joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007f350
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100d5134]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x1007f391
mov eax, 2
xorps xmm0, xmm0
mov word [ebp - 0x14], ax
movzx eax, word [esi + 4]
push eax
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
push 0
push 0
mov eax, esi
neg eax
sbb eax, eax
xor ecx, ecx
and eax, 0x10
test esi, esi
push eax
lea eax, [ebp - 0x14]
cmove eax, ecx
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x14]
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASendTo]
pop edi
pop esi
cmp eax, 0xffffffff
jne 0x1007f3e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret

Function at 0x1007f4f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100d5134]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, 0x10624dd3
mul ecx
push esi
mov esi, dword [ebp + 0xc]
shr edx, 6
imul eax, edx, 0x3e8
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x20c], 0
sub ecx, eax
mov dword [ebp - 0x108], 0
imul eax, ecx, 0x3e8
mov dword [ebp - 0x210], eax
mov eax, dword [esi]
test al, 1
je 0x1007f55c
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], 1
test al, 2
je 0x1007f570
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], 1
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x1007f5a8
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080e96
mov esp, ebp
pop ebp
ret
mov dword [esi], 0
test eax, eax
je 0x1007f5da
lea eax, [ebp - 0x108]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1007f5c6
or dword [esi], 1
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1007f5da
or dword [esi], 2
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10080e96
mov esp, ebp
pop ebp
ret

Function at 0x100952da
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009525c

Function at 0x1009b00a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009ae80

Function at 0x100a10e7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a0d64
Function at 0x402464
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
push dword [esp + 0x18]
xor ebp, ebp
push dword [0x4e2348]
mov ebx, ebp
call fcn.0042beee
mov edi, eax
test edi, edi
je 0x402523
push esi
push dword [esp + 0x1c]
call fcn.00402659
mov esi, dword [edi + 8]
lea eax, [esp + 0x14]
push ebp
push ebp
push ebp
push eax
lea eax, [esp + 0x20]
mov dword [edi + 4], 1
mov ecx, dword [esi]
push eax
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
push ebp
push esi
call dword [ecx + 0x2c]
pop esi
test eax, eax
jne 0x4024e6
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
push dword [esp + 0x10]
push dword [edi]
call fcn.00402860
mov eax, dword [edi + 8]
add esp, 0xc
mov ecx, dword [eax]
push ebp
push ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [ecx + 0x4c]
lea eax, [esp + 0x18]
push eax
push ebp
push edi
push 0x40252d
push 0x2000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40250c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
mov eax, dword [edi + 8]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov ecx, dword [edi + 8]
push 1
push ebp
push ebp
mov edx, dword [ecx]
push ecx
call dword [edx + 0x30]
pop edi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x423636
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x4e26a4]
call fcn.0042beee
mov ebx, eax
test ebx, ebx
je 0x42369a
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42365f
push dword [esp + 0xc]
push ebx
call eax
jmp 0x42369a
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0042cb80
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0042cc50
pop edi
pop esi
pop ebx
ret 8

Function at 0x42506d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x425100
push 9
call esi
test al, al
jns 0x425100
push 0x11
call esi
test al, al
js 0x425100
push 0x10
call esi
test al, al
js 0x425100
push 0x12
call esi
test al, al
js 0x425100
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 5
lea eax, [ebp - 0x24]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x4250e2
push 4
lea eax, [ebp - 0x24]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x425100
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
jne 0x425100
xor eax, eax
jmp 0x425181
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x425128
push 0x11
call esi
test al, al
js 0x425120
push 0x10
call esi
test al, al
js 0x425120
push 0x12
call esi
test al, al
jns 0x425128
push 1
push edi
call fcn.00425189
mov esi, dword [sym.imp.USER32.dll_GetPropW]
test ebx, ebx
je 0x42513e
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x42517e
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x42517e
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x42517e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x42517e
lea eax, [esi - 1]
push eax
push dword [0x4e26b0]
call fcn.0042beee
test eax, eax
je 0x42517e
mov eax, dword [eax + 8]
jmp 0x425180
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42619c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4e1d34], eax
test eax, eax
je 0x4261ca
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4e1d30], eax
lea eax, [ebp - 0x114]
mov dword [0x4e1d38], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42622c
cmp dword [ebp - 0x104], 1
jne 0x426201
and dword [0x4e1d38], 0
jmp 0x426244
cmp dword [ebp - 0x104], 2
jne 0x42622c
cmp dword [ebp - 0x110], 5
jb 0x4261f8
jne 0x42622c
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x4e1d38]
mov dword [0x4e1d38], eax
jmp 0x426231
mov eax, dword [0x4e1d38]
test eax, eax
je 0x426244
call fcn.00425ae4
neg eax
sbb eax, eax
and dword [0x4e1d38], eax
mov esp, ebp
pop ebp
ret

Function at 0x427cc0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x427cf2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427ced
cmp dword [esp + 0xc], esi
je 0x427d09
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x42b499
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401000
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x2c
mov dword [ebp - 0x1c], edx
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
je 0x4010c0
mov ebx, eax
mov eax, edx
or eax, 0xf01ff
test edx, 0x2000000
mov dword [ebx], 2
cmovne edx, eax
lea eax, [ebx + 4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 4], edx
mov dword [esp], eax
mov dword [esp + 4], 0x41abc8
call dword [sym.imp.ntdll.dll_RtlMapGenericMask]
sub esp, 8
mov dword [esp], esi
call sym._service_lock
lea edx, [esi + 0x80]
mov dword [ebx + 0x14], esi
lea eax, [ebx + 8]
mov dword [ebx + 8], edx
mov edx, dword [esi + 0x84]
mov dword [ebx + 0xc], edx
mov dword [edx], eax
mov dword [esi + 0x84], eax
mov dword [esp], esi
call sym._service_unlock
mov dword [edi], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call dbg.release_service
mov eax, 0x46a
jmp 0x4010b7
Function at 0x4015b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x24
mov eax, dword [eax]
cmp eax, 1
je 0x401612
cmp eax, 2
jne 0x40163b
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sym._service_lock
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov dword [edx + 4], eax
mov edx, dword [ebx + 8]
mov dword [eax], edx
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4015fc
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [ebx + 0x18]
sub esp, 4
call sym._sc_notify_release
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sym._service_unlock
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dbg.release_service
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
test byte [0x419000], 2
jne 0x401650
mov dword [esp], 6
call sym._RpcRaiseException_4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.invalid_handle_type__d_n
mov dword [esp + 8], global___FUNCTION__.37
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401644

Function at 0x401a30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
mov eax, dword fs:[0x18]
sub esp, 0x2c
mov dword [esp + 8], 0x6c
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x401b0d
mov edx, dword [ebx + 0xc]
lea edi, [eax + 0xc]
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x14], edx
mov edi, dword [esi + 0x14]
mov ecx, dword [esi + 0x68]
mov dword [eax + 0x38], edi
mov edi, dword [esi + 0x18]
mov dword [ebp - 0x20], ecx
mov dword [eax + 0x3c], edi
mov edi, dword [esi + 0x1c]
mov dword [eax + 0x40], edi
mov edi, dword [esi + 0x20]
mov dword [eax + 0x44], edi
mov edi, dword [esi + 0x24]
mov dword [eax + 0x48], edi
mov edi, dword [esi + 0x28]
mov dword [eax + 0x4c], edi
mov ecx, dword [esi + 0x2c]
mov dword [eax + 0x54], 0
mov dword [eax + 0x50], ecx
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x401ac3
test byte [esi + 0x14], 0xb
jne 0x401ac3
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x54], edx
mov esi, dword [eax + 0x3c]
mov edx, 1
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
lea ecx, [esi - 1]
mov esi, dword [ebp - 0x1c]
mov dword [eax + 0x68], 0
shl edx, cl
mov dword [eax], 1
mov dword [eax + 0x64], edx
mov dword [eax + 4], 2
mov dword [eax + 8], esi
xchg dword [ebx + 0x14], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402000
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
test byte [0x419000], 8
jne 0x4020b8
test ebx, ebx
je 0x40203a
cmp word [ebx], 0
jne 0x402108
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x402160
mov dword [eax], 1
mov eax, edi
or eax, 0xf003f
test edi, 0x2000000
cmovne edi, eax
lea eax, [ebx + 4]
mov dword [ebx + 4], edi
mov dword [esp], eax
mov dword [esp + 4], 0x41abd8
call dword [sym.imp.ntdll.dll_RtlMapGenericMask]
mov eax, dword [0x41d020]
sub esp, 8
mov dword [ebx + 8], eax
xor eax, eax
mov dword [esi], ebx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, ebx
mov dword [ebp - 0x20], edx
call sym._wine_dbgstr_wn.constprop.0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], edi
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], str.__s___s___lx__n
mov dword [esp + 8], global___FUNCTION__.42
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x40202c
mov edx, dword [sym.imp.kernel32.dll_lstrcmpW]
mov dword [esp + 4], str.ServicesFailed
mov dword [esp], ebx
mov dword [ebp - 0x1c], edx
call edx
mov ecx, eax
sub esp, 8
mov eax, 0x429
test ecx, ecx
je 0x4020a8
mov dword [esp + 4], str.ServicesActive
mov dword [esp], ebx
mov edx, dword [ebp - 0x1c]
call edx
mov edx, eax
sub esp, 8
mov eax, 0x7b
test edx, edx
je 0x40203a
jmp 0x4020a8
mov eax, 0x46a
jmp 0x4020a8
Function at 0x402e20
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov edx, 2
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
lea ecx, [ebp - 0x1c]
call sym._validate_service_handle
mov ebx, eax
test eax, eax
jne 0x402ee1
cmp esi, 2
je 0x402f10
cmp esi, 7
je 0x402f68
cmp esi, 1
jne 0x402ef0
mov eax, dword [edi]
test eax, eax
je 0x402ee1
xor edi, edi
cmp word [eax], 0
jne 0x402ff0
mov esi, dword [ebp - 0x1c]
test byte [0x419000], 8
jne 0x403010
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sym._service_lock
mov edx, dword [esi + 0x14]
mov eax, dword fs:[0x18]
mov edx, dword [edx + 0x5c]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 0x14]
sub esp, 0xc
mov dword [eax + 0x5c], edi
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dbg.save_service_config
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sym._service_unlock
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test byte [0x419000], 1
jne 0x402f90
lea esp, [ebp - 0x10]
mov ebx, 0x7c
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test byte [0x419000], 1
je 0x402ee1
mov eax, dword [edi + 8]
call sym._wine_dbgstr_wn.constprop.0
mov esi, eax
mov eax, dword [edi + 4]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov eax, dword [edi]
mov dword [esp + 0xc], str.SERVICE_CONFIG_FAILURE_ACTIONS_not_implemented:_period__lu_msg__s_cmd__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], global___FUNCTION__.50
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x402ee1
mov esi, dword [ebp - 0x1c]
test byte [0x419000], 8
jne 0x402fc0
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sym._service_lock
mov eax, dword [esi + 0x14]
mov edx, dword [edi]
mov dword [eax + 0x58], edx
jmp 0x402ecb
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.level__lu_not_implemented_n
mov dword [esp + 8], global___FUNCTION__.50
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x402efd
mov eax, dword [edi]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.changing_service__p_preshutdown_timeout_to__ld_n
mov dword [esp + 0x14], eax
mov dword [esp + 8], global___FUNCTION__.50
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x402f74
mov dword [esp], eax
call dbg.strdupW
mov edi, eax
test eax, eax
jne 0x402e80
mov ebx, 8
jmp 0x402ee1
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.changing_service__p_descr_to__s_n
mov dword [esp + 8], global___FUNCTION__.50
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x402e90
Function at 0x404a90
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
push ecx
sub esp, 0x48
mov ebx, dword [ecx]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x20], 0
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x1c], 0
mov ecx, dword [ecx + 0x14]
mov edi, dword [edi + 0x18]
test byte [0x419000], 8
jne 0x404c20
mov edx, dword [ebx]
cmp edx, 1
je 0x404be8
mov eax, 6
cmp edx, 2
je 0x404af8
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea ecx, [ebp - 0x1c]
mov edx, 4
mov eax, ebx
call sym._validate_service_handle
test eax, eax
jne 0x404ae7
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x404c90
mov dword [eax], 3
mov dword [eax + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [ebx + 8], eax
mov eax, dword [esi + 8]
sub esp, 0x10
mov esi, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sym._service_lock
mov edx, dword [esi + 0x18]
test edx, edx
jne 0x404ca0
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov ecx, dword [edx + 0x18]
test eax, eax
jne 0x404bb4
sub ecx, 1
mov eax, 1
shl eax, cl
and eax, dword [ebx + 0xc]
jne 0x404cc0
lock add dword [ebx + 0x10], 1
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x18], ebx
lock add dword [ebx + 0x10], 1
mov eax, dword [ebp - 0x1c]
mov dword [edi], ebx
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call sym._service_unlock
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea ecx, [ebp - 0x20]
mov edx, 4
mov eax, ebx
call sym._validate_scm_handle
test eax, eax
jne 0x404ae7
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x404b0b
test byte [0x419000], 4
jne 0x404c68
mov eax, 0x78
jmp 0x404ae7
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__p__NotifyMask:_0x_lx___p___p___p___p__n
mov dword [esp + 8], global___FUNCTION__.4
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x404ad2
mov dword [esp + 0xc], str.Need_support_for_service_creation_deletion_notifications_n
mov dword [esp + 8], global___FUNCTION__.4
mov dword [esp + 4], global___dbch
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x404c13
mov eax, 0x46a
jmp 0x404ae7
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call sym._service_unlock
mov eax, ebx
call sym._sc_notify_release
mov eax, 0x4da
jmp 0x404ae7
mov eax, ebx
call dbg.fill_notify
mov dword [esi + 0x10], 1
jmp 0x404bbf
Function at 0x405800
Capabilities:
Contain obfuscated stackstrings
Listen for remote procedure calls

Disassembly:
push ebp
xor eax, eax
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0x54
mov dword [ebp - 0x38], 0x63006e
mov dword [ebp - 0x34], 0x630061
mov dword [ebp - 0x30], 0x5f006e
mov dword [ebp - 0x2c], 0x70006e
mov word [ebp - 0x28], ax
mov dword [ebp - 0x24], 0x70005c
mov dword [ebp - 0x20], 0x700069
mov dword [ebp - 0x1c], 0x5c0065
mov dword [ebp - 0x18], 0x760073
mov dword [ebp - 0x14], 0x630063
mov dword [ebp - 0x10], 0x6c0074
mov word [ebp - 0xc], dx
call dword [sym.imp.kernel32.dll_CreateThreadpoolCleanupGroup]
mov dword [0x41d004], eax
test eax, eax
je 0x405910
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._RpcServerUseProtseqEpW_16
sub esp, 0x10
mov ebx, eax
test eax, eax
je 0x4058b0
test byte [0x419000], 2
jne 0x405998
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x419188]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._RpcServerRegisterIf_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x405930
test byte [0x419000], 2
je 0x4058a4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerRegisterIf_failed_with_error__lu_n
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4058a4
test byte [0x419000], 2
jne 0x4059d0
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0x34]
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4d2
mov dword [esp], 1
call sym._RpcServerListen_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x405a10
test byte [0x419000], 2
je 0x4058a4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerListen_failed_with_error__lu_n
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4058a4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerUseProtseq_failed_with_error__lu_n
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], 0x41a4a4
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x40591d
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x41d000
mov dword [esp + 4], 0x3e8
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
sub esp, 0x10
jmp 0x4058a4

Function at 0x405af0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret 4