joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fa50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dc58f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5265f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.K10_FIDVID_Control.0
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
xor edi, edi
lea ebp, [esi + 0x44]
push 0x10
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x42fae8
lea ecx, [edi - 0x3ffeff9c]
push ecx
mov ecx, eax
call fcn.00427860
jmp 0x42faea
xor eax, eax
mov dword [ebp], eax
add edi, 1
add ebp, 4
cmp edi, 5
mov byte [esp + 0x24], bl
jl 0x42fac1
push 0x10
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 2
je 0x42fb21
push 0xc0010062
mov ecx, eax
call fcn.00427860
jmp 0x42fb23
xor eax, eax
push 0x10
mov byte [esp + 0x28], bl
mov dword [esi + 0x5c], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 3
je 0x42fb4f
push 0xc0010063
mov ecx, eax
call fcn.00427860
jmp 0x42fb51
xor eax, eax
push 0x10
mov byte [esp + 0x28], bl
mov dword [esi + 0x58], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 4
je 0x42fb7d
push 0xc0010071
mov ecx, eax
call fcn.00427860
jmp 0x42fb7f
xor eax, eax
push 0x10
mov byte [esp + 0x28], bl
mov dword [esi + 0x34], eax
call fcn.004b3e57
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 5
je 0x42fbae
push 0xc0010070
mov ecx, eax
call fcn.00427860
mov dword [esi + 0x38], eax
jmp 0x42fbb1
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x460e30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebp
push edi
mov edi, ecx
xor ebp, ebp
or eax, 0xffffffff
cmp dword [edi + 0x10], eax
mov dword [esp + 8], ebp
je 0x460ef0
push ebx
push esi
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edi + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edx, dword [esp + 0x34]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x460ea2
mov dword [esp + 0x10], ebp
jmp 0x460ec5
mov edx, dword [edi + 0x10]
push ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x460ec5
call ebx
mov dword [esp + 0x10], 0xffffffff
cmp esi, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x460ed2
push esi
call ebx
cmp dword [esp + 0x10], ebp
ja 0x460eea
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x460eea
push eax
call ebx
mov dword [edi + 0x10], 0xffffffff
mov eax, dword [esp + 0x10]
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x18
ret 0xc

Function at 0x460f00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push edi
mov ebx, ecx
xor edi, edi
or eax, 0xffffffff
cmp dword [ebx + 0x10], eax
mov dword [esp + 8], edi
je 0x460fd3
push ebp
push esi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebx + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call ebp
test edi, edi
jne 0x460f66
cmp eax, 0x3e5
jne 0x460f9f
mov edx, dword [esp + 0x34]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x460f83
mov dword [esp + 0x10], 0
jmp 0x460fa7
mov edx, dword [ebx + 0x10]
push 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x460fa7
call ebp
mov dword [esp + 0x10], 0xffffffff
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x460fb4
push esi
call edi
cmp dword [esp + 0x10], 0
pop esi
pop ebp
ja 0x460fcf
mov eax, dword [ebx + 0x10]
cmp eax, 0xffffffff
je 0x460fcf
push eax
call edi
mov dword [ebx + 0x10], 0xffffffff
mov eax, dword [esp + 8]
pop edi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4a047b
Capabilities:
Get common file path

Disassembly:
sub esp, 0x204
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
or eax, 0xffffffff
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi + 0x204], eax
mov dword [esi + 0xb50], eax
mov dword [esi + 0xb54], eax
mov dword [esi + 0xb58], eax
mov dword [esi + 0xb64], eax
mov dword [esi + 0xd74], eax
mov dword [esi + 0xd7c], eax
mov dword [esi + 0xd80], eax
mov dword [esi + 0xd84], eax
mov dword [esi + 0xd88], eax
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0xb74]
lea ebp, [esi + 0xb6c]
push 0x200
mov dword [esi], vtable.CKMDriver.0
mov byte [esi + 0x410], bl
mov byte [esi + 0x610], bl
mov byte [esi + 0x210], bl
mov byte [esi + 0xa10], bl
mov byte [esi + 0xb10], bl
mov byte [esi + 0x810], bl
mov byte [esi + 4], bl
mov byte [edi], bl
mov dword [esi + 0xb68], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x20c], ebx
mov dword [esi + 0xb5c], ebx
mov dword [esi + 0xb60], ebx
mov dword [esi + 0xd78], ebx
mov dword [ebp], ebx
mov dword [esi + 0xb70], ebx
mov byte [esp + 0x18], bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x4a0576
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esp + 0x14]
push ecx
push str._scpuz_driver__d.log
push 0x200
push edi
call fcn.00422580
push 0x4eef68
push edi
push ebp
call fcn.004c3608
mov ebp, dword [ebp]
add esp, 0x20
cmp ebp, ebx
je 0x4a0576
push ebp
call fcn.004c2f55
add esp, 4
mov ecx, dword [esp + 0x210]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c2fd1
add esp, 0x204
ret

Function at 0x4a05b0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x104
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [esp + 0x10c]
push edi
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [esi + 0xb6c]
push 0x4eef8c
add esi, 0xb74
push esi
push edi
call fcn.004c3608
add esp, 0xc
cmp dword [edi], 0
je 0x4a062e
mov edx, dword [esp + 0x114]
lea ecx, [esp + 0x118]
push ecx
push edx
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
call fcn.004c3a3d
mov edx, dword [edi]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.004c44e8
mov eax, dword [edi]
push eax
call fcn.004c2f55
add esp, 0x1c
mov ecx, dword [esp + 0x108]
pop edi
pop esi
xor ecx, esp
call fcn.004c2fd1
add esp, 0x104
ret
Function at 0x4a0650
Capabilities:
Check os version

Disassembly:
sub esp, 0xc8
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
push edi
push 0x9c
lea eax, [esp + 0x34]
push 0
push eax
mov esi, ecx
call fcn.004c43d0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x9c
call edi
test eax, eax
jne 0x4a06e0
push 0x94
push eax
lea edx, [esp + 0x38]
push edx
call fcn.004c43d0
add esp, 0xc
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 0x94
call edi
test eax, eax
jne 0x4a06e0
push str._vGetOSVersion__GetVersionEx_returned_NULL_n
push esi
call fcn.004a05b0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.004c2fd1
add esp, 0xc8
ret
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x40]
push ebp
push edx
push ecx
push eax
push str._vGetOSVersion__m_iOSVersion___d___d._d__n
push esi
mov dword [esi + 0xb50], eax
mov dword [esi + 0xb54], ecx
mov dword [esi + 0xb58], edx
call fcn.004a05b0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4e32e0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a078e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push edi
call ebx
test eax, eax
je 0x4a0786
lea ecx, [esp + 0x14]
push ecx
call eax
movzx eax, word [esp + 0x14]
cmp eax, 9
mov dword [esi + 0xb64], eax
jne 0x4a0777
push str.IsWow64Process
push edi
call ebx
test eax, eax
je 0x4a0786
lea edx, [esp + 0x10]
push edx
push ebp
call eax
test eax, eax
je 0x4a0786
mov eax, dword [esp + 0x10]
mov dword [esi + 0xb5c], eax
jmp 0x4a0786
cmp eax, 6
jne 0x4a0786
mov dword [esi + 0xb60], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [esi + 0xb5c]
push ecx
push str._vGetOSVersion__m_bIsAMD64___d_n
push esi
call fcn.004a05b0
mov ecx, dword [esp + 0xdc]
add esp, 0xc
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.004c2fd1
add esp, 0xc8
ret
Function at 0x4a07c0
Capabilities:
Delete file

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esi + 0xb68]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx edx, word [esp + 0x14]
movzx ecx, word [esp + 0x10]
mov edi, eax
movzx eax, word [esp + 0x12]
push edi
push edx
push eax
push ecx
push str._vCloseDriver__02d:_02d:_02d__WaitForSingleObject_error___d_n
push esi
call fcn.004a05b0
add esp, 0x18
test edi, edi
jne 0x4a0842
mov eax, dword [esi + 0xb50]
sub eax, 1
je 0x4a082e
sub eax, 1
jne 0x4a0835
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.004a2f80
jmp 0x4a0835
mov ecx, esi
call fcn.004a2920
mov ecx, dword [esi + 0xb68]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi + 0xb68]
test eax, eax
je 0x4a086c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
push str._vCloseDriver__CloseHandle_mutex____d_n
push esi
call fcn.004a05b0
add esp, 0xc
mov dword [esi + 0xb68], 0
cmp dword [esp + 0x24], 0
je 0x4a0889
cmp byte [esi + 0xb74], 0
lea eax, [esi + 0xb74]
je 0x4a0889
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x4a0d30
Capabilities:
Check os version

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x29c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2b4]
push edi
push 0x9c
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, ecx
call fcn.004c43d0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x9c
call edi
test eax, eax
jne 0x4a0da1
push 0x94
push eax
lea edx, [esp + 0x18]
push edx
call fcn.004c43d0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x94
call edi
push esi
lea ecx, [esp + 0xb0]
push 0x200
push ecx
call fcn.00422580
mov eax, dword [esp + 0x2c]
add esp, 0xc
sub eax, 1
je 0x4a0e44
sub eax, 1
jne 0x4a0e5e
mov eax, dword [esp + 0x14]
cmp eax, 4
jbe 0x4a0e15
cmp eax, 5
jne 0x4a0de1
cmp dword [esp + 0x18], ebx
je 0x4a0e15
push esi
push str.Global_s
lea edx, [esp + 0xb4]
push 0x200
push edx
call fcn.00422580
mov edx, dword [esp + 0x2c4]
add esp, 0x10
lea ecx, [esp + 0xac]
push ecx
push edx
mov ecx, ebp
call fcn.004a09d0
jmp 0x4a0e60
push esi
lea eax, [esp + 0xb0]
push 0x200
push eax
call fcn.00422580
mov edx, dword [esp + 0x2c0]
add esp, 0xc
lea ecx, [esp + 0xac]
push ecx
push edx
mov ecx, ebp
call fcn.004a09d0
jmp 0x4a0e60
mov ecx, dword [esp + 0x2b4]
lea eax, [esp + 0xac]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x4a0e60
mov eax, ebx
mov ecx, dword [esp + 0x2ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c2fd1
add esp, 0x2a0
ret 8
Function at 0x4a29c0
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x204
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x610]
push eax
lea ecx, [esp + 0x14]
push 0x200
push ecx
xor ebx, ebx
call fcn.004c5045
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4a2a03
sub eax, edx
cmp byte [esp + eax + 0xf], 0x5c
lea eax, [esp + eax + 0x10]
je 0x4a2a1f
mov byte [eax], 0x5c
mov byte [eax + 1], bl
lea edx, [esi + 0xa10]
push edx
lea eax, [esp + 0x14]
push 0x200
push eax
call fcn.00422660
lea ecx, [esp + 0x1c]
push ecx
push str._WinNT_bCreateService__szDestName___s_n
push esi
call fcn.004a05b0
add esp, 0x18
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 1
push 2
push 1
push 0xf01ff
lea eax, [esi + 0xb10]
push eax
push eax
mov eax, dword [esi + 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4a2ab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str._WinNT_bCreateService__CreateService_failed__error_code___d_n
push esi
call fcn.004a05b0
mov eax, ebx
add esp, 0xc
sub eax, 5
je 0x4a2aa5
sub eax, 0x42b
je 0x4a2aa5
sub eax, 1
je 0x4a2aa9
xor edi, edi
jmp 0x4a2ad6
mov edi, 1
xor ebx, ebx
jmp 0x4a2ad6
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x4a2ad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str._WinNT_bCreateService__CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
pop esi
mov dword [ebp], ebx
pop ebp
pop ebx
xor ecx, esp
call fcn.004c2fd1
add esp, 0x204
ret 4

Function at 0x4a2b00
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x208]
push 0xf01ff
lea eax, [esi + 0xb10]
push eax
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x4a2b43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str._WinNT_dwDeleteService__Openservice_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4a2b68
call ebp
mov edi, eax
push edi
push str._WinNT_dwDeleteService__DeleteService_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4a2b86
call ebp
mov edi, eax
push edi
push str._WinNT_dwDeleteService__CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4a2b90
Capabilities:
Start service

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, dword [ebx + 0x208]
push 0xf01ff
lea eax, [ebx + 0xb10]
push eax
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
jne 0x4a2bdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str._WinNT_bStartService__OpenService_failed__error_code___d_n
push ebx
call fcn.004a05b0
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [edx], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
push edi
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test edi, edi
jne 0x4a2c1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str._WinNT_bStartService__StartService_failed__error_code___d_n
push ebx
call fcn.004a05b0
add esp, 0xc
cmp esi, 0x420
ja 0x4a2c1a
je 0x4a2c4d
mov eax, esi
sub eax, 2
je 0x4a2c1a
sub eax, 0x23f
xor edi, edi
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4a2c3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str._WinNT_bStartService__CloseServiceHandle_failed__errorcode___d_n
push ebx
call fcn.004a05b0
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor esi, esi
lea edi, [esi + 1]
jmp 0x4a2c1c
Function at 0x4a2c60
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x208]
push 0xf01ff
lea eax, [esi + 0xb10]
push eax
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x4a2ca9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str._WinNT_dwStopService__OpenService_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [esp + 0x10]
push edx
push 4
push ebx
call ebp
test eax, eax
je 0x4a2d39
mov eax, dword [esp + 0x14]
push eax
push str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_INTERROGATE__status__0x_X_n
push esi
call fcn.004a05b0
add esp, 0xc
cmp dword [esp + 0x14], 1
je 0x4a2d50
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
call ebp
test eax, eax
je 0x4a2d29
mov edx, dword [esp + 0x14]
push edx
push str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_STOP__status__0x_X_n
push esi
call fcn.004a05b0
add esp, 0xc
cmp dword [esp + 0x14], 3
jne 0x4a2d50
mov eax, dword [esi + 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
mov dword [esi + 0x204], 0xffffffff
call ebp
push eax
push str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_STOP__failed__pending__result___d_n
jmp 0x4a2d47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_STOP__failed__errorcode___d_n
jmp 0x4a2d47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_INTERROGATE__failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
pop ebp
jne 0x4a2d73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str._WinNT_dwStopService__CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4a2e00
Capabilities:
Get hostname

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x10]
push ecx
lea edi, [esi + 0x210]
push edi
xor ebx, ebx
mov dword [esp + 0x18], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
movzx edx, word [esp + 0x20]
movzx eax, word [esp + 0x1e]
movzx ecx, word [esp + 0x1c]
push edi
push edx
push eax
push ecx
push str._WinNT_bInstallDriver__02d:_02d:_02d__szMachineName___s_n
push esi
call fcn.004a05b0
add esp, 0x18
cmp byte [edi], bl
je 0x4a2e56
mov ebx, edi
push 0xf003f
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esi + 0x208], eax
jne 0x4a2e96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str._WinNT_bInstallDriver__OpenSCManager_failed__error_code___d_n
push esi
call fcn.004a05b0
mov edx, dword [esp + 0x34]
add esp, 0xc
mov dword [edx], edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret 4
cmp dword [esi + 0x20c], 0
je 0x4a2ef8
cmp dword [esi + 0xb5c], 0
je 0x4a2eb1
mov eax, dword [esi + 0xd84]
push eax
jmp 0x4a2eca
cmp dword [esi + 0xb60], 0
je 0x4a2ec3
mov ecx, dword [esi + 0xd88]
push ecx
jmp 0x4a2eca
mov edx, dword [esi + 0xd80]
push edx
mov ecx, esi
call fcn.004a3480
test eax, eax
jne 0x4a2ef8
push str._WinNT_bInstallDriver__Unable_to_extract_driver_file_n
push esi
call fcn.004a05b0
mov eax, dword [esp + 0x30]
add esp, 8
pop edi
pop esi
mov dword [eax], 0x5001
xor eax, eax
pop ebx
add esp, 0x18
ret 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004a29c0
mov edi, eax
test edi, edi
je 0x4a2f23
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004a2b90
mov edi, eax
test edi, edi
jne 0x4a2f23
mov ecx, esi
call fcn.004a2b00
mov eax, dword [esi + 0x208]
test eax, eax
je 0x4a2f4d
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4a2f4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._WinNT_bInstallDriver__CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.004a05b0
add esp, 0xc
cmp dword [esi + 0x20c], 0
je 0x4a2f5d
mov ecx, esi
call fcn.004a30c0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x18
ret 4
Function at 0x4a30c0
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x218
mov eax, dword [0x5265f0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
mov esi, ecx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esi + 0xa10]
push ecx
lea edi, [esi + 0x610]
push edi
push str._s_s
lea edx, [esp + 0x30]
push 0x200
push edx
call fcn.00422580
add esp, 0x14
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test ebx, ebx
jne 0x4a3125
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x1e]
movzx eax, word [esp + 0x1c]
push ebp
push ebx
push ecx
push edx
push eax
push str._bDeleteFile__02d:_02d:_02d__DeleteFile_returned___d__error___d__n
push esi
call fcn.004a05b0
mov eax, edi
add esp, 0x1c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4a3150
lea ecx, [esi + 0x410]
sub eax, edx
lea edx, [ecx + 1]
mov dword [esp + 0x10], edx
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4a3168
sub ecx, dword [esp + 0x10]
cmp eax, ecx
jbe 0x4a31b1
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test ebx, ebx
jne 0x4a318e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
movzx eax, word [esp + 0x20]
movzx ecx, word [esp + 0x1e]
movzx edx, word [esp + 0x1c]
push ebp
push ebx
push edi
push eax
push ecx
push edx
push str._bDeleteFile__02d:_02d:_02d__RemoveDirectory__s_returned___d__error___d__n
push esi
call fcn.004a05b0
add esp, 0x20
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004c2fd1
add esp, 0x218
ret