joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3d84
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x4e3ec9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004056dc
lea eax, [ebp - 4]
mov edx, dword [0x4fb328]
mov edx, dword [edx + 4]
call fcn.00405774
xor eax, eax
push ebp
push 0x4e3e9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4e3e30
cmp dword [ebp - 0x8c], 1
jne 0x4e3e30
cmp dword [ebp - 0x94], 0xa
jne 0x4e3e30
lea ecx, [ebp - 0xa0]
mov edx, 0x4e3edc
mov eax, dword [ebp - 4]
call fcn.004bdd24
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 4]
call fcn.00405774
call fcn.00405100
jmp 0x4e3ea3
call fcn.004bd828
sub al, 2
jb 0x4e3e3f
sub al, 8
jb 0x4e3e62
jmp 0x4e3e83
lea ecx, [ebp - 0xa4]
mov edx, 0x4e3eec
mov eax, dword [ebp - 4]
call fcn.004bdd24
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 4]
call fcn.00405774
jmp 0x4e3e83
lea ecx, [ebp - 0xa8]
mov edx, 0x4e3efc
mov eax, dword [ebp - 4]
call fcn.004bdd24
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 4]
call fcn.00405774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3ea3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405730
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3ed0
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.00405700
lea eax, [ebp - 4]
call fcn.004056dc
ret

Function at 0x4e437c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4e43e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004bdd24
mov eax, dword [ebp - 0xc]
call fcn.00405b6c
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e43f0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405700
ret
Function at 0x4e43f8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4e44cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004bdd24
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
je 0x4e44b2
push 0x20
mov eax, dword [ebp - 0xc]
call fcn.00405b6c
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x4e447b
xor ebx, ebx
jmp 0x4e4481
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
jne 0x4e44b2
push 0
push 0x4e44e4
push dword [ebp - 0xc]
push 0x4e44f4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405a70
mov eax, dword [ebp - 0x10]
movzx ecx, word [0x4e4510]
mov dl, 1
call fcn.00448a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e44d4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405700
ret
Function at 0x4e8730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e888d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
mov word [ebp - 0x10], 0
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004dfe10
call fcn.004bd828
sub al, 2
jae 0x4e87b5
push 0xff
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x25c]
mov ecx, pe_nt_image_headers32
call fcn.0040594c
mov eax, dword [ebp - 0x260]
mov ecx, 0xff
xor edx, edx
call fcn.00405bd4
lea eax, [ebx + 0x3cc]
mov edx, dword [ebp - 0xc]
call fcn.00405730
lea ecx, [ebp - 4]
mov edx, 0x4e88a4
mov eax, dword [ebp - 0xc]
call fcn.004bdd24
mov eax, dword [ebp - 4]
call fcn.0040af30
test al, al
je 0x4e8838
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x15c]
call fcn.0040384c
mov edx, 2
lea eax, [ebp - 0x15c]
call fcn.00403efc
call fcn.004031e8
test eax, eax
jne 0x4e882d
lea edx, [ebp - 0xe]
lea eax, [ebp - 0x15c]
call fcn.00403bd8
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x15c]
call fcn.00403bd8
lea eax, [ebp - 0x15c]
call fcn.00403914
call fcn.004031e8
movsx ebx, word [ebp - 0x10]
jmp 0x4e8867
mov word [ebp - 0x10], 1
mov esi, 0x1b
mov ebx, dword [0x4f5398]
call fcn.004bf254
movzx edx, byte [ebx]
cmp eax, edx
jne 0x4e885d
movzx eax, word [ebx + 2]
mov word [ebp - 0x10], ax
add ebx, 0xc
dec esi
jne 0x4e8849
movsx ebx, word [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8894
lea eax, [ebp - 0x260]
call fcn.004056dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405700
ret
Function at 0x4ed584
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4ed70b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
mov edx, 0x4ed724
mov eax, dword [ebp - 4]
call fcn.004bdd24
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
jne 0x4ed605
lea eax, [ebp - 0x68]
call fcn.0040b454
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0xc]
mov edx, 0x4ed724
call fcn.004bdd24
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
jne 0x4ed605
mov dword [ebp - 0x10], 0x20000004
cmp dword [ebp - 0x10], 0
jne 0x4ed6e3
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b3c
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0xa
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
je 0x4ed6e3
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000020
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0x4ed738
push 0x4ed744
push dword [ebp - 8]
push 0x4ed744
lea eax, [ebp - 0x6c]
mov edx, 5
call fcn.00405a70
mov eax, dword [ebp - 0x6c]
call fcn.00405b6c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4ed6e3
xor eax, eax
push ebp
push 0x4ed6dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed6e3
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed712
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00405700
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405700
ret
Function at 0x4ed748
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
mov edx, 0x4ed85c
call fcn.00405730
mov eax, esi
call fcn.0040af30
test al, al
je 0x4ed84b
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.00405b6c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4ed84b
mov eax, ebx
call fcn.00402ef8
mov dword [ebp - 0xc], eax
push ebp
push 0x4ed844
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ed82e
mov eax, dword [ebp - 0xc]
mov esi, eax
mov edx, ebx
sub edx, 0x34
test edx, edx
jle 0x4ed7da
mov esi, eax
cmp dword [esi], 0xfeef04bd
je 0x4ed7da
inc eax
dec edx
jne 0x4ed7cc
cmp dword [esi], 0xfeef04bd
jne 0x4ed82e
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 8]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, word [esi + 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [esi + 0xc]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
movzx eax, word [esi + 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x4ed870
call fcn.0040bbec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed84b
mov eax, dword [ebp - 0xc]
call fcn.00402f14
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ee2f8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4ee4b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 8]
mov eax, 0x4ee4d0
call fcn.004bdc90
mov eax, dword [ebp - 8]
call fcn.00405b6c
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4ee4dc
push dword [ebp - 4]
push 0x4ee4f8
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405a70
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.004ed584
mov eax, dword [ebp - 8]
call fcn.0040af30
test al, al
je 0x4ee48e
mov eax, dword [ebp - 8]
call fcn.004bdebc
mov ebx, eax
lea esi, [ebx + 2]
mov eax, esi
call fcn.00402ef8
mov dword [ebp - 0x18], eax
mov edx, esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
call fcn.00403b3c
push 0x40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x419d88]
call fcn.0041ed94
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4ee487
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dl, 1
mov eax, dword [0x419b88]
call fcn.00404770
mov esi, eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.00406900
mov edx, dword [ebp - 0x24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ee43b
inc ebx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x1c]
dec ebx
jne 0x4ee41b
mov eax, esi
call fcn.004047a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee48e
mov eax, dword [ebp - 0x14]
call fcn.004047a0
mov eax, dword [ebp - 0x18]
call fcn.00402f14
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 8]
call fcn.00405b6c
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee4bd
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405700
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405700
ret
Function at 0x4ee584
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4ee6fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 1
xor edx, edx
mov eax, 0xf
call fcn.004a70b4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ee6d8
xor eax, eax
push ebp
push 0x4ee6d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.004a70d4
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4ee6ab
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040a1fc
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040594c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040a1fc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405b04
jne 0x4ee697
mov ecx, dword [ebp - 0x12c]
xor edx, edx
mov eax, 1
call fcn.004ee710
mov esi, eax
test esi, esi
jne 0x4ee67d
mov dword [ebp - 8], 5
call fcn.00405100
jmp 0x4ee6d8
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x4ee691
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
push esi
call sub.kernel32.dll_CloseHandle_1
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.004a70f4
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4ee60d
mov dword [ebp - 8], 0x7f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee6d8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee705
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00405700
lea eax, [ebp - 4]
call fcn.004056dc
ret
Function at 0x4ee710
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x4ee879
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 5
jne 0x4ee879
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
not eax
cmp eax, 2
jne 0x4ee775
mov ebx, 5
jmp 0x4ee879
mov dword [ebp - 8], 0x10
lea eax, [ebp - 0xc]
push eax
push 0
push 0x28
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4ee7bf
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0x3f0
jne 0x4ee879
lea eax, [ebp - 0xc]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4ee879
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa4], 2
lea eax, [ebp - 0xac]
push eax
push 0x4ee884
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc0]
push eax
push 0x10
lea eax, [ebp - 0xb0]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x4ee81b
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4ee879
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x514
jne 0x4ee839
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4ee879
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_OpenProcess
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0xc0]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jne 0x4ee879
push 5
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eeacc
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [ebx + 8], 0
je 0x4eebbd
mov dword [ebp - 4], 4
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4eeb14
call sub.kernel32.dll_GetLastError_1
mov cl, 1
mov edx, eax
mov eax, ebx
call fcn.004ee988
jmp 0x4eebbd
push 0xf01ff
mov eax, dword [ebx + 4]
call fcn.00405b6c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4eeb46
call sub.kernel32.dll_GetLastError_1
mov cl, 2
mov edx, eax
mov eax, ebx
call fcn.004ee988
jmp 0x4eebbd
xor eax, eax
push ebp
push 0x4eebb6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4eeb6c
call fcn.00405100
jmp 0x4eebbd
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eebbd
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eebc8
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20]
push ecx
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 4], ecx
mov edi, edx
xor esi, esi
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4eec0c
inc esi
movzx eax, si
imul eax, eax, 0x64
push eax
call sub.kernel32.dll_Sleep_1
test bl, bl
jne 0x4eec16
cmp si, 0x14
jbe 0x4eebe7
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eec54
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EnumDependentServicesA
mov eax, dword [ebp - 0x14]
add eax, 0x64
call fcn.00402ef8
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x4eed6d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EnumDependentServicesA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4eecd0
call fcn.00405100
jmp 0x4eed78
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4eed57
inc eax
mov dword [ebp - 0x28], eax
push 0x24
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 8], 0
jne 0x4eed14
call sub.kernel32.dll_GetLastError_1
mov cl, 0xa
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004ee988
call fcn.00405100
jmp 0x4eed78
xor eax, eax
push ebp
push 0x4eed47
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004eed80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eed4e
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eed74
mov eax, dword [ebp - 0x1c]
call fcn.00402f14
ret
movzx eax, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x4eed80
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
lea edi, [ebp - 0x30]
mov byte [ebp - 5], 0
mov eax, edi
xor ecx, ecx
mov edx, 0x1c
call fcn.00403b3c
push edi
mov eax, dword [esi]
push eax
call sub.advapi32.dll_QueryServiceStatus
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x10], eax
jmp 0x4eee5a
push edi
mov edx, dword [esi]
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.004eebc8
test al, al
jne 0x4eee02
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x425
je 0x4eede7
dec eax
jne 0x4eedf3
jmp 0x4eee74
push 0x7d0
call sub.kernel32.dll_Sleep_1
jmp 0x4eee02
mov cl, 6
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004ee988
jmp 0x4eee74
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
push edi
mov eax, dword [esi]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
xor ebx, ebx
jmp 0x4eee54
push 0x64
call sub.kernel32.dll_Sleep_1
push edi
mov eax, dword [esi]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
inc ebx
mov eax, dword [edi + 0x18]
mov ecx, 0x64
xor edx, edx
div ecx
cmp ebx, eax
ja 0x4eee5a
cmp dword [edi + 4], 1
jne 0x4eee27
cmp dword [edi + 4], 1
je 0x4eee74
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xc]
jb 0x4eedb9
cmp dword [edi + 4], 1
jne 0x4eee7e
mov byte [ebp - 5], 1
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eee8c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
cmp byte [ebx + 8], 0
je 0x4eefbc
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4eeecc
call sub.kernel32.dll_GetLastError_1
mov cl, 3
mov edx, eax
mov eax, ebx
call fcn.004ee988
jmp 0x4eefbc
push 0xf01ff
mov eax, dword [ebx + 4]
call fcn.00405b6c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4eef01
call sub.kernel32.dll_GetLastError_1
mov cl, 4
mov edx, eax
mov eax, ebx
call fcn.004ee988
jmp 0x4eefbc
mov eax, dword [ebx + 4]
call fcn.004eec24
test al, al
je 0x4eef1a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004eec54
xor edx, edx
push ebp
push 0x4eefb5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4eef61
call sub.kernel32.dll_GetLastError_1
cmp eax, 6
je 0x4eef5a
mov cl, 5
mov edx, eax
mov eax, ebx
call fcn.004ee988
call fcn.00405100
jmp 0x4eefbc
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004eed80
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eefbc
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4f56f0]
mov eax, dword [eax]
call fcn.00476ef4
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eefc8
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
xor esi, esi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4eeffb
inc esi
movzx eax, si
imul eax, eax, 0x64
push eax
call sub.kernel32.dll_Sleep_1
test bl, bl
jne 0x4ef005
cmp si, 0x14
jbe 0x4eefd6
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4