joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fdff4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4fe025
dec al
je 0x4fe060
dec al
je 0x4fe0a5
dec al
je 0x4fe10e
jmp 0x4fe198
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4fe198
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4fe035
jmp 0x4fe198
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4fe198
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4fe070
jmp 0x4fe198
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4fe198
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4fe0d4
xor ebp, ebp
jmp 0x4fe0e4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4fe0ed
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4fe0b5
jmp 0x4fe198
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4fe198
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4fe167
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004fb084
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4fe122
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x508fa8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x508ff9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x508fe0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x508fd0
jmp 0x508ff9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x508fe1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5230b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00480d90
mov edx, eax
mov eax, ebp
xor ecx, ecx
call fcn.00481454
mov eax, dword [esp]
call fcn.00480d90
mov edi, eax
test edi, edi
jle 0x52311b
mov ebx, 1
mov eax, ebp
call fcn.00480e88
mov edx, dword [esp]
movzx edx, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x5230e6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x523194
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.00480d90
mov edx, eax
mov eax, dword [esp]
xor ecx, ecx
call fcn.00481454
mov eax, edi
call fcn.00480d90
mov ebp, eax
test ebp, ebp
jle 0x5231f5
mov ebx, 1
mov eax, dword [esp]
call fcn.00480e88
movzx edx, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
movzx eax, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x5231c5
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5450c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5450e4
call fcn.00546244
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x545103
test bl, 1
je 0x545103
call fcn.0054dbb4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x549ed4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00543d5c
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.00543e58
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00543e58
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5761a9
lea ecx, [ebp - 0x200]
push ecx
call fcn.00543d5c
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.00543e58
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.0054b610
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x549fe5
push esi
call fcn.00543e58
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00543e58
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00542eb0
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x549fbc
xor eax, eax
jmp 0x54a06c
push esi
call fcn.00543e58
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00543e58
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00543c8b
add esp, 0xc
jmp 0x54a025
mov edi, dword [ebx + 0x24]
push edi
call fcn.00543e58
pop ecx
push eax
push esi
call fcn.00543e58
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00543e58
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00542ed0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x54a025
xor eax, eax
jmp 0x54a06c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00543d5c
add esp, 8
push 0x5761ab
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00543d5c
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.00543d5c
add esp, 8
push 0x5761ad
mov edx, dword [ebx + 0x24]
push edx
call fcn.00543d5c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54db48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x54db75
jmp 0x54dbac
call fcn.0054daf8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00543e58
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00543e58
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x54dc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5767e4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x54dd0a
cmp dword [0x5767e0], 0
jne 0x54dd0a
cmp dword [0x576a28], 0
je 0x54dcc4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0054d600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x54dcaa
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0054d600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x54dcaa
lea ebx, [ebp - 0x84]
jmp 0x54dcab
inc ebx
call fcn.0054dbe8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x54dd45
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5767e8
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00543e58
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5767eb
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x54dd45
cmp dword [0x5767e0], 0
je 0x54dd24
cmp dword [0x5767e0], 0xffffffff
je 0x54dd45
push esi
call dword [0x5767e0]
pop ecx
mov eax, dword [0x5767e4]
test eax, eax
je 0x54dd45
cmp dword [0x5767e4], 0xffffffff
je 0x54dd45
cmp byte [eax], 0
je 0x54dd45
push esi
push eax
call fcn.0054db48
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54e66c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x587594], 0
jne 0x54e6f8
cmp dword [0x5875c8], 0
jne 0x54e69c
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [0x5875c8], eax
test eax, eax
jne 0x54e69c
push str.GetEnvironmentStrings_failed
call fcn.0054dd5c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x5875c8]
jmp 0x54e6b5
lea eax, [edi + 1]
add edi, edi
add edi, 2
add ebp, eax
inc esi
add ebx, edi
push ebx
call fcn.00544124
pop ecx
mov edi, eax
test eax, eax
jne 0x54e6a8
lea edi, [ebp + 1]
mov eax, edi
add eax, eax
push eax
call fcn.00542eb0
pop ecx
mov ebx, eax
mov dword [0x587598], ebx
test ebx, ebx
jne 0x54e6e3
xor eax, eax
jmp 0x54e7bf
add edi, edi
mov edx, dword [0x5875c8]
push edi
push edx
push ebx
call fcn.00543aa4
add esp, 0xc
jmp 0x54e718
xor esi, esi
mov ebx, dword [0x587594]
jmp 0x54e712
push eax
call fcn.00544124
pop ecx
test eax, eax
jne 0x54e70e
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x54e702
lea ebx, [esi + 4]
push 4
mov dword [0x58759c], ebx
inc ebx
push ebx
call fcn.00542e14
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x54e73b
xor eax, eax
jmp 0x54e7bf
cmp dword [0x587594], 0
jne 0x54e770
xor esi, esi
mov ebx, dword [0x587598]
mov eax, dword [esp]
mov ebp, eax
jmp 0x54e761
mov dword [ebp], ebx
add edi, edi
add ebp, 4
add edi, 2
inc esi
add ebx, edi
push ebx
call fcn.00544124
pop ecx
mov edi, eax
test eax, eax
jne 0x54e753
jmp 0x54e7a1
xor esi, esi
mov ebx, dword [0x587594]
mov eax, dword [esp]
mov edi, eax
jmp 0x54e79b
push eax
call fcn.00544124
pop ecx
test eax, eax
je 0x54e790
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x54e794
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x54e77f
mov eax, dword [0x587594]
test eax, eax
je 0x54e7b1
push eax
call fcn.00542ec0
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x587594], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x551834
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0048173c
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x464cf1
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x464ceb
test ah, 4
je 0x464ceb
test al, 0x10
je 0x464ceb
mov eax, esi
call fcn.0048173c
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x464cf1
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x464c9c

Function at 0x554984
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov edx, 0x5783df
mov ecx, 1
mov eax, esi
call fcn.00552f44
push 0
push ebx
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
je 0x5549b5
mov bl, 1
jmp 0x5549b7
xor ebx, ebx
mov edx, 0x5783f0
xor ecx, ecx
mov eax, esi
call fcn.00552f44
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5560f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x556d18
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
mov ebx, eax
cmp byte [ebx], 0
jne 0x556d3e
push esp
push 0x202
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
jne 0x556d3a
mov byte [ebx], 1
jmp 0x556d3e
xor eax, eax
jmp 0x556d40
mov al, 1
add esp, 0x190
pop ebx
ret

Function at 0x556ecc
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef4
mov edi, edx
mov ebx, eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], edi
cmp dword [ebx + 8], 0
jne 0x556ef2
xor eax, eax
mov dword [esp], eax
jmp 0x556ef9
mov dword [esp], 1
xor edx, edx
mov dword [esp + 4], edx
xor esi, esi
push 0
call sub.WSOCK32.DLL_WSASetLastError
push esp
push 0
lea eax, [esp + 0x10]
lea edx, [edi + 1]
push eax
push 0
push edx
call sub.WSOCK32.DLL_select
test eax, eax
je 0x556f2c
call sub.WSOCK32.DLL_WSAGetLastError
test eax, eax
jne 0x556f2c
mov al, 1
jmp 0x556f40
inc esi
cmp byte [ebx + 1], 1
jne 0x556f35
jmp 0x556f3e
cmp esi, dword [ebx + 8]
jl 0x556f08
jmp 0x556f3e
xor eax, eax
add esp, 0x10c
pop edi
pop esi
pop ebx
ret
Function at 0x55da50
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov edx, dword [ebp + 0x14]
mov ecx, edx
mov edx, dword [ebp + 8]
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x10
jl 0x55da63
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x55db1f
mov edx, dword [ebp + 0x14]
xor eax, eax
mov ecx, edx
mov edx, dword [ebp + 0x10]
lea esi, [ebp - 0x14]
mov bl, byte [ecx]
xor bl, byte [edx]
and ebx, 0xff
mov edi, eax
and edi, reloc.WSOCK32.DLL_closesocket
jns 0x55da9f
dec edi
or edi, 0xfffffffc
inc edi
shl edi, 8
inc eax
add edi, str.cw
inc ecx
inc edx
mov bl, byte [edi + ebx]
mov byte [esi], bl
inc esi
cmp eax, 0x10
jl 0x55da86
mov eax, dword [ebp + 0x14]
push eax
lea edx, [ebp - 0x14]
push edx
call fcn.0055d30c
add dword [ebp + 0x10], 0x10
mov edx, dword [ebp + 0x14]
add esp, 8
mov ecx, edx
mov edx, dword [ebp + 0x10]
xor eax, eax
lea esi, [ebp - 0x14]
mov bl, byte [edx]
xor bl, byte [ecx]
and ebx, 0xff
lea edi, [eax + 2]
and edi, reloc.WSOCK32.DLL_closesocket
jns 0x55daf1
dec edi
or edi, 0xfffffffc
inc edi
shl edi, 8
inc eax
add edi, str.cw
inc ecx
inc edx
mov bl, byte [edi + ebx]
mov byte [esi], bl
inc esi
cmp eax, 0x10
jl 0x55dad7
mov eax, dword [ebp + 0x14]
push eax
lea edx, [ebp - 0x14]
push edx
call fcn.0055d30c
add esp, 8
add dword [ebp + 0x10], 0x10
inc dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
sar ecx, 1
jns 0x55db29
adc ecx, 0
cmp ecx, dword [ebp - 4]
jg 0x55da79
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.0055d30c
mov edx, dword [ebp + 0x14]
add esp, 8
mov esi, edx
mov edx, dword [ebp + 0x10]
xor eax, eax
lea ecx, [ebp - 0x14]
mov bl, byte [edx]
inc edx
xor bl, byte [ecx]
inc ecx
mov byte [esi], bl
inc esi
inc eax
cmp eax, 0x10
jl 0x55db4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55f394
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov eax, 0x57cef4
call fcn.00544234
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.005527d4
inc dword [ebp - 8]
mov word [ebp - 0x14], 0xc
xor edx, edx
mov dword [ebp - 0x34], edx
mov word [ebp - 0x14], 0x18
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x14], 0x18
push dword [ebp - 0x2c]
push 0
push 0x2000000
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x55f569
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov dword [ebp - 0x40], edx
lea ecx, [ebp - 0x3c]
push ecx
push 0x201eb
push dword [ebp - 0x38]
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x55f569
lea eax, [ebp - 0x48]
push eax
push 0x57ce2a
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
test eax, eax
je 0x55f569
mov dword [ebp - 0x60], 1
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x5c], edx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], 2
lea ecx, [ebp - 0x40]
push ecx
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_DuplicateTokenEx
test eax, eax
je 0x55f561
push 4
lea eax, [ebp - 0x30]
push eax
push 0xc
push dword [ebp - 0x40]
call sub.ADVAPI32.DLL_SetTokenInformation
push 0
push 0
push 0x10
lea edx, [ebp - 0x60]
push edx
push 0
push dword [ebp - 0x40]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
test eax, eax
je 0x55f559
push 0x44
push 0
lea ecx, [ebp - 0xa4]
push ecx
call fcn.00543c8b
add esp, 0xc
mov dword [ebp - 0xa4], 0x44
mov dword [ebp - 0x9c], str.winsta0default
push 0x10
push 0
lea eax, [ebp - 0xb4]
push eax
call fcn.00543c8b
add esp, 0xc
mov dword [ebp - 0x4c], 0x30
xor edx, edx
mov dword [ebp - 0x50], edx
push 1
push dword [ebp - 0x40]
lea ecx, [ebp - 0x50]
push ecx
call fcn.00560cd4
test eax, eax
je 0x55f501
or dword [ebp - 0x4c], 0x400
jmp 0x55f506
xor eax, eax
mov dword [ebp - 0x50], eax
cmp byte [ebp + 8], 1
jne 0x55f519
mov dword [ebp - 0x78], 1
mov word [ebp - 0x74], 0
lea edx, [ebp - 0xb4]
push edx
lea ecx, [ebp - 0xa4]
push ecx
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push 0
push 0
push 0
cmp dword [ebp + 0xc], 0
je 0x55f540
mov eax, dword [ebp + 0xc]
jmp 0x55f545
mov eax, 0x57ce5c
push eax
push 0
push dword [ebp - 0x40]
call sub.ADVAPI32.DLL_CreateProcessAsUserW
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x14], 0xc
jmp 0x55f584
mov eax, dword [ebp - 0x34]
push eax
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00552924
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x55f5cc
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, 0x57d0a8
call fcn.00544234
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005527d4
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
push 1
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov edi, eax
test edi, edi
jne 0x55f62e
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.00552924
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x55f689
xor ebx, ebx
push 0x10
cmp dword [ebp - 4], 0
je 0x55f63d
mov eax, dword [ebp - 4]
jmp 0x55f642
mov eax, 0x57cf2e
push eax
push edi
call sub.ADVAPI32.DLL_OpenServiceW
mov esi, eax
test esi, esi
je 0x55f665
push 0
push 0
push esi
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
je 0x55f65f
mov bl, 1
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push edi
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.00552924
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55fbf8
Capabilities:
Delete service
Manipulate safe mode programs
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, 0x57d32c
call fcn.00544234
mov dword [ebp - 0x20], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005527d4
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 0xc
push 1
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov esi, eax
test esi, esi
jne 0x55fc62
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x20]
call fcn.00552924
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x55fdf0
mov byte [ebp - 0x3d], 0
push 0xf01ff
cmp dword [ebp - 4], 0
je 0x55fc76
mov ecx, dword [ebp - 4]
jmp 0x55fc7b
mov ecx, 0x57cff6
push ecx
push esi
call sub.ADVAPI32.DLL_OpenServiceW
mov ebx, eax
test ebx, ebx
je 0x55fdcb
lea eax, [ebp - 0x5c]
push eax
push 1
push ebx
call sub.ADVAPI32.DLL_ControlService
push ebx
call sub.ADVAPI32.DLL_DeleteService
test eax, eax
je 0x55fca6
mov byte [ebp - 0x3d], 1
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov dl, 1
mov eax, dword [0x43e1ac]
call fcn.00440240
mov ebx, eax
mov edx, closesocket
mov eax, ebx
call fcn.00440328
mov word [ebp - 0x2c], 0x18
xor ecx, ecx
lea edx, [ebp - 4]
mov dword [ebp - 8], ecx
xor ecx, ecx
inc dword [ebp - 0x20]
mov eax, str.SYSTEMCurrentControlSetControlSafeBootMinimal_
mov word [ebp - 0x2c], 0x24
mov word [ebp - 0x2c], 0x30
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x20]
call fcn.00552d38
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0055294c
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00552924
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00440470
test al, al
je 0x55fd2d
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0044078c
mov eax, ebx
call fcn.004402f8
mov word [ebp - 0x2c], 0x3c
xor edx, edx
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x20]
lea edx, [ebp - 4]
mov eax, str.SYSTEMCurrentControlSetControlSafeBootNetwork_
call fcn.00552d38
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0055294c
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00552924
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00440470
test al, al
je 0x55fd87
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0044078c
mov eax, ebx
call fcn.004402f8
mov edi, ebx
mov dword [ebp - 0x18], edi
test edi, edi
je 0x55fdb5
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov word [ebp - 0x2c], 0x60
mov edx, 3
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x2c], 0x48
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2c], 0xc
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
mov al, byte [ebp - 0x3d]
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x20]
call fcn.00552924
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret