joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803d22e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 0x98]
cmp dword [esi], 0
jne 0x1803d289
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
inc edi
test eax, eax
je 0x1803d285
jmp 0x1803d27f
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
cmp eax, ebx
jae 0x1803d276
or ecx, 0xffffffff
sub ecx, ebx
add ecx, eax
cmp ecx, dword [ebp - 4]
jae 0x1803d285
cmp dword [esi + 4], 0
jg 0x1803d25a
xchg dword [esi], edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1803daca
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 2
pop esi
mov ecx, dword [edi + 0x80]
cmp ecx, dword [edi + 0x84]
je 0x1803dafd
xor eax, eax
cmp dword [ecx + 0x14], eax
setne al
mov dword [ebp - 0xc], eax
mov esi, eax
mov al, byte [edi + 0x8d]
mov bl, byte [edi + 0x11]
mov dword [ebp - 0xc], eax
call fcn.1801fa2a
mov ecx, dword [edi + 0xc]
inc eax
push esi
push ebx
push dword [ebp - 0xc]
mov dl, byte [eax]
call fcn.1803f1e2
add esp, 0xc
mov byte [edi + 0x8c], al
mov ecx, 0x181ca618
push eax
call fcn.18025fbc
cmp byte [edi + 0x8c], 0
je 0x1803db4a
call fcn.180170be
test al, al
je 0x1803db4a
mov cl, 1
xor ebx, ebx
jmp 0x1803db4e
xor ebx, ebx
mov cl, bl
call fcn.1807499e
mov edx, dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18014dc7
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], ebx
je 0x1803dc2c
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1803dc2c
movzx ecx, byte [0x181cf106]
neg ecx
sbb ecx, ecx
and ecx, 0x181cf000
je 0x1803dbd8
push 7
pop edx
push 3
pop eax
push eax
push edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008bfd
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.180072ef
push dword [ebp - 0xc]
movzx eax, byte [edi + 0x8c]
push eax
lea eax, [ebp - 0x1c]
push str._is_machine:__d__Current_dir___s_
push eax
call fcn.180072d0
mov ecx, dword [ebp - 0xc]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18007012
mov ecx, edi
call fcn.1803e487
mov cl, byte [edi + 0x8c]
call fcn.1803f0ba
push dword [edi + 0xc]
call fcn.1803e3a3
test al, al
je 0x1803dc0c
mov cl, byte [edi + 0x8c]
call fcn.18026ff2
test al, al
je 0x1803dc0c
mov edi, 0xa0430607
jmp 0x1803dc33
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [edi + 0xc]
call fcn.1803e3f5
mov edi, eax
mov ecx, edi
call fcn.1801d087
mov esi, dword [ebp - 8]
test edi, edi
js 0x1803dc33
jmp 0x1803dc35
call fcn.1801ba7c
mov edi, eax
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x1803ecdf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
call fcn.1801fa2a
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
jne 0x1803ed10
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.1800759a
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
push 0x20019
push edi
mov dword [ebp - 0x18], 0x18196d8c
mov dword [ebp - 0x10], 0x200
call fcn.1801a2ce
mov ebx, eax
mov ecx, ebx
call fcn.1801d087
test ebx, ebx
js 0x1803ee85
lea ecx, [ebp - 0x18]
call fcn.1801b29e
test eax, eax
je 0x1803ee80
push str.Clients
lea ecx, [ebp - 0x18]
call fcn.1801a330
test al, al
je 0x1803ee80
push str.ClientState
lea ecx, [ebp - 0x18]
call fcn.1801a330
test al, al
je 0x1803ee80
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1803ee80
push ebx
push ebx
push ebx
push ebx
push str.path
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1803ee80
mov dword [ebp - 8], ebx
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
lea eax, [ebp - 8]
push eax
push str.version
lea ecx, [ebp - 0x18]
call fcn.1801a8b3
mov ebx, eax
mov ecx, ebx
call fcn.1801d087
test ebx, ebx
js 0x1803ee73
and dword [ebp - 0x1c], 0
call fcn.1801fa2a
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
jne 0x1803ee0c
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
push eax
lea ecx, [ebp - 0x1c]
call fcn.1800759a
and dword [ebp - 0xc], 0
call fcn.1800703b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800774f
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
mov edx, 0x181a09b8
mov ecx, esi
call fcn.1801ca91
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.1801d087
test ebx, ebx
js 0x1803ee60
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.18009caa
test al, al
je 0x1803ee5e
mov ebx, 0xa043090b
jmp 0x1803ee60
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18007012
lea ecx, [esi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
jmp 0x1803ee85
mov ebx, 0x80070003
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x18196d8c
je 0x1803eea6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x200
lea ecx, [edi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x1803fbca
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18154880
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015d01
test al, al
je 0x1803fdbb
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812da70
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.180407f0
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x1803fc51
mov ecx, edi
call fcn.1801d087
test edi, edi
jns 0x1803fdbb
mov ecx, edi
call fcn.1801d087
test edi, edi
jns 0x1803fc63
mov eax, edi
jmp 0x1803fdbd
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1803fc88
call fcn.1801ba7c
mov esi, eax
jmp 0x1803fdb7
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18081b1c
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1803fcbe
call fcn.1801ba7c
mov esi, eax
jmp 0x1803fda2
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18042346
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x1803fd31
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x1803fcf0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a4750
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803fd85
call fcn.1801ba7c
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x1803fd90
push esi
call fcn.18119673
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1803fdbd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18118dc8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1803fdd0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015d01
test al, al
je 0x1803fe74
call fcn.180408cc
test al, al
jne 0x1803fe74
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1803fe17
call fcn.1801ba7c
mov ebx, eax
jmp 0x1803fe70
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081b1c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1803fe4c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1803fe57
call fcn.1801ba7c
mov ebx, eax
test esi, esi
je 0x1803fe5e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x1803fe76
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x1804009b
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18154880
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015d01
test al, al
je 0x1804028c
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812da70
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18040c59
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x18040122
mov ecx, edi
call fcn.1801d087
test edi, edi
jns 0x1804028c
mov ecx, edi
call fcn.1801d087
test edi, edi
jns 0x18040134
mov eax, edi
jmp 0x1804028e
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18040159
call fcn.1801ba7c
mov esi, eax
jmp 0x18040288
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18081a5f
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1804018f
call fcn.1801ba7c
mov esi, eax
jmp 0x18040273
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18042346
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x18040202
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x180401c1
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a4750
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18040256
call fcn.1801ba7c
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18040261
push esi
call fcn.18119673
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1804028e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18118dc8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x180402a1
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015d01
test al, al
je 0x18040345
call fcn.18040d35
test al, al
jne 0x18040345
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180402e8
call fcn.1801ba7c
mov ebx, eax
jmp 0x18040341
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081a5f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1804031d
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18040328
call fcn.1801ba7c
mov ebx, eax
test esi, esi
je 0x1804032f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18040347
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret

Function at 0x180409a4
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18041664
test al, al
je 0x180409cc
xor eax, eax
jmp 0x18040a7f
call fcn.1803ff1b
mov esi, eax
mov ecx, esi
call fcn.1801d087
test esi, esi
jns 0x180409e8
lfence
mov eax, esi
jmp 0x18040a7f
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18040a14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040a7d
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040a7d
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081b1c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18040a4b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18040a64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040a60
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18040a6b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x18040e0d
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18041812
test al, al
je 0x18040e35
xor eax, eax
jmp 0x18040ee8
call fcn.180403ec
mov esi, eax
mov ecx, esi
call fcn.1801d087
test esi, esi
jns 0x18040e51
lfence
mov eax, esi
jmp 0x18040ee8
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18040e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040ee6
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040ee6
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081a5f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18040eb4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18040ecd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040ec9
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18040ed4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret

Function at 0x18040ef7
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x18040f3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040fb1
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040fb1
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081a5f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18041786
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 0xc]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x18040f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040f97
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040f97
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x18041d25
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.180079af
push dword [eax + 4]
push dword [eax]
call fcn.1813538b
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x18041d8b
push eax
call fcn.1813d111
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x18041dba
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18118dc8
leave
ret

Function at 0x18042053
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181caf60
push edi
mov edi, ecx
cmp dword [0x181caf60], ebx
je 0x18042094
push ecx
mov ecx, esi
call fcn.1803ab19
mov ebx, eax
mov ecx, ebx
call fcn.1801d087
test ebx, ebx
js 0x18042102
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18042076
lfence
cmp byte [edi + 0x3c], 0
je 0x18042110
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x18042109
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18042260
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x180420d7
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18042109
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180420f9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18042118
lfence
mov eax, ebx
jmp 0x18042123
mov esi, 0x80004005
jmp 0x1804211c
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18042121
call fcn.1804200f
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret 4
Function at 0x18042178
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181cb030
push edi
mov edi, ecx
cmp dword [0x181cb030], ebx
je 0x180421b9
push ecx
mov ecx, esi
call fcn.1803ab19
mov ebx, eax
mov ecx, ebx
call fcn.1801d087
test ebx, ebx
js 0x18042227
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x1804219b
lfence
cmp byte [edi + 0x3c], 0
je 0x18042235
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x1804222e
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18042260
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x180421fc
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1804222e
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1804221e
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1804223d
lfence
mov eax, ebx
jmp 0x18042248
mov esi, 0x80004005
jmp 0x18042241
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18042246
call fcn.18042134
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret 4

Function at 0x1804595b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esi + 0x1c]
call fcn.18047009
mov edi, dword [esi + 0x18]
and dword [esi + 0x18], 0
test edi, edi
je 0x18045985
mov ecx, edi
call fcn.18085624
push 0x24
push edi
call fcn.181192f6
pop ecx
pop ecx
mov ecx, dword [0x181cefac]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1803d22e