joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43405f
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x43406d
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push pe_nt_image_headers32
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x4340ba
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00436e90
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.004338a8
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00433946
test eax, eax
jne 0x434116
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00436e90
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push pe_nt_image_headers32
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.004338a8
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00436910
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00436910
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00433946
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43411b
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x434152
test edi, edi
je 0x434152
call fcn.0043405f
test eax, eax
jne 0x434157
push 0x20
mov edx, esi
mov ecx, esi
call fcn.004338a8
push 0x20
push esi
push edi
call fcn.00436910
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x4338d2
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x43420a
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x4342a4
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4342a4
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0042f8ed
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4342a9
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x43426a
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.004341f4
mov ecx, ebx
mov esi, eax
call fcn.004341f4
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x434244
jmp 0x43428f
mov ecx, dword [esp + 0x10]
jmp 0x43428f
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.004341f4
mov ecx, ebx
mov esi, eax
call fcn.004341f4
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x434270
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x4342a9
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x44c0e6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044bf65

Function at 0x44fabf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044f42d
Function at 0x44faca
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044f668
Function at 0x402660
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Distribuore
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [0x408d90]
test eax, eax
je 0x4026b5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408d94]
test eax, eax
je 0x402701
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408d98]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408d98]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402728
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402755
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x402779
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40279b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4027cd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x4027fd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x402836
push str.Distribuore
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Distribuore
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x402857
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x403dc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret
Function at 0xe0e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xe0e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe0e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0e06a
add dl, dl
jne 0xe0e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0e0dc
xor eax, eax
add dl, dl
jne 0xe0e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe0e17d
add dl, dl
jne 0xe0e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe0e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe0e075
mov eax, 1
add dl, dl
jne 0xe0e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe0e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0e0e1
sub eax, ebx
mov ebx, 1
jne 0xe0e128
mov ecx, 1
add dl, dl
jne 0xe0e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe0e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe0e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe0e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe0e136
cmp eax, 0x7d00
jae 0xe0e16d
cmp eax, 0x500
jb 0xe0e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0e075
cmp eax, 0x7f
ja 0xe0e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe0e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe0e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe0e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x50533476
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x3df61294
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42f380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d55b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x66c214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x679ba8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x679ba8
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x63ee88
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0042da40
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42fe90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d56e9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x66c214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x679ba8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [ecx], 0x679ba8
mov dword [esi + 0x30], 0x679ba8
mov dword [esi + 0x34], 0x679ba8
mov edi, dword [ebp + 8]
mov edx, edi
mov byte [ebp - 4], 3
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x42ff31
sub edx, ebx
push edx
push edi
call fcn.0042da40
mov edi, dword [ebp + 0xc]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x42ff50
sub edx, ecx
lea ecx, [esi + 0x30]
push edx
push edi
call fcn.0042da40
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x42ff70
sub edx, ecx
lea ecx, [esi + 0x34]
push edx
push edi
call fcn.0042da40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x434270
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov dword [ebp - 4], 0
push dword [esi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x4342c6
mov ecx, dword [esi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], str.CppWindowsService_in_OnStart
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push ecx
mov edx, esi
call fcn.004356b0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x435150
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov dword [ebp - 4], 0
push dword [esi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x4351a6
mov ecx, dword [esi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], str.AGSService_in_OnStop
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.Thread_OnStop_...
push 0
push 4
push str.AGSService
push dword [0x679bb8]
mov dword [0x679bc0], 1
call fcn.00496770
add esp, 0x14
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
test eax, eax
jne 0x4351e1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x667860
push eax
call fcn.00578a57
int3
Function at 0x435f50
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x435fa6
mov ecx, dword [edi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x435fb0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push str._s_failed_w_err_0x_08lx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004357b0
add esp, 0x14
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x436044
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00562e44
mov esp, ebp
pop ebp
ret 8
Function at 0x436060
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d652b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4360df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x640360
call fcn.00433ee0
add esp, 8
jmp 0x43624c
xor eax, eax
lea ecx, [ebp - 0x230]
cmp word [0x63f4ac], ax
setne al
push eax
push 0x63f4ac
call fcn.00433520
cmp word [ebp - 0x218], 0
jne 0x43610a
xor ecx, ecx
jmp 0x436122
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436113
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00436450
xor eax, eax
lea ecx, [ebp - 0x230]
cmp word [0x63f4ac], ax
setne al
push eax
push 0x63f4ac
call fcn.00436450
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x43617d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00433ee0
add esp, 8
jmp 0x43624c
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0
cmovae eax, dword [ebp - 0x230]
push 0
push 0x63f7d8
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x63f728
push 0x63f70c
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x4361f7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.00433ee0
add esp, 8
call esi
push eax
push str.AGSSerice_Service_Install_Failed_...08lx
push edi
push 4
push str.AGSService
push dword [0x679bb8]
call fcn.00496770
add esp, 0x18
jmp 0x43623c
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x63f728
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0x63f70c
push str._s_is_installed._n
call fcn.00433ee0
push str.AGSSerice_Service_Installed_...
push 0
push 4
push str.AGSService
push dword [0x679bb8]
call fcn.00496770
add esp, 0x1c
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
test edi, edi
je 0x43624c
push edi
call esi
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x43626a
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00433df0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x436290
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push 0
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x4362f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00433ee0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
push 0x10024
push 0x63f70c
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x436318
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x4363ce
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4363ab
push 0x63f70c
push str.Stopping__s.
call fcn.00433ee0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x436387
nop dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, 3
jne 0x43638a
push 0x640510
call fcn.00433ee0
add esp, 4
push 0x3e8
call edi
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
jne 0x436360
mov eax, dword [ebp - 0x1c]
push 0x63f70c
cmp eax, 1
jne 0x43639b
push 0x640514
jmp 0x4363a0
push str._n_s_failed_to_stop._n
call fcn.00433ee0
mov ebx, dword [ebp - 0x24]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4363c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x640568
jmp 0x4363ce
push 0x63f70c
push str._s_is_removed._n
call fcn.00433ee0
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
test esi, esi
je 0x4363e6
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00562e44
mov esp, ebp
pop ebp
ret

Function at 0x438ef0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
mov dword [ebp - 0xc], 0xc
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 1
push eax
lea eax, [esi + 8]
mov dword [ebp - 8], 0
push eax
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x438f4b
push str.Failed_to_create_pipe
push dword [0x66a028]
push 2
push str.AdobeGCClientNSLookup
push dword [esi]
call fcn.00496770
add esp, 0x14
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x438f7f
push str.Failed_to_set_handle_information
push dword [0x66a028]
push 2
push str.AdobeGCClientNSLookup
push dword [esi]
call fcn.00496770
add esp, 0x14
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret