joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e3386
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100e3423
push ebx
push esi
call fcn.100e334f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100e1ab6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100e33d0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100e3422
push edi
push eax
call fcn.100de67a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100e33f0
call fcn.100de640
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100e3421
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100e1ab6
add esp, 0x20
test eax, eax
jne 0x100e340f
push edi
call fcn.100de640
jmp 0x100e3417
push ebx
call fcn.100de640
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100e3426
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100e3437
pop esi
ret
push ebx
push edi
push esi
call fcn.100e334f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100de67a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100e345f
push ebx
push esi
push edi
call fcn.100c2e20
add esp, 0xc
push 0
call fcn.100de640
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100e3823
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e3474
Function at 0x100eb5d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100eb5fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100eb5fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041ed50
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x2004]
push 0x2000
push edx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret

Function at 0x4024a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x206
mov dword [ebp - 0xc], 1
test edi, edi
je 0x402506
test esi, esi
je 0x402506
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push 0x4251a4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402506
lea ecx, [ebp - 4]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402506
mov eax, dword [ebp - 4]
shr eax, 1
cmp word [esi + eax*2], 0
je 0x40250c
xor ecx, ecx
mov word [esi + eax*2], cx
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x402520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
test esi, esi
je 0x40257b
test edi, edi
je 0x40257b
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push 0x4251a4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40257b
lea ecx, [ebp - 8]
push ecx
push edi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402581
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4025a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push 0x4251a4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4025f9
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.JHI_SERVICE_PORT
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4025ef
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret
Function at 0x402610
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push 0x4251a4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402669
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.JHI_ADDRESS_TYPE
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40265f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret
Function at 0x4062d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x4063d8
cmp byte [edi + 0x49], 0
je 0x4063d8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x4063cc
lea esi, [ebp - 0x2c]
call fcn.00405e10
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x406343
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x40636b
dec eax
je 0x40636f
sub eax, 2
lea esi, [ebp - 0x2c]
jne 0x4063c7
jmp 0x4063d3
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x40637f
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x4063a9
cmp edx, 0x10
jae 0x40638e
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x4063c4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4063d0
test esi, esi
jne 0x406337
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.00401ac0
jmp 0x406331
lea esi, [ebp - 0x2c]
call fcn.00405c80
xor al, al
jmp 0x4063da
lea esi, [ebp - 0x2c]
call fcn.00405c80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
Function at 0x40e4a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420eb8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x42c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 4
mov dword [esi], vtable.intel_dal::ICommandsServer.0
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
add esp, 4
test edi, edi
je 0x40e4f3
push 0
push 0xa
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [edi], eax
jmp 0x40e4f5
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov byte [esi + 4], 0xa
lea edi, [esi + 0x10]
push edi
mov dword [ebp - 4], 0
push 0x202
mov dword [esi], vtable.intel_dal::CommandsServerSocketsWin32.0
mov dword [esi + 0x1a0], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40e54e
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp + 0xc], str.WSAStartup_failed
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x42738c
lea edx, [ebp - 0x18]
push edx
call sub.MSVCR100.dll__CxxThrowException
cmp byte [edi], 2
jne 0x40e56e
cmp byte [edi + 1], 2
jne 0x40e56e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp + 0xc], str.Could_not_find_a_usable_version_of_Winsock.dll
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x42738c
lea ecx, [ebp - 0x18]
push ecx
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x410c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x410caf
mov eax, dword [ebp - 4]
push 0
and eax, 0xffff02ff
lea ecx, [ebp - 8]
push ecx
or eax, 0x2ff
push 4
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410cb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.00410cf0
test al, al
setne al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x410cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
xor al, al
push edi
mov edi, ecx
mov byte [ebp - 1], al
mov dword [ebp - 8], 0
test ebx, ebx
je 0x410da5
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x410da5
push esi
push ecx
call fcn.004011a0
mov esi, eax
add esp, 4
test esi, esi
je 0x410da1
mov eax, dword [edi + 0x10]
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
mov eax, dword [edi + 0x10]
mov edi, dword [edi + 0xc]
add esp, 0xc
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410d8c
cmp byte [esi + 3], 0
jne 0x410d8c
movzx edx, word [esi + 6]
mov word [ebx], dx
mov ax, word [esi + 4]
mov word [ebx + 2], ax
mov cx, word [esi + 0xa]
mov word [ebx + 4], cx
movzx edx, word [esi + 8]
mov word [ebx + 6], dx
push esi
mov bl, 1
call fcn.00401210
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp - 1]
push esi
call fcn.00401210
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410db0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor eax, eax
xor bl, bl
xor ecx, ecx
cmp dword [ebp + 8], eax
je 0x410e60
cmp dword [esi + 0x10], eax
je 0x410e60
and ecx, 0xff00001d
or ecx, 0x1d
push 0
mov dword [ebp - 0xc], ecx
and eax, 0xffff0203
lea ecx, [ebp - 8]
push ecx
or eax, 0x203
push 8
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410e6a
mov eax, dword [esi + 0x10]
push edi
push eax
call fcn.004011a0
mov edi, eax
add esp, 4
test edi, edi
je 0x410e5f
mov ecx, dword [esi + 0x10]
push ecx
push 0
push edi
call sub.MSVCR100.dll_memset
mov eax, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
add esp, 0xc
push 0
lea edx, [ebp - 4]
push edx
push eax
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410e56
cmp byte [edi + 3], bl
jne 0x410e56
mov eax, dword [edi + 9]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov bl, 1
push edi
call fcn.00401210
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412df0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x412ed6
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x412ed6
push 0xffffffffffffffff
push str.iptApp.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412ed6
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412e80
sub eax, edx
sar eax, 1
push edi
lea edi, [eax + 1]
lea edx, [edi + edi]
push edx
call fcn.004011a0
mov esi, eax
add esp, 4
test esi, esi
je 0x412ee7
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
test eax, eax
je 0x412ee7
push esi
call fcn.00401210
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
Function at 0x414030
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x24], 0
je 0x414059
mov eax, 7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x414070
mov eax, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414075
sub eax, edx
mov dword [ebp - 0x38], eax
cmp eax, 0x20
jg 0x41405d
push esi
push str..mailslot_
lea eax, [ebp - 0x34]
push 0x2e
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
push edi
lea ecx, [ebp - 0x34]
push 0x2e
push ecx
call dword [sym.imp.MSVCR100.dll_strcat_s]
mov eax, dword [ebp + 8]
add esp, 0x18
test eax, eax
jne 0x4140dc
push eax
push eax
push 0x1a8
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov esi, eax
cmp esi, 0xffffffff
je 0x414103
push 0
push 0
push 0
push 0
push 4
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
jmp 0x4140fe
cmp eax, 1
jne 0x414142
push 0
push 0x80
push 3
push 0
push eax
push 0x40000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414117
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x38]
push ecx
push edi
push 0x22
push ebx
call dword [sym.imp.MSVCR100.dll_strncpy_s]
mov edx, dword [ebp + 8]
add esp, 0x10
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x28], edx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0xa
pop esi
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret

Function at 0x414160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
mov dword [ebp - 0x1b4], esi
jne 0x414196
mov eax, 5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x28], 1
je 0x4141b0
mov eax, 0xa
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
test edi, edi
je 0x4141f7
push ebx
mov esi, edi
lea ebx, [ebp - 0x1b0]
call fcn.004143c0
lea esi, [edi + 0x12]
call fcn.004143c0
lea esi, [edi + 0x34]
call fcn.004143c0
lea esi, [edi + 0x56]
call fcn.004143c0
mov eax, dword [ebp - 0x1b0]
mov esi, dword [ebp - 0x1b4]
mov byte [eax - 1], 0
pop ebx
push 0
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi + 0x24]
inc eax
push eax
lea eax, [ebp - 0x1ac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0xfffffffd
xor ecx, ebp
add eax, 3
pop esi
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
Function at 0x4142f0
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0x28], 0
je 0x41431c
mov eax, 0xa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x24]
test eax, eax
je 0x414337
push 0
lea ecx, [ebp - 0x1b8]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp dword [ebp - 0x1b8], 0
ja 0x414353
mov eax, 9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x24]
push 0
lea edx, [ebp - 0x1b4]
push edx
push 0x1a8
lea eax, [ebp - 0x1b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414389
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x1b0]
mov ecx, edi
mov byte [ebp + edx - 0x1b0], 0
call fcn.004144a0
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0xfffffff5
xor ecx, ebp
add eax, 0xb
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
Function at 0x415800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4213e6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x42c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
or eax, 0xffffffff
xor ebx, ebx
mov byte [ecx], 0
call fcn.00401b90
mov dword [ebp - 4], ebx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
lea edx, [edi + 0x38]
push edx
lea eax, [esi + 0x38]
push eax
mov dword [esi + 0x34], ecx
call fcn.00417930
lea edx, [esi + 0x44]
lea ecx, [edi + 0x44]
push edx
mov byte [ebp - 4], 1
call fcn.00417c70
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov ecx, dword [edi + 0x60]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0x64]
mov dword [esi + 0x64], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a150
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42279e
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x42c050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x430ea8], 1
mov ebx, dword [ebp + 8]
mov esi, ecx
mov edi, edx
jne 0x41a1a4
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
cmp byte [0x430eb8], 0
je 0x41a1cb
push 0x4010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
push edi
mov ecx, ebx
mov edx, esi
call fcn.00419e90
mov edi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 0x4c], edi
cmp edi, eax
je 0x41a1ef
cmp edi, 0x402
jne 0x41a2da
xor ecx, ecx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], eax
mov word [ebp - 0x48], cx
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov eax, esi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a214
sub eax, edx
mov edi, eax
mov eax, esi
lea esi, [ebp - 0x2c]
call fcn.00401c70
mov byte [ebp - 4], 1
test byte [0x430f18], 1
jne 0x41a257
or dword [0x430f18], 1
mov byte [ebp - 4], 2
call fcn.00402740
push 0x423420
call fcn.0041d6db
add esp, 4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x4d]
push edx
lea ebx, [ebp - 0x48]
lea ecx, [ebp - 0x2c]
call fcn.004033a0
cmp dword [ebp - 0x18], 0x10
mov bl, al
jb 0x41a27b
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor esi, esi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2c], 0
lea edi, [esi + 8]
test bl, bl
je 0x41a2c5
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x41a29d
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
test eax, eax
je 0x41a2c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x4c], esi
jne 0x41a2c5
mov dword [ebp - 0x4c], 0x104
jmp 0x41a2c5
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x34], edi
jb 0x41a2d7
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, dword [ebp - 0x4c]
test byte [0x430ea8], 1
jne 0x41a2fc
or dword [0x430ea8], 1
call fcn.00411560
push 0x423380
call fcn.0041d6db
add esp, 4
cmp byte [0x430eb8], 0
je 0x41a324
push edi
push 0x4011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d5b4
mov esp, ebp
pop ebp
ret
Function at 0x41aa70
Capabilities:
Delete service

Disassembly:
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x41aabc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41aaa6
push str.ACCESS_DENIED:_administrative_privileges_required._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, 2
pop esi
ret
push eax
push str.OpenSCManager_failed___d__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, 1
pop esi
ret
push edi
push 0x10000
push str.jhi_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x41ab03
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x41ab27
cmp eax, 0x424
jne 0x41ab3d
push str.Error:_the_service_does_not_exist._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
lea eax, [edi + 4]
pop edi
pop esi
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41ab56
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
jne 0x41ab3d
push str.ACCESS_DENIED:_administrative_privileges_required._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
pop edi
mov eax, 2
pop esi
ret
call esi
push eax
push str.Uninstall_Service_failed:___d__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
pop edi
mov eax, 1
pop esi
ret
push str.JHI_Service_removed_successfully_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
ret