joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x59ad00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x220], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x224], 0
call fcn.00533c00
push eax
mov eax, dword [ebp + 8]
add eax, 0x228
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2a8], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a9], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2aa], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ac], 0
call fcn.00533b50
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0x8c]
mov byte [edx + 0x2ab], al
movsx ecx, byte [ebp - 0x8c]
test ecx, ecx
je 0x570915
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x316]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x21c]
lea eax, [eax + edx + 1]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x21c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x21c]
add eax, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x57095b
mov eax, 0xffffffe6
jmp 0x5709d9
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x5709ab
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x316]
add ecx, 1
push ecx
push 1
mov edx, dword [ebp + 8]
add edx, 0x2d0
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x316]
add edx, 1
cmp eax, edx
je 0x5709ab
mov eax, 0xffffffe6
jmp 0x5709d9
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
push 0x80
push 1
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0x80
je 0x5709d7
mov eax, 0xffffffe6
jmp 0x5709d9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551a8e
mov esp, ebp
pop ebp
ret
Function at 0x40c10c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0040bf0b
sub byte [ebx + ebx*4 + 0x12], 0xf
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040bf0b
jg 0x40c12a
call 0x47cc280a
push es
cmp ax, bx
jbe 0x40c165
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40c15f
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40c150
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
call fcn.0040bf0b
mov byte [edi + 0x16], ah
dec ebx
lea eax, [ebp - 0x58]
push eax
call fcn.0040bf1b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040bed0
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40c1f9
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040bf0b
sub byte [edi + 0x458d2403], al
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x40c658
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40c5e2
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40c600
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40c65e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40c645
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40c64e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je fcn.0040c658
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40c63a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
invalid

Function at 0x40d384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
invalid
Function at 0x41a69c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41a6a2
ret

Function at 0x41cdec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41ce3d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41ce24
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41ce14
jmp 0x41ce3d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41ce25
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435bf0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x435c0c
cmp dword [esi + 4], 0
je 0x435c39
test byte [ebx + 0x45], 1
jne 0x435c2b
mov eax, ebx
call fcn.00434c60
test eax, eax
jne 0x435c2b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x435d49
mov edx, esi
mov eax, ebx
call fcn.00435868
jmp 0x435d49
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x435d42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00437b60
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00432db4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00435bf0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00437b60
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435d49
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43f830
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403d64
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43f891
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x43f891
cmp byte [ebp - 0x102], 0
je 0x43f891
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403f90
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401cc0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5652d2
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5c2f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x224], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call fcn.00543790
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401d55
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00402310
push str.Foxit_Software
mov ecx, esi
call fcn.00401e70
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x401d89
mov ecx, dword [esi]
call fcn.00406bd0
test eax, eax
jne 0x401da1
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x401d9c
mov ecx, dword [esi]
call fcn.00406ca0
push str.Foxit_Reader_
mov ecx, esi
call fcn.00401e70
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x401db7
mov ecx, dword [esi]
call fcn.00406bd0
test eax, eax
jne 0x401dcf
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x401dca
mov ecx, dword [esi]
call fcn.00406ca0
push str.Foxit_Service_
mov ecx, esi
call fcn.00401e70
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x401de5
mov ecx, dword [esi]
call fcn.00406bd0
test eax, eax
jne 0x401dfd
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x401df8
mov ecx, dword [esi]
call fcn.00406ca0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00540fa1
mov esp, ebp
pop ebp
ret
Function at 0x403360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x403389
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40339f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403396
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4033d2
nop
cmp esi, ecx
jae 0x403396
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4033c0
cmp esi, ecx
jae 0x403396
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4033f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x4034fa
test eax, 0xffff0000
jne 0x4034fa
push esi
push edi
movzx edi, ax
push edi
call fcn.00408427
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4034f6
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4034f6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4034f6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4034f6
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x403489
cmp esi, ecx
jae 0x4034f6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x403477
cmp esi, ecx
jae 0x4034f6
movzx eax, word [esi]
test ax, ax
je 0x4034f6
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x4034bc
push edi
mov ecx, ebx
call fcn.00403860
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x4034bf
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00547858
add esp, 0x10
cmp eax, 0x50
ja case.0x4034dd.1
movzx eax, byte [eax + 0x403528]
jmp dword [eax*4 + 0x403518]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x40350d
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004081b3
call fcn.00408199
push 0x80070057
call fcn.004037f0
nop
in al, 0x34
inc eax
add byte [ebx], al
xor eax, 0x35080040
inc eax
add byte [eax], cl
xor eax, 0x3000040
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3
Function at 0x405910
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56573b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5c2f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x234], ebx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00543790
add esp, 0xc
mov dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
push 1
push 0x5a6184
call fcn.00402310
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4059c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.00404cf0
add esp, 8
jmp 0x405acf
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4059f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5a60e8
call fcn.00404cf0
add esp, 8
jmp 0x405acf
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401e70
push 0x5a6184
lea ecx, [ebp - 0x230]
call fcn.00401e70
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0
cmovae eax, dword [ebp - 0x230]
push 0
push 0x5a5bb8
push 0
push 0
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x405a6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.00404cf0
jmp 0x405ac2
push esi
call ebx
mov esi, dword [ebp - 0x234]
push esi
push str._s_is_installed._n
call fcn.00404cf0
add esp, 8
push 0x114
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x405aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5a6188
jmp 0x405abd
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x405ac5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartService_failed_w_err_0x_08lx_n
call fcn.00403900
add esp, 8
push edi
call ebx
test esi, esi
je 0x405acf
push esi
call ebx
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x405b0b
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405b27
push edx
push ecx
call fcn.00540fb2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00540fa1
mov esp, ebp
pop ebp
ret
call fcn.00547155
int3
Function at 0x405b30
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov bl, dl
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x405b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed___d__n
call fcn.00403aa0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x405ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed___d__n
call fcn.00403aa0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
movzx eax, bl
add eax, 2
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x405beb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig_failed___d__n
call fcn.00403aa0
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Service_disabled_successfully._n
call fcn.00403aa0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405de0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x5c2f60]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0
push 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TraverseProcessID_CreateToolhelp32Snapshot_GetLastError___d
call fcn.00403900
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.00540fa1
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x405e92
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TraverseProcessID_Process32First_GetLastError___d
call fcn.00403900
add esp, 8
test esi, esi
je 0x405e79
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.00540fa1
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax + eax]
push dword [esp + 0x14]
lea eax, [esp + 0x40]
push eax
call fcn.005478dc
add esp, 8
test eax, eax
jne 0x405ee2
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x405ed2
cmp dword [esp + 0x10], edi
je 0x405f18
call ebx
push eax
push str.TraverseProcessID_ProcessIdToSessionId_GetLastError___d
call fcn.00403900
add esp, 8
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x405ea0
xor ebx, ebx
test esi, esi
je 0x405eff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00540fa1
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [esp + 0x20]
jmp 0x405ef4