joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401490
Capabilities:
Get file attributes
Get file size
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
pushal
push 0x200
push 0x4044a5
push dword [ebp + 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov dword [ebp - 0x204], 0
push 0x4044a5
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [0x4048a5], eax
test eax, 1
je 0x4014da
xor eax, 1
push eax
push 0x4044a5
call sub.KERNEL32.DLL_SetFileAttributesA
push 0x4044a5
call fcn.004013b0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x4044a5
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x40159c
cmp byte [0x404963], 0
jne 0x401597
push 0x34
push 0x4044a5
push 0x4040c7
push dword [0x404444]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x401597
lea esi, [ebp - 0x200]
mov edi, 0x4044a5
cmp byte [edi + 1], 0x3a
jne 0x40154b
push edi
call fcn.00402d60
mov edi, eax
push edi
push esi
call sub.KERNEL32.DLL_lstrcpyA
push esi
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 0
jbe 0x40155e
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.KERNEL32.DLL_lstrcpyA
pop eax
add esi, eax
push 0x2e
push 0x4042a8
push esi
call sub.KERNEL32.DLL_RtlMoveMemory
pop esi
push dword [0x404444]
push 0
push esi
push 0x4044a5
call fcn.00402ce0
cmp eax, 1
jne 0x401597
jmp 0x4014b6
jmp 0x401640
push 0x4042d6
call fcn.00401360
push 0x4044a5
call fcn.00401360
mov dword [0x4048a9], eax
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [0x4048ad], eax
cmp dword [ebp + 0xc], 0
jne 0x4015cb
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 1
jne 0x4015ea
add eax, 0x22e
add eax, dword [0x404420]
push 0x100
push eax
call fcn.00402da0
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x4048b9]
push 0
push dword [0x4048b9]
push 0
push 4
push 0
push dword [0x4048a9]
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
jne 0x40161c
push 0x4040ef
call fcn.00401360
jmp 0x401640
mov dword [0x4048b5], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
jne 0x401635
jmp 0x401610
mov dword [0x4048b1], eax
mov dword [ebp - 0x204], eax
popal
mov eax, dword [ebp - 0x204]
leave
ret 0xc

Function at 0x401650
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x4048a9]
or esi, esi
je 0x4016a8
push dword [0x4048b1]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [0x4048b5]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push dword [0x4048b9]
push esi
call sub.KERNEL32.DLL_SetFilePointer
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push esi
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp + 8]
call fcn.00401400
push dword [0x4048a5]
push 0x4044a5
call sub.KERNEL32.DLL_SetFileAttributesA
popal
leave
ret 4
Function at 0x4016e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
pushal
mov byte [ebp - 0x201], 0
push 1
push 8
call fcn.00401050
or eax, eax
je 0x40173d
mov esi, eax
push 0x200
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x4042e4
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00402c84
mov byte [ebp - 0x201], 1
popal
movzx eax, byte [ebp - 0x201]
leave
ret
Function at 0x402760
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x40278d
inc ecx
cmp ecx, dword [0x4048ad]
jne 0x40278d
push 0x4043e5
call fcn.00401360
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
cmp dword [ecx + esi], 0x4550
jne 0x40276f
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x4048ad]
cmp dword [eax - 4], 0x32505564
jne 0x4027b6
push 0x4043fc
call fcn.00401360
jmp 0x402782
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
add esi, 0xf8
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
cmp dword [ebp + 0xc], 4
jne 0x4027dc
mov ecx, dword [esi + 0x34]
jmp 0x4027de
xor ecx, ecx
mov dword [0x402aad], ecx
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov dword [0x402aa5], ebx
add dword [0x402aa5], ecx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x40280f
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x402811
xor eax, eax
mov dword [0x402ab1], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x40289a
mov ebx, 0x22e
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call sub.KERNEL32.DLL_RtlMoveMemory
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x404420]
sub ebx, eax
push ebx
push ecx
push edx
call sub.KERNEL32.DLL_RtlMoveMemory
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.00402da0
add dword [edi + 8], eax
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.00402da0
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [0x4048b9]
mov dword [eax - 4], 0x32505564
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10

Function at 0x402c84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x402caf
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.DLL_FlushFileBuffers
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x402dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.ADVAPI32.DLL_RegOpenKeyA
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
jne 0x402e42
mov eax, 4
mov dword [ebp - 4], eax
inc dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
push eax
push dword [ebp - 8]
call fcn.00402fb2
pop eax
leave
ret 0x10

Function at 0x402ee0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x402f20
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
push esi
call sub.KERNEL32.DLL_lstrlenA
push esi
add esi, eax
jmp 0x402f15
dec esi
cmp byte [esi], 0x5c
jne 0x402f14
mov byte [esi], 0
pop esi
jmp 0x402f23
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
popal
leave
ret 4

Function at 0x402f30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x402f7f
cmp byte [esi], 0
je 0x402f7f
lea edi, [ebp - 0x401]
jmp 0x402f54
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x402f5e
cmp byte [esi], 0
jne 0x402f52
cmp al, 0x3a
je 0x402f52
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
cmp byte [esi - 1], 0
jne 0x402f50
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4

Function at 0x411e72
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00411ef1
jae 0x411e7e
xor ecx, ecx
call fcn.00411ef1
jae 0x411ea8
xor eax, eax
call fcn.00411ef1
jae 0x411eb9
mov al, 0x10
call fcn.00411ef1
adc al, al
jae 0x411e9a
jne 0x411ee6
stosb byte es:[edi], al
jmp 0x411e7f
call fcn.00411efd
dec ecx
loop 0x411ec5
mov eax, ebp
call fcn.00411efb
jmp 0x411ee7
lodsb al, byte [esi]
shr eax, 1
je 0x411f0d
adc ecx, 2
mov ebp, eax
jmp 0x411ee7
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00411efb
cmp eax, 0x7d00
jae 0x411ee5
cmp eax, 0x500
jae 0x411ee6
cmp eax, 0x7f
ja 0x411ee7
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x411e7f
pop ebp
ret 8
Function at 0x404920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x449c59
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x10], 0
call fcn.00411820
mov ebp, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x30], 1
call fcn.00411710
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x34], 2
call fcn.004011f0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x2c], 1
call fcn.0040ec70
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.0040ec70
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x24
ret 4
Function at 0x40a750
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44990b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov dword [esp + 0x20], 0
mov ecx, edi
mov dword [esi], vtable.CPBasePath.0
call fcn.0040ec40
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x14]
mov dword [esi + 4], eax
call fcn.00401050
lea edx, [esp + 0x14]
lea ecx, [edi + 4]
push edx
mov byte [esp + 0x24], 2
call fcn.00401b00
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.0040ec70
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0040ec70
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0xc
Function at 0x40dd50
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x44971e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
push edi
lea ecx, [esp + 0x20]
call fcn.0040dc60
mov esi, eax
push str.CCZipperObjectFactory::MakeObject
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.004010e0
push esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov byte [esp + 0x34], 1
call fcn.004011f0
lea esi, [eax + 4]
mov byte [esp + 0x2c], 2
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x40ddcb
mov edx, dword [eax + 4]
push edx
mov ecx, esi
call fcn.00401bf0
mov esi, dword [esi]
push esi
push 7
call fcn.00410650
add esp, 8
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.0040ec70
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.0040ec70
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040ec70
xor eax, eax
cmp edi, 0x7a666474
je 0x40de4b
cmp edi, 0x7a666864
jne 0x40de81
push 0x24
call fcn.00428ba5
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov dword [esp + 0x2c], 4
je 0x40de7f
push eax
call fcn.0040deb0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
push 0x30
call fcn.00428ba5
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov dword [esp + 0x2c], 3
je 0x40de7f
push eax
call fcn.0040e850
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
Function at 0x40df90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x449440
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x458be0
lea ecx, [esp + 0x28]
call fcn.004010e0
lea edi, [eax + 4]
mov dword [esp + 0x38], 0
mov eax, dword [edi]
sub eax, 0x10
mov ebx, 1
cmp dword [eax + 0xc], ebx
jle 0x40dff1
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00401bf0
mov edi, dword [edi]
push edi
push 7
call fcn.00410650
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040ec70
cmp dword [ebp + 8], 0
je 0x40e02f
mov eax, 0x68
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x10], 0
je 0x40e10c
mov edi, dword [ebp + 0xc]
mov edx, dword [edi]
mov edx, dword [edx + 8]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call edx
test eax, eax
jne 0x40e05d
cmp dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
jg 0x40e07a
mov eax, 0xc8
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 0xc]
mov ebx, 1
mov eax, dword [0x467ce0]
mov ecx, dword [ebp + 0x14]
push eax
push ecx
push 0x7a666474
push edi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x2c], 0
call fcn.004130a0
add esp, 0x18
test eax, eax
jne 0x40e05d
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40e0f2
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov eax, dword [esi + 0x18]
lea ebx, [esi + 0x10]
call fcn.0040e7d0
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040c410
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jl 0x40e072
jmp 0x40e058
mov eax, 0x66
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x50]
call eax
test eax, eax
jne 0x40e05d
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jle 0x40e058
xor edi, edi
test edi, edi
jl 0x40e161
cmp ebx, dword [esi + 0x18]
jge 0x40e161
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx + edi]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
add ecx, edi
push eax
call edx
test eax, eax
jne 0x40e05d
add ebx, 1
add edi, 0x30
cmp ebx, dword [esi + 0x18]
jl 0x40e12f
jmp 0x40e058
call fcn.00428daa
int3
Function at 0x40f2a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x446520
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
mov eax, dword [eax - 0xc]
test eax, eax
lea edi, [ebp + 4]
jne 0x40f2ef
mov eax, 0x64
