joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c40
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e189
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x4251d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
push eax
push str.__del_reg__KEY:
lea ecx, [ebp - 0x30]
push ecx
call fcn.0040a7c0
add esp, 0xc
mov dword [ebp - 0x16c], eax
mov edx, dword [ebp - 0x16c]
mov dword [ebp - 0x170], edx
mov dword [ebp - 4], 0
push str.__Value:
mov eax, dword [ebp - 0x170]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040a870
add esp, 0xc
mov dword [ebp - 0x174], eax
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x178], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x178]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.0040a940
add esp, 0xc
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.00401580
add esp, 4
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.004077c0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.004077c0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004077c0
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x18], 0x10
jb 0x404d51
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x184], ecx
jmp 0x404d5d
mov edx, dword [ebp + 0xc]
add edx, 4
mov dword [ebp - 0x184], edx
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x184]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404e4d
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 0x10
jb 0x404d98
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x188], edx
jmp 0x404da4
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x404e0d
push str.____done.
lea ecx, [ebp - 0x84]
call fcn.00406560
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x84]
push ecx
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.004077c0
mov al, 1
jmp 0x404e8b
push str.____failed.
lea ecx, [ebp - 0xa0]
call fcn.00406560
mov dword [ebp - 4], 4
lea edx, [ebp - 0xa0]
push edx
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0xa0]
call fcn.004077c0
xor al, al
jmp 0x404e8b
push str.____not_exist
lea ecx, [ebp - 0xbc]
call fcn.00406560
mov dword [ebp - 4], 5
lea eax, [ebp - 0xbc]
push eax
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0xbc]
call fcn.004077c0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x404ea0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e1c0
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4251d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x404edc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x7c], edx
jmp 0x404ee5
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x404f24
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x404f0c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x80], ecx
jmp 0x404f15
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 0x80], edx
push 0x80
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x404f3b
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x84], eax
jmp 0x404f47
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x404faf
mov eax, dword [ebp + 8]
push eax
push str.__del_file:
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040a7c0
add esp, 0xc
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x8c]
push eax
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.004077c0
jmp 0x405021
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 5
jne 0x405021
mov ecx, dword [ebp + 8]
push ecx
call fcn.004058e0
add esp, 4
movzx edx, al
test edx, edx
je 0x405021
mov eax, dword [ebp + 8]
push eax
push str.__del_file_after_rebooting:
lea ecx, [ebp - 0x50]
push ecx
call fcn.0040a7c0
add esp, 0xc
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x94], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x94]
push eax
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.004077c0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4058e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e2c0
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4251d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x405923
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x7c], edx
jmp 0x40592c
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
and edx, 0x10
je 0x4059de
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x405959
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x80], edx
jmp 0x405962
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x80], eax
push 4
push 0
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4059d2
mov edx, dword [ebp + 8]
push edx
push str.__del_dir_on_reboot_:
lea eax, [ebp - 0x34]
push eax
call fcn.0040a7c0
add esp, 0xc
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x88], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x88]
push edx
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.004077c0
mov al, 1
jmp 0x405ac9
xor al, al
jmp 0x405ac9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x4059f5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x8c], edx
jmp 0x405a01
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x405a1e
mov al, 1
jmp 0x405ac9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jne 0x405a34
mov al, 1
jmp 0x405ac9
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0x10
jb 0x405a4b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x90], ecx
jmp 0x405a57
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 0x90], edx
push 4
push 0
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x405ac7
mov ecx, dword [ebp + 8]
push ecx
push str.__del_file_on_reboot_:
lea edx, [ebp - 0x50]
push edx
call fcn.0040a7c0
add esp, 0xc
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.004077c0
mov al, 1
jmp 0x405ac9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x405f40
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x23f4
call fcn.004112b0
lea eax, [ebp - 0x23ec]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x23dc
lea edx, [ebp - 0x23e8]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40608b
mov dword [ebp - 0x23f0], 0
jmp 0x405f98
mov ecx, dword [ebp - 0x23f0]
add ecx, 1
mov dword [ebp - 0x23f0], ecx
mov edx, dword [ebp - 0x23f0]
cmp edx, dword [ebp - 0x23ec]
jae 0x406082
push 0xf01ff
mov eax, dword [ebp - 0x23f0]
imul eax, eax, 0x24
mov ecx, dword [ebp + eax - 0x23e8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x23f4], eax
cmp dword [ebp + 0xc], 0
jne 0x405fdd
xor eax, eax
jmp 0x40608d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x23f4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00405f40
add esp, 0xc
mov eax, dword [ebp - 0x23f4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x23f0]
imul ecx, ecx, 0x24
cmp dword [ebp + ecx - 0x23dc], 2
je 0x40603a
mov edx, dword [ebp - 0x23f0]
imul edx, edx, 0x24
cmp dword [ebp + edx - 0x23dc], 4
je 0x40603a
mov eax, dword [ebp - 0x23f0]
imul eax, eax, 0x24
cmp dword [ebp + eax - 0x23dc], 5
jne 0x40607d
mov ecx, dword [ebp - 0x23f0]
imul ecx, ecx, 0x24
mov edx, dword [ebp + ecx - 0x23e8]
push edx
push 0x104
movzx eax, word [0x43658c]
imul eax, eax, 0x104
add eax, 0x426188
push eax
call fcn.0041194e
add esp, 0xc
mov cx, word [0x43658c]
add cx, 1
mov word [0x43658c], cx
jmp 0x405f89
mov eax, 1
jmp 0x40608d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4060a0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4060c2
xor eax, eax
jmp 0x4061d7
mov dword [ebp - 0x28], 0
jmp 0x4060d4
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x100
jae 0x4061d2
push 0xf01ff
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x104
add ecx, 0x426188
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40611a
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4061d7
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x406147
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4061d7
cmp dword [ebp - 0x1c], 4
je 0x4061b9
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x2c], 0
jmp 0x40616d
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1e
jae 0x4061b9
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40619f
cmp dword [ebp - 0x1c], 4
jne 0x406192
jmp 0x4061b9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4061b7
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4061d7
jmp 0x406164
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4060cb
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4061e0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e366
mov eax, dword fs:[0]
push eax
mov eax, 0x24ac
call fcn.004112b0
mov eax, dword [0x4251d4]
xor eax, ebp
mov dword [ebp - 0x2400], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x23f8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x23dc
lea edx, [ebp - 0x23f4]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x406370
mov dword [ebp - 0x23fc], 0
jmp 0x40625d
mov ecx, dword [ebp - 0x23fc]
add ecx, 1
mov dword [ebp - 0x23fc], ecx
mov edx, dword [ebp - 0x23fc]
cmp edx, dword [ebp - 0x23f8]
jae 0x40636a
push 0xf01ff
mov eax, dword [ebp - 0x23fc]
imul eax, eax, 0x24
mov ecx, dword [ebp + eax - 0x23f4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x2420], eax
cmp dword [ebp - 0x2420], 0
jne 0x4062a5
xor al, al
jmp 0x406372
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x2420]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004061e0
add esp, 0xc
mov eax, dword [ebp - 0x2420]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x23fc]
imul ecx, ecx, 0x24
mov edx, dword [ebp + ecx - 0x23f4]
push edx
lea ecx, [ebp - 0x241c]
call fcn.00406560
mov dword [ebp - 4], 0
cmp dword [ebp - 0x2404], 0x10
jb 0x406303
mov eax, dword [ebp - 0x2418]
mov dword [ebp - 0x24b8], eax
jmp 0x40630f
lea ecx, [ebp - 0x2418]
mov dword [ebp - 0x24b8], ecx
mov edx, dword [ebp - 0x24b8]
push edx
lea ecx, [ebp - 0x243c]
call fcn.00406560
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x243c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00406390
add esp, 0xc
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x243c]
call fcn.004077c0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x241c]
call fcn.004077c0
jmp 0x40624e
mov al, 1
jmp 0x406372
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2400]
xor ecx, ebp
call fcn.00411116
mov esp, ebp
pop ebp
ret
Function at 0x406390
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e3bb
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4251d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x11], 1
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x4063d3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x11c], edx
jmp 0x4063df
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0x11c], eax
push 0xf01ff
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406405
xor al, al
jmp 0x40654b
mov eax, dword [ebp + 0xc]
push eax
push str.__stopping_service:
lea ecx, [ebp - 0x50]
push ecx
call fcn.0040a7c0
add esp, 0xc
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x124], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x124]
push eax
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.004077c0
mov dword [ebp - 0x34], 0
jmp 0x406467
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp + 0x10]
jae 0x40653e
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40648e
mov byte [ebp - 0x11], 0
jmp 0x40653e
cmp dword [ebp - 0x2c], 1
je 0x4064b9
cmp dword [ebp - 0x34], 0
jne 0x4064b7
lea edx, [ebp - 0x30]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4064b7
mov byte [ebp - 0x11], 0
jmp 0x40653e
jmp 0x4064f2
push str.__stopped
lea ecx, [ebp - 0x6c]
call fcn.00406560
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x6c]
push ecx
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.004077c0
mov byte [ebp - 0x11], 1
jmp 0x40653e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41f6b4
lea ecx, [ebp - 0x88]
call fcn.00406560
mov dword [ebp - 4], 2
lea edx, [ebp - 0x88]
push edx
call fcn.00401580
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x88]
call fcn.004077c0
jmp 0x40645e
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ce30
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41eaf6
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x4251d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x114]
call fcn.0040bed0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x114]
mov dword [eax], vtable.DiasInstall::FirewallPecker_FWAS.0
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x114]
add edx, 4
push edx
push 0x41fef4
push 1
push 0
push 0x41fee4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40cf5e
push 0x41feb8
lea ecx, [ebp - 0x74]
call fcn.00406560
mov byte [ebp - 4], 1
push str.CoCreateInstance___fail
lea ecx, [ebp - 0x90]
call fcn.00406560
mov byte [ebp - 4], 2
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040b890
mov byte [ebp - 4], 3
mov dword [ebp - 0x58], vtable.DiasInstall::FwError.0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xe8], ecx
push 0
push 0
mov ecx, dword [ebp - 0xe8]
call fcn.004077c0
mov edx, dword [0x41ff6c]
push edx
push 0
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xe8]
call fcn.00407220
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
push 0x422e2c
lea edx, [ebp - 0x58]
push edx
call fcn.004119b6
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x90]
call fcn.004077c0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x74]
call fcn.004077c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411116
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4251d4]
jne 0x411120
repz ret
jmp fcn.004151ec

Function at 0x41aa84
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414bda
and dword [ebp - 4], 0
cmp dword [0x437044], 0
mov ebx, eax
jne 0x41ab35
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41abe6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x421860
push edi
call esi
test eax, eax
je 0x41abe6
push eax
call fcn.00414b68
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437044], eax
call esi
push eax
call fcn.00414b68
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437048], eax
call esi
push eax
call fcn.00414b68
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43704c], eax
call esi
push eax
call fcn.00414b68
pop ecx
mov dword [0x437054], eax
test eax, eax
je 0x41ab35
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00414b68
pop ecx
mov dword [0x437050], eax
mov eax, dword [0x437050]
cmp eax, ebx
je 0x41ab8d
cmp dword [0x437054], ebx
je 0x41ab8d
push eax
call fcn.00414be3
push dword [0x437054]
mov esi, eax
call fcn.00414be3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ab8d
test edi, edi
je 0x41ab8d
call esi
test eax, eax
je 0x41ab84
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ab84
test byte [ebp - 0xc], 1
jne 0x41ab8d
or dword [ebp + 0x10], 0x200000
jmp 0x41abc6
mov eax, dword [0x437048]
cmp eax, ebx
je 0x41abc6
push eax
call fcn.00414be3
pop ecx
test eax, eax
je 0x41abc6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41abc6
mov eax, dword [0x43704c]
cmp eax, ebx
je 0x41abc6
push eax
call fcn.00414be3
pop ecx
test eax, eax
je 0x41abc6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437044]
call fcn.00414be3
pop ecx
test eax, eax
je 0x41abe6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41abe8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4397e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x439805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x439878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x43983a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x43986d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43986b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x439831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4397fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401160
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x488014]
xor eax, ebp
mov dword [ebp - 4], eax
push str.title_Vinject
call fcn.0042e242
add esp, 4
push str.color_0a
call fcn.0042e242
add esp, 4
push 0x401b30
push str.Injecting_HUX_Remastered_to_csgo.exe_
push 0x4899b8
call fcn.00401380
add esp, 8
mov ecx, eax
call fcn.00402bf0
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x108]
push eax
push 0x104
push str.hux.dll
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push str.csgo.exe
call fcn.004010d0
add esp, 4
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push ecx
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10c], eax
push 4
push 0x3000
push 0x104
push 0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x110], eax
push 0
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x401b30
push str.Nigga_koolaid_in_a_melon_UwU
push 0x4899b8
call fcn.00401380
add esp, 8
mov ecx, eax
call fcn.00402bf0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421706
mov esp, ebp
pop ebp
ret