp 0x4f4421
cmp byte [ebp - 0xd], 3
jne 0x4f4421
mov eax, ebx
call fcn.00471df0
test al, al
jne 0x4f441d
mov byte [esi + 0x54a7a5], 3
jmp 0x4f4421
mov byte [ebp - 0xd], 2
cmp byte [ebp - 0xd], 2
jne 0x4f4449
mov eax, ebx
sub al, 0x41
inc eax
call fcn.00409cd8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f445d
mov eax, dword [ebp - 0xc]
call fcn.00409dac
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
and al, 0xdf
mov bl, al
cmp bl, 0x41
jae 0x4f43bc
xor eax, eax
mov dword [0x540320], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f52e4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
xor eax, eax
push ebp
push 0x4f54f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x841
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 4
push 2
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x540a5c]
cmp eax, 0x7a
jne 0x4f54d9
mov eax, dword [ebp - 8]
call fcn.00408d98
mov dword [ebp - 4], eax
mov eax, dword [0x54a800]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x54a804]
mov edx, dword [eax]
call dword [edx + 8]
push 0
push 4
push 2
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x540a5c]
test eax, eax
jne 0x4f53fa
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x4f53fa
inc ebx
xor esi, esi
lea eax, [esi + esi*2]
mov edx, dword [ebp - 4]
lea edi, [edx + eax*8 + 4]
cmp dword [edi + 0xc], 0
je 0x4f53f6
cmp dword [edi + 0x14], 0
je 0x4f53f6
mov eax, dword [edi]
cmp eax, 3
je 0x4f53a5
cmp eax, 4
je 0x4f53a5
cmp eax, 5
jne 0x4f53f6
mov edx, dword [edi + 0x14]
mov eax, dword [0x54a800]
call fcn.00416f54
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x4f53da
mov edx, dword [ebp - 0xc]
mov eax, dword [0x54a804]
call fcn.00416ef8
mov ecx, eax
inc ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x54a804]
call fcn.00417044
jmp 0x4f53f6
mov edx, dword [edi + 0x14]
mov eax, dword [0x54a800]
call fcn.00416d9c
mov edx, 1
mov eax, dword [0x54a804]
call fcn.00416d9c
inc esi
dec ebx
jne 0x4f537e
mov eax, dword [ebp - 4]
call fcn.004027dc
mov eax, dword [0x54a800]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4f54d2
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x54a804]
call fcn.00416ef8
cmp eax, 8
jbe 0x4f54ca
mov edx, esi
mov eax, dword [0x54a800]
call fcn.00416ef8
mov edi, eax
xor eax, eax
call fcn.004b458c
mov dword [0x540c3c], eax
mov eax, edi
call fcn.004f2b4c
test al, al
jne 0x4f54ca
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.004b4a8c
push edi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4f547b
cmp eax, 0xffffffff
je 0x4f547b
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
cmp dword [0x54041c], 0
je 0x4f54ca
cmp dword [ebp - 0x10], 0
je 0x4f54ca
push 0
lea edx, [ebp - 0x14]
mov eax, 0xec
call fcn.004ab980
mov eax, dword [ebp - 0x14]
call fcn.00404a84
push eax
lea edx, [ebp - 0x18]
mov eax, 0x25
call fcn.004ac210
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404894
mov eax, dword [ebp - 0x18]
call fcn.00404a84
push eax
push 0
call sub.user32.dll_MessageBoxA_1
inc esi
dec ebx
jne 0x4f5416
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f54fb
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004045dc
ret
Function at 0x4f554c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x4f56e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x845
cmp dword [0x540a70], 0
je 0x4f5660
push 0
push 0x1388
mov eax, dword [0x540338]
mov edx, dword [0x54033c]
call fcn.00405a30
cmp edx, 0
jne 0x4f5660
cmp eax, 0x4b0
jne 0x4f5660
cmp dword [0x540bb8], 0
jne 0x4f55bd
mov dl, 1
mov eax, dword [0x47089c]
call fcn.0040377c
mov dword [0x540bb8], eax
mov eax, dword [0x54045c]
call fcn.00404ea0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4f55e5
mov eax, dword [0x54045c]
push eax
mov eax, dword [0x540a70]
push eax
call fcn.0046df00
jmp 0x4f5660
test al, 6
je 0x4f55fd
push 0x20
mov eax, dword [0x54045c]
call fcn.00404ea0
push eax
call sub.kernel32.dll_SetFileAttributesW
jmp 0x4f55d2
push 0xa
mov eax, dword [0x54045c]
push eax
mov eax, dword [0x540bb8]
push eax
call fcn.0046dfb8
test al, al
je 0x4f55d2
mov eax, dword [0x540bb8]
call fcn.00419764
push edx
push eax
mov eax, dword [0x540a70]
call fcn.00419764
cmp edx, dword [esp + 4]
jne 0x4f5633
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4f55d2
mov eax, dword [0x540bb8]
call fcn.00419764
mov ecx, eax
mov eax, dword [0x540a70]
mov edx, dword [eax + 4]
mov eax, dword [0x540bb8]
mov eax, dword [eax + 4]
call fcn.00471f28
test eax, eax
jne 0x4f55d2
cmp dword [0x540430], 0
jle 0x4f56c9
sub dword [0x540430], 0xc8
cmp dword [0x540430], 0
jg 0x4f56d0
mov dword [0x540430], 0x4e20
lea eax, [ebp - 4]
mov edx, dword [0x54a62c]
call fcn.00404650
xor ebx, ebx
call fcn.004e9d5c
test al, al
jne 0x4f56a1
mov bl, 1
mov eax, dword [ebp - 4]
call fcn.004e9ef4
cmp eax, 2
je 0x4f56b7
cmp dword [0x540ba8], 3
jle 0x4f56be
mov bl, 1
call fcn.004e9e14
mov dl, 1
mov eax, ebx
call fcn.004ea11c
jmp 0x4f56d0
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f56ed
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4f5770
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor edx, edx
push ebp
push 0x4f58d3
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [0x540320], 0x847
cmp al, byte [0x540c64]
je 0x4f58b1
mov byte [0x540c64], al
cmp dword [0x54a9f4], 0
jne 0x4f57bf
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov dword [0x54a9f4], eax
mov eax, dword [0x54a9f4]
mov eax, dword [eax + 8]
test eax, eax
jle 0x4f57f5
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f57eb
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x54a9f4]
call fcn.00416ef8
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4f57d5
mov eax, dword [0x54a9f4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x54a56c]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [0x541c9c]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 2], al
cmp byte [0x540c64], 0
je 0x4f58b1
mov bl, 0x41
cmp bl, byte [ebp - 1]
je 0x4f58a7
cmp bl, byte [ebp - 2]
je 0x4f58a7
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404798
lea eax, [ebp - 0xc]
mov edx, 0x4f58e8
call fcn.00404894
mov eax, dword [ebp - 0xc]
call fcn.00404a84
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4f58a7
lea edx, [ebp - 0x10]
mov eax, 0x7d
call fcn.004ab980
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404798
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
pop ecx
call fcn.004048d8
push 0
push 0x22
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 8]
call fcn.00404adc
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
je 0x4f58a7
mov edx, eax
mov eax, dword [0x54a9f4]
call fcn.00416d9c
inc ebx
cmp bl, 0x5b
jne 0x4f581a
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f58da
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004045dc
ret

Function at 0x4f5d6c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
mov eax, dword [ebp - 8]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4f5e16
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0046de9c
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.0046de9c
cmp esi, eax
jne 0x4f5dcf
mov eax, dword [ebp - 4]
call fcn.00470b50
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00470b50
cmp edx, dword [esp + 4]
jne 0x4f5dcb
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f5dfb
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.0040986c
push 0
lea eax, [ebp - 8]
call fcn.00404adc
push eax
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5e1d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4fd0e4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
mov eax, dword [ebp - 8]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4fd188
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046de9c
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0046de9c
mov ecx, eax
test ecx, ecx
jle 0x4fd16b
test ebx, ebx
jle 0x4fd14a
mov eax, ecx
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x4fd13d
mov bl, 1
jmp 0x4fd16d
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.0040986c
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
lea eax, [ebp - 8]
call fcn.00404adc
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4fd16d
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd18f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002d87
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003220
call fcn.01002f44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10043c8
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002b9c
cmp eax, esi
jne 0x1002b8f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002b9f
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1002b76
xor esi, esi
inc esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002bb2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002bed
mov eax, dword [0x10043c4]
test eax, eax
jne 0x1002be7
mov dword [0x10043c4], esi
push 0x1001188
push 0x100117c
call fcn.01002af3
pop ecx
pop ecx
test eax, eax
je 0x1002bed
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002cb7
mov dword [0x1004078], esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002c11
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043c4], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002c1e
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x10043cc], ebx
je 0x1002c3f
push 0x10043cc
call fcn.01002eb9
pop ecx
test eax, eax
je 0x1002c3f
push ebx
push 2
push ebx
call dword [0x10043cc]
push dword [0x1004060]
push dword [0x1004064]
push dword [0x100405c]
call fcn.010018dc
add esp, 0xc
mov dword [0x1004074], eax
cmp dword [0x1004068], ebx
jne 0x1002c9d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004078], ebx
jne 0x1002cab
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004074]
call fcn.01002f89
ret
call 0x112b000
jmp 0x1002b54

Function at 0x8ccbaa
Capabilities:
Encode data using xor

Disassembly:
push 0x8cc92e
pop ecx
and ebx, esi
call fcn.008ccbea
or ebx, ebx
xor dword [edi], ecx
sub esi, 1
add edi, 1
mov ebx, esi
and esi, ebx
add ebx, 0xd76f1b56
cmp edi, edx
jne fcn.008ccbaa
sub esi, 1
ret
Function at 0x401170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, 0xd4c3
test ebp, ebp
je 0x401237
test edx, edx
je 0x401237
push ebx
push esi
lea esi, [ebp + 2]
sub ebp, edx
mov ebx, 8
mov al, byte [edx + ebp]
mov ecx, edi
sar ecx, 8
xor al, cl
mov byte [edx], al
movzx eax, al
add eax, edi
imul eax, eax, 0xfc51
add eax, 0xe3b2
mov ecx, eax
sar ecx, 8
xor cl, byte [esi - 1]
add edx, 5
mov byte [edx - 4], cl
movzx ecx, cl
add ecx, eax
imul ecx, ecx, 0xfc51
add ecx, 0xe3b2
mov eax, ecx
sar eax, 8
xor al, byte [esi]
add esi, 5
mov byte [edx - 3], al
movzx eax, al
add eax, ecx
imul eax, eax, 0xfc51
add eax, 0xe3b2
mov ecx, eax
sar ecx, 8
xor cl, byte [esi - 4]
mov byte [edx - 2], cl
movzx ecx, cl
add ecx, eax
imul ecx, ecx, 0xfc51
add ecx, 0xe3b2
mov eax, ecx
sar eax, 8
xor al, byte [esi - 3]
movzx edi, al
add edi, ecx
imul edi, edi, 0xfc51
mov byte [edx - 1], al
add edi, 0xe3b2
sub ebx, 1
jne 0x401197
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
ret
pop edi
xor al, al
pop ebp
ret

Function at 0x4012e0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x401364
push esi
push 0xf01ff
push str.SeetrolMyService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401324
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0xc], 1
je 0x401350
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
pop edi
add esp, 0x1c
ret

Function at 0x401370
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4013f4
push esi
push 0xf01ff
push str.SeetrolClientService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4013b4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0xc], 1
je 0x4013e0
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
pop edi
add esp, 0x1c
ret
Function at 0x401400
Capabilities:
Set registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x110], eax
mov al, byte [0x42021c]
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], vtable.CMyRegistry.0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
cmp al, 0x14
jne 0x401454
mov eax, esi
imul eax, eax, 0x184
add eax, 0x419efc
push eax
push 0x41fff8
push str.SoftWareKnowhowUpdate_s_s
jmp 0x40148e
cmp al, 0x15
jne 0x401471
imul ecx, ecx, 0x184
add ecx, 0x419efc
push ecx
push 0x41fff8
push str.SoftWareKnowhowUpdate2_s_s
jmp 0x40148e
cmp al, 0x1c
jne 0x40149a
mov edx, esi
imul edx, edx, 0x184
add edx, 0x419efc
push edx
push 0x41fff8
push str.SoftWareKnowhowUpdate3_s_s
lea edx, [esp + 0x28]
call fcn.00404a30
add esp, 0xc
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push closesocket
call edi
test eax, eax
jne 0x401566
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x14], 0
jne 0x401627
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push closesocket
call edi
test eax, eax
jne 0x401627
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
imul esi, esi, 0x184
lea ecx, [esi + 0x419f7c]
mov dword [esp + 0x14], 1
test ecx, ecx
je 0x40152b
mov eax, ecx
lea edi, [eax + 1]
jmp 0x401510
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401510
mov edx, dword [esp + 0x10]
sub eax, edi
push eax
push ecx
push 1
push 0
push str.VERSION
push edx
call ebp
lea edx, [esi + 0x419fbc]
test edx, edx
je 0x40155c
cmp dword [esp + 0x14], 0
je 0x40155c
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401541
sub eax, esi
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push 0
push str.BUILDDATE
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x401621
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40158a
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x14], 0
jne 0x401627
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push closesocket
call edi
test eax, eax
jne 0x401627
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
imul esi, esi, 0x184
lea ecx, [esi + 0x419f7c]
mov dword [esp + 0x14], 1
test ecx, ecx
je 0x4015eb
mov eax, ecx
lea edi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4015d0
sub eax, edi
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 1
push 0
push str.VERSION
push ecx
call ebp
lea edx, [esi + 0x419fbc]
test edx, edx
je 0x40161c
cmp dword [esp + 0x14], 0
je 0x40161c
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401601
sub eax, esi
push eax
push edx
mov edx, dword [esp + 0x18]
push 1
push 0
push str.BUILDDATE
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00404aa2
add esp, 0x114
ret
Function at 0x401640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x198
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x194], eax
mov al, byte [0x42021c]
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x14], vtable.CMyRegistry.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], ebx
lea ebp, [ebx + 1]
cmp al, 0x14
jne 0x401698
mov eax, dword [esp + 0x1a8]
imul eax, eax, 0x184
add eax, 0x419efc
push eax
push 0x41fff8
push str.SoftWareKnowhowUpdate_s_s
jmp 0x4016de
cmp al, 0x15
jne 0x4016bc
mov ecx, dword [esp + 0x1a8]
imul ecx, ecx, 0x184
add ecx, 0x419efc
push ecx
push 0x41fff8
push str.SoftWareKnowhowUpdate2_s_s
jmp 0x4016de
cmp al, 0x1c
jne 0x4016ed
mov edx, dword [esp + 0x1a8]
imul edx, edx, 0x184
add edx, 0x419efc
push edx
push 0x41fff8
push str.SoftWareKnowhowUpdate3_s_s
lea edx, [esp + 0xac]
call fcn.00404a30
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xa4]
push ecx
push closesocket
call esi
test eax, eax
jne 0x4017c8
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x1c], ebx
jne 0x4017c8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xa4]
push ecx
push closesocket
call esi
test eax, eax
jne 0x4017c8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.VERSION
mov esi, 0xff
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], esi
call edi
test eax, eax
je 0x40177c
mov byte [esp + 0x64], bl
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x20], ebx
je 0x4017ae
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.BUILDDATE
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
je 0x4017b2
mov byte [esp + 0x24], bl
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test eax, eax
jne 0x4017ca
mov dword [esp + 0x1c], ebx
jmp 0x4017ca
xor ebp, ebp
mov esi, dword [esp + 0x1a8]
imul esi, esi, 0x184
lea edx, [esp + 0x60]
push edx
lea eax, [esi + 0x419f7c]
push eax
call fcn.00404f09
add esp, 8
test eax, eax
jne 0x40181f
lea ecx, [esp + 0x20]
push ecx
lea edx, [esi + 0x419fbc]
push edx
call fcn.00404f09
add esp, 8
test eax, eax
jne 0x40181f
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00404aa2
add esp, 0x198
ret
mov ecx, dword [esp + 0x1a0]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00404aa2
add esp, 0x198
ret