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x40f2d5
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x40f2d5
push ecx
push eax
call fcn.00432375
add esp, 8
test eax, eax
je 0x40f2d5
sub eax, dword [edi]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
je 0x40f2d5
mov edx, dword [edi]
cmp esi, dword [edx - 0xc]
jne 0x40f35a
mov ecx, dword [esp + 0x30]
push edi
add ecx, 4
call fcn.00401b00
mov ecx, dword [esp + 0x34]
push 0x456411
add ecx, 4
call fcn.00401a30
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
push esi
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call fcn.004081c0
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
mov edx, dword [esp + 0x38]
mov ecx, dword [edx + 4]
mov ecx, dword [ecx - 0xc]
xor edx, edx
cmp dword [esp + 0x3c], edx
mov dword [esp + 0x28], 0
setne dl
sub eax, edx
sub eax, ecx
sub eax, esi
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call fcn.004082b0
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x1c]
add ecx, 4
push edx
mov byte [esp + 0x2c], 1
call fcn.00401b00
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x14]
add ecx, 4
push eax
call fcn.00401b00
mov eax, dword [esp + 0x14]
mov esi, vtable.CPString.0
add eax, 0xfffffff0
mov byte [esp + 0x28], 0
mov dword [esp + 0x10], esi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f3ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], esi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f41b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x40f540
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45b0d8
push 0x4330a0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x4630c8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x7530
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 1
mov edi, dword [ebp + 0xc]
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call ebx
test eax, eax
jne 0x40f72c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40f5fb
mov edx, dword [ebp - 0x1c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x40f5fb
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push esi
push 1
push edi
call ebx
test eax, eax
jne 0x40f60f
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x4630c8
call fcn.00433238
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp ebx, dword [ebp - 0x20]
jae 0x40f720
lea ecx, [ebx + ebx*8]
lea esi, [esi + ecx*4]
mov ecx, 9
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
push 0x24
mov edx, dword [ebp - 0x7c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
jne 0x40f66d
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x4630c8
call fcn.00433238
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov dword [ebp - 4], edi
lea edx, [ebp - 0x58]
push edx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40f5e8
lea esp, [esp]
cmp dword [ebp - 0x54], edi
je 0x40f6f0
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c]
push edx
push 0x24
lea eax, [ebp - 0x58]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40f646
cmp dword [ebp - 0x54], edi
je 0x40f6f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jbe 0x40f690
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x4630c8
call fcn.00433238
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
call fcn.0040f714
add ebx, edi
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x28]
jmp 0x40f614
mov dword [ebp - 4], 0xfffffffe
call fcn.0040f746
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f760
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x446818
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0xf003f
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40f7da
mov eax, dword [esp + 0x20]
cmp dword [eax - 4], 1
jle 0x40f7ba
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x24]
call fcn.00401bf0
mov eax, dword [esp + 0x20]
push 0x10000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40f802
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040ec70
mov eax, 0x64
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40f821
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
jmp 0x40f7da
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040ec70
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x40faa0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4465c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4630c8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0xf003f
push 0
push 0
mov dword [esp + 0x34], 0
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x40fb46
mov eax, dword [esp + 0x34]
mov ebx, 1
cmp dword [eax - 4], ebx
jle 0x40fb0c
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x38]
call fcn.00401bf0
mov eax, dword [esp + 0x34]
push 0x80000000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x40fbe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
mov dword [esp + 0x38], eax
jg 0x40fb6f
je 0x40fb3f
sub eax, 5
je 0x40fb3d
sub eax, ebx
je 0x40fb3f
jmp 0x40fb76
mov dword [esi], ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040ec70
mov eax, 0x64
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
cmp eax, 0x424
je 0x40fbde
push str.OpenService_Error
lea ecx, [esp + 0x1c]
call fcn.004010e0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, eax
mov byte [esp + 0x30], bl
call fcn.00401270
lea esi, [eax + 4]
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], ebx
mov byte [esp + 0x28], 2
jle 0x40fbb6
mov eax, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00401bf0
mov esi, dword [esi]
push esi
push 2
call fcn.00410650
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.0040ec70
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call fcn.0040ec70
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40fbf5
mov dword [esi], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040ec70
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret