joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bf20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004160b0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_CharLowerBuffA]
lea edx, [ebp - 0x224]
push edx
push 0x45bfb0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x42c14c
mov dword [ebp - 0x21c], 0
cmp dword [ebp - 0x218], 0
jne 0x42c13f
cmp dword [ebp - 4], 0
jne 0x42c13f
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x2bc], eax
push 0x200
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x2bc]
push edx
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
cmp dword [ebp - 0x218], 0
jne 0x42c13a
lea edx, [ebp - 0x210]
push edx
call fcn.004160b0
add esp, 4
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00419460
add esp, 8
test eax, eax
jne 0x42c13a
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x42c133
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.InprocServer32
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x42c126
mov dword [ebp - 8], 1
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x228], edx
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x42c119
push 0x88
push 0
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.004168a0
add esp, 0xc
mov byte [ebp - 0x2b8], 0x88
push 0x4000
lea edx, [ebp - 0x2b8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x42c119
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 1
jmp 0x42bf8c
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret
Function at 0x42c430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x14], 0
jne 0x42c607
lea eax, [ebp - 0x3ec]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42c605
mov dword [ebp - 8], 1
mov dword [ebp - 0x1e4], 0x100
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push str.clsid
mov eax, dword [ebp - 0x3ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42c5f8
push 0x200
lea ecx, [ebp - 0x3e8]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.0042bf20
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42c5f8
push 0x29c
call fcn.004088d8
add esp, 4
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x14], 0
je 0x42c5f8
push 0x29c
push 0
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004168a0
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [edx], eax
push 0x64
lea ecx, [ebp - 0x1e0]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x110]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0x1e0]
push ecx
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42c586
push 0x10
lea edx, [ebp - 0x3fc]
push edx
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
call fcn.00416920
add esp, 0xc
mov dword [ebp - 8], 1
mov dword [ebp - 0x1e4], 0x100
lea ecx, [ebp - 0x1e4]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.description
mov ecx, dword [ebp - 0x3ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42c5e4
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 0x14]
add eax, 0x214
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x42c5f8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x14]
add edx, 0x214
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x3ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42c631
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x298]
push edx
mov eax, dword [ebp + 0x10]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042c430
add esp, 0x10
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x298], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret
Function at 0x42d280
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x698
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x476310]
and eax, 2
je 0x42d2a8
push 0x45c970
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 0
jmp 0x42d2cd
mov ecx, dword [ebp - 0x68c]
add ecx, 1
mov dword [ebp - 0x68c], ecx
mov edx, dword [ebp - 0x68c]
cmp edx, dword [ebp + 8]
jge 0x42d37e
mov eax, dword [ebp - 0x68c]
imul eax, eax, 0x34
mov ecx, dword [ebp - 0x68c]
mov dword [ebp + eax - 0x688], ecx
mov edx, dword [ebp - 0x68c]
imul edx, edx, 0x34
mov dword [ebp + edx - 0x684], 1
mov eax, dword [ebp - 0x68c]
imul eax, eax, 0x34
lea ecx, [ebp + eax - 0x688]
push ecx
call fcn.0042ccd0
add esp, 4
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0
jne 0x42d379
mov edx, dword [ebp - 0x68c]
imul edx, edx, 0x34
mov eax, dword [ebp + edx - 0x67c]
and eax, 0x80000000
je 0x42d379
mov ecx, dword [ebp - 0x68c]
imul ecx, ecx, 0x34
mov edx, dword [ebp + ecx - 0x67c]
and edx, 0x7fffffff
mov dword [ebp - 0x698], edx
cmp dword [ebp - 0x698], 0x800
jne 0x42d379
mov dword [ebp - 0x690], 1
jmp 0x42d37e
jmp 0x42d2be
mov eax, dword [0x476310]
and eax, 2
je 0x42d3b4
cmp dword [ebp - 0x690], 0
je 0x42d39e
push str.TRUE:_ASIOChannelInfoHasTopCenterChannelForWUH_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x42d3a9
push str.FALSE:_ASIOChannelInfoHasTopCenterChannelForWUH_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Exit:_CheckWhetherASIOChannelInfoHasTopCenterChannelForWUH___r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x690]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret
Function at 0x42dc30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jne 0x42dc9c
push 0x104
lea eax, [ebp - 0x838]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
je 0x42dc9c
lea ecx, [ebp - 0x838]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x83c], eax
lea edx, [ebp - 0x838]
push edx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x628]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x840], 1
jmp 0x42dcb7
mov edx, dword [ebp - 0x840]
add edx, 1
mov dword [ebp - 0x840], edx
mov eax, dword [ebp - 0x840]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x844], eax
cmp dword [ebp + 0x18], 0
jne 0x42dd09
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42dd09
jmp 0x42dca8
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043c000
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x42dd31
jmp 0x42dd38
jmp 0x42dd38
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret
Function at 0x43d000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43d0cf
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x638], eax
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [str.CTAudMon.ini]
push ecx
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x634], eax
lea ecx, [ebp - 0x630]
push ecx
push 0
push str.UseSideBySideCODEC
mov edx, dword [0x4640c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43d0cd
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
jmp 0x43d171
jmp 0x43d0d6
mov dword [ebp - 8], 0
xor ecx, ecx
mov edx, dword [ebp + 0x10]
mov word [edx], cx
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43d167
push str.SHGetFolderPathW
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
je 0x43d14e
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x640]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43d14c
push str.CreativeShared_Files
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x43d155
mov dword [ebp - 0x10], 0x80004005
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x63c], eax
jmp 0x43d16e
mov dword [ebp - 0x10], 0x80004005
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret
Function at 0x43d5f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x43d613
mov eax, 3
jmp 0x43d7dc
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x43d6cc
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x638], eax
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [str.CTAudMon.ini]
push ecx
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x634], eax
lea ecx, [ebp - 0x630]
push ecx
push 0
push 0x467558
mov edx, dword [0x464130]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
je 0x43d6cc
cmp dword [ebp - 0x63c], 3
je 0x43d6be
cmp dword [ebp - 0x63c], 4
jne 0x43d6cc
mov eax, dword [ebp + 8]
push eax
call fcn.0043d460
jmp 0x43d7dc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
je 0x43d6f8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 0x640], eax
push 0x7d0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43d71d
mov eax, 2
jmp 0x43d7dc
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0
je 0x43d739
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x644], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x14], 0
je 0x43d796
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
je 0x43d796
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x138]
push ecx
call fcn.0043d410
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d7bb
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x138], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x64c], eax
mov ecx, dword [ebp - 0x64c]
push ecx
call fcn.00408912
add esp, 4
mov dword [ebp - 0xc], 0
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret 4
Function at 0x43e299
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x43e2d4
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x43e2bb
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x43e2cc
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x43e2d6
inc edi
add eax, 0x28
cmp edi, esi
jb 0x43e2b1
xor eax, eax
pop edi
pop esi
ret
Function at 0x449e60
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x449fb9
push 0x10024
push str.CTAudSvcService
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x449f8d
push 0x477800
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x449f3f
push 0x471774
push str.Stopping__s.
call fcn.00416e24
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x477800
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x449f10
cmp dword [0x477804], 3
jne 0x449f0c
push 0x4717c0
call fcn.00416e24
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x449f0e
jmp 0x449f10
jmp 0x449ed6
cmp dword [0x477804], 1
jne 0x449f2d
push 0x4717c4
push str._n_s_stopped._n
call fcn.00416e24
add esp, 8
jmp 0x449f3f
push 0x471810
push str._n_s_failed_to_stop._n
call fcn.00416e24
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x449f61
push 0x47186c
push str._s_removed._n
call fcn.00416e24
add esp, 8
jmp 0x449f81
push 0x100
push 0x4775e0
call fcn.00449dc0
add esp, 8
push eax
push str.DeleteService_failed____s_n
call fcn.00416e24
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x449fad
push 0x100
push 0x4775e0
call fcn.00449dc0
add esp, 8
push eax
push str.OpenService_failed____s_n
call fcn.00416e24
add esp, 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x449fd9
push 0x100
push 0x4775e0
call fcn.00449dc0
add esp, 8
push eax
push str.OpenSCManager_failed____s_n
call fcn.00416e24
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x449fe0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x44a035
push 0x100
push 0x4775e0
call fcn.00449dc0
add esp, 8
push eax
push 0x4715ac
push str.Unable_to_install__s____s_n
call fcn.00416e24
add esp, 0xc
jmp 0x44a109
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x44a0e9
push 0
push 0
push str.Audiosrv
push 0
push str.AudioGroup
lea ecx, [ebp - 0x210]
push ecx
push 1
push 2
push 0x10
push 4
push 0x471644
push 0x471674
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x44a0ba
push 0x471694
push str._s_installed._n
call fcn.00416e24
add esp, 8
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x44a0da
push 0x100
push 0x4775e0
call fcn.00449dc0
add esp, 8
push eax
push str.CreateService_failed____s_n
call fcn.00416e24
add esp, 8
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x44a109
push 0x100
push 0x4775e0
call fcn.00449dc0
add esp, 8
push eax
push 0x47171c
call fcn.00416e24
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret

Function at 0x44a120
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x474b8c], 0
jne 0x44a1c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x474b88], eax
push 0x471550
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 4], eax
mov eax, dword [0x474b88]
push eax
push 0x471570
push str._s_error:__d
push 0x6c
lea ecx, [ebp - 0xe0]
push ecx
call fcn.00416de5
add esp, 0x14
lea edx, [ebp - 0xe0]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 4], 0
je 0x44a1c0
push 0
lea ecx, [ebp - 0xe8]
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret
Function at 0x44a2c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44a2ef
push str.CmdDebugService_CommandLineToArgvW_returned_NULL_n
call fcn.00416e24
add esp, 4
jmp 0x44a328
push 0x4719c4
push str.Debugging__s._n
call fcn.00416e24
add esp, 8
push 1
push 0x44a280
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0044b520
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret
Function at 0x44a910
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x46fc68]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x44a9e5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x44a9e5
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44a9e3
cmp dword [ebp - 0xc], 0
jne 0x44a9d9
mov dword [ebp - 0x814], 0x800
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0x810]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x103
jne 0x44a9bb
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0xc], eax
jmp 0x44a9d9
cmp dword [ebp - 0xc], 0
jne 0x44a9d7
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044a910
add esp, 8
mov dword [ebp - 0xc], eax
jmp 0x44a968
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44a9ec
mov dword [ebp - 0xc], 0x3f2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004148bc
mov esp, ebp
pop ebp
ret

Function at 0x44ad10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44ad40
mov eax, dword [ebp - 0x10]
jmp 0x44adcd
mov eax, dword [ebp + 0x18]
shl eax, 1
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44ad94
cmp dword [ebp - 0x10], 0xea
jne 0x44ad83
mov eax, dword [ebp - 0xc]
shr eax, 1
add eax, 1
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x44adcd
cmp dword [ebp + 0x14], 0
je 0x44adb3
cmp dword [ebp - 4], 1
je 0x44adb1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3f1
jmp 0x44adcd
jmp 0x44adc0
mov ecx, dword [ebp - 0xc]
shr ecx, 1
add ecx, 1
mov edx, dword [ebp + 0x1c]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret