joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427320
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x453de8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663d8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
lea ebp, [esi + 0xa88]
mov dword [esp + 0x18], ebx
mov edx, str.msdk
mov dword [esp + 0x28], ebx
call fcn.00401e60
test eax, eax
je 0x427385
mov edi, esi
mov byte [esi + 0xb14], bl
call fcn.00426dd0
push esi
call fcn.00426fd0
push esi
mov ecx, 0x45b8cc
call fcn.0042c870
push esi
mov ecx, str.AUDIO
call fcn.0042c870
test al, al
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x427559
call fcn.004021a0
test eax, eax
jne 0x427451
mov ecx, esi
call fcn.00428b00
lea ebx, [esp + 0x14]
mov eax, 0x468c64
mov dword [esp + 0x14], 0x7e2
call fcn.0042f2e0
mov dword [eax], 0x9f6
call fcn.00432e50
call fcn.00432e90
call fcn.00432ed0
push 1
call fcn.00432fd0
cmp eax, 0x3eb
je 0x427400
cmp eax, 0x47b
je 0x427400
cmp eax, 0xffffffff
jne 0x42744f
mov dword [esi + 0x10], 0xff
jmp 0x427428
push str.User_canceled_wizard
push 0x4676b8
mov eax, 2
call fcn.0042dae0
mov dword [0x4676dc], 0xa009
add esp, 8
mov dword [esi + 0x10], 9
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42756d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor ebx, ebx
call fcn.00434f50
push ebp
mov ecx, str.SoftwareIntelGFX
call fcn.00413c30
call fcn.00434e60
mov eax, dword [0x468cf8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x468cf8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x468cf8], ebx
cmp dword [ebp + 0x38], ebx
jne 0x427527
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x42749b
push eax
call edi
lea edx, [esp + 0x18]
push edx
push 0xf003f
push ebx
push str.SoftwareIntelGFX
push 0x80000002
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x427527
push 0x458500
lea eax, [esp + 0x1c]
push eax
mov edx, 0x45b040
call fcn.0042dd90
push str.HDMI
call fcn.00406db0
call fcn.0040b1d0
push str.Version
lea ecx, [esp + 0x1c]
push ecx
mov edx, eax
call fcn.0042dd90
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebx
push str.HDAUDIO
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x427523
push eax
call edi
mov dword [esp + 0x18], ebx
call fcn.00425940
call fcn.004021a0
test eax, eax
jne 0x427559
cmp dword [ebp + 0x34], ebx
je 0x427541
call fcn.00432f50
jmp 0x427546
call fcn.00432f10
push 1
call fcn.00432fd0
cmp eax, 0x467
jne 0x427559
call fcn.0042d380
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov ecx, dword [ebp + 0x38]
mov dword [0x4676dc], ecx
je 0x42756d
push eax
call edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x42c170
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x435e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x468c60]
push 0
push 0x435d90
push 0
push 0x9b
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
jmp eax

Function at 0x42c870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4520c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663d8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
push esi
push str.Reading_action_list_from_resource:__s
push 0x4676b8
xor eax, eax
mov dword [esp + 0x40], ebp
call fcn.0042dae0
add esp, 0xc
push 0x45d04c
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebp
je 0x42c96f
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ebx, [edi + 2]
push ebx
mov ebp, eax
call fcn.00437e01
add esp, 4
push ebx
mov esi, eax
push 0
push esi
call fcn.004434e0
add esp, 0xc
push edi
push ebp
push esi
call fcn.0043f600
add esp, 0xc
push 0xa
lea edi, [esi + 2]
lea ecx, [esp + 0x1c]
call fcn.00437100
add esp, 4
push esi
call fcn.0043a723
mov ecx, dword [esp + 0x40]
add esp, 4
lea eax, [esp + 0x18]
push eax
add ecx, 0xa88
push ecx
call fcn.00413060
mov edi, eax
test edi, edi
jne 0x42c96d
push str.Error_loading_resource_action_file
push 0x4676b8
lea eax, [edi + 2]
call fcn.0042dae0
add esp, 8
mov dword [0x4676dc], 0xa006
xor ebp, ebp
mov eax, dword [esp + 0x1c]
cmp edi, ebp
setne bl
cmp eax, ebp
je 0x42c99a
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x20]
push edx
call fcn.004115d0
mov eax, dword [esp + 0x20]
add esp, 4
push eax
call fcn.00439935
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x42dae0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x1c], 8
mov esi, eax
jb 0x42daf5
mov eax, dword [edi + 8]
jmp 0x42daf8
lea eax, [edi + 8]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42dc5e
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, 1
jne 0x42db35
mov esi, 0x45d95c
jmp 0x42db44
cmp esi, 2
mov esi, 0x45d964
je 0x42db44
mov esi, 0x456938
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42db50
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebp
call ebx
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42db80
sub eax, edx
mov edx, dword [edi + 0x20]
sar eax, 1
add edx, edx
test edx, edx
mov esi, eax
mov eax, 0x469328
jle 0x42dbbf
mov ecx, edx
shr ecx, 1
mov eax, 0x200020
mov edi, 0x469328
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
lea eax, [edx*2 + 0x469328]
mov word [eax], 0
mov ecx, dword [edi + 0x20]
push 0
add ecx, ecx
lea eax, [esp + 0x14]
push eax
sub ecx, esi
add ecx, ecx
push ecx
push 0x469328
push ebp
call ebx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0043be4d
mov esi, eax
add esi, 3
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437e01
mov ecx, dword [esp + 0x28]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
push edi
call fcn.0043bfe2
push 0x45d970
push esi
push edi
call fcn.0043a458
mov eax, edi
add esp, 0x28
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42dc30
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push ebp
call ebx
push edi
call fcn.0043a723
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x42dd70
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 8]
push eax
mov eax, dword [edx]
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
ret 4

Function at 0x42dd90
Capabilities:
Set registry value

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42dd96
mov ecx, dword [esp + 0xc]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 8
Function at 0x42ddd0
Capabilities:
Set registry value

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ddd6
mov ecx, dword [esp + 0xc]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push 2
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 8

Function at 0x42de10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
mov dword [esp + 8], 0
jbe 0x42de32
call fcn.00439412
mov eax, dword [esi + 8]
cmp dword [esi + 4], eax
mov dword [esp + 0xc], eax
jbe 0x42de43
call fcn.00439412
test esi, esi
je 0x42de4b
cmp esi, esi
je 0x42de50
call fcn.00439412
cmp edi, dword [esp + 0xc]
je 0x42de87
test esi, esi
jne 0x42de5f
call fcn.00439412
cmp edi, dword [esi + 8]
jb 0x42de69
call fcn.00439412
cmp edi, dword [esi + 8]
mov ecx, dword [esp + 8]
mov eax, dword [edi + 0x14]
lea edx, [ecx + eax + 1]
mov dword [esp + 8], edx
jb 0x42de82
call fcn.00439412
add edi, 0x1c
jmp 0x42de32
mov eax, dword [esp + 8]
add eax, 1
xor ecx, ecx
mov dword [esp + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437e01
mov edi, eax
add esp, 4
lea eax, [esp + 8]
push eax
push edi
mov eax, esi
call fcn.004368e0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp + 0xc]
add esp, 8
lea edx, [ecx + ecx]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ecx]
push edi
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
pop edi
add eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x42def0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42df00
sub eax, edx
sar eax, 1
add eax, 1
push eax
call fcn.00437e01
mov ebx, eax
movzx eax, word [esi]
add esp, 4
test ax, ax
je 0x42df97
cmp ax, 0x61
jb 0x42df37
cmp ax, 0x66
ja 0x42df37
mov al, byte [esi]
sub al, 0x57
jmp 0x42df4d
cmp ax, 0x41
jb 0x42df49
cmp ax, 0x46
ja 0x42df49
mov al, byte [esi]
sub al, 0x37
jmp 0x42df4d
mov al, byte [esi]
sub al, 0x30
movzx ecx, word [esi + 2]
add esi, 2
shl al, 4
cmp cx, 0x61
jb 0x42df6a
cmp cx, 0x66
ja 0x42df6a
mov cl, byte [esi]
sub cl, 0x57
jmp 0x42df84
cmp cx, 0x41
jb 0x42df7f
cmp cx, 0x46
ja 0x42df7f
mov dl, byte [esi]
sub dl, 0x37
or al, dl
jmp 0x42df86
mov cl, byte [esi]
sub cl, 0x30
or al, cl
add esi, 2
mov byte [ebx + edi], al
movzx eax, word [esi]
add edi, 1
test ax, ax
jne 0x42df25
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push edi
push ebx
push 3
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.0043a723
add esp, 4
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
ret 8
Function at 0x42dfd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp]
push esi
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push esi
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x42e005
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.00437e01
mov ecx, dword [ebp]
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
push 0
push 0
push esi
push ecx
call ebx
mov ebx, eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42e040
mov esi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.004040c0
push edi
call fcn.0043a723
add esp, 4
pop edi
pop esi
xor eax, eax
test ebx, ebx
pop ebp
sete al
pop ebx
ret 8

Function at 0x42e080
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp]
push esi
push edi
mov edi, eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push edi
push ecx
mov dword [esp + 0x30], 0
call ebx
test eax, eax
je 0x42e0b9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437e01
mov ecx, dword [ebp]
add esp, 4
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
push 0
push 0
push edi
push ecx
call ebx
mov edx, dword [esp + 0x1c]
push edx
mov ecx, esi
mov edi, eax
call fcn.00436810
add esp, 4
push esi
call fcn.0043a723
add esp, 4
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
pop ecx
ret 8
Function at 0x42e200
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x214
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, dword [esp + 0x230]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push esi
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42e2ef
lea edx, [esp + 0x10]
push edx
mov eax, edi
or eax, 0xf003f
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push esi
call ebx
test eax, eax
jne 0x42e2ef
mov eax, dword [esp + 0x10]
push edi
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0042e200
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x100
jne 0x42e2db
mov eax, dword [0x468d04]
test eax, eax
jne 0x42e2c3
push str.RegDeleteKeyExW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call ebp
test eax, eax
mov dword [0x468d04], eax
je 0x42e2d4
push 0
push 0x100
lea edx, [esp + 0x20]
push edx
push esi
call eax
jmp 0x42e2e7
mov eax, 0x32
jmp 0x42e2e7
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x42e232
cmp eax, 0x103
pop edi
pop esi
pop ebp
pop ebx
jne 0x42e2fc
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00437ffa
add esp, 0x214
ret

Function at 0x42e8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x468c60]
push edi
push 0x45e58c
push str.LICENSE
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42e913
xor al, al
pop edi
ret 4
mov ecx, dword [0x468c60]
push ebx
push ebp
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x468c60]
push edi
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ebx, [esi + 2]
push ebx
mov ebp, eax
call fcn.00437e01
push ebx
mov edi, eax
push 0
push edi
call fcn.004434e0
push esi
push ebp
push edi
call fcn.0043f600
mov eax, edi
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42e961
mov esi, dword [esp + 0x14]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.004040c0
push edi
call fcn.0043a723
add esp, 4
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
ret 4
Function at 0x431320
Capabilities:
Check for peb beingdebugged flag
Create service
Modify service
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4515a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663d8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov eax, edi
xor ebx, ebx
mov dword [esp + 0x44], ebp
xor esi, esi
lea edx, [eax + 2]
jmp 0x431370
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x431370
sub eax, edx
sar eax, 1
je 0x431423
push 0x2c
lea ecx, [esp + 0x2c]
call fcn.00437100
add esp, 4
lea ecx, [esp + 0x28]
xor esi, esi
call fcn.0040d2c0
test eax, eax
jbe 0x4313ed
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x4313c7
mov ecx, dword [esp + 0x30]
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x4313d0
call fcn.00439412
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + ebp + 0x14]
lea ecx, [esp + 0x28]
lea ebx, [ebx + eax + 1]
add esi, 1
add ebp, 0x1c
call fcn.0040d2c0
cmp esi, eax
jb 0x4313a6
xor ebp, ebp
add ebx, 1
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x1c], ebx
neg ecx
or ecx, eax
push ecx
call fcn.00437e01
mov esi, eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x30]
call fcn.004368e0
add esp, 8
mov edi, dword [esp + 0x4c]
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x431435
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x5c]
push ebp
push ebp
push esi
push ebp
mov ecx, eax
push ebp
and ecx, 0x10000000
xor edx, edx
cmp edx, ecx
mov edx, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x68]
push 1
sbb ecx, ecx
and eax, 0xefffffff
push eax
mov eax, dword [esp + 0x78]
push eax
mov eax, dword [edi]
neg ecx
push 0xf003f
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x7c]
push ecx
push edx
push eax
mov dword [edi + 4], ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebp
mov dword [edi + 4], eax
je 0x4314d2
mov ecx, dword [esp + 0x64]
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea edx, [esp + 0x20]
push edx
push 1
push eax
mov dword [esp + 0x2c], ecx
call ebx
test eax, eax
jne 0x4314b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
mov dword [esp + 0x18], eax
jne 0x4314dc
call fcn.00431ae0
cmp eax, 0x6000100
jb 0x4314dc
cmp eax, 0xffffffff
ja 0x4314dc
mov ecx, dword [edi + 4]
lea eax, [esp + 0x24]
push eax
push 3
push ecx
call ebx
test eax, eax
jne 0x4314dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
cmp esi, ebp
je 0x4314e9
push esi
call fcn.0043a723
add esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x43150f
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x30]
push edx
call fcn.004115d0
mov eax, dword [esp + 0x30]
add esp, 4
push eax
call fcn.00439935
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x1c
Function at 0x431530
Capabilities:
Modify service

Disassembly:
push ecx
push esi
mov ecx, eax
and ecx, 0x10000000
xor esi, esi
xor edx, edx
cmp edx, ecx
mov edx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x18]
push esi
sbb ecx, ecx
push esi
neg ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [edi + 4]
push esi
push esi
push edx
push 0xffffffffffffffff
and eax, 0xefffffff
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x4315d0
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ebp
lea eax, [esp + 0x14]
push eax
push 1
push ecx
mov dword [esp + 0x20], edx
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4315a5
call ebp
mov esi, eax
test esi, esi
jne 0x4315dd
call fcn.00431ae0
cmp eax, 0x6000100
jb 0x4315db
cmp eax, 0xffffffff
ja 0x4315db
mov eax, dword [edi + 4]
lea edx, [esp + 0xc]
push edx
push 3
push eax
call ebx
test eax, eax
jne 0x4315db
call ebp
pop ebp
pop ebx
pop esi
pop ecx
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ecx
ret 0x14
mov eax, esi
pop ebp
pop ebx
pop esi
pop ecx
ret 0x14

Function at 0x431610
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov eax, dword [ebx + 4]
sub esp, 0x1c
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edx, dword [ebx + 4]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4316e7
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esp + 0x10], 4
mov ebp, dword [esp + 0x20]
mov esi, eax
je 0x4316c3
nop
mov eax, 0xcccccccd
mul dword [esp + 0x24]
shr edx, 3
cmp edx, 0x3e8
jae 0x43166b
mov edx, 0x3e8
jmp 0x431678
cmp edx, 0x2710
jbe 0x431678
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4316bc
cmp dword [esp + 0x20], ebp
jbe 0x4316a2
call edi
mov ebp, dword [esp + 0x20]
mov esi, eax
jmp 0x4316ac
call edi
sub eax, esi
cmp eax, dword [esp + 0x24]
ja 0x4316bc
cmp dword [esp + 0x10], 4
jne 0x431650
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
cmp dword [esp + 0x10], 4
jne 0x4316cc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
pop ebp
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
ret
Function at 0x431700
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov ecx, dword [ebx + 4]
sub esp, 0x1c
lea eax, [esp]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x43171d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx + 4]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4317e7
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esp + 0x10], 1
mov ebp, dword [esp + 0x20]
mov esi, eax
je 0x4317c3
jmp 0x431750
mov eax, 0xcccccccd
mul dword [esp + 0x24]
shr edx, 3
cmp edx, 0x3e8
jae 0x43176b
mov edx, 0x3e8
jmp 0x431778
cmp edx, 0x2710
jbe 0x431778
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4317bc
cmp dword [esp + 0x20], ebp
jbe 0x4317a2
call edi
mov ebp, dword [esp + 0x20]
mov esi, eax
jmp 0x4317ac
call edi
sub eax, esi
cmp eax, dword [esp + 0x24]
ja 0x4317bc
cmp dword [esp + 0x10], 1
jne 0x431750
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
cmp dword [esp + 0x10], 1
jne 0x4317cc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
pop ebp
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
ret

Function at 0x431d90
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431dc2
lea ecx, [esp]
push ecx
call eax
xor eax, eax
cmp word [esp], 6
sete al
add esp, 0x24
ret
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp word [esp], 6
sete al
add esp, 0x24
ret

Function at 0x431ef0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x10
xor eax, eax
lea ecx, [esp]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
push ecx
push 0x431e00
mov dword [esp + 8], 0x12
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
add esp, 0x10
ret