joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428f50
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x435740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x468ca0]
push 0
push 0x435680
push 0
push 0x9b
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
jmp eax

Function at 0x429ed0
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4663e0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push str.Cleanup
push str.__s_
push 0x4676a0
xor eax, eax
mov esi, ecx
call fcn.0042cad0
mov ebx, 1
add dword [0x4676c0], ebx
add esp, 0xc
cmp byte [esi + 0xce4], 0
je 0x42a020
cmp dword [esi + 0xa34], 8
jb 0x429f2a
mov esi, dword [esi + 0xa20]
jmp 0x429f30
add esi, 0xa20
push edi
push esi
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00439323
add esp, 0xc
push str.UninstallSetup.exe
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x80
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
push str.Marking___s__for_deletion_on_reboot
push 0x4676a0
xor eax, eax
call fcn.0042cad0
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call edi
test eax, eax
je 0x42a051
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathIsSystemFolderW]
push 0
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x42a000
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x42a000
lea edx, [esp + 0x10]
push edx
push str.Marking___s__for_deletion_on_reboot
push 0x4676a0
call fcn.0042cad0
add esp, 0xc
push 4
push 0
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
jne 0x429fb0
sub dword [0x4676c0], 1
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0043782a
add esp, 0x20c
ret
push str.Cleanup_is_being_skipped
push 0x4676a0
xor eax, eax
call fcn.0042cad0
add esp, 8
sub dword [0x4676c0], ebx
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0043782a
add esp, 0x20c
ret
sub dword [0x4676c0], ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043782a
add esp, 0x20c
ret
Function at 0x42a490
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
sub esp, 0x39c
mov eax, dword [0x4663e0]
xor eax, esp
mov dword [esp + 0x398], eax
mov eax, dword [0x468b8c]
cmp dword [eax + 0xce0], 8
push esi
mov esi, ecx
jb 0x42a4bd
mov eax, dword [eax + 0xccc]
jmp 0x42a4c2
add eax, 0xccc
push eax
lea eax, [esp + 0x198]
push 0x104
push eax
call fcn.00439323
add esp, 0xc
push str._version.ini
lea ecx, [esp + 0x198]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x194]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42a562
lea eax, [esp + 0x194]
push eax
push 0xc8
lea ecx, [esp + 0xc]
push ecx
push 0
push str.PackVer
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a530
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
call fcn.00404160
mov al, 1
pop esi
mov ecx, dword [esp + 0x398]
xor ecx, esp
call fcn.0043782a
add esp, 0x39c
ret
mov ecx, dword [esp + 0x39c]
pop esi
xor ecx, esp
xor al, al
call fcn.0043782a
add esp, 0x39c
ret
Function at 0x42bf50
Capabilities:
Create process on windows
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x450db6
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x4663e0]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663e0]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xe4]
lea eax, [esp + 0x34]
push eax
call fcn.00402450
xor ebx, ebx
mov dword [esp + 0xdc], ebx
movzx eax, word [0x468c78]
cmp ax, 0x409
jne 0x42bfc0
push str._removdrv.txt
push ecx
push ebp
lea ecx, [esp + 0x48]
push ecx
jmp 0x42c035
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 3
lea edx, [esp + 0xc0]
push edx
movzx esi, ax
push 0x59
push esi
call edi
push 3
lea eax, [esp + 0xc8]
push eax
push 0x5a
push esi
call edi
push str._removdrv.txt
push ecx
lea ecx, [esp + 0xcc]
push ecx
push ecx
push 0x45d2e0
push ecx
lea edx, [esp + 0xd4]
push edx
push ecx
push 0x456b1c
push ecx
lea eax, [esp + 0x64]
push ebp
push eax
call fcn.00405010
add esp, 0xc
push eax
call fcn.00405010
add esp, 0xc
push eax
call fcn.00405010
add esp, 0xc
push eax
call fcn.00405010
add esp, 0xc
push eax
call fcn.00405010
add esp, 0xc
push eax
call fcn.00405010
add esp, 8
lea ecx, [esp + 0x18]
lea eax, [esp + 0x34]
call fcn.00402590
mov esi, 8
mov byte [esp + 0xdc], 1
cmp dword [eax + 0x18], esi
jb 0x42c06a
mov eax, dword [eax + 4]
jmp 0x42c06d
add eax, 4
push eax
push 0x45d2e4
push 0x4676a0
xor eax, eax
call fcn.0042cad0
add esp, 0xc
mov byte [esp + 0xdc], bl
cmp dword [esp + 0x30], esi
jb 0x42c09c
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00439059
add esp, 4
lea ecx, [esp + 0x18]
lea eax, [esp + 0x34]
call fcn.00402590
cmp dword [eax + 0x18], esi
jb 0x42c0b3
mov eax, dword [eax + 4]
jmp 0x42c0b6
add eax, 4
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x30], esi
jb 0x42c0da
mov edx, dword [esp + 0x1c]
push edx
call fcn.00439059
add esp, 4
lea ecx, [esp + 0x88]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov dword [esp + 0xdc], 0xffffffff
call fcn.004024f0
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.00436cf8
add esp, 4
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.0043782a
add esp, 0xcc
ret 4
Function at 0x42cad0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x1c], 8
mov esi, eax
jb 0x42cae5
mov eax, dword [edi + 8]
jmp 0x42cae8
lea eax, [edi + 8]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42cc4e
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, 1
jne 0x42cb25
mov esi, 0x45d6f4
jmp 0x42cb34
cmp esi, 2
mov esi, str._
je 0x42cb34
mov esi, 0x456938
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cb40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push esi
push ebp
call ebx
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cb70
sub eax, edx
mov edx, dword [edi + 0x20]
sar eax, 1
add edx, edx
test edx, edx
mov esi, eax
mov eax, 0x469368
jle 0x42cbaf
mov ecx, edx
shr ecx, 1
mov eax, 0x200020
mov edi, 0x469368
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x18]
lea eax, [edx*2 + 0x469368]
mov word [eax], 0
mov ecx, dword [edi + 0x20]
push 0
add ecx, ecx
lea eax, [esp + 0x14]
push eax
sub ecx, esi
add ecx, ecx
push ecx
push 0x469368
push ebp
call ebx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0043b4fe
mov esi, eax
add esi, 3
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437631
mov ecx, dword [esp + 0x28]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push esi
push edi
call fcn.0043b693
push 0x45d708
push esi
push edi
call fcn.0043938f
mov eax, edi
add esp, 0x28
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cc20
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push ebp
call ebx
push edi
call fcn.00439b7b
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x42cd60
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 8]
push eax
mov eax, dword [edx]
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
ret 4

Function at 0x42cd80
Capabilities:
Set registry value

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cd86
mov ecx, dword [esp + 0xc]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 8
Function at 0x42cdc0
Capabilities:
Set registry value

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cdc6
mov ecx, dword [esp + 0xc]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push 2
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
pop esi
ret 8

Function at 0x42ce00
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ce10
sub eax, edx
sar eax, 1
add eax, 1
push eax
call fcn.00437631
mov ebx, eax
movzx eax, word [esi]
add esp, 4
test ax, ax
je 0x42cea7
cmp ax, 0x61
jb 0x42ce47
cmp ax, 0x66
ja 0x42ce47
mov al, byte [esi]
sub al, 0x57
jmp 0x42ce5d
cmp ax, 0x41
jb 0x42ce59
cmp ax, 0x46
ja 0x42ce59
mov al, byte [esi]
sub al, 0x37
jmp 0x42ce5d
mov al, byte [esi]
sub al, 0x30
movzx ecx, word [esi + 2]
add esi, 2
shl al, 4
cmp cx, 0x61
jb 0x42ce7a
cmp cx, 0x66
ja 0x42ce7a
mov cl, byte [esi]
sub cl, 0x57
jmp 0x42ce94
cmp cx, 0x41
jb 0x42ce8f
cmp cx, 0x46
ja 0x42ce8f
mov dl, byte [esi]
sub dl, 0x37
or al, dl
jmp 0x42ce96
mov cl, byte [esi]
sub cl, 0x30
or al, cl
add esi, 2
mov byte [ebx + edi], al
movzx eax, word [esi]
add edi, 1
test ax, ax
jne 0x42ce35
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push edi
push ebx
push 3
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.00439b7b
add esp, 4
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
ret 8

Function at 0x42cee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax]
push 0
push 0
push edx
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
add eax, 1
pop ecx
ret 4

Function at 0x42cf10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp]
push esi
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push esi
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x42cf45
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.00437631
mov ecx, dword [ebp]
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
push 0
push 0
push esi
push ecx
call ebx
mov ebx, eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cf80
mov esi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00404160
push edi
call fcn.00439b7b
add esp, 4
pop edi
pop esi
xor eax, eax
test ebx, ebx
pop ebp
sete al
pop ebx
ret 8
Function at 0x42cfc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
mov edi, eax
mov ecx, dword [edi]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push str.InstallConfig
push ecx
mov dword [esp + 0x24], 0
call ebp
test eax, eax
je 0x42cff6
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 4
mov eax, dword [esp + 0xc]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437631
mov ecx, dword [edi]
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.InstallConfig
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
mov edi, eax
call fcn.00436040
add esp, 4
push esi
call fcn.00439b7b
add esp, 4
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
pop ebp
pop ecx
ret 4

Function at 0x42d140
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x214
mov eax, dword [0x4663e0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, dword [esp + 0x230]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push esi
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42d22f
lea edx, [esp + 0x10]
push edx
mov eax, edi
or eax, 0xf003f
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push esi
call ebx
test eax, eax
jne 0x42d22f
mov eax, dword [esp + 0x10]
push edi
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0042d140
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x100
jne 0x42d21b
mov eax, dword [0x468d44]
test eax, eax
jne 0x42d203
push str.RegDeleteKeyExW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call ebp
test eax, eax
mov dword [0x468d44], eax
je 0x42d214
push 0
push 0x100
lea edx, [esp + 0x20]
push edx
push esi
call eax
jmp 0x42d227
mov eax, 0x32
jmp 0x42d227
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x42d172
cmp eax, 0x103
pop edi
pop esi
pop ebp
pop ebx
jne 0x42d23c
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0043782a
add esp, 0x214
ret
Function at 0x42d830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x468ca0]
push edi
push str.LRCDATA
push str.LICENSE
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42d853
xor al, al
pop edi
ret 4
mov ecx, dword [0x468ca0]
push ebx
push ebp
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x468ca0]
push edi
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ebx, [esi + 2]
push ebx
mov ebp, eax
call fcn.00437631
push ebx
mov edi, eax
push 0
push edi
call fcn.00443300
push esi
push ebp
push edi
call fcn.0043d760
mov eax, edi
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d8a1
mov esi, dword [esp + 0x14]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00404160
push edi
call fcn.00439b7b
add esp, 4
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
ret 4
Function at 0x430320
Capabilities:
Check for peb beingdebugged flag
Create service
Modify service
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x450c08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663e0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov eax, edi
xor ebx, ebx
mov dword [esp + 0x44], ebp
xor esi, esi
lea edx, [eax + 2]
jmp 0x430370
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x430370
sub eax, edx
sar eax, 1
je 0x430423
push 0x2c
lea ecx, [esp + 0x2c]
call fcn.00436930
add esp, 4
lea ecx, [esp + 0x28]
xor esi, esi
call fcn.0040d0d0
test eax, eax
jbe 0x4303ed
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x4303c7
mov ecx, dword [esp + 0x30]
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x4303d0
call fcn.00439049
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + ebp + 0x14]
lea ecx, [esp + 0x28]
lea ebx, [ebx + eax + 1]
add esi, 1
add ebp, 0x1c
call fcn.0040d0d0
cmp esi, eax
jb 0x4303a6
xor ebp, ebp
add ebx, 1
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x1c], ebx
neg ecx
or ecx, eax
push ecx
call fcn.00437631
mov esi, eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x30]
call fcn.00436110
add esp, 8
mov edi, dword [esp + 0x4c]
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x430435
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x5c]
push ebp
push ebp
push esi
push ebp
mov ecx, eax
push ebp
and ecx, 0x10000000
xor edx, edx
cmp edx, ecx
mov edx, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x68]
push 1
sbb ecx, ecx
and eax, 0xefffffff
push eax
mov eax, dword [esp + 0x78]
push eax
mov eax, dword [edi]
neg ecx
push 0xf003f
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x7c]
push ecx
push edx
push eax
mov dword [edi + 4], ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebp
mov dword [edi + 4], eax
je 0x4304d2
mov ecx, dword [esp + 0x64]
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea edx, [esp + 0x20]
push edx
push 1
push eax
mov dword [esp + 0x2c], ecx
call ebx
test eax, eax
jne 0x4304b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
mov dword [esp + 0x18], eax
jne 0x4304dc
call fcn.00430be0
cmp eax, 0x6000100
jb 0x4304dc
cmp eax, 0xffffffff
ja 0x4304dc
mov ecx, dword [edi + 4]
lea eax, [esp + 0x24]
push eax
push 3
push ecx
call ebx
test eax, eax
jne 0x4304dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
cmp esi, ebp
je 0x4304e9
push esi
call fcn.00439b7b
add esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x43050f
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x30]
push edx
call fcn.00411400
mov eax, dword [esp + 0x30]
add esp, 4
push eax
call fcn.00439059
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x1c
Function at 0x430530
Capabilities:
Modify service

Disassembly:
push ecx
push esi
mov ecx, eax
and ecx, 0x10000000
xor esi, esi
xor edx, edx
cmp edx, ecx
mov edx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x18]
push esi
sbb ecx, ecx
push esi
neg ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [edi + 4]
push esi
push esi
push edx
push 0xffffffffffffffff
and eax, 0xefffffff
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x4305d0
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ebp
lea eax, [esp + 0x14]
push eax
push 1
push ecx
mov dword [esp + 0x20], edx
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4305a5
call ebp
mov esi, eax
test esi, esi
jne 0x4305dd
call fcn.00430be0
cmp eax, 0x6000100
jb 0x4305db
cmp eax, 0xffffffff
ja 0x4305db
mov eax, dword [edi + 4]
lea edx, [esp + 0xc]
push edx
push 3
push eax
call ebx
test eax, eax
jne 0x4305db
call ebp
pop ebp
pop ebx
pop esi
pop ecx
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ecx
ret 0x14
mov eax, esi
pop ebp
pop ebx
pop esi
pop ecx
ret 0x14

Function at 0x430610
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov eax, dword [ebx + 4]
sub esp, 0x1c
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edx, dword [ebx + 4]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4306e7
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esp + 0x10], 4
mov ebp, dword [esp + 0x20]
mov esi, eax
je 0x4306c3
nop
mov eax, 0xcccccccd
mul dword [esp + 0x24]
shr edx, 3
cmp edx, 0x3e8
jae 0x43066b
mov edx, 0x3e8
jmp 0x430678
cmp edx, 0x2710
jbe 0x430678
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4306bc
cmp dword [esp + 0x20], ebp
jbe 0x4306a2
call edi
mov ebp, dword [esp + 0x20]
mov esi, eax
jmp 0x4306ac
call edi
sub eax, esi
cmp eax, dword [esp + 0x24]
ja 0x4306bc
cmp dword [esp + 0x10], 4
jne 0x430650
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
cmp dword [esp + 0x10], 4
jne 0x4306cc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
pop ebp
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
ret
Function at 0x430700
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov ecx, dword [ebx + 4]
sub esp, 0x20
lea eax, [esp + 4]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x43071e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx + 4]
push ebp
push esi
push edi
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4307d8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esp + 0x14], 1
mov ebp, dword [esp + 0x24]
mov esi, eax
je 0x4307be
lea ecx, [ecx]
mov eax, 0xcccccccd
mul dword [esp + 0x28]
shr edx, 3
cmp edx, 0x3e8
jae 0x43076b
mov edx, 0x3e8
jmp 0x430778
cmp edx, 0x2710
jbe 0x430778
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4307b7
cmp dword [esp + 0x24], ebp
jbe 0x4307a2
call edi
mov ebp, dword [esp + 0x24]
mov esi, eax
jmp 0x4307ac
call edi
sub eax, esi
cmp eax, dword [esp + 0x28]
ja 0x4307b7
cmp dword [esp + 0x14], 1
jne 0x430750
xor eax, eax
jmp 0x4307de
cmp dword [esp + 0x14], 1
jne 0x4307c2
xor eax, eax
jmp 0x4307de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
jmp 0x4307de
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4308f0
cmp eax, 0x424
je 0x4308f0
push 0x45d850
push 0x4676a0
mov eax, 1
mov dword [esp + 0x14], 0
call fcn.0042cad0
mov ecx, dword [ebx + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call fcn.00437631
mov esi, eax
add esp, 4
test esi, esi
je 0x4308eb
mov ecx, dword [esp + 0xc]
mov edx, dword [ebx + 4]
lea eax, [esp + 0xc]
push eax
push ecx
push esi
push edx
call edi
test eax, eax
je 0x4308b9
mov eax, dword [esi + 0xc]
push eax
call fcn.004312e0
add esp, 4
cmp eax, 1
jne 0x430891
push str.Force_closing_the_service
push 0x4676a0
call fcn.0042cad0
mov ecx, dword [esi + 0xc]
push ecx
call fcn.00431320
add esp, 0xc
push esi
mov edi, eax
call fcn.00439b7b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20
ret
push str.Service_is_not_running
push 0x4676a0
xor eax, eax
call fcn.0042cad0
add esp, 8
push esi
xor edi, edi
call fcn.00439b7b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.Error_retrieving_service_configuration__0x_X_
push 0x4676a0
mov eax, 1
call fcn.0042cad0
add esp, 0xc
push esi
call fcn.00439b7b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20
ret
mov eax, 0xe
pop edi
pop esi
pop ebp
add esp, 0x20
ret