joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470930
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7faa8c]
sub esp, 0x2dc
push ebx
push ebp
push esi
mov esi, dword [0x47badc]
shr eax, 3
push edi
test eax, eax
je 0x470acb
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x470964
mov esi, dword [esp + 0x18]
cmp dword [0x7faa8c], 0x1c
jne 0x470981
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x475200]
mov eax, dword [0x475204]
mov ecx, dword [0x475208]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [0x47520c]
mov ebp, 0xc6ef3720
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], 0x20
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x28]
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x2c]
lea edx, [edi + ebp]
xor eax, ecx
xor eax, edx
sub ebx, eax
mov eax, ebx
shl eax, 4
mov dword [0x7fa9fc], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x14], eax
cmp dword [0x7faa8c], 0x1be
jne 0x470a0d
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, ebx
shr esi, 5
add esi, dword [esp + 0x30]
cmp dword [0x7faa8c], 0x979
mov dword [0x7faa00], 0xff6b3619
mov dword [0x7faa04], 0xffffffff
jne 0x470a4a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebx + ebp]
xor esi, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sub edi, eax
add ebp, 0x61c88647
dec dword [esp + 0x1c]
mov dword [esp + 0x14], eax
jne 0x4709ba
cmp dword [0x7faa8c], 0x8d4
jne 0x470a82
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [0x7faa8c], 0x17
jne 0x470aba
push 0
push 0
push 0
push 0x404690
push 0x4046a0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x470960
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x41a260
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x43b180]
test esi, esi
jle 0x41a370
mov edi, dword [0x43b184]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x41a294
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x41a315
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x41a280
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x41a397
mov eax, dword [0x43b184]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x43b184]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x41a377
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x41a30e
sub eax, 4
and eax, 0xfffffffb
jne 0x41a320
add dword [0x43b180], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x43b184]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x41a30e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
xor esi, esi
jmp 0x41a29e
mov eax, dword [0x43b184]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]

Function at 0x41a7d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x43b198
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x43b190]
sub esp, 4
test ebx, ebx
je 0x41a825
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41a81e
test esi, esi
je 0x41a81e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41a800
mov dword [esp], 0x43b198
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41aff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
movzx eax, byte [0x4317b8]
test al, al
je 0x41b050
test edi, edi
je 0x41b085
mov esi, dword [0x4319c0]
lea ecx, [ebx + edi]
xor eax, eax
lea esi, [esi]
add ebx, 1
movzx edx, byte [ebx - 1]
mov edi, eax
shr eax, 6
shl edi, 8
and eax, 0xff
or edx, edi
xor dx, word [esi + eax*2]
cmp ebx, ecx
mov eax, edx
jne 0x41b020
add esp, 0x1c
and ax, 0x3fff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x4317b8
call sym.___cxa_guard_acquire
test eax, eax
je 0x41b00a
movzx eax, byte [0x4317b0]
test al, al
je 0x41b08f
mov dword [esp], 0x4317b8
mov dword [0x4319c0], 0x4317c0
call sym.___cxa_guard_release
test edi, edi
jne 0x41b00e
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x4317b0
call sym.___cxa_guard_acquire
test eax, eax
je 0x41b06b
xor esi, esi
mov edx, esi
mov eax, esi
and dx, 0x81
cmp dx, 0x80
je 0x41b1f0
cmp dx, 1
je 0x41b1f0
mov edx, eax
and edx, 0x42
cmp dx, 0x40
je 0x41b1e0
cmp dx, 2
je 0x41b1e0
mov edx, eax
and edx, 0x24
cmp dx, 4
je 0x41b1d0
cmp dx, 0x20
je 0x41b1d0
mov edx, eax
mov ecx, eax
and edx, 0x18
xor ecx, 0x18
sub edx, 8
test dx, 0xfff0
cmove eax, ecx
mov edx, eax
mov ecx, eax
and edx, 2
and ecx, 4
test al, 1
movzx edx, dx
movzx ecx, cx
je 0x41b200
test edx, edx
je 0x41b273
test ecx, ecx
mov edx, 0x1d5c
jne 0x41b250
test al, 8
jne 0x41b218
lea ecx, [edx + edx]
nop
mov edx, ecx
xor dh, 0x20
test al, 0x10
cmovne ecx, edx
lea edx, [ecx + ecx]
mov ebp, edx
xor bp, 0x2757
and ch, 0x20
cmovne edx, ebp
mov ecx, edx
xor ch, 0x20
test al, 0x20
cmovne edx, ecx
lea ecx, [edx + edx]
mov ebp, ecx
xor bp, 0x2757
and dh, 0x20
cmovne ecx, ebp
mov edx, ecx
xor dh, 0x20
test al, 0x40
cmovne ecx, edx
lea edx, [ecx + ecx]
mov ebp, edx
xor bp, 0x2757
and ch, 0x20
cmovne edx, ebp
mov ecx, edx
xor ch, 0x20
test al, 0x80
cmovne edx, ecx
lea eax, [edx + edx]
and dh, 0x20
je 0x41b231
xor ax, 0x2757
mov word [esi + esi + 0x4317c0], ax
add esi, 1
cmp esi, 0x100
jne 0x41b0a1
mov dword [esp], 0x4317b0
call sym.___cxa_guard_release
jmp 0x41b06b
xor eax, 0x24
jmp 0x41b0f1
xor eax, 0x42
jmp 0x41b0d8
xor al, 0x81
jmp 0x41b0bf
test edx, edx
jne 0x41b260
xor edx, edx
test ecx, ecx
je 0x41b214
mov edx, 0x4000
xor dx, 0x2757
test al, 8
je 0x41b21b
xor dh, 0x20
lea ecx, [edx + edx]
and dh, 0x20
je 0x41b140
xor cx, 0x2757
jmp 0x41b140
mov word [esi + esi + 0x4317c0], ax
add esi, 1
cmp esi, 0x100
jne 0x41b0a1
jmp 0x41b1bf
test al, 8
mov ecx, 0xfffff416
je 0x41b227
mov edx, 0x7a0b
jmp 0x41b218
test ecx, ecx
mov edx, 0xffffceae
je 0x41b20f
mov edx, 0xffff8eae
jmp 0x41b133
test ecx, ecx
mov edx, 0xffffd3f2
je 0x41b20f
mov edx, 0xffff93f2
jmp 0x41b133
Function at 0x41b570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push section..data
push 0x430004
push 0x430010
push 0x43001c
push 0x430028
push 0x1a
mov ecx, dword [0x42725c]
push ecx
call fcn.004037c0
add esp, 0x20
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 1
jle 0x4010fa
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
push 0x430030
call fcn.00401d80
test eax, eax
jne 0x401084
mov dword [ebp - 0x10], 1
jmp 0x4010fa
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0x430040
call fcn.00401d80
test eax, eax
jne 0x4010a2
mov dword [ebp - 0x10], 2
jmp 0x4010fa
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
push 0x430054
call fcn.00401d80
test eax, eax
jne 0x4010c0
mov dword [ebp - 0x10], 3
jmp 0x4010fa
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
push 0x430060
call fcn.00401d80
test eax, eax
jne 0x4010de
mov dword [ebp - 0x10], 4
jmp 0x4010fa
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0x43006c
call fcn.00401d80
test eax, eax
jne 0x4010fa
mov dword [ebp - 0x10], 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 4
ja case.default.0x40111c
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x4011ac]
call fcn.00401890
mov dword [ebp - 0x14], eax
jmp 0x401176
call fcn.00401280
mov dword [ebp - 0x14], eax
jmp 0x401176
call fcn.004014e0
mov dword [ebp - 0x14], eax
jmp 0x401176
call fcn.004015d0
mov dword [ebp - 0x14], eax
jmp 0x401176
call fcn.00401730
mov dword [ebp - 0x14], eax
jmp 0x401176
mov eax, 1
test eax, eax
je 0x401176
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402d10
mov dword [ebp - 0x14], eax
push 0x430074
push 0x430078
push 0x430084
push 0x430090
push str.WinMain
push 0x4e
mov edx, dword [0x42725c]
push edx
call fcn.004037c0
add esp, 0x1c
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401280
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x430158
push 0x43015c
push 0x430168
push 0x430174
push 0x430180
push 0x79
mov eax, dword [0x42725c]
push eax
call fcn.004037c0
add esp, 0x1c
mov dword [ebp - 0x42c], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401313
push str.GetModuleFileName_failed
push 0x4301ac
push 0x4301b8
push 0x4301c4
push 0x4301d0
push 0x7d
mov edx, dword [0x427268]
push edx
call fcn.004037c0
add esp, 0x1c
mov eax, dword [ebp - 0x42c]
jmp 0x401488
push 0x4301e0
lea eax, [ebp - 0x218]
push eax
push str.__ls___ls
push 0x104
lea ecx, [ebp - 0x428]
push ecx
call fcn.004014a0
add esp, 0x14
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401388
push 0x4301fc
push 0x430214
push 0x430220
push 0x43022c
push 0x430238
push 0x8a
mov edx, dword [0x427268]
push edx
call fcn.004037c0
add esp, 0x1c
mov eax, dword [ebp - 0x42c]
jmp 0x401488
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x428]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x430248
push 0x430260
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x401445
mov dword [ebp - 8], str.WebPAM_PRO_seervice
lea edx, [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x401412
push str.ChangeServiceConfig2_failed
push 0x4302bc
push 0x4302c8
push 0x4302d4
push 0x4302e0
push 0xa7
mov ecx, dword [0x427268]
push ecx
call fcn.004037c0
add esp, 0x1c
call fcn.00402c90
mov edx, 1
test edx, edx
je 0x40142c
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00401650
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x42c], 1
jmp 0x401472
push str.CreateService_failed
push 0x430308
push 0x430314
push 0x430320
push str.service_install
push 0xb6
mov edx, dword [0x427268]
push edx
call fcn.004037c0
add esp, 0x1c
cmp dword [ebp - 4], 0
je 0x401482
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret

Function at 0x401580
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4015c2
push str.DeleteService_failed
push 0x430390
push 0x43039c
push 0x4303a8
push str._service_uninstall
push 0xe0
mov ecx, dword [0x427268]
push ecx
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x4015c7
mov eax, 1
pop ebp
ret 4
Function at 0x401650
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push eax
push 0x24
lea ecx, [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x4016a3
push 0x430400
push 0x43041c
push 0x430428
push 0x430434
push 0x430440
push 0x10a
mov eax, dword [0x427268]
push eax
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x401727
cmp dword [ebp - 0x20], 1
je 0x4016e0
cmp dword [ebp - 0x20], 3
je 0x4016e0
push str.Service_is_run__now.
push 0x430468
push 0x430474
push 0x430480
push 0x43048c
push 0x111
mov ecx, dword [0x427268]
push ecx
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x401727
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401722
push str.StartService_failed
push 0x4304b0
push 0x4304bc
push 0x4304c8
push str._service_start
push 0x11b
mov eax, dword [0x427268]
push eax
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x401727
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4017b0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push eax
push 0x24
lea ecx, [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x401803
push str.QueryServiceStatusEx_failed
push 0x430538
push 0x430544
push 0x430550
push 0x43055c
push 0x146
mov eax, dword [0x427268]
push eax
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x40188a
cmp dword [ebp - 0x20], 1
je 0x40180f
cmp dword [ebp - 0x20], 3
jne 0x401840
push str.Service_is_stop__now.
push 0x430584
push 0x430590
push 0x43059c
push 0x4305a8
push 0x14d
mov ecx, dword [0x427268]
push ecx
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x40188a
lea edx, [ebp - 0x24]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x401885
push str.ControlService_failed
push 0x4305d0
push 0x4305dc
push 0x4305e8
push str._service_stop
push 0x157
mov ecx, dword [0x427268]
push ecx
call fcn.004037c0
add esp, 0x1c
xor eax, eax
jmp 0x40188a
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x402810
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x245], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jne 0x402875
push str.CreateToolhelp32Snapshot_error_
push 0x430ee4
push 0x430ef0
push 0x430efc
push 0x430f10
push 0xcb
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
xor al, al
jmp 0x40297a
mov dword [ebp - 0x238], 0x22c
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jne 0x4028d7
push str.Process32First_error_
push 0x430f4c
push 0x430f58
push 0x430f64
push 0x430f78
push 0xd4
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
cmp dword [ebp - 0x244], 0
je 0x40292d
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401d80
test eax, eax
jne 0x402912
mov eax, dword [ebp - 0x230]
push eax
call fcn.00402990
mov byte [ebp - 0x245], al
mov dword [ebp - 0x23c], 1
jmp 0x40292d
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x244], eax
jmp 0x4028d7
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x23c], 0
jne 0x402974
mov ecx, dword [ebp + 8]
push ecx
push str.can_not_find__ls
push 0x430fb0
push 0x430fbc
push 0x430fc8
push str.undine_ExtFunc_KillProcessByName
push 0xe5
mov edx, dword [0x427264]
push edx
call fcn.004037c0
add esp, 0x20
mov al, byte [ebp - 0x245]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret 4

Function at 0x402990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [ebp - 5], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402a00
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4029c7
mov byte [ebp - 5], 1
jmp 0x4029f4
push str.TerminateProcess_failed
push 0x431018
push 0x431024
push 0x431030
push 0x431044
push 0xfa
mov edx, dword [0x427264]
push edx
call fcn.004037c0
add esp, 0x1c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402a2d
push str.OpenProcess_failed
push 0x431078
push 0x431084
push 0x431090
push str.undine_ExtFunc_KillProcessByID
push 0x100
mov ecx, dword [0x427264]
push ecx
call fcn.004037c0
add esp, 0x1c
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 4
Function at 0x403130
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403160
jmp case.0x4031df.1
push str.install
lea ecx, [ebp - 0x110]
push ecx
push 0x431464
lea edx, [ebp - 0x218]
push edx
call fcn.004073b0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x431470
push 0x431474
push 0x431480
push 0x43148c
push str.On_Button_Install_Click
push 0xe2
mov ecx, dword [0x42725c]
push ecx
call fcn.004037c0
add esp, 0x20
push 5
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xb
ja case.0x4031df.1
mov eax, dword [ebp - 0x21c]
movzx ecx, byte [eax + 0x403238]
jmp dword [ecx*4 + 0x403224]
push 0x4314b8
call fcn.004037a0
jmp case.0x4031df.1
push 0x43150c
call fcn.004037a0
jmp case.0x4031df.1
push 0x431540
call fcn.004037a0
jmp case.0x4031df.1
push 0x431598
call fcn.004037a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret

Function at 0x403250
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403280
jmp case.0x4032ff.1
push str.uninstall
lea ecx, [ebp - 0x110]
push ecx
push 0x4315dc
lea edx, [ebp - 0x218]
push edx
call fcn.004073b0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x4315e8
push 0x4315ec
push 0x4315f8
push 0x431604
push str.On_Button_Uninstall_Click
push 0xfe
mov ecx, dword [0x42725c]
push ecx
call fcn.004037c0
add esp, 0x20
push 5
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xb
ja case.0x4032ff.1
mov eax, dword [ebp - 0x21c]
movzx ecx, byte [eax + 0x403358]
jmp dword [ecx*4 + 0x403344]
push 0x431638
call fcn.004037a0
jmp case.0x4032ff.1
push 0x43168c
call fcn.004037a0
jmp case.0x4032ff.1
push 0x4316c0
call fcn.004037a0
jmp case.0x4032ff.1
push 0x431710
call fcn.004037a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret
Function at 0x403370
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4033a0
jmp case.0x40341f.1
push str.start
lea ecx, [ebp - 0x110]
push ecx
push 0x431754
lea edx, [ebp - 0x218]
push edx
call fcn.004073b0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x431760
push 0x431764
push 0x431770
push 0x43177c
push str.On_Button_Start_Click
push 0x11a
mov ecx, dword [0x42725c]
push ecx
call fcn.004037c0
add esp, 0x20
push 5
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xb
ja case.0x40341f.1
mov eax, dword [ebp - 0x21c]
movzx ecx, byte [eax + 0x403478]
jmp dword [ecx*4 + 0x403464]
push 0x4317a8
call fcn.004037a0
jmp case.0x40341f.1
push 0x4317fc
call fcn.004037a0
jmp case.0x40341f.1
push 0x431830
call fcn.004037a0
jmp case.0x40341f.1
push 0x431880
call fcn.004037a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret

Function at 0x403490
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4034c0
jmp case.0x40353f.1
push str.stop
lea ecx, [ebp - 0x110]
push ecx
push str.__s___ls
lea edx, [ebp - 0x218]
push edx
call fcn.004073b0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x4318d0
push 0x4318d4
push 0x4318e0
push str.undine_MenuForm.c
push str.On_Button_Stop_Click
push 0x136
mov ecx, dword [0x42725c]
push ecx
call fcn.004037c0
add esp, 0x20
push 5
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xb
ja case.0x40353f.1
mov eax, dword [ebp - 0x21c]
movzx ecx, byte [eax + 0x403598]
jmp dword [ecx*4 + 0x403584]
push str.The_system_is_out_of_memory_or_resources.
call fcn.004037a0
jmp case.0x40353f.1
push str.The_.exe_file_is_invalid
call fcn.004037a0
jmp case.0x40353f.1
push str.The_specified_file_was_not_found.
call fcn.004037a0
jmp case.0x40353f.1
push str.The_specified_path_was_not_found.
call fcn.004037a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret