joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66e0c300
Capabilities:
Get file version info
Read file on windows

Disassembly:
sub esp, 0x118
mov eax, dword [0x66fe31a0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebp
mov ebp, ecx
cmp byte [ebp + 0x14], 0
jne 0x66e0c40e
push edi
lea ecx, [ebp + 0x18]
call fcn.66e13a90
test eax, eax
je 0x66e0c40d
push ebx
push esi
lea eax, [esp + 0x20]
push eax
lea ecx, [ebp + 0x18]
call fcn.66e13a40
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x66e0c3b5
push ebx
call fcn.66e13cb5
mov esi, eax
add esp, 4
test esi, esi
je 0x66e0c3ac
push esi
push ebx
push dword [esp + 0x28]
lea ecx, [ebp + 0x18]
call fcn.66e13a40
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x66e0c3ac
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x66f8af3c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x66e0c3ac
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
mov ecx, ebp
push eax
call fcn.66e13c60
push esi
call fcn.66e13cbe
add esp, 4
cmp byte [ebp + 0x14], 0
jne 0x66e0c40b
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea ecx, [ebp + 0x18]
call fcn.66e13a40
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
jne 0x66e0c430
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x66e0c427
cmp eax, 0x20
je 0x66e0c3fa
call esi
jmp 0x66e0c40b
push 0
push 0x9803ea
mov ecx, 0x66feb0e0
call fcn.66e09730
pop esi
pop ebx
pop edi
mov al, byte [ebp + 0x14]
mov ecx, dword [esp + 0x118]
pop ebp
xor ecx, esp
call fcn.66f2a29c
add esp, 0x118
ret
push 0
push 0x9503ef
jmp 0x66e0c401
xor ecx, ecx
mov dword [esp + 0x14], 0x100
xor al, al
mov dword [esp + 0x18], ecx
mov byte [esp + 0x13], al
test al, al
jne 0x66e0c509
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x100
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x14]
test eax, eax
mov al, byte [esp + 0x13]
je 0x66e0c4ef
cmp ebx, 0x16
jb 0x66e0c4ef
xor edi, edi
cmp ebx, 0x16
jb 0x66e0c4ef
test al, al
jne 0x66e0c4ef
lea edx, [esp + 0x24]
mov eax, 0x66f8bd28
add edx, edi
mov esi, 0x12
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x66e0c4dd
add edx, 4
add eax, 4
sub esi, 4
jae 0x66e0c4a4
mov cx, word [edx]
mov esi, dword [esp + 0x1c]
cmp cx, word [eax]
jne 0x66e0c4e1
mov eax, dword [esp + 0x18]
mov ecx, ebp
add eax, 0x16
add eax, edi
push eax
push esi
call fcn.66e0c250
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x13], al
jmp 0x66e0c4e5
mov esi, dword [esp + 0x1c]
mov al, byte [esp + 0x13]
inc edi
mov ecx, ebx
sub ecx, edi
cmp ecx, 0x16
jae 0x66e0c490
mov ecx, dword [esp + 0x18]
add ecx, 0xc8
mov dword [esp + 0x18], ecx
cmp ebx, 0x100
je 0x66e0c444
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x66e0c40b
Function at 0x66e0e6b0
Capabilities:
Delete file
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x24]
xor bl, bl
mov byte [esp + 0xb], bl
test esi, esi
je 0x66e0e7dc
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x66e0e6e4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x66e0e7db
mov eax, dword [esp + 0x20]
push ebp
push dword [esp + 0x28]
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
je 0x66e0e7da
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x66e0e7da
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [esp + 0x2c]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x66e0e7da
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor ebx, ebx
push 0x80
push esi
call ebp
push 0x66f8bf44
push esi
call fcn.66f2c0c4
mov edi, eax
add esp, 8
test edi, edi
jne 0x66e0e792
lea esp, [esp]
mov eax, ebx
inc ebx
cmp eax, 0xa
ja 0x66e0e78e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80
push esi
call ebp
push 0x66f8bf44
push esi
call fcn.66f2c0c4
mov edi, eax
add esp, 8
test edi, edi
je 0x66e0e760
jmp 0x66e0e792
test edi, edi
je 0x66e0e7d6
push edi
push dword [esp + 0x18]
mov byte [esp + 0x1b], 1
push 1
push dword [esp + 0x38]
call fcn.66f2c592
push edi
call fcn.66f2be24
mov ecx, dword [esp + 0x44]
add esp, 0x14
test ecx, ecx
je 0x66e0e7d6
mov eax, dword [ecx]
push esi
mov eax, dword [eax]
call eax
test al, al
jne 0x66e0e7d6
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebp
pop edi
xor bl, bl
pop esi
mov al, bl
pop ebx
add esp, 8
ret
mov bl, byte [esp + 0x13]
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x66e0eae0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66f779f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0
call fcn.66f2b535
mov eax, dword [esp + 0x28]
test esi, esi
mov dword [edi + 0xc], eax
mov edx, 0x66f8af39
mov eax, dword [esp + 0x2c]
cmovne edx, esi
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [edi], vtable.FNPNS::EXCEPT::CFnpException.0
mov dword [edi + 0x14], eax
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], 0
mov byte [edi + 0x18], 0
cmp byte [edx], 0
mov dword [esp + 0x20], 0
jne 0x66e0eb65
xor eax, eax
jmp 0x66e0eb79
mov eax, edx
lea ebx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x66e0eb70
sub eax, ebx
push eax
push edx
lea ecx, [edi + 0x18]
call fcn.66e02560
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
Function at 0x66e10310
Capabilities:
Delete service
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66f77ca0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [esp + 0x20]
call fcn.66e12890
mov esi, dword [esp + 0x20]
mov dword [esp + 0x30], 0
test esi, esi
jne 0x66e10398
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x66feb0e0
push esi
cmp eax, 5
je 0x66e10387
push 0x409ffff
call fcn.66e09730
mov bl, al
jmp 0x66e10529
push 0x40703ef
call fcn.66e09730
mov bl, al
jmp 0x66e10529
mov ecx, dword [ebx + 0x8c]
add ecx, 4
push 0x10000
call fcn.66e13a40
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
push esi
call edi
push eax
lea ecx, [esp + 0x18]
call fcn.66e12890
mov eax, dword [esp + 0x18]
mov byte [esp + 0x30], 1
test eax, eax
jne 0x66e1040a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x66e103f2
cmp eax, 0x7b
je 0x66e10519
cmp eax, 0x424
je 0x66e10519
xor bl, bl
jmp 0x66e1051b
push 0
push 0x41503ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e1051b
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x66e10472
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
je 0x66e1045a
dec eax
je 0x66e10472
sub eax, 0x42a
je 0x66e10442
push 0
push 0x432ffff
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e1051b
mov ecx, dword [ebx + 0x8c]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x66e10472
xor bl, bl
jmp 0x66e1051b
push 0
push 0x43003ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e1051b
lea ecx, [esp + 0x14]
call fcn.66e12930
mov eax, dword [ebx + 0x8c]
mov al, byte [eax + 0x2c]
test al, al
jne 0x66e1049d
push 0
push 0x43b03e9
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e1051b
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebp
mov ecx, dword [ebx + 0x8c]
mov esi, dword [esp + 0x20]
add ecx, 4
push 0x20000
call fcn.66e13a40
push eax
push esi
call edi
push eax
lea ecx, [esp + 0x18]
call fcn.66e128d0
xor edi, edi
cmp dword [esp + 0x18], edi
je 0x66e10519
lea ecx, [esp + 0x14]
call fcn.66e12930
push 0x64
call ebp
mov eax, edi
inc edi
cmp eax, 0x32
jg 0x66e10550
mov ecx, dword [ebx + 0x8c]
mov esi, dword [esp + 0x20]
add ecx, 4
push 0x20000
call fcn.66e13a40
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
lea ecx, [esp + 0x18]
call fcn.66e128d0
cmp dword [esp + 0x18], 0
jne 0x66e104d4
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.66e128b0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.66e128b0
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x45003ea
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e1051b
Function at 0x66e10680
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x66f77d08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, ecx
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [esp + 0x24]
call fcn.66e12890
cmp dword [esp + 0x24], 0
mov dword [esp + 0x44], 0
jne 0x66e10700
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x66feb0e0
push 0
cmp eax, 5
je 0x66e106ef
push 0x320ffff
call fcn.66e09730
jmp 0x66e108a2
push 0x31d03ef
call fcn.66e09730
mov bl, al
jmp 0x66e108a4
lea ecx, [esp + 0x28]
call fcn.66e13490
lea eax, [esp + 0x28]
mov byte [esp + 0x44], 1
push eax
mov ecx, edi
call fcn.66e11140
mov ecx, dword [edi + 0x8c]
mov esi, dword [esp + 0x24]
add ecx, 4
push 2
call fcn.66e13a40
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
lea ecx, [esp + 0x1c]
call fcn.66e12890
cmp dword [esp + 0x1c], 0
mov byte [esp + 0x44], 2
jne 0x66e10779
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x66feb0e0
push 0
cmp eax, 5
je 0x66e1076f
push 0x33b03ea
call fcn.66e09730
mov bl, al
jmp 0x66e10857
push 0x33503ef
jmp 0x66e10881
cmp byte [edi + 0xb0], 0
je 0x66e107b3
mov byte [edi + 0xb0], 0
lea ecx, [esp + 0x18]
call fcn.66e12930
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x54]
call eax
test al, al
je 0x66e10855
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x50]
call eax
mov bl, al
jmp 0x66e10857
lea ecx, [edi + 0x94]
call fcn.66e13a90
test eax, eax
jne 0x66e107c9
mov ebx, 0x66f8af39
jmp 0x66e107d6
lea ecx, [edi + 0x94]
call fcn.66e13a40
mov ebx, eax
mov ecx, dword [edi + 0x8c]
mov esi, dword [esp + 0x1c]
mov dl, byte [ecx + 0x2d]
lea ecx, [ecx + 4]
call fcn.66e13a40
push eax
push 0
push 0
push dword [edi + 0xa8]
lea ecx, [esp + 0x38]
push 0
push ebx
call fcn.66e13a40
push eax
push 0xffffffffffffffff
push 2
push dword [edi + 0x90]
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x66e10886
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x66e10875
cmp eax, 0x57
je 0x66e10789
cmp eax, 0x430
jne 0x66e10886
mov ecx, dword [edi + 0x8c]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x66e10855
push 0
push 0x36303ea
mov ecx, 0x66feb0e0
call fcn.66e09730
xor bl, bl
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
call fcn.66e128b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0
call fcn.66e134c0
jmp 0x66e108a4
push 0
push 0x35f03ef
mov ecx, 0x66feb0e0
call fcn.66e09730
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
call fcn.66e128b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0
call fcn.66e134c0
mov bl, 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], 0xffffffff
call fcn.66e128b0
mov al, bl
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x66e10b90
Capabilities:
Query service status

Disassembly:
push 0xffffffffffffffff
push 0x66f77d90
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x66fe31a0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x38]
call fcn.66e13ad0
mov ecx, dword [esi + 0x8c]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x6c], 0
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x3c], 0
jne 0x66e10c34
cmp dword [esi + 0x90], 0x10
je 0x66e10c40
lea ecx, [esp + 0x10]
call fcn.66e09b20
mov ecx, dword [esi + 0x8c]
add ecx, 4
mov byte [esp + 0x68], 1
call fcn.66e13a40
push eax
lea ecx, [esp + 0x14]
call fcn.66e09b80
mov byte [esp + 0x68], 0
lea ecx, [esp + 0x10]
test al, al
je 0x66e10c3b
call fcn.66e09b30
mov bl, 1
jmp 0x66e10d3e
call fcn.66e09b30
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [esp + 0x1c]
call fcn.66e12890
mov edi, dword [esp + 0x1c]
mov byte [esp + 0x68], 2
test edi, edi
jne 0x66e10c96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x66feb0e0
push edi
cmp eax, 5
je 0x66e10c85
push 0xebffff
call fcn.66e09730
mov bl, al
jmp 0x66e10d30
push 0xe903ef
call fcn.66e09730
mov bl, al
jmp 0x66e10d30
mov ecx, dword [esi + 0x8c]
add ecx, 4
push 4
call fcn.66e13a40
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
lea ecx, [esp + 0x24]
call fcn.66e12890
mov eax, dword [esp + 0x24]
mov byte [esp + 0x68], 3
test eax, eax
jne 0x66e10ce5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x66e10d1c
push 0
push 0xf703ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e10d22
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x66e10d15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x66e10d1c
push 0
push 0x10503ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e10d22
cmp dword [esp + 0x44], 4
je 0x66e10d20
xor bl, bl
jmp 0x66e10d22
mov bl, 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x68], 2
call fcn.66e128b0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 0
call fcn.66e128b0
lea ecx, [esp + 0x28]
mov dword [esp + 0x68], 0xffffffff
call fcn.66e13b10
mov al, bl
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.66f2a29c
add esp, 0x5c
ret
Function at 0x66e10d70
Capabilities:
Query service status
Start service

Disassembly:
push 0xffffffffffffffff
push 0x66f77dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x66fe31a0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x54]
test esi, esi
jne 0x66e10daf
xor al, al
jmp 0x66e10f02
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [esp + 0x10]
call fcn.66e12890
push 4
push esi
push dword [esp + 0x18]
mov dword [esp + 0x58], 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
lea ecx, [esp + 0x20]
call fcn.66e12890
mov eax, dword [esp + 0x20]
mov byte [esp + 0x4c], 1
test eax, eax
jne 0x66e10e18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x66e10edf
push 0
push 0x53903ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e10ee1
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x66e10e4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x66e10edf
push 0
push 0x54d03ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e10ee1
cmp dword [esp + 0x28], 4
jne 0x66e10edf
push 0x10
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
lea ecx, [esp + 0x18]
call fcn.66e12890
mov eax, dword [esp + 0x18]
mov byte [esp + 0x4c], 2
push 0
test eax, eax
jne 0x66e10ea1
push 0x55703ef
mov ecx, 0x66feb0e0
call fcn.66e09730
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 1
mov bl, al
call fcn.66e128b0
jmp 0x66e10ee1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x66e10ed1
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x422
je 0x66e10ec0
sub eax, 0xe
jne 0x66e10ed1
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], bl
call fcn.66e128b0
jmp 0x66e10ee1
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 1
call fcn.66e128b0
xor bl, bl
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.66e128b0
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.66e128b0
mov al, bl
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.66f2a29c
add esp, 0x44
ret 4
Function at 0x66e11900
Capabilities:
Query service status
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x66f77ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x66fe31a0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x8c]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x66e11b24
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [esp + 0x1c]
call fcn.66e12890
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x64], 0
test esi, esi
jne 0x66e119a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x66feb0e0
push esi
cmp eax, 5
je 0x66e11990
push 0x133ffff
call fcn.66e09730
mov bl, al
jmp 0x66e11b11
push 0x13103ef
call fcn.66e09730
mov bl, al
jmp 0x66e11b11
mov ecx, dword [edi + 0x8c]
add ecx, 4
push 0x24
call fcn.66e13a40
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
lea ecx, [esp + 0x14]
call fcn.66e12890
cmp dword [esp + 0x14], 0
mov byte [esp + 0x64], 1
jne 0x66e11a1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x66e11a06
cmp eax, 0x7b
je 0x66e11b01
cmp eax, 0x424
je 0x66e11b01
push 0
push 0x14403ee
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e11b03
push 0
push 0x13e03ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e11b03
mov ecx, dword [edi + 0x8c]
push 0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
jne 0x66e11a38
xor bl, bl
jmp 0x66e11b03
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 0
push eax
push 1
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x66e11ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x425
ja 0x66e11a9a
je 0x66e11ab6
cmp eax, 5
je 0x66e11a85
cmp eax, 0x41c
jne 0x66e11aa1
push 0
push 0x15b03ee
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e11b03
push 0
push 0x15503ef
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e11b03
cmp eax, 0x426
je 0x66e11b01
push 0
push 0x15dffff
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e11b03
mov eax, dword [esp + 0x40]
dec eax
je 0x66e11b01
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call edi
xor esi, esi
cmp dword [esp + 0x24], 1
je 0x66e11b01
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0xc8
call ebx
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call edi
mov eax, esi
inc esi
cmp eax, 0x64
jg 0x66e11b42
cmp dword [esp + 0x24], 1
jne 0x66e11ae0
mov bl, 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x64], 0
call fcn.66e128b0
lea ecx, [esp + 0x18]
mov dword [esp + 0x64], 0xffffffff
call fcn.66e128b0
mov al, bl
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.66f2a29c
add esp, 0x58
ret
push 0
push 0x18403ee
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
jmp 0x66e11b03
Function at 0x66e11f10
Capabilities:
Delete registry key

Disassembly:
mov al, byte [esp + 4]
push esi
push edi
mov esi, ecx
test al, al
je 0x66e11f2f
push 0
push 0
mov ecx, esi
call fcn.66e12200
test eax, eax
je 0x66e11fe5
push 0x5c
push dword [esi + 4]
call fcn.66f2c614
add esp, 8
test eax, eax
je 0x66e11fe5
push eax
call fcn.66f2b896
mov edi, eax
add esp, 4
cmp byte [edi], 0
jne 0x66e11f67
push edi
push dword [esi + 4]
call fcn.66f2b7f9
add esp, 8
mov byte [eax], 0
mov al, 1
jmp 0x66e11f18
mov eax, dword [esi + 0xc]
test eax, eax
je 0x66e11f75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [esi + 4]
mov dword [esi + 0xc], 0
call fcn.66f2b7f9
add esp, 8
mov ecx, esi
mov byte [eax], 0
push 0
push 0
call fcn.66e12200
test eax, eax
je 0x66e11fde
push edi
push 0
push 0
mov ecx, esi
call fcn.66e12200
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x66e11fbd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0xc], 0
test edi, edi
je 0x66e11fd4
cmp edi, 2
je 0x66e11fd4
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
pop edi
mov al, 1
pop esi
ret 4
pop edi
xor al, al
pop esi
ret 4

Function at 0x66e11ff0
Capabilities:
Delete registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
mov esi, ecx
call fcn.66e12200
test eax, eax
jne 0x66e12019
cmp dword [esp + 4], 2
pop esi
sete al
pop ecx
ret 4
push dword [esp + 0xc]
mov ecx, esi
push 0
push 0
call fcn.66e12200
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x66e1203f
cmp eax, 2
je 0x66e1203f
xor eax, eax
pop esi
pop ecx
ret 4
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x66e12050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0xc]
mov ebp, ecx
test edi, edi
jne 0x66e12063
pop edi
xor al, al
pop ebp
ret 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x66e12074
pop esi
pop edi
xor al, al
pop ebp
ret 0xc
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
push edi
push 0
push 1
call fcn.66e12200
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
mov ebx, eax
test ebx, ebx
jne 0x66e12106
cmp dword [esp + 0x18], 7
jne 0x66e12106
test ecx, ecx
je 0x66e12106
lea eax, [ecx + 1]
push eax
call fcn.66e13cb5
add esp, 4
mov dword [esi], eax
lea ecx, [esp + 0x14]
push ecx
push eax
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
push ebx
push edi
push ebx
push 1
call fcn.66e12200
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x66e120f2
cmp dword [esp + 0x18], 7
jne 0x66e120f2
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x66e12106
push dword [esi]
call fcn.66e13cbe
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x66e12110
mov dword [eax], ecx
test ebx, ebx
pop ebx
jne 0x66e1212b
cmp dword [esp + 0x14], 7
jne 0x66e1212b
test ecx, ecx
je 0x66e1212b
pop esi
pop edi
mov eax, 1
pop ebp
ret 0xc
pop esi
pop edi
xor eax, eax
pop ebp
ret 0xc
Function at 0x66e12140
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x66e1214d
xor al, al
ret 8
lea edx, [esp + 4]
mov dword [esp + 4], 4
push edx
push dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0
push eax
push 0
push 1
call fcn.66e12200
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x66e12189
cmp dword [esp + 8], 4
jne 0x66e12189
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x66e12190
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
mov ebx, ecx
je 0x66e121f6
mov esi, dword [esp + 0x10]
test esi, esi
je 0x66e121f6
mov eax, dword [esp + 0x14]
push eax
push 0
push esi
mov dword [esp + 0x1c], eax
call fcn.66f2b130
add esp, 0xc
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x1c]
push 0
push 1
call fcn.66e12200
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x66e121ef
cmp dword [esp + 0x14], 1
jne 0x66e121ef
pop esi
mov eax, 1
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
pop esi
xor al, al
pop ebx
ret 0xc