joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e3e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp + 8]
setne cl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov esi, ecx
mov ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46e419
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x46e420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46e43e
test al, 0x10
je 0x46e43e
mov esi, 1
jmp 0x46e440
xor esi, esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46e45f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x46e4c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e4d0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push ebx
push eax
call fcn.004ba3e2
lea ecx, [esi + 2]
push 0x5c
push ecx
mov ebx, eax
mov dword [ebp - 4], 0
call fcn.004ba628
add esp, 0xc
test eax, eax
je 0x46e553
push edi
sub eax, esi
sar eax, 1
cmp dword [ebp - 4], 0
mov edi, eax
jle 0x46e53c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e517
sub eax, edx
push edi
sar eax, 1
push esi
inc eax
push eax
push ebx
call fcn.004ba888
add esp, 0x10
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc dword [ebp - 4]
lea edx, [esi + edi*2 + 2]
push 0x5c
push edx
call fcn.004ba628
add esp, 8
test eax, eax
jne 0x46e506
pop edi
push ebx
call fcn.004ba2c5
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop ebx
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x46ee30
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7988
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.0042545f
add esp, 4
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
mov edi, edx
mov edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46eeb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ecx, ecx
test edi, edi
sete cl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov esi, ecx
mov ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46eee3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x471730
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9329
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov ebx, 1
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
call fcn.004ab443
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x47178c
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
test edi, edi
je 0x4717c2
test edi, 0xffff0000
jne 0x4717c6
movzx edi, di
push edi
call fcn.004b33b0
test eax, eax
je 0x4717d8
push edi
push eax
mov ecx, esi
call fcn.00424e6b
jmp 0x4717d8
xor eax, eax
jmp 0x4717cf
push edi
call fcn.004b9b7a
add esp, 4
push eax
push edi
mov ecx, esi
call fcn.004253ee
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
test ecx, ecx
je 0x471805
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x471805
push ecx
push eax
call fcn.004b9d01
add esp, 8
test eax, eax
je 0x471805
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
jne 0x471824
push 0x4eba54
call fcn.004b9b7a
add esp, 4
push eax
push 0x4eba54
mov ecx, esi
call fcn.004253ee
jmp 0x4718fb
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx - 0xc]
push 0
add eax, ecx
push esi
call fcn.00424882
push ebx
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.004249da
mov eax, dword [eax]
push 0x4f56cc
push eax
call fcn.004b9dc0
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x14]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471874
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4718e7
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
mov ebx, 1
cmp edi, ebx
jge 0x47188c
mov ebx, edi
test edi, edi
jle 0x4718e7
sub edi, ebx
cmp dword [eax - 4], 1
jle 0x47189f
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, esi
call fcn.00422592
mov eax, dword [esi]
lea ecx, [edi + edi + 2]
push ecx
lea edx, [eax + ebx*2]
push edx
push ecx
push eax
call fcn.004b96cf
add esp, 0x10
cmp eax, 0x50
ja case.0x4718c0.1
movzx eax, byte [eax + 0x47194c]
jmp dword [eax*4 + 0x47193c]
call fcn.004ab9ab
call fcn.004ab9e3
test edi, edi
jl 0x471932
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x471932
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + edi*2], dx
push 0x4f21dc
mov eax, esi
call fcn.0043d838
push eax
mov ecx, esi
call fcn.00424ef9
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47191e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
rcr dword [eax], 1
inc edi
add bh, al
sbb byte [edi], al
int3
Function at 0x4719a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7959
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004ab443
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4719f1
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov ecx, 1
mov dword [ebp - 0x14], 0x200
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x200
or eax, ecx
jge 0x471a30
push 0x200
mov ecx, esi
call fcn.00422527
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x471a54
push ecx
push eax
call fcn.004b9b5b
add esp, 8
test eax, eax
jl 0x471a78
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x471a78
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
int3

Function at 0x471a90
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d92e1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.004ab443
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x471adc
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, 0x4eba54
mov dword [ebp - 4], 1
test ecx, 0xffff0000
jne 0x471b18
mov edx, ecx
movzx edi, dx
push edi
call fcn.004b33b0
test eax, eax
je 0x471b32
push edi
push eax
mov ecx, esi
call fcn.00424e6b
jmp 0x471b32
push 0x4eba54
call fcn.004b9b7a
add esp, 4
push eax
push 0x4eba54
mov ecx, esi
call fcn.004253ee
mov dword [ebp - 4], 0
mov eax, dword [esi]
sub eax, 0x10
mov dword [ebp - 0x14], 0x104
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 0x10], 1
jge 0x471b6c
push 0x104
mov ecx, esi
call fcn.00422527
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x471b90
push ecx
push eax
call fcn.004b9b5b
add esp, 8
test eax, eax
jl 0x471bb5
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x471bb5
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
int3
Function at 0x471c10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc5d0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
or ebx, 0xffffffff
test byte [0x52a4d0], 1
jne 0x471ce0
or dword [0x52a4d0], 1
mov dword [ebp - 4], 0
call fcn.004ab443
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x471c74
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [0x52a4cc], eax
mov ecx, 0x4eba54
mov byte [ebp - 4], 1
test ecx, 0xffff0000
jne 0x471cb3
mov edx, ecx
movzx esi, dx
push esi
call fcn.004b33b0
test eax, eax
je 0x471cd0
push esi
push eax
mov ecx, 0x52a4cc
call fcn.00424e6b
jmp 0x471cd0
push 0x4eba54
call fcn.004b9b7a
add esp, 4
push eax
push 0x4eba54
mov ecx, 0x52a4cc
call fcn.004253ee
push 0x4e3aa0
call fcn.004bc798
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, dword [0x52a4cc]
cmp dword [ecx - 0xc], 0
jne 0x471deb
mov edx, dword [ecx - 8]
mov eax, 1
sub eax, dword [ecx - 4]
sub edx, 0x514
or eax, edx
jge 0x471d1a
push 0x514
mov ecx, 0x52a4cc
call fcn.00422527
mov ecx, dword [0x52a4cc]
push 0x514
push ecx
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
mov eax, dword [0x52a4cc]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.004b9b5b
add esp, 8
test eax, eax
jl 0x471e12
mov ecx, dword [0x52a4cc]
cmp eax, dword [ecx - 8]
jg 0x471e12
mov dword [ecx - 0xc], eax
mov edx, dword [0x52a4cc]
xor ecx, ecx
mov word [edx + eax*2], cx
test esi, esi
jbe 0x471d9b
mov eax, dword [0x52a4cc]
cmp dword [eax - 0xc], ecx
jle 0x471d9b
push 0x7e
push eax
call fcn.004ba628
add esp, 8
test eax, eax
je 0x471d9b
sub eax, dword [0x52a4cc]
sar eax, 1
cmp eax, ebx
je 0x471d9b
push 0x52a4cc
call fcn.0046e580
add esp, 4
mov eax, dword [0x52a4cc]
push eax
lea ecx, [ebp - 0x10]
push str.ReplaceUserProfile:_CurProfile_s
push ecx
call fcn.0046bd30
mov dword [ebp - 4], 2
mov eax, dword [eax]
push eax
push str.DynamicPaths_Initialize
call fcn.00469f10
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x471de5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x52a4cc]
lea eax, [ecx - 0x10]
push eax
call fcn.0042545f
mov ecx, eax
mov eax, dword [ebp + 8]
add esp, 4
add ecx, 0x10
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
int3
Function at 0x471e20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7920
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jle 0x471f93
push 0x25
push ecx
call fcn.004ba628
add esp, 8
cmp eax, ebx
je 0x471f93
sub eax, dword [ebp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
je 0x471f93
call fcn.004ab443
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x471e97
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, 1
mov byte [ebp - 4], cl
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x471ecd
push 0x514
lea ecx, [ebp - 0x10]
call fcn.00422527
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
push 0x514
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004b9b5b
add esp, 8
cmp eax, ebx
jl 0x471fe4
cmp eax, dword [esi - 8]
jg 0x471fe4
xor edx, edx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], dx
cmp edi, ebx
jbe 0x471f74
add esi, 0xfffffff0
push esi
call fcn.0042545f
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [ebp - 4], bl
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x471f3a
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471f60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471f93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.0042545f
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471fd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
int3
Function at 0x471ff0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9298
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.004ab443
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x47203a
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, 1
mov byte [ebp - 4], cl
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x472069
push edi
lea ecx, [ebp - 0x10]
call fcn.00422527
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004b9b5b
add esp, 8
cmp eax, ebx
jl 0x4721db
cmp eax, dword [esi - 8]
jg 0x4721db
xor edx, edx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], dx
cmp edi, ebx
jne 0x472171
call fcn.004ab443
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4720c0
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov ecx, 0x4eba54
mov byte [ebp - 4], 2
test ecx, 0xffff0000
jne 0x4720fd
mov edx, ecx
movzx edi, dx
push edi
call fcn.004b33b0
cmp eax, ebx
je 0x472117
mov ecx, dword [ebp + 8]
push edi
push eax
call fcn.00424e6b
jmp 0x472117
push 0x4eba54
call fcn.004b9b7a
add esp, 4
push eax
push 0x4eba54
mov ecx, edi
call fcn.004253ee
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472136
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47215c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 0xfffffff0
push esi
call fcn.0042545f
mov edi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [ebp - 4], bl
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4721a1
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4721c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
int3
Function at 0x4723e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d90b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x523f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.004ab443
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x472429
push 0x80004005
call fcn.00422000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ecx, [eax + 0x10]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0xc], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
je 0x47249a
lea eax, [edx - 0x10]
lea esi, [ecx - 0x10]
cmp eax, esi
je 0x4724f3
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47248b
mov ecx, dword [eax]
cmp ecx, dword [esi]
jne 0x47248b
push eax
call fcn.0042545f
add esp, 4
mov ebx, eax
or edx, 0xffffffff
lock xadd dword [edi], edx
dec edx
test edx, edx
jg 0x472483
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0x10
mov dword [ebp - 0x18], ebx
jmp 0x4724f3
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [ebp - 0x18]
call fcn.004253ee
jmp 0x4724f3
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x4724ba
push esi
lea ecx, [ebp + 8]
call fcn.00422527
mov edx, dword [ebp + 8]
lea eax, [esi + 1]
push eax
push edx
call fcn.004bca75
add esp, 8
test esi, esi
jl 0x47256f
mov eax, dword [ebp + 8]
cmp esi, dword [eax - 8]
jg 0x47256f
mov dword [eax - 0xc], esi
mov edx, dword [ebp + 8]
xor ecx, ecx
lea eax, [ebp + 8]
mov word [edx + esi*2], cx
push eax
lea ecx, [ebp - 0x18]
call fcn.00424ef9
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x18]
push edx
push 0x4721f0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472535
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47255b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00422000
int3
Function at 0x475700
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x514c00
push 0x4c0140
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x523f10]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x7530
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 1
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call ebx
test eax, eax
jne 0x4758e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4757ba
mov edx, dword [ebp - 0x1c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4757ba
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push esi
push 1
push edi
call ebx
test eax, eax
jne 0x4757ce
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x523f10
call fcn.004c99c0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp ebx, dword [ebp - 0x20]
jae 0x4758d4
lea ecx, [ebx + ebx*8]
lea esi, [esi + ecx*4]
mov ecx, 9
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
push 0x24
mov edx, dword [ebp - 0x7c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
jne 0x47582c
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x523f10
call fcn.004c99c0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov dword [ebp - 4], edi
lea edx, [ebp - 0x58]
push edx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4757a7
cmp dword [ebp - 0x54], edi
je 0x4758a8
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c]
push edx
push 0x24
lea eax, [ebp - 0x58]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x475805
cmp dword [ebp - 0x54], edi
je 0x4758a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jbe 0x475848
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x523f10
call fcn.004c99c0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
call fcn.004758cc
add ebx, edi
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x28]
jmp 0x4757d3
mov dword [ebp - 4], 0xfffffffe
call fcn.004758fa
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret