joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6613
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x18c
mov eax, 0x550727
call fcn.0053655e
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
cmp eax, 0x100
jne 0x4a6684
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
je 0x4a682c
push 0x10
call edi
test bx, ax
je 0x4a682c
cmp dword [esi + 8], 0x70
jne 0x4a682c
xor eax, eax
mov dword [ebp - 0x14], eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00402902
mov ecx, eax
call fcn.004a49ab
lea ecx, [ebp - 0x38]
call fcn.00410090
jmp 0x4a682c
cmp eax, 0x400
jbe 0x4a682c
cmp eax, 0x409
jne 0x4a6706
xor edi, edi
lea ecx, [ebp - 0xe8]
inc edi
push edi
push 3
call fcn.00404da4
lea eax, [ebp - 0xd8]
mov dword [ebp - 4], edi
push 0x571f48
push eax
call fcn.0040446a
pop ecx
pop ecx
lea eax, [ebp - 0xe8]
push eax
push str.MessageFilter::PreTranslateMessage
push 0x5f
push str.C:workprojects_rubilnik_srccoreCore.cpp
push edi
call fcn.00407c20
mov ecx, eax
call fcn.00412039
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00404fea
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
push dword [esi + 8]
call fcn.00403d03
mov ecx, eax
call fcn.004a5e4e
jmp 0x4a682c
cmp eax, 0x40b
jne 0x4a6729
cmp dword [esi + 8], 0
setne al
movzx eax, al
push eax
call fcn.00403d03
mov ecx, eax
call fcn.004a8469
jmp 0x4a682c
cmp eax, 0x40c
jne 0x4a6741
call fcn.00403d03
mov ecx, eax
call fcn.004a8406
jmp 0x4a682c
cmp eax, 0x40e
jne 0x4a67bc
xor edi, edi
lea ecx, [ebp - 0x198]
inc edi
push edi
push 3
call fcn.00404da4
lea eax, [ebp - 0x188]
mov dword [ebp - 4], 2
push str.PreTranslateMessage_:_WM_CONFIG_LOADED
push eax
call fcn.0040446a
pop ecx
pop ecx
lea eax, [ebp - 0x198]
push eax
push str.MessageFilter::PreTranslateMessage
push 0x6f
push str.C:workprojects_rubilnik_srccoreCore.cpp
push edi
call fcn.00407c20
mov ecx, eax
call fcn.00412039
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.00404fea
lea ecx, [ebp - 0x130]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
call fcn.00403d03
mov ecx, eax
call fcn.004a5f7f
jmp 0x4a682c
cmp eax, 0x410
jne 0x4a67d1
call fcn.00403d03
mov ecx, eax
call fcn.004a8bb8
jmp 0x4a682c
cmp eax, 0x411
jne 0x4a67e9
push dword [esi + 8]
call fcn.004214d0
mov ecx, eax
call fcn.004a94d6
jmp 0x4a682c
cmp eax, 0x413
jne 0x4a6801
push dword [esi + 8]
call fcn.004214d0
mov ecx, eax
call fcn.004a92ef
jmp 0x4a682c
cmp eax, 0x414
jne 0x4a6816
call fcn.00428f4c
mov ecx, eax
call fcn.004baba7
jmp 0x4a682c
cmp eax, 0x412
jne 0x4a682c
push dword [esi + 8]
call fcn.004214d0
mov ecx, eax
call fcn.004a93db
xor eax, eax
call fcn.00536508
ret 4
Function at 0x4a696f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x550765
call fcn.005365cc
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4a69ec
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4a69ec
call fcn.00405442
mov esi, eax
jmp 0x4a6ac3
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4a6a0f
call fcn.00405442
jmp 0x4a6ab6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x4a6a05
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4a6a3f
mov esi, 0x8007000e
jmp 0x4a6ab8
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004a5c3c
jmp 0x4a6a65
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x4a6a38
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4a6a05
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.004a6836
mov esi, eax
test edi, edi
je 0x4a6ac3
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4a6adc
lea ecx, [ebp - 0x418]
call fcn.00420b77
lea ecx, [ebp - 0x428]
call fcn.00404f98
mov eax, esi
call fcn.00536519
ret 0x10
Function at 0x4a7c96
Capabilities:
Get common file path

Disassembly:
push 0x2d0
mov eax, 0x550939
call fcn.0053655e
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
xor eax, eax
mov dword [ebp - 0x2dc], ebx
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x565fa4
lea ecx, [ebp - 0x2d8]
push esi
call fcn.00401cd4
mov edi, eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c0]
push esi
call fcn.00401cd4
mov esi, eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00401cd4
push 0x55a440
push eax
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 2
push eax
call fcn.004030d5
push esi
push eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
push eax
call fcn.004045e5
push 0x55a440
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 4
push eax
call fcn.004030d5
push edi
push eax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 5
push eax
call fcn.004045e5
push str..exe
push eax
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 6
push eax
call fcn.004030d5
add esp, 0x3c
lea ecx, [ebp - 0x248]
call fcn.0040257a
lea ecx, [ebp - 0x260]
call fcn.0040257a
lea ecx, [ebp - 0x278]
call fcn.0040257a
lea ecx, [ebp - 0x290]
call fcn.0040257a
lea ecx, [ebp - 0x2a8]
call fcn.0040257a
lea ecx, [ebp - 0x2c0]
call fcn.0040257a
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0xe
call fcn.0040257a
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0040a686
lea ecx, [ebp - 0x230]
call fcn.0040257a
mov eax, ebx
call fcn.00536508
ret

Function at 0x4a90f2
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x550c90
call fcn.0053655e
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
cmp dword [eax + 0xb4], 2
jne 0x4a9196
lea eax, [ebp - 0x28]
push eax
call fcn.004028c7
mov ecx, eax
call fcn.00452c5a
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x4a9145
cmp dword [esi + 0x14], 8
jb 0x4a9132
mov esi, dword [esi]
push 5
push ebx
push ebx
push esi
push 0x55a570
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4a918c
push esi
lea eax, [ebp - 0x40]
push 0x55a6d0
push eax
call fcn.0040469f
add esp, 0xc
cmp dword [eax + 0x14], 8
mov ecx, eax
mov byte [ebp - 4], 1
jb 0x4a9165
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403bb9
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.0040257a
push ebx
push ebx
lea eax, [ebp - 0x28]
push 5
push eax
call fcn.00408992
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040257a
jmp 0x4a91b1
cmp dword [esi + 0x14], 8
jb 0x4a919e
mov esi, dword [esi]
push 5
xor ebx, ebx
push ebx
push ebx
push esi
push 0x55a570
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00536508
ret 4

Function at 0x4a994c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x10], 0
push esi
je 0x4a997f
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push dword [esi]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a997f
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov al, 1
jmp 0x4a9981
xor al, al
pop esi
leave
ret 8
Function at 0x4a9986
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x10], 0
je 0x4a99b1
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a99b1
mov al, 1
jmp 0x4a99b3
xor al, al
leave
ret 8

Function at 0x4a9bf2
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550df1
mov eax, dword fs:[0]
push eax
mov eax, 0x20d0
call fcn.00536760
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp byte [esi + 0x11], 0
je 0x4a9cde
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x4a9cde
cmp dword [esi + 0xc], edi
je 0x4a9ce8
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0x2000
push eax
lea eax, [ebp - 0x2010]
mov ecx, esi
push eax
call fcn.004a994c
test al, al
je 0x4a9cd3
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2028]
call fcn.00401ca5
push edi
push dword [ebp - 0x202c]
lea ecx, [ebp - 0x2028]
mov dword [ebp - 4], edi
call fcn.0040847e
cmp dword [esi + 0x14], edi
je 0x4a9cb5
sub esp, 0x18
lea eax, [ebp - 0x2028]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004068e7
call dword [esi + 0x14]
add esp, 0x18
lea eax, [ebp - 0x2028]
push eax
lea ecx, [esi + 0x18]
call fcn.004a9b8c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
call fcn.00402554
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x10], 0
jne 0x4a9c40
cmp byte [esi + 0x11], 0
je 0x4a9cf7
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor esi, esi
lea ecx, [ebp - 0x20dc]
inc esi
push esi
push 3
call fcn.00404da4
lea eax, [ebp - 0x20cc]
mov dword [ebp - 4], esi
push str.Exit_work_loop.
push eax
call fcn.0040446a
pop ecx
pop ecx
lea eax, [ebp - 0x20dc]
push eax
push str.DataReceiver::run
push 0x7d
push 0x572a88
push esi
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x2074]
call fcn.00404fea
lea ecx, [ebp - 0x2074]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005364e2
leave
ret
Function at 0x4a9d6e
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x4a9d92
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [esi + 0x10], 0
je 0x4a9e00
push ebx
cmp dword [esi + 0xc], 0
je 0x4a9dff
jmp 0x4a9de8
lea ecx, [esi + 0x14]
call fcn.004a9b21
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x1c]
and dword [ebp - 8], 0
push eax
call fcn.004068e7
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push dword [ebp - 0xc]
cmovae eax, dword [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004a9986
lea ecx, [esi + 0x14]
call fcn.004a9b66
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1c]
call fcn.00402554
cmp dword [esi + 0x24], 0
jne 0x4a9da1
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x10], 0
jne 0x4a9d99
pop ebx
cmp byte [esi + 0x11], 0
je 0x4a9e0f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005364e2
leave
ret
Function at 0x4aa5bc
Capabilities:
Persist via run registry key

Disassembly:
push 0x128
mov eax, 0x550fa5
call fcn.0053655e
mov edi, ecx
cmp byte [ebp + 0xc], 0
je 0x4aa5e0
call fcn.004aa7d3
test al, al
je 0x4aa7cb
mov ecx, edi
call fcn.004aa321
mov ecx, edi
call fcn.004aa826
mov bh, byte [ebp + 8]
test bh, bh
je 0x4aa603
mov ecx, edi
call fcn.004aa8ae
mov ecx, edi
call fcn.004aac3d
lea ecx, [ebp - 0x84]
call fcn.0049238e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0x565fa4
call fcn.00401cd4
mov esi, eax
push str.SOFTWARE_
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401cd4
push esi
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.004045e5
add esp, 0xc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.00492d9c
lea ecx, [ebp - 0x58]
mov bl, al
call fcn.0040257a
lea ecx, [ebp - 0x40]
call fcn.0040257a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040257a
test bl, bl
je 0x4aa6b1
movzx esi, bh
lea ecx, [ebp - 0x28]
xor esi, 1
push str.runmode
add esi, 2
call fcn.00401cd4
push esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x84]
call fcn.00494e04
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0040257a
call fcn.00407c5b
cmp dword [eax + 4], 0
jne 0x4aa7be
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.004aaf66
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.00401cd4
push 0xf003f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.00494263
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
mov bl, al
call fcn.0040257a
test bl, bl
je 0x4aa758
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x58]
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.00403913
push 0x565fa4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.00401cd4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x84]
call fcn.00495002
lea ecx, [ebp - 0x40]
call fcn.0040257a
lea ecx, [ebp - 0x28]
call fcn.0040257a
jmp 0x4aa7b6
push 1
push 3
lea ecx, [ebp - 0x134]
call fcn.00404da4
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 9
push str.Run_registry_FAILED
push eax
call fcn.0040446a
pop ecx
pop ecx
lea eax, [ebp - 0x134]
push eax
push str.Installer::create
push 0x4a
push str.C:workprojects_rubilnik_srccoreInstaller.cpp
push 0
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0xcc]
call fcn.00404fea
lea ecx, [ebp - 0xcc]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x58]
call fcn.0040257a
lea ecx, [ebp - 0x84]
call fcn.004923c4
mov al, 1
call fcn.00536508
ret 8
Function at 0x4ae56e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x38
mov eax, 0x551d95
call fcn.0053655e
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push esi
call fcn.0040a686
lea eax, [ebp - 0x34]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0040d971
or dword [ebp - 4], 0xffffffff
mov bl, al
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00403ae4
lea ecx, [ebp - 0x34]
call fcn.0040257a
test bl, bl
jne 0x4ae5b6
xor al, al
jmp 0x4ae67f
push esi
lea ecx, [ebp - 0x34]
call fcn.0040a686
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 1
push eax
call fcn.0040d820
pop ecx
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00403ae4
lea ecx, [ebp - 0x34]
call fcn.0040257a
test bl, bl
jne 0x4ae5af
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
jb 0x4ae5f6
mov eax, dword [esi]
push edi
push edi
push 0x80
push 3
push 1
push SysReAllocString
push eax
lea ecx, [ebp - 0x3c]
call fcn.00405781
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4ae655
lea eax, [ebp - 0x44]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x3c]
movlpd qword [ebp - 0x44], xmm0
call fcn.0040c491
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4ae639
push eax
call edi
xor eax, eax
cmp dword [ebp - 0x40], 0
ja 0x4ae645
cmp dword [ebp - 0x44], 1
jbe 0x4ae658
test eax, eax
je 0x4ae5af
push eax
call edi
jmp 0x4ae5af
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4ae65f
push eax
call edi
cmp dword [esi + 0x14], 8
jb 0x4ae667
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ae5af
test eax, 0x11111
setne al
call fcn.00536508
ret 4
Function at 0x4b0ce1
Capabilities:
Start service

Disassembly:
push 0x100
mov eax, 0x5525d1
call fcn.0053655e
lea eax, [ebp - 0x5c]
push eax
call fcn.004b0af8
mov esi, dword [ebp - 0x5c]
xor edi, edi
mov dword [ebp - 4], edi
test esi, esi
je 0x4b0d16
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4b0df0
push str.net_start
lea ecx, [ebp - 0x58]
call fcn.00401cd4
push dword [0x5f83f0]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004030d5
add esp, 0xc
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0040257a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00401cd4
push edi
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push edi
push eax
call fcn.00408992
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.0040257a
push 1
push 3
lea ecx, [ebp - 0x10c]
call fcn.00404da4
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xfc]
push str.StartService__error
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea eax, [ebp - 0x10c]
push eax
push str.ServiceApp::start
push 0x16e
push str.C:workprojects_rubilnik_srccoreService.cpp
push edi
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0xa4]
call fcn.00404fea
lea ecx, [ebp - 0xa4]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x28]
call fcn.0040257a
test esi, esi
je 0x4b0dfb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.00536508
ret

Function at 0x4b0e01
Capabilities:
Stop service

Disassembly:
push 0xb4
mov eax, 0x552588
call fcn.0053652a
lea eax, [ebp - 0x10]
push eax
call fcn.004b0af8
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x4b0eae
push 0x601c84
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4b0ea5
push 1
push 3
lea ecx, [ebp - 0xc0]
call fcn.00404da4
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xb0]
push str.ControlService__error
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea eax, [ebp - 0xc0]
push eax
push str.ServiceApp::stop
push 0x177
push str.C:workprojects_rubilnik_srccoreService.cpp
push 0
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x58]
call fcn.00404fea
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.005364f3
ret
Function at 0x4b4c54
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x4b4c8b
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
ret

Function at 0x4b4c79
Capabilities:
Terminate thread

Disassembly:
cmp dword [ecx + 4], 0
je 0x4b4c8a
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret

Function at 0x4ba449
Capabilities:
Create directory

Disassembly:
push 0x178
mov eax, 0x554009
call fcn.0053655e
mov esi, ecx
lea ecx, [ebp - 0x184]
call fcn.0040faf6
and dword [ebp - 4], 0
lea eax, [esi + 0x140]
push eax
lea ecx, [ebp - 0xa4]
call fcn.0041e881
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x184]
call fcn.0041105f
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0041e9d7
test bl, bl
je 0x4ba582
lea ecx, [ebp - 0x184]
call fcn.00411121
test al, al
je 0x4ba582
lea eax, [esi + 0x118]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040a686
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x184]
call fcn.004113b3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
mov bl, al
call fcn.00403ae4
lea ecx, [ebp - 0x34]
call fcn.0040257a
test bl, bl
je 0x4ba582
push str.clnz
lea ecx, [ebp - 0x4c]
call fcn.00401cd4
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00406d34
pop ecx
pop ecx
lea edi, [esi + 0x158]
push eax
mov ecx, edi
call fcn.004035f6
lea ecx, [ebp - 0x28]
call fcn.0040257a
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.0040257a
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4ba549
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esi + 0x118]
push edi
push eax
call fcn.00408cb8
pop ecx
pop ecx
test al, al
je 0x4ba582
mov byte [esi + 0x13c], 1
cmp dword [esi + 0x114], 0
je 0x4ba598
push 1
lea ecx, [esi + 0xf0]
call fcn.0040fdbe
cmp dword [esi + 0x114], 0
je 0x4ba598
push 0
lea ecx, [esi + 0xf0]
call fcn.0040fdbe
lea ecx, [ebp - 0x184]
call fcn.0040fc71
call fcn.00536508
ret
Function at 0x4beff6
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554da8
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00536760
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x4bf038
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x4bf10b
cmp esi, 0xffffffff
je 0x4bf10b
lea eax, [ebp - 0x2024]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2028], edi
cmp edi, 0xffffffff
je 0x4bf10b
mov eax, dword [ebp - 0x2024]
mov edi, ebx
mov dword [ebp - 0x2020], eax
mov dword [ebp - 0x2014], ebx
push ebx
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bf0e5
cmp dword [ebp - 0x2014], ebx
je 0x4bf0e5
push dword [ebp - 0x2014]
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp + 0xc]
call fcn.004bec63
add edi, dword [ebp - 0x2014]
cmp dword [ebp - 0x2014], ebx
ja 0x4bf09b
push esi
mov dword [ebp - 0x2018], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x201c]
cmp edi, dword [ebp - 0x2018]
jne 0x4bf10b
cmp dword [ebp - 0x2020], ebx
jne 0x4bf10b
xor ebx, ebx
inc ebx
lea ecx, [ebp + 0xc]
call fcn.00410090
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005364e2
leave
ret 0x2c
Function at 0x4c7b34
Capabilities:
Reference sql statements

Disassembly:
push 0x6c
mov eax, 0x5565ff
call fcn.0053655e
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x68]
mov edi, dword [ebp + 0xc]
call fcn.004e3b5a
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004043f8
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
lea eax, [ebp - 0x58]
inc ebx
push str.SELECT__FROM_scan_WHERE_name
push eax
mov byte [ebp - 4], bl
call fcn.00456f08
push 0x569998
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.00456e7b
add esp, 0x20
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004e3bef
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.004e3b74
lea ecx, [ebp - 0x78]
call fcn.004e3b6f
lea ecx, [ebp - 0x40]
call fcn.00402554
lea ecx, [ebp - 0x58]
call fcn.00402554
lea ecx, [ebp - 0x28]
call fcn.00402554
cmp byte [ebp - 0x60], 0
jne 0x4c7bd3
cmp dword [ebp - 0x64], 0
jne 0x4c7bd5
xor bl, bl
lea ecx, [ebp - 0x68]
call fcn.004e3b6f
mov al, bl
call fcn.00536508
ret 8