joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406090
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41f034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push ecx
push 0x24
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
push 0
push eax
movdqu xmmword [ebp - 0x24], xmm0
movdqu xmmword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40616c
mov eax, dword [ebp - 0x24]
cmp eax, 1
jne 0x4060e8
mov ecx, str.SERVICE_STOPPED
jmp 0x406134
cmp eax, 2
jne 0x4060f4
mov ecx, str.SERVICE_START_PENDING
jmp 0x406134
cmp eax, 3
jne 0x406100
mov ecx, str.SERVICE_STOP_PENDING
jmp 0x406134
cmp eax, 4
jne 0x40610c
mov ecx, str.SERVICE_RUNNING
jmp 0x406134
cmp eax, 5
jne 0x406118
mov ecx, str.SERVICE_CONTINUE_PENDING
jmp 0x406134
cmp eax, 6
jne 0x406124
mov ecx, str.SERVICE_PAUSE_PENDING
jmp 0x406134
cmp eax, 7
mov ecx, str.SERVICE_PAUSED
mov edx, str.UNKNOWN_SERVICE_STATE
cmovne ecx, edx
push ecx
push eax
push str.QueryServiceStatus:0x_x__s_
push 1
push 0xf6
push 0x417fb8
push 0x417f7c
call fcn.00407550
add esp, 0x1c
cmp dword [ebp - 0x24], 4
jne 0x406191
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412f62
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:QueryServiceStatusEx_fail_0x_x
push 1
push 0xfe
push 0x418024
push str.CServiceObj::ServiceIsRunning
call fcn.004071c0
add esp, 0x18
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00412f62
mov esp, ebp
pop ebp
ret 4
Function at 0x4061b0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413ee8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x41f034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str._DoInstall__begin...
push 1
push 0x105
push 0x418080
push 0x4180a4
mov dword [ebp - 4], 1
call fcn.004071c0
add esp, 0x14
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push 0xf01ff
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
test eax, eax
jne 0x4062ee
call edi
cmp eax, 0x424
jne 0x4062d3
push 0x4180bc
push 1
push 0x10b
push 0x4180e8
push 0x41810c
call fcn.004071c0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
lea eax, [ebp + 0x20]
push eax
call fcn.00401520
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00401520
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00405e70
mov dword [esi + 4], eax
test eax, eax
jne 0x4062ee
push 0x418124
push 1
push 0x10f
push 0x418140
push 0x418164
call fcn.004071c0
add esp, 0x14
jmp 0x406370
call edi
push eax
push 0x4181a0
push 1
push 0x115
push 0x41817c
push 0x4181e8
jmp 0x406368
push dword [esi + 4]
call fcn.00406090
test al, al
je 0x40631c
push str.Check_Service_already_running_
push 1
push 0x11d
push 0x418220
push 0x418244
call fcn.004071c0
add esp, 0x14
mov bl, 1
jmp 0x406372
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40634f
push 0x41825c
push 1
push 0x123
push 0x418274
push 0x418298
call fcn.004071c0
add esp, 0x14
mov bl, 1
jmp 0x406372
call edi
push eax
push 0x4182b0
push 1
push 0x128
push 0x4182c8
push str.CServiceObj::DoInstall
call fcn.004071c0
add esp, 0x18
xor bl, bl
cmp dword [ebp + 0x1c], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x406386
push dword [ebp + 8]
call esi
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x4063a8
push dword [ebp + 0x20]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4063c0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413f18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41f034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.DoUninstall...
push 1
push 0x130
push 0x418314
push 0x418338
mov dword [ebp - 4], 0
call fcn.004071c0
add esp, 0x14
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push 0xf01ff
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [edi + 4], eax
test eax, eax
jne 0x406484
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x424
jne 0x406466
push str.WARN:The_specified_service_does_not_exist_as_an_installed_service.
push 1
push 0x136
push 0x418354
push 0x4183bc
call fcn.004071c0
add esp, 0x14
mov bl, 1
jmp 0x40653a
call esi
push eax
push str.ERR:OpenService_fail_0x_x_n
push 1
push 0x139
push 0x4183f4
push 0x418418
jmp 0x406530
push eax
call fcn.00406090
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x4064e8
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4064c7
push str.SERVICE_CONTROL_STOP_SUCCESS
push 1
push 0x142
push 0x418454
push 0x418478
call fcn.004071c0
add esp, 0x14
jmp 0x4064e8
call esi
push eax
push str.ERR:ControlService_fail_0x_x_n
push 1
push 0x146
push 0x4184b4
push 0x4184d8
call fcn.004071c0
add esp, 0x18
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x406517
push str.DeleteService__SUCCESS
push 1
push 0x14b
push 0x41850c
push 0x418530
call fcn.004071c0
add esp, 0x14
mov bl, 1
jmp 0x40653a
call esi
push eax
push str.ERR:DeleteService_fail_0x_x
push 1
push 0x150
push 0x418568
push str.CServiceObj::DoUninstall
call fcn.004071c0
add esp, 0x18
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x40654c
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412f62
mov esp, ebp
pop ebp
ret 0x18
Function at 0x406750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 8
jb 0x406761
mov eax, dword [ebx]
jmp 0x406763
mov eax, ebx
push 0x406960
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [ebx + 0x34], eax
test eax, eax
jne 0x40679d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVC___ERR:RegisterServiceCtrlHandler_fail__0x_x_n
push 1
push 0x3d
push 0x418c8c
push 0x418cb4
call fcn.004071c0
add esp, 0x18
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push str._SVC___initial_status_to_SERVICE_START_PENDING...
push 1
push 0x46
push 0x418d0c
lea edi, [ebx + 0x18]
mov dword [ebx + 0x28], 0
mov dword [edi], 0x10
push 0x418d34
call fcn.004071c0
mov eax, dword [0x41f04c]
add esp, 0x14
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebx + 0x2c], eax
inc eax
mov dword [ebx + 0x1c], 2
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0xbb8
mov dword [ebx + 0x20], 0
mov dword [0x41f04c], eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push ebx
push 0x4068f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp - 4]
mov dword [ebx + 0x38], eax
push str._SVC___Success_create_work_thread_:__d
push 1
push 0x4e
push 0x418d80
push 0x418da8
call fcn.004071c0
push str._SVC___initialization_is_complete__set_status_SERVICE_RUNNING
push 1
push 0x51
push 0x418e0c
push 0x418e34
call fcn.004071c0
add esp, 0x2c
mov dword [ebx + 0x1c], 4
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x20], 1
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x2c], 0
call esi
push str._SVC___Perform_work_until_service_stops...
push 1
push 0x55
push 0x418e84
push 0x418eac
call fcn.004071c0
add esp, 0x14
push 0xffffffffffffffff
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str._SVC___Work_thread_has_exit__set_status_SERVICE_STOPPED
push 1
push 0x58
push 0x418f08
push str.CServiceTemplate::OnMainCallback
call fcn.004071c0
add esp, 0x14
mov dword [ebx + 0x1c], 1
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x20], 1
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x2c], 0
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4069a0
Capabilities:
Terminate thread

Disassembly:
push esi
push str._SVC__handle_SERVICE_CONTROL_STOP...
push 1
push 0x81
push 0x419128
push 0x419150
mov esi, ecx
call fcn.004071c0
add esp, 0x14
call fcn.00406570
mov ecx, dword [0x41f04c]
mov dword [eax + 0x2c], ecx
inc ecx
mov dword [0x41f04c], ecx
lea ecx, [eax + 0x18]
push ecx
push dword [eax + 0x34]
mov dword [eax + 0x1c], 3
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x406a08
call eax
cmp dword [esi + 0x38], 0
je 0x406a3e
push str.kill_work_thread...
push 1
push 0x8d
push str..._srcServiceUtilServiceTemplate.cpp
push str.CServiceTemplate::OnHandleServiceStop
call fcn.004071c0
add esp, 0x14
push 0xfffffffffffffffe
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x38], 0
push 0
push ecx
push dword [esi + 0x1c]
call fcn.00406570
mov ecx, eax
call fcn.00406a60
pop esi
ret
Function at 0x406fa0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41402b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x41f034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.00407640
add esp, 8
cmp byte [0x41f919], 0
mov dword [ebp - 4], 0
je 0x4070c5
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x407030
mov ecx, dword [esi]
jmp 0x407032
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.00407c50
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x4070aa
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x41f920]
test eax, eax
jne 0x4070f5
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x41f920], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x41f920]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0040e190
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x40711f
push eax
push eax
call fcn.00406bf0
add esp, 8
push dword [0x41f920]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0040e190
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x40714d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x40714d
cmp ecx, 3
ja case.default.0x40714d
jmp dword [ecx*4 + 0x4071ac]
push esi
mov ecx, edi
call fcn.0040dc50
jmp case.default.0x40714d
push esi
mov ecx, edi
call fcn.0040e260
jmp case.default.0x40714d
push esi
mov ecx, edi
call fcn.0040e730
jmp case.default.0x40714d
push esi
mov ecx, edi
call fcn.0040df90
cmp dword [ebp - 0x130], 0x10
jb 0x407191
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412f62
mov esp, ebp
pop ebp
ret
Function at 0x407a40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414130
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41f034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.004085c0
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x407c1c
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00401520
call fcn.00407e80
add esp, 0x18
test al, al
je 0x407abf
mov bl, 1
jmp 0x407c1e
call fcn.004081f0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004044c0
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x407b0c
cmp dword [ebp + 0x1c], 8
jb 0x407aef
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.00402830
cmp dword [ebp - 0x14], 8
jb 0x407b1d
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.00408090
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x407bcd
cmp ecx, esi
jbe 0x407c11
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x407bc4
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.00403740
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00401520
call fcn.00407e80
add esp, 0x18
test al, al
jne 0x407bac
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x407bc1
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x407b47
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00401520
call fcn.00407e80
add esp, 0x18
test al, al
je 0x407c1c
mov bl, 1
jmp 0x407c1e
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x407c2f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412f62
mov esp, ebp
pop ebp
ret
Function at 0x407e80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4141c8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x41f034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.00408090
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x407ede
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410b40
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414e89
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41f034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00402b70
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00402b70
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00402b70
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.00412e10
add esp, 4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.00412b90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x412670
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [0x41fa14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4126c4
push esi
push 0x10
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x41269a
mov ecx, eax
call fcn.00411e30
mov esi, eax
jmp 0x41269c
xor esi, esi
push dword [0x41fa14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4126b4
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push esi
push dword [0x41fa14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x401000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
je 0x4010e8
test eax, eax
jle 0x4010e8
push ebx
push esi
or esi, 0xffffffff
cmp eax, 8
mov ecx, 0xff
jl 0x4010c8
push edi
mov edi, eax
shr edi, 3
mov ebx, edi
imul ebx, ebx, 0xfffffff8
add eax, ebx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
dec edi
jne 0x401030
pop edi
test eax, eax
je 0x4010e1
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x425600]
inc edx
dec eax
jne 0x4010cc
mov eax, esi
pop esi
not eax
pop ebx
ret
xor eax, eax
ret

Function at 0x401292
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4012a9
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4012de
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4012da
cmp edi, eax
jae 0x4012de
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4012cc
cmp edi, eax
jb 0x4012e2
xor eax, eax
jmp 0x4012ec
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x401300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0
push str.InstallDir
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401365
cmp dword [ebp + 8], 1
je 0x40133e
cmp dword [ebp + 8], 2
je 0x40133e
push 0xd
pop eax
jmp 0x401365
test edi, edi
mov eax, dword [ebp - 4]
je 0x40135f
test eax, eax
je 0x40135b
test al, 1
jne 0x401339
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40135f
jmp 0x401339
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 4
Function at 0x401908
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 0x2c], eax
je 0x4019db
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RunDetector
push eax
call edi
push str.GetDectectorResult
push dword [esi + 0x2c]
mov dword [esi + 4], eax
call edi
push str.WaitDetectorComplete
push dword [esi + 0x2c]
mov dword [esi + 8], eax
call edi
push str.CancelDetector
push dword [esi + 0x2c]
mov dword [esi + 0xc], eax
call edi
push str.InitDetector
push dword [esi + 0x2c]
mov dword [esi + 0x10], eax
call edi
push str.UnInitDetector
push dword [esi + 0x2c]
mov dword [esi + 0x14], eax
call edi
push str.SetGroupId
push dword [esi + 0x2c]
mov dword [esi + 0x18], eax
call edi
push str.RunDetectorEx
push dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
call edi
push str.GetDectectorResultEx
push dword [esi + 0x2c]
mov dword [esi + 0x20], eax
call edi
push str.WaitDetectorCompleteEx
push dword [esi + 0x2c]
mov dword [esi + 0x24], eax
call edi
cmp dword [esi + 4], ebx
mov dword [esi + 0x28], eax
pop edi
je 0x4019d6
cmp dword [esi + 8], ebx
je 0x4019d6
cmp dword [esi + 0xc], ebx
je 0x4019d6
cmp dword [esi + 0x10], ebx
je 0x4019d6
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x4019d6
cmp dword [esi + 0x1c], ebx
je 0x4019d6
push dword [esp + 0xc]
call eax
xor eax, eax
inc eax
jmp 0x4019dd
call fcn.004019e2
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x401a8e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x401b1f
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
mov ebx, str.InstallDir
push ebx
push eax
call edi
cmp dword [ebp - 8], 1
jne 0x401b1d
push esi
mov esi, dword [ebp + 0xc]
call fcn.00403fa8
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00403fe8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push 0
push ebx
push dword [eax]
call edi
test eax, eax
jne 0x401b1c
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x401b0e
push eax
call fcn.00409884
pop ecx
mov edx, esi
call fcn.0040445d
mov dword [ebp - 0xc], 1
pop esi
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x401b26
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x401b54
push dword [esp + 0xc]
call fcn.00409884
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401b54
inc edi
mov eax, edi
pop edi
ret 8