joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4172c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x1c
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
push edi
push esi
call dword [0x478c1c]
add esp, 8
push edi
push esi
cmp eax, 1
jne 0x41730a
call dword [0x478c38]
add esp, 8
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0043f03d
add esp, 0x1c
ret
call dword [0x478c0c]
add esp, 8
test eax, eax
jne 0x417379
call dword [0x4787d4]
test al, 2
je 0x417366
mov eax, dword [str.luaenv::read:_not_bool_n]
mov ecx, dword [0x4654c4]
mov edx, dword [0x4654c8]
mov dword [esp + 8], eax
mov eax, dword [0x4654cc]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ecx
mov ecx, dword [0x4654d0]
mov dword [esp + 0x10], edx
mov edx, dword [0x4654d4]
lea eax, [esp + 8]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0043f03d
add esp, 0x1c
ret
push edi
push esi
call dword [0x478c30]
fcomp qword [0x4654b8]
add esp, 8
fnstsw ax
test ah, 0x44
jnp 0x4173a7
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0043f03d
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0043f03d
add esp, 0x1c
ret

Function at 0x417900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4601a8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
jae 0x41793b
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push edx
push eax
push ecx
call dword [0x478c60]
add esp, 0xc
cmp dword [esp + 0x30], 0x10
jb 0x41795f
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043e711
add esp, 4
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
Function at 0x417d20
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
lea eax, [esp + 0x38]
push eax
push ecx
call fcn.0044050a
mov edi, eax
inc edi
push edi
call fcn.004249f6
mov ebx, eax
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
push edx
push eax
push edi
push ebx
call fcn.0044067a
push str._ALERT
push esi
call dword [0x478c64]
push 0xffffd8ee
push esi
call dword [0x478c80]
push 0xffffffffffffffff
push esi
call dword [0x478c1c]
add esp, 0x34
cmp eax, 6
jne 0x417da1
push ebx
push esi
call dword [0x478c64]
push 0
push 1
push esi
call dword [0x478cb8]
add esp, 0x14
jmp 0x417df2
call dword [0x4787d4]
test al, 2
je 0x417de6
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.00417a90
mov eax, dword [esp + 0x18]
mov edi, 8
add esp, 8
cmp dword [esp + 0x24], edi
jae 0x417dcc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esp + 0x24], edi
jb 0x417de6
mov edx, dword [esp + 0x10]
push edx
call fcn.0043e711
add esp, 4
push 0xfffffffffffffffe
push esi
call dword [0x478bf0]
add esp, 8
push ebx
call fcn.0043fdf4
mov ecx, dword [esp + 0x2c]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043f03d
add esp, 0x20
ret

Function at 0x417e10
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x460268
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov edi, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
mov ebp, dword [esp + 0x64]
push edi
xor ebx, ebx
push esi
mov dword [esp + 0x1c], ebx
call dword [0x478c10]
add esp, 8
test eax, eax
jne 0x417ea9
call dword [0x4787d4]
test al, 2
je 0x417e8a
mov ecx, 6
mov esi, str.luaenv::read:_not_string_n
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x34]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ecx, ecx
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], ebx
push ebx
mov word [ebp + 4], cx
push 0x46c82c
mov ecx, ebp
call fcn.00408f40
jmp 0x417f02
lea edx, [esp + 0x14]
push edx
push edi
push esi
mov dword [esp + 0x20], ebx
call dword [0x478c3c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.0040b960
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x64], ebx
call fcn.00417be0
add esp, 8
cmp dword [esp + 0x30], 0x10
jb 0x417f02
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043e711
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0043f03d
add esp, 0x4c
ret
Function at 0x417f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4602a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x38], 0
call fcn.00417970
add esp, 8
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
mov byte [esp + 0x30], 1
jae 0x417f91
lea eax, [esp + 0xc]
mov edx, dword [esp + 0x1c]
push edx
push eax
push esi
call dword [0x478c60]
add esp, 0xc
cmp dword [esp + 0x20], 0x10
jb 0x417fb5
mov eax, dword [esp + 0xc]
push eax
call fcn.0043e711
add esp, 4
cmp dword [esp + 0x54], 8
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
jb 0x417fde
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0043e711
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0043f03d
add esp, 0x2c
ret
Function at 0x41a520
Capabilities:
Access peb ldr_data
Get number of processors
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x460779
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
mov ebx, dword [esp + 0x60]
xor esi, esi
push eax
mov dword [esp + 0x54], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
call fcn.004175b0
mov edi, dword [ebx + 0xc]
mov eax, 1
mov dword [esp + 0x50], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
cmp edi, dword [ebx + 0x10]
jbe 0x41a594
call fcn.0043ef9f
mov esi, dword [ebx]
mov ebp, dword [ebx + 0x10]
cmp dword [ebx + 0xc], ebp
jbe 0x41a5a3
call fcn.0043ef9f
mov eax, dword [ebx]
test esi, esi
je 0x41a5ad
cmp esi, eax
je 0x41a5b2
call fcn.0043ef9f
cmp edi, ebp
je 0x41a667
mov eax, dword [esp + 0x20]
push 0x64
push eax
call dword [0x478c04]
add esp, 8
test eax, eax
je 0x41a640
test esi, esi
jne 0x41a638
call fcn.0043ef9f
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41a5e3
call fcn.0043ef9f
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edi
mov word [ecx + 4], dx
call fcn.00408e40
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
call fcn.0041a180
test esi, esi
jne 0x41a63c
call fcn.0043ef9f
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41a62c
call fcn.0043ef9f
add edi, 0x1c
inc dword [esp + 0x18]
jmp 0x41a596
mov eax, dword [esi]
jmp 0x41a5d9
mov eax, dword [esi]
jmp 0x41a622
call dword [0x4787d4]
test al, 2
je 0x41a667
mov ecx, 6
mov esi, str.vector_T__stack_overflow_n
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x28]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0043f03d
add esp, 0x40
ret

Function at 0x41a6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4607b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x10]
xor esi, esi
push edx
mov dword [esp + 0x20], esi
call fcn.0041a520
add esp, 0xc
lea ecx, [esp + 8]
call fcn.004176f0
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x41a712
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x2c]
push edx
push ecx
push eax
call fcn.0040bd60
mov edx, dword [esp + 0x3c]
push edx
call fcn.0043e711
add esp, 0x14
mov eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.0043e711
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x41a740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4607b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 0x18
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x20], esp
xor esi, esi
push eax
mov dword [esp + 0x30], esi
call fcn.004128b0
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0041a6a0
mov eax, dword [esp + 0x48]
add esp, 0x1c
cmp eax, esi
je 0x41a7b2
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x2c]
push ecx
push edx
push eax
call fcn.0040bd60
mov eax, dword [esp + 0x3c]
push eax
call fcn.0043e711
add esp, 0x14
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.0043e711
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x41a7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4607b8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], edi
call fcn.00417530
test al, al
je 0x41a851
fild dword [esp + 0x1c]
mov eax, dword [esi]
sub esp, 8
fstp qword [esp]
push eax
call dword [0x478c58]
sub esp, 0xc
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.004128b0
mov eax, dword [esi]
push eax
call fcn.0041a740
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
push edx
call dword [0x478ca0]
add esp, 0x24
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x41a87b
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x2c]
push edx
push ecx
push eax
call fcn.0040bd60
mov edx, dword [esp + 0x3c]
push edx
call fcn.0043e711
add esp, 0x14
mov eax, dword [esp + 0x20]
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call fcn.0043e711
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x1c
Function at 0x41ab00
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4608b1
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov edi, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
mov ebp, dword [esp + 0x64]
push edi
push esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], 0
call dword [0x478c1c]
add esp, 8
cmp eax, 5
je 0x41abb4
call dword [0x4787d4]
test al, 2
je 0x41aba8
mov eax, dword [str.vector_T__not_table_n]
mov ecx, dword [0x46572c]
mov edx, dword [0x465730]
mov dword [esp + 0x34], eax
mov eax, dword [0x465734]
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], ecx
mov ecx, dword [0x465738]
mov dword [esp + 0x3c], edx
mov dl, byte [0x46573c]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x48], ecx
mov byte [esp + 0x4c], dl
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, ebp
call fcn.004127a0
jmp 0x41ac96
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.00417650
push edi
push esi
mov dword [esp + 0x64], 1
call dword [0x478c40]
add esp, 8
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.004127a0
mov esi, 1
mov byte [esp + 0x5c], 2
cmp edi, esi
jb 0x41ac2f
lea ebp, [esi + 7]
mov edi, edi
push esi
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0041a150
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x60], 3
call fcn.004138e0
mov byte [esp + 0x5c], 2
cmp dword [esp + 0x4c], ebp
jb 0x41ac26
mov edx, dword [esp + 0x38]
push edx
call fcn.0043e711
add esp, 4
inc esi
cmp esi, edi
jbe 0x41abf0
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call fcn.004128b0
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [esp + 0x10], 1
cmp eax, esi
je 0x41ac6f
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x28]
push edx
push ecx
push eax
call fcn.0040bd60
mov edx, dword [esp + 0x38]
push edx
call fcn.0043e711
add esp, 0x14
mov eax, dword [esp + 0x1c]
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.0043e711
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x5c], 0
call fcn.004176f0
mov eax, ebp
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0043f03d
add esp, 0x50
ret
Function at 0x41d580
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 8]
push eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.0041d4d0
mov eax, esi
pop esi
ret 4

Function at 0x41d740
Capabilities:
Delete file
Get file size
Move file
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jne 0x41d757
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 8
push ebp
lea ebp, [esi + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x14], ebx
je 0x41d847
mov ecx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi + 0x14]
xor eax, eax
cmp edx, eax
jl 0x41d847
jg 0x41d7a0
mov eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x41d847
push edi
push 0x465da0
lea edi, [esi + 0x30]
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.0040bb30
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, dword [edi]
push ebx
push 0x8000080
push 2
push ebx
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
pop edi
cmp eax, 0xffffffff
jne 0x41d7fc
mov dword [esi], ebx
cmp dword [esi + 0xc], ebx
je 0x41d827
mov eax, dword [esi]
cmp eax, ebx
je 0x41d827
push ebx
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x28], 0xfeff
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d847
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esi]
cmp esi, ebx
je 0x41d868
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret 8

Function at 0x41da10
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41da41
push esi
call fcn.0040b3b0
add esp, 4
push esi
test eax, eax
jne 0x41da43
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41da41
push 1
push 0x4751d0
push esi
call fcn.00414020
add esp, 0xc
pop esi
ret
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x41da41
push str.Initialize
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41da41
pop esi
jmp eax
Function at 0x41da60
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41da91
push esi
call fcn.0040b3b0
add esp, 4
push esi
test eax, eax
jne 0x41da93
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41da91
push 1
push 0x4751d0
push esi
call fcn.00414020
add esp, 0xc
pop esi
ret
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x41da91
push str.OnExiting
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41da91
pop esi
jmp eax
Function at 0x41e8a0
Capabilities:
Check if file exists
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x460b68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x4c]
cmp dword [ebx + 0x14], 0
je 0x41ea1a
mov edi, dword [esp + 0x48]
cmp dword [edi + 0x18], 8
jb 0x41e8e6
mov eax, dword [edi + 4]
jmp 0x41e8e9
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ea1a
push 0xffffffffffffffff
push 0
push edi
lea ecx, [esi + 8]
call fcn.00408e40
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [esi + 0x24]
call fcn.00408bb0
mov al, byte [esp + 0x50]
mov edi, dword [esp + 0x54]
push 0
push 0
push esi
push 0x41e880
push 0
push 0
mov byte [esi], al
mov dword [esi + 4], edi
call fcn.0043f6d2
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x41ea1a
test edi, edi
je 0x41ea03
push edi
push 1
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x41ea1a
mov edi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebx
push 0x1b7740
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
call edi
mov byte [0x479465], 1
cmp eax, 0x102
je 0x41e96d
test eax, eax
je 0x41e9a6
cmp eax, 1
jne 0x41e96d
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41ea1c
cmp byte [esi + 1], 0
je 0x41e9e5
lea edx, [esp + 0x1c]
push edx
call fcn.0041ea40
mov ecx, eax
call fcn.0041ec50
cmp dword [eax + 0x18], 8
mov dword [esp + 0x40], 0
jb 0x41e9d0
mov eax, dword [eax + 4]
jmp 0x41e9d3
add eax, 4
push eax
call fcn.00420030
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.004084b0
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41ea1c
push 0x1b7740
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41ea1c
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x10
Function at 0x41eb80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x460ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00408e40
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41ebe0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0041e230
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00408e40
cmp dword [esp + 0x28], 8
jb 0x41ec2d
mov eax, dword [esp + 0x14]
push eax
call fcn.0043e711
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x41f1a0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x38
push esi
mov esi, ecx
call fcn.0041eda0
test eax, eax
jne 0x41f1b9
mov eax, 1
pop esi
add esp, 0x38
ret
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x41f1d5
pop ebx
pop esi
add esp, 0x38
ret
push edi
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0041ec50
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x41f1f1
mov eax, dword [eax + 4]
jmp 0x41f1f4
add eax, 4
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp dword [esp + 0x24], edi
jb 0x41f216
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0043e711
add esp, 4
xor edx, edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], dx
test esi, esi
jne 0x41f241
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x38
ret
lea eax, [esp + 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
xor eax, eax
test edi, edi
pop edi
pop ebx
setne al
pop esi
add esp, 0x38
ret

Function at 0x41f880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x11c
push 0
push 0x479348
call fcn.0043f440
push 0x479348
mov dword [0x479348], 0x11c
call fcn.00421080
add esp, 0x10
call fcn.00415200
test eax, eax
push 0x104
lea ecx, [esp + 4]
setne al
push ecx
mov byte [0x479464], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f8e1
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 4]
push edx
mov ecx, 0x475874
call fcn.00408f40
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0043f03d
add esp, 0x20c
ret

Function at 0x41fef0
Capabilities:
Query service status

Disassembly:
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x41ff0d
mov eax, 0x80004003
pop ebx
ret
mov eax, dword [esp + 8]
push edi
push 5
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x41ff31
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 0x80004005
pop ebx
ret
mov ecx, dword [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esi, eax
neg esi
sbb esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and esi, 0x7fffbffb
add esi, 0x80004005
call edi
push ebx
call edi
mov eax, esi
pop esi
pop edi
pop ebx
ret