joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc0f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409746
and dword [ebp - 4], 0
cmp dword [0x45dfd0], 0
mov ebx, eax
jne 0x40bcc0
push 0x40241c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bd71
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402410
push edi
call esi
test eax, eax
je 0x40bd71
push eax
call fcn.004096d4
mov dword [esp], 0x402400
push edi
mov dword [0x45dfd0], eax
call esi
push eax
call fcn.004096d4
mov dword [esp], 0x4023ec
push edi
mov dword [0x45dfd4], eax
call esi
push eax
call fcn.004096d4
mov dword [esp], 0x4023d0
push edi
mov dword [0x45dfd8], eax
call esi
push eax
call fcn.004096d4
pop ecx
mov dword [0x45dfe0], eax
test eax, eax
je 0x40bcc0
push 0x4023b8
push edi
call esi
push eax
call fcn.004096d4
pop ecx
mov dword [0x45dfdc], eax
mov eax, dword [0x45dfdc]
cmp eax, ebx
je 0x40bd18
cmp dword [0x45dfe0], ebx
je 0x40bd18
push eax
call fcn.0040974f
push dword [0x45dfe0]
mov esi, eax
call fcn.0040974f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bd18
test edi, edi
je 0x40bd18
call esi
test eax, eax
je 0x40bd0f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bd0f
test byte [ebp - 0xc], 1
jne 0x40bd18
or dword [ebp + 0x10], 0x200000
jmp 0x40bd51
mov eax, dword [0x45dfd4]
cmp eax, ebx
je 0x40bd51
push eax
call fcn.0040974f
pop ecx
test eax, eax
je 0x40bd51
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bd51
mov eax, dword [0x45dfd8]
cmp eax, ebx
je 0x40bd51
push eax
call fcn.0040974f
pop ecx
test eax, eax
je 0x40bd51
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45dfd0]
call fcn.0040974f
pop ecx
test eax, eax
je 0x40bd71
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bd73
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d8b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x415579
call fcn.00414060
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00413b24
and dword [ebp - 4], 0
and dword [esi + 8], 0
lea eax, [esi + 0xc]
push eax
mov dword [esi], 0x417870
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.00402551
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402551
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x3c], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402e00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4155ac
call fcn.00414060
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x417870
mov ecx, dword [esi + 8]
test ecx, ecx
mov dword [ebp - 4], 3
je 0x402e2b
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402cbd
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.00402cbd
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00413b31
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4093d8
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x415ac1
call fcn.00414060
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0x10
mov dword [ebp - 0x18], ecx
lea ebx, [esi + 4]
jb 0x4093fa
mov eax, dword [ebx]
jmp 0x4093fc
mov eax, ebx
lea ecx, [ebp - 0x4c]
push ecx
push eax
call dword [sym.imp.MSVCR71.dll__stat]
test eax, eax
pop ecx
pop ecx
jne 0x409430
cmp dword [esi + 0x18], 0x10
jb 0x409417
mov eax, dword [ebx]
jmp 0x409419
mov eax, ebx
push 0x418838
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
xor esi, esi
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
jne 0x409434
xor al, al
jmp 0x4094ac
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
push edi
inc eax
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a1bc
cmp dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], esi
jbe 0x40947d
test edi, edi
jne 0x409458
xor eax, eax
jmp 0x40945d
mov eax, dword [ebp - 0x20]
sub eax, edi
push dword [ebp - 0x10]
sub eax, esi
push eax
lea ecx, [edi + esi]
push 1
push ecx
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
test eax, eax
je 0x4094bc
add esi, eax
cmp esi, dword [ebp - 0x14]
jb 0x409450
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR71.dll_fclose]
lea eax, [edi + esi]
mov byte [eax], 0
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0040910b
test eax, eax
jne 0x40948f
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00408e68
mov al, bl
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
mov eax, dword [ebp - 0x10]
test byte [eax + 0xc], 0x20
je 0x40947d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x4094d2
mov esi, dword [ebx]
jmp 0x4094d4
mov esi, ebx
call dword [sym.imp.MSVCR71.dll__errno]
push dword [eax]
call dword [sym.imp.MSVCR71.dll_strerror]
push eax
push esi
push str.Failed_to_read_file__s:__s_n
call fcn.004112c3
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x14
xor bl, bl
jmp 0x4094a1
Function at 0x40b307
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x415c13
call fcn.00414060
sub esp, 0x24
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20]
call fcn.0040a1bc
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
cmp dword [ebx + 0x18], 0x10
lea edi, [ebx + 4]
jb 0x40b33d
mov eax, dword [edi]
jmp 0x40b33f
mov eax, edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x40b3c2
cmp eax, esi
jae 0x40b3c2
push esi
lea ecx, [ebp - 0x30]
call fcn.0040a1bc
mov edi, dword [ebp - 0x2c]
test edi, edi
mov esi, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jne 0x40b371
xor eax, eax
jmp 0x40b375
mov eax, esi
sub eax, edi
push eax
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x40b391
test edi, edi
je 0x40b391
sub esi, edi
cmp eax, esi
jae 0x40b391
push edi
jmp 0x40b3b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40b3ad
push eax
push dword [ebp - 0x1c]
push str.Unable_to_get_long_path_name_for___s_:_GetLongPathName_failed__error__d__n
call fcn.0041100f
add esp, 0xc
push dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
call fcn.004014ff
lea ecx, [ebp - 0x30]
call fcn.00408e68
jmp 0x40b3e8
cmp dword [ebx + 0x18], 0x10
jb 0x40b3ca
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x419728
call fcn.0041100f
mov ecx, dword [ebp + 8]
add esp, 0xc
push ebx
call fcn.00401452
lea ecx, [ebp - 0x20]
call fcn.00408e68
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40b943
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x415c97
call fcn.00414060
sub esp, 0x30
mov eax, dword [0x422a68]
push ebx
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
xor ebx, ebx
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x40b9a1
call edi
cmp eax, 0x3f0
jne 0x40b99a
lea eax, [ebp - 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40b9a1
xor al, al
jmp 0x40ba81
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
push 0x400
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040a1bc
mov byte [ebp - 4], 1
push esi
mov esi, dword [ebp - 0x38]
cmp esi, ebx
mov dword [ebp - 0x28], ebx
jne 0x40b9ca
xor eax, eax
jmp 0x40b9cf
mov eax, dword [ebp - 0x34]
sub eax, esi
lea ecx, [ebp - 0x28]
push ecx
push eax
push esi
push 2
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40ba01
call edi
cmp eax, 0x7a
jne 0x40ba6a
lea ecx, [ebp - 0x3c]
call fcn.00408e68
push ebx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3c]
call fcn.0040ba97
jmp 0x40b9bc
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40ba6a
xor edi, edi
cmp dword [esi], ebx
mov byte [ebp - 0x19], bl
jbe 0x40ba5e
lea ebx, [esi + 4]
push dword [ebp - 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40ba5a
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x40ba41
jmp 0x40ba5e
mov byte [ebp - 0x19], 1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov bl, byte [ebp - 0x19]
lea ecx, [ebp - 0x3c]
call fcn.00408e68
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040ad4d
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00414165
leave
ret
Function at 0x40f240
Capabilities:
Get memory capacity

Disassembly:
cmp dword [0x422cd0], 0
jne 0x40f25c
cmp dword [0x422cc8], 0
jne 0x40f257
jmp fcn.0040f0b2
jmp fcn.0040effa
jmp fcn.0040f12c

Function at 0x40f877
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0xc], ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40f8d3
cmp eax, ebx
je 0x40f8d3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0x10
jb 0x40f8bc
mov ecx, dword [ecx + 8]
jmp 0x40f8bf
add ecx, 8
push eax
push ecx
push str.File_seek_error___s_:_error__d_n
call fcn.0041100f
add esp, 0xc
jmp 0x40f978
mov edx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, ebx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edx
jne 0x40f8ef
xor eax, eax
jmp 0x40f8f4
mov eax, dword [esi + 8]
sub eax, ecx
cmp edx, ebx
ja 0x40f8fc
cmp edi, ebx
jbe 0x40f976
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
cmp byte [0x422d78], bl
je 0x40f90f
call fcn.0040eb15
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00410f3f
mov eax, dword [eax]
pop ecx
pop ecx
mov ecx, dword [esi + 4]
push ebx
lea edx, [ebp + 0x18]
push edx
push eax
push ecx
push dword [ebp + 0xc]
mov dword [ebp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f950
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x40f976
sub dword [ebp - 8], eax
sbb dword [ebp - 4], ebx
jne 0x40f902
cmp dword [ebp - 8], ebx
ja 0x40f902
jmp 0x40f976
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0x10
jb 0x40f964
mov ecx, dword [ecx + 8]
jmp 0x40f967
add ecx, 8
push eax
push ecx
push str.File_read_error___s_:_error__d_n
call fcn.0041100f
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fa83
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x415feb
call fcn.00414060
sub esp, 0x1b8
mov eax, dword [0x422a68]
push ebx
push 0x5c
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18c]
push eax
call fcn.00409058
push 0x41bac4
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00409d5e
add esp, 0x18
push ebx
push 1
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 2
call fcn.004010eb
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40fae2
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x16c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x170], eax
jne 0x40fb0b
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004010eb
jmp 0x40fbd8
push esi
push edi
cmp byte [ebp + 0xc], bl
je 0x40fba4
test byte [ebp - 0x16c], 0x10
je 0x40fba4
push 2
mov edi, 0x41bac8
lea esi, [ebp - 0x140]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40fba4
push 3
mov edi, 0x41bacc
lea esi, [ebp - 0x140]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40fba4
push 0x5c
push dword [ebp + 8]
lea eax, [ebp - 0x1a8]
push eax
call fcn.00409058
lea ecx, [ebp - 0x140]
push ecx
push eax
lea eax, [ebp - 0x1c4]
push eax
mov byte [ebp - 4], 3
call fcn.00409d5e
push dword [ebp + 0xc]
mov byte [ebp - 4], 4
push eax
call fcn.0040fa83
add esp, 0x20
push ebx
push 1
lea ecx, [ebp - 0x1c4]
call fcn.004010eb
push ebx
push 1
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 2
call fcn.004010eb
lea eax, [ebp - 0x16c]
push eax
push dword [ebp - 0x170]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fb0d
push dword [ebp - 0x170]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004010eb
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00414165
leave
ret
Function at 0x41106b
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
sub eax, ebx
push esi
push edi
je 0x411087
dec eax
je 0x411083
dec eax
jne 0x41108c
push 4
pop esi
jmp 0x41108f
push 2
jmp 0x411080
xor esi, esi
inc esi
jmp 0x41108f
mov esi, dword [ebp - 4]
push 0x41c5c8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, ebx
jne 0x4110b5
mov byte [0x422ded], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_report_messages_to_system_event_log:_RegisterEventSource_failed__error__d__n
jmp 0x41111d
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 1
push ebx
push 0x40000001
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x411104
call esi
cmp eax, 0x5de
mov byte [0x422ded], bl
jne 0x4110f7
push str.Unable_to_report_messages_to_system_event_log:_event_log_is_full_n
call fcn.0041100f
jmp 0x411103
push eax
push str.Unable_to_report_messages_to_system_event_log:_ReportEvent_failed__error__d__n
call fcn.0041100f
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test eax, eax
jne 0x411124
mov byte [0x422ded], bl
call esi
push eax
push str.Unable_to_report_messages_to_system_event_log:_DeregisterEventSource_failed__error__d__n
call fcn.0041100f
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411388
Capabilities:
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x41625a
call fcn.00414060
sub esp, 0x30
mov eax, dword [0x422a68]
push esi
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
xor edi, edi
push edi
push 0x20006
push edi
push edi
push edi
mov esi, str.SYSTEMCurrentControlSetServicesEventLogApplicationJavaQuickStarterService
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
je 0x4113db
push eax
push esi
push str.Unable_to_initialize_event_logging:_Could_not_create_the_registry_key_HKEY_LOCAL_MACHINE_s._Error__d_n
call fcn.0041100f
add esp, 0xc
jmp 0x411470
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0040b295
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jae 0x411400
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc ecx
push ecx
push eax
push 2
push edi
push str.EventMessageFile
push dword [ebp - 0x34]
call esi
cmp eax, edi
je 0x411425
push eax
push str.Unable_to_initialize_event_logging:_Could_not_set_the_event_message_file._Error__d_n
jmp 0x411449
push 4
lea eax, [ebp - 0x38]
push eax
push 4
push edi
push str.TypesSupported
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 7
call esi
cmp eax, edi
je 0x411452
push eax
push str.Unable_to_initialize_event_logging:_Could_not_set_the_supported_types._Error__d_n
call fcn.0041100f
pop ecx
pop ecx
jmp 0x411459
mov byte [0x422ded], 1
push edi
lea ecx, [ebp - 0x2c]
push 1
call fcn.004010eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00411545
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.00414165
leave
ret

Function at 0x411486
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x41626c
call fcn.00414060
push ecx
push ecx
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push 0x41c36c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4114de
cmp eax, 2
jne 0x4114cc
push 0x41c3a4
push 0x41c3dc
push 4
call fcn.00411322
add esp, 0xc
jmp 0x411539
push eax
push 0x41c410
push 0x41c448
call fcn.0041100f
jmp 0x4114c7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x41c48c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x41152d
cmp eax, 2
jne 0x411515
push 0x41c4a4
push 0x41c4bc
push 0x41c4f4
push 4
call fcn.00411322
jmp 0x41152a
push eax
push 0x41c52c
push str.SYSTEMCurrentControlSetServicesEventLogApplication
push 0x41c580
call fcn.0041100f
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411545
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x41189f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4162ee
call fcn.00414060
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], eax
call fcn.00404019
xor ebx, ebx
push 0x16
pop ecx
xor eax, eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea edi, [esi + 0x30]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
call fcn.0040b0e2
mov dword [esi + 0x88], eax
call fcn.0040b0e2
shl eax, 4
lea ecx, [esi + 0x94]
mov dword [esi + 0x8c], eax
mov byte [esi + 0x90], bl
mov byte [esi + 0x91], bl
call fcn.00404019
lea eax, [esi + 0xb0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xc0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [esi + 0xd0], bl
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x412207
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x416324
call fcn.00414060
push ecx
push ecx
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push dword [0x4229a0]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412262
cmp eax, 2
jne 0x41224f
push dword [0x4229a0]
push str.Registry_key_HKEY_LOCAL_MACHINE_s_does_not_exist_n
push 4
call fcn.00411322
add esp, 0xc
jmp 0x4122bf
push eax
push dword [0x4229a0]
push str.Could_not_open_the_registry_key_HKEY_LOCAL_MACHINE_s._Error__d_n
call fcn.0041100f
jmp 0x41224a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x41d13c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4122b3
cmp eax, 2
jne 0x41229a
push 0x41d148
push dword [0x4229a0]
push str.Registry_value_HKEY_LOCAL_MACHINE_s_s_does_not_exist_n
push 4
call fcn.00411322
jmp 0x4122b0
push eax
push str.jqs_sun.com
push dword [0x4229a0]
push str.Could_not_delete_the_registry_value_HKEY_LOCAL_MACHINE_s_s._Error__d_n
call fcn.0041100f
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411545
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4122cb
Capabilities:
Modify service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 2
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x412312
cmp byte [ebp + 8], 0
mov esi, 0x41d494
jne 0x4122f6
mov esi, 0x41d49c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Unable_to__s_service:_OpenSCManager_failed__error__d__n
call fcn.004112c3
add esp, 0xc
xor al, al
jmp 0x41244b
push ebx
push 0xf01ff
push 0x41d4dc
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 4], ebx
jne 0x412367
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x41234d
push 0x41d4f4
push 0x41d508
call fcn.004112c3
pop ecx
pop ecx
jmp 0x412360
push eax
push 0x41d524
push str.Unable_to_open__s_service:_OpenService_failed__error__d__n
call fcn.004112c3
add esp, 0xc
xor al, al
jmp 0x41244a
push edi
push edi
push edi
xor eax, eax
cmp byte [ebp + 8], al
push edi
push edi
push edi
sete al
push edi
push 0xffffffffffffffff
lea eax, [eax + eax + 2]
push eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x4123a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp + 8], 0
mov ecx, str.enable
jne 0x4123a0
mov ecx, str.disable
push eax
push ecx
push str.Unable_to__s_service:_ChangeServiceConfig_failed__error__d__n
jmp 0x412358
cmp byte [ebp + 8], 0
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
je 0x4123e7
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x41241b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x3e8
jmp 0x4123d5
cmp dword [ebp - 0x20], 2
jne 0x41241b
push edi
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4123cf
jmp 0x41241b
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41241b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x3e8
jmp 0x41240b
cmp dword [ebp - 0x20], 3
jne 0x41241b
push edi
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x412405
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
mov bl, 1
call esi
test eax, eax
je 0x412438
cmp byte [ebp + 8], 0
je 0x41244f
cmp dword [ebp - 0x3c], 4
je 0x412455
xor bl, bl
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 4]
call esi
mov al, bl
pop ebx
pop edi
pop esi
leave
ret
cmp dword [ebp - 0x3c], 1
jne 0x412436
mov bl, 1
jmp 0x412438