joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x46c61b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x46c71e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4f34a8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4f34a8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4f34a8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4f34a8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4f34a8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4f34a8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4f34a8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4f34a8]
xor eax, edx
inc ecx
dec edi
jne 0x46c636
pop edi
test esi, esi
je 0x46c740
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4f34a8]
xor eax, edx
inc ecx
dec esi
jne 0x46c722
pop esi
pop ebx
not eax
ret

Function at 0x46c750
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x4f34a8]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x4f34a8]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x46d150
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x46d191
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46d186
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x46d1a4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
ret
Function at 0x46de60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x46de7c
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x46de8d
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x46de9b
push edi
call fcn.0046e280
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.0046dc60
add esp, 0x10
test eax, eax
je 0x46dec3
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x46dee2
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call sub.MFC42.DLL_operatornew
mov dword [esi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x46df1b
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x46df69
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0046c9e0
add esp, 4
test eax, eax
jne 0x46df69
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x46df96
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x46dfa2
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg cl
sbb ecx, ecx
mov dword [ebx], 0x12345678
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], 0x34567890
je 0x46dfe3
mov al, byte [ebp]
test al, al
je 0x46dfe3
push eax
push ebx
call fcn.0046c750
add esp, 8
inc ebp
jne 0x46dfcf
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x46e3c0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x46e4a2
cmp dword [ebp + 4], 0xffffffff
jne 0x46e4a2
push ebx
lea ebx, [ebp + 0x13c]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebp + 0x13b]
cmp cl, 0x5c
je 0x46e432
cmp cl, 0x2f
je 0x46e432
mov edi, 0x50c164
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp edi, 1
pop ebx
jne 0x46e45e
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46e45e
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call fcn.0046cf00
add esp, 0x10
test eax, eax
jne 0x46e481
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.0046d4d0
add esp, 4
mov dword [ebp], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x46eaa0
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x214]
mov al, byte [esi]
test al, al
je 0x46eb72
push ebx
push ebp
push edi
mov ebx, esi
mov ecx, esi
cmp al, 0x2f
je 0x46eac7
cmp al, 0x5c
jne 0x46eac9
mov ebx, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x46eabf
mov ebp, dword [esp + 0x21c]
cmp ebx, esi
mov edx, ebx
je 0x46eb0c
mov eax, ebx
lea edi, [esp + 0x10]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x10], 0
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.0046eaa0
add esp, 8
lea edx, [ebx + 1]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret
Function at 0x49e6d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b7ec1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0049f510
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x49e77b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49e772
cmp al, 0xff
je 0x49e772
dec al
mov byte [ecx], al
jmp 0x49e77b
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x49e7ac
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49e7a3
cmp al, 0xff
je 0x49e7a3
dec al
mov byte [ecx], al
jmp 0x49e7ac
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6b6f33e7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x552515ad
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4013c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 4]
push esi
push eax
push 0xf003f
push 0
push str.SOFTWAREINSTALL_EVDO_OEM
push 0x80000002
xor bl, bl
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401434
mov esi, dword [esp + 8]
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.FLAG
push esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401429
cmp dword [esp + 0x14], 1
jne 0x401429
mov bl, 1
test esi, esi
je 0x401434
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401540
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x20
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
mov dword [esp + 8], edi
jne 0x401573
push str.OpenSCManager_failed
call fcn.00401ab0
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x20
ret
push 0xf01ff
push 0x40e090
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4015a6
push str.create_service_failed
call fcn.00401ab0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4015d6
push str.start_service_failed
call fcn.00401ab0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x401607
push str.query_service_status_failed
call fcn.00401ab0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call ebx
mov ebp, dword [esp + 0x28]
mov edi, eax
cmp dword [esp + 0x18], 2
jne 0x40168f
mov eax, 0xcccccccd
mul dword [esp + 0x2c]
shr edx, 3
cmp edx, 0x3e8
jae 0x401639
mov edx, 0x3e8
jmp 0x401646
cmp edx, 0x2710
jbe 0x401646
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401682
cmp dword [esp + 0x28], ebp
jbe 0x40166d
call ebx
mov ebp, dword [esp + 0x28]
mov edi, eax
jmp 0x401679
call ebx
mov ecx, dword [esp + 0x2c]
sub eax, edi
cmp eax, ecx
ja 0x40168f
cmp dword [esp + 0x18], 2
je 0x40161e
jmp 0x40168f
push str.query_service_pending_status_failed
call fcn.00401ab0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [0x41102c]
mov esi, 4
push 0x411010
push eax
mov dword [0x411014], esi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, esi
pop ebx
jne 0x4016d0
pop edi
mov eax, 1
pop esi
add esp, 0x20
ret
push str.start_service_failed_not_running
call fcn.00401ab0
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4018e0
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x104
push esi
call fcn.00401890
test eax, eax
je 0x4018fd
mov eax, 1
pop esi
add esp, 0x104
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x401929
push str.Service_open_sc_manager_fail
call fcn.00401ab0
add esp, 4
xor eax, eax
pop esi
add esp, 0x104
ret
lea eax, [esp + 4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0x41113c
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 1
push 2
push 0x20
push 0xf01ff
push 0x40e090
push 0x40e090
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x40198b
push str.Service_create_fail
call fcn.00401ab0
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
add esp, 0x104
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x4019b0
Capabilities:
Delete service
Stop service
Terminate process

Disassembly:
sub esp, 0x1c
push esi
push edi
call fcn.00401890
test eax, eax
jne 0x4019c9
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4019f3
push str.Uninstall_open_sc_manager_failed
call fcn.00401ab0
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x1c
ret
push 0x10020
push 0x40e090
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401a26
push str.Uninstall_open_service_failed
call fcn.00401ab0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x401a45
push str.Uninstall_stop_service_failed
call fcn.00401ab0
add esp, 4
push ebx
push 0x3e8
mov dword [0x411138], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x1388
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401a7d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
test ebx, ebx
pop ebx
je 0x401a99
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
push str.Service_could_not_be_deleted
call fcn.00401ab0
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x401ab0
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x104
mov ecx, dword [esp + 0x108]
lea eax, [esp + 0x10c]
push esi
push eax
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.00401de1
add esp, 0xc
lea eax, [esp + 8]
mov dword [esp + 4], eax
push 0x40e090
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x401b10
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x104
ret
Function at 0x4096e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x469fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045e830
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409762
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045c5dd
mov eax, dword [eax]
push 0x4b91d0
push eax
call fcn.0044ea64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045eabb
test bl, bl
je 0x409762
push 0x4b91d0
lea ecx, [esp + 0xc]
call fcn.0045ee4b
push 0x4bcd4c
lea ecx, [esp + 0xc]
call fcn.0045ee4b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40979e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045eabb
jmp 0x409869
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409822
lea edx, [esp + 0x7c]
push 0x4bcd48
push edx
call fcn.0044ea64
add esp, 8
test eax, eax
je 0x409822
lea eax, [esp + 0x7c]
push 0x4bcd44
push eax
call fcn.0044ea64
add esp, 8
test eax, eax
je 0x409822
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4097b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045eabb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a060
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a0c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc