joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149f0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x4563d0]
test eax, eax
jne 0x414a05
push 0x452308
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret
mov edx, dword [esp + 4]
xor ecx, ecx
mov eax, 0x4553d0
cmp dword [eax], edx
je 0x414a2b
add eax, 4
inc ecx
cmp eax, 0x4563d0
jl 0x414a10
push 0x4522d0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret
push edx
mov dword [ecx*4 + 0x4553d0], 0
call fcn.00424c65
add esp, 4
ret
Function at 0x416c20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x416c2b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x416d2e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4447ec]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4447ec]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4447ec]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4447ec]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4447ec]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4447ec]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4447ec]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4447ec]
xor eax, edx
inc ecx
dec edi
jne 0x416c46
pop edi
test esi, esi
je 0x416d50
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4447ec]
xor eax, edx
inc ecx
dec esi
jne 0x416d32
pop esi
pop ebx
not eax
ret

Function at 0x416d60
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x4447ec]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x4447ec]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x417780
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4177c1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4177b6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4177d4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
ret
Function at 0x418300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x41831c
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x41832d
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x41833b
push edi
call fcn.00418710
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.00418100
add esp, 0x10
test eax, eax
je 0x418363
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call fcn.00414960
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x418382
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call fcn.00414960
add esp, 4
cmp eax, ebx
mov dword [esi], eax
jne 0x4183a1
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
mov dword [esi + 0x44], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
xor eax, eax
cmp edx, ebx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], edx
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x64], ecx
mov edx, dword [edi]
sete al
mov dword [esi + 0x60], edx
mov ecx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x18], ebx
jne 0x418400
lea edx, [esi + 4]
mov dword [esi + 0x24], ebx
push edx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00417010
add esp, 4
test eax, eax
jne 0x418400
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x41842d
mov ecx, dword [edi + 0x38]
shr ecx, 8
mov byte [esi + 0x80], cl
jmp 0x418439
mov edx, dword [edi + 0x3c]
shr edx, 0x18
mov byte [esi + 0x80], dl
mov al, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg al
sbb eax, eax
mov dword [ebx], 0x12345678
and eax, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], 0x34567890
je 0x41847a
mov al, byte [ebp]
test al, al
je 0x41847a
push eax
push ebx
call fcn.00416d60
add esp, 8
inc ebp
jne 0x418466
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [edi + 0x7c], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x418850
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x418932
cmp dword [ebp + 4], 0xffffffff
jne 0x418932
push ebx
lea ebx, [ebp + 0x13c]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebp + 0x13b]
cmp cl, 0x5c
je 0x4188c2
cmp cl, 0x2f
je 0x4188c2
mov edi, 0x451f58
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp edi, 1
pop ebx
jne 0x4188ee
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4188ee
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call fcn.00417530
add esp, 0x10
test eax, eax
jne 0x418911
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.00417a60
add esp, 4
mov dword [ebp], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc
Function at 0x418dc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
test esi, esi
push edi
je 0x418f8c
mov ebx, dword [esp + 0x220]
test ebx, ebx
jne 0x418de9
mov ebx, 0x454aa4
push esi
push ebx
call fcn.00424ce0
add esp, 8
test eax, eax
je 0x418dfe
mov esi, ebx
mov ebx, 0x454aa4
mov dl, byte [0x454aa4]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], dl
lea ebp, [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x418ead
mov edi, 0x451f58
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [esp + 0x114]
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea ebp, [esp + 0x114]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x114]
push 0x451f5c
push ecx
stosb byte es:[edi], al
call fcn.00426599
mov edx, eax
add esp, 8
test edx, edx
je 0x418f8c
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esp + 0x10]
lea ebp, [esp + 0x10]
test al, al
jne 0x418f07
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
jmp 0x418f4e
mov edi, 0x451f58
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea ebp, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
cmp eax, 0xffffffff
jne 0x418f73
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x451f5c
push 0
call fcn.00426599
mov edx, eax
add esp, 8
test edx, edx
jne 0x418ee6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x4196a0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x400
lea eax, [esp + 0x408]
lea edx, [esp]
push eax
push ecx
push edx
call fcn.00426113
add esp, 0xc
lea eax, [esp]
push 0
push 0x452550
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x419830
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
mov eax, 0x55555556
push ebx
mov ebx, dword [esp + 0x14]
lea ecx, [ebx + 2]
imul ecx
mov ecx, dword [esp + 0x1c]
mov eax, edx
shr eax, 0x1f
add edx, eax
shl edx, 2
cmp ecx, edx
jge 0x41985b
xor eax, eax
pop ebx
add esp, 8
ret
push ebp
push esi
mov esi, dword [esp + 0x20]
mov edx, ecx
push edi
xor eax, eax
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
xor edx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
test ebx, ebx
jle 0x419970
mov ebx, dword [esp + 0x1c]
mov al, byte [ebx + edi]
lea ebp, [edi + 1]
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov eax, ecx
shr eax, 2
mov al, byte [eax + 0x444c18]
mov byte [edx + esi], al
mov eax, dword [esp + 0x20]
cmp ebp, eax
jge 0x419952
mov al, byte [edi + ebx + 1]
and ecx, 3
mov byte [esp + 0x11], al
mov eax, dword [esp + 0x11]
and eax, 0xff
mov ebx, eax
shr ebx, 4
shl ecx, 4
or ebx, ecx
inc ebp
mov cl, byte [ebx + 0x444c18]
mov byte [edx + esi + 1], cl
mov ecx, dword [esp + 0x20]
cmp ebp, ecx
jge 0x41991f
mov ebx, dword [esp + 0x1c]
and eax, 0xf
shl eax, 2
mov cl, byte [edi + ebx + 2]
mov byte [esp + 0x12], cl
mov ecx, dword [esp + 0x12]
and ecx, 0xff
mov ebp, ecx
shr ebp, 6
or ebp, eax
and ecx, 0x3f
mov al, byte [ebp + 0x444c18]
mov byte [edx + esi + 2], al
mov cl, byte [ecx + 0x444c18]
mov byte [edx + esi + 3], cl
jmp 0x419936
mov ebx, dword [esp + 0x1c]
and eax, 0xf
mov al, byte [eax*4 + 0x444c18]
mov byte [edx + esi + 2], al
mov byte [edx + esi + 3], 0x3d
mov eax, dword [esp + 0x20]
add edi, 3
add edx, 4
cmp edi, eax
jl 0x419884
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov al, byte [esp + 0x10]
and eax, 3
shl eax, 4
mov cl, byte [eax + 0x444c18]
mov al, 0x3d
mov byte [edx + esi + 1], cl
mov byte [edx + esi + 2], al
mov byte [edx + esi + 3], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x419980
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4199ae
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
test esi, esi
jne 0x4199f0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
jne 0x4199e5
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
ret
Function at 0x419a30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push esi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x419ab1
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x10]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419aa6
mov ecx, dword [esp + 0x18]
test ecx, ecx
jl 0x419a97
cmp dword [esp + 0x1c], 7
jne 0x419a97
xor eax, eax
test ecx, ecx
jle 0x419a93
cmp byte [eax + esi], 0
jne 0x419a8e
mov byte [eax + esi], 0xa
inc eax
cmp eax, ecx
jl 0x419a84
mov byte [esi + ecx], 0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
pop esi
ret
Function at 0x419b00
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x419b54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push 0x449870
push eax
call fcn.004236ae
mov ecx, dword [ebp + 8]
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x18], esi
jne 0x419b84
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x24]
push 0x449870
push edx
mov dword [ebp - 0x24], eax
call fcn.004236ae
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push esi
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x419bbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x419bbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x28]
push 0x449870
push ecx
mov dword [ebp - 0x28], eax
call fcn.004236ae
mov eax, dword [ebp - 0x14]
cmp eax, ebx
ja 0x419bd4
lea edx, [ebp - 0x2c]
push 0x449870
push edx
mov dword [ebp - 0x2c], ebx
call fcn.004236ae
push eax
lea ecx, [ebp - 0x3c]
call fcn.00413440
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.004136c0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
push ecx
push edx
push eax
push esi
call edi
test eax, eax
jne 0x419c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0x449870
push eax
call fcn.004236ae
lea ecx, [ebp - 0x3c]
call fcn.004136c0
mov edi, dword [eax + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
push ecx
call esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], bl
call fcn.00413510
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419c90
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x419cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x449870
push eax
call fcn.004236ae
mov ecx, dword [ebp + 8]
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
jne 0x419d1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x20]
push 0x449870
push edx
mov dword [ebp - 0x20], eax
call fcn.004236ae
lea eax, [ebp - 0x50]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x419d44
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x24]
push 0x449870
push ecx
mov dword [ebp - 0x24], eax
call fcn.004236ae
lea edx, [ebp - 0x50]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x419d6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x449870
push eax
call fcn.004236ae
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, dword [ebp - 0x3c]
mov esi, eax
cmp dword [ebp - 0x4c], 3
jne 0x419e5b
mov eax, 0xcccccccd
mul dword [ebp - 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x419d9b
mov edx, 0x3e8
jmp 0x419da8
cmp edx, 0x2710
jbe 0x419da8
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x50]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x419dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push 0x449870
push eax
call fcn.004236ae
cmp dword [ebp - 0x3c], ebx
ja 0x419d70
call edi
mov ecx, dword [ebp - 0x38]
sub eax, esi
cmp eax, ecx
jbe 0x419d77
lea ecx, [ebp - 0x30]
push 0x449870
push ecx
mov dword [ebp - 0x30], 0x5b4
call fcn.004236ae
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x419e0b
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x419e19
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
cmp eax, 0x424
je 0x419e55
cmp eax, 0x426
je 0x419e55
mov edx, dword [ebp + 8]
push eax
push edx
push str.SCM_
call fcn.004128b0
add esp, 0xc
mov eax, 0x419e42
ret
mov eax, 0x419e6d
ret
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [ebp - 0x18]
push ecx
call esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419f20
Capabilities:
Check mutex on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esp + 8], eax
jne 0x419f3a
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x419f56
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ecx
ret
mov eax, dword [0x4563e0]
mov edx, dword [0x4563e4]
sub edx, eax
push esi
sar edx, 2
cmp edx, 1
mov esi, eax
jae 0x41a063
mov edx, dword [0x4563dc]
test edx, edx
je 0x419f88
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x419f8d
mov ecx, 1
test edx, edx
jne 0x419f95
xor eax, eax
jmp 0x419f9a
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 4], eax
jge 0x419fa6
xor eax, eax
push ebx
push ebp
shl eax, 2
push edi
push eax
call fcn.00438b8f
mov ebx, dword [0x4563dc]
add esp, 4
mov ebp, eax
cmp ebx, esi
mov edi, ebp
je 0x419fd7
push ebx
push edi
call fcn.0041a2f0
add ebx, 4
add esp, 8
add edi, 4
cmp ebx, esi
jne 0x419fc3
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
mov ecx, 0x4563d8
call fcn.0041a2c0
mov edx, dword [0x4563e0]
add edi, 4
push edi
push edx
push esi
mov ecx, 0x4563d8
call fcn.0041a290
mov eax, dword [0x4563e0]
mov ecx, dword [0x4563dc]
push eax
push ecx
mov ecx, 0x4563d8
call fcn.0041a1a0
mov edx, dword [0x4563dc]
push edx
call fcn.00438bb8
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [ebp + eax*4]
mov dword [0x4563e4], ecx
mov ecx, dword [0x4563dc]
test ecx, ecx
jne 0x41a041
xor eax, eax
jmp 0x41a04b
mov eax, dword [0x4563e0]
sub eax, ecx
sar eax, 2
lea edx, [ebp + eax*4 + 4]
mov dword [0x4563dc], ebp
pop edi
pop ebp
mov dword [0x4563e0], edx
pop ebx
jmp 0x41a0fe
xor cl, cl
cmp cl, 1
jae 0x41a0b6
lea edx, [eax + 4]
mov ecx, 0x4563d8
push edx
push eax
push eax
call fcn.0041a290
lea eax, [esp + 0xc]
mov edx, 1
push eax
mov eax, dword [0x4563e0]
mov ecx, eax
sub ecx, esi
sar ecx, 2
sub edx, ecx
mov ecx, 0x4563d8
push edx
push eax
call fcn.0041a2c0
mov eax, dword [0x4563e0]
cmp esi, eax
je 0x41a0f7
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x41a0a7
jmp 0x41a0f7
push eax
push eax
add eax, 0xfffffffc
mov ecx, 0x4563d8
push eax
call fcn.0041a290
mov eax, dword [0x4563e0]
mov ecx, eax
add eax, 0xfffffffc
cmp esi, eax
je 0x41a0e3
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, esi
mov dword [ecx], edx
jne 0x41a0d4
lea eax, [esi + 4]
cmp esi, eax
je 0x41a0f7
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x41a0ea
add dword [0x4563e0], 4
push 0x41a120
call fcn.00425687
add esp, 4
mov eax, 1
pop esi
pop ecx
ret