joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bbf6c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor edx, edx
push ebp
push 0x4bc0cd
push dword fs:[edx]
mov dword fs:[edx], esp
sub al, 1
jb 0x4bbf90
je 0x4bbfaa
dec al
je 0x4bbfc4
jmp 0x4bc07f
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
push 0x80
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x4bbff5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
call fcn.0040989c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x368]
call fcn.00409dd4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
test dword [eax + 0x1dfa], 0x200
jbe 0x4bc058
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
mov dl, 1
call fcn.004924fc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 0x4c0
call fcn.00404880
push 0
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
mov esi, 0xc
test esi, esi
je 0x4bc0b7
push 0x4bc0e4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, esi
call fcn.004bb160
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax + 0x31e0]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ecx, ecx
mov ebx, dword [eax]
call dword [ebx + 0x98]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc0d4
lea eax, [ebp - 4]
call fcn.0040482c
ret

Function at 0x4caff8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x4cb0af
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4cb0c8
call fcn.00404e20
test eax, eax
jle 0x4cb04e
mov edx, dword [ebp - 4]
mov eax, 0x4cb0c8
call fcn.00404e20
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ae4
dec eax
cmp ebx, eax
jne 0x4cb04e
xor ebx, ebx
jmp 0x4cb091
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.00407ae0
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x4cb0d4
mov edx, dword [ebp - 4]
call fcn.00404b30
mov eax, dword [ebp - 0x28]
call fcn.00404cdc
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb0b6
lea eax, [ebp - 0x28]
call fcn.0040482c
lea eax, [ebp - 4]
call fcn.0040482c
ret
Function at 0x4dedf4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4df054
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4dee57
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d838
cmp al, 1
jne 0x4dee57
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004debd4
test al, al
je 0x4defe3
cmp dword [ebp - 8], 0
jge 0x4dee75
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x210]
call fcn.00404ae4
cmp ebx, eax
jge 0x4deebf
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x51ba88]
and eax, 0xff
bt dword [edx], eax
jae 0x4deebf
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4deed3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004dedd0
cmp ebx, dword [ebp - 8]
je 0x4defd5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4deeff
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c7c
and eax, 0x7f
movzx eax, word [eax*2 + 0x51af84]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4defc2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c7c
and eax, 0x7f
movzx eax, word [eax*2 + 0x51af84]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044c9d0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c7c
and eax, 0x7f
movzx eax, word [eax*2 + 0x51af84]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044c9d0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4defc9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4df036
cmp dword [ebp - 8], 0
jge 0x4defee
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x218]
call fcn.00404ae4
cmp eax, dword [ebp - 8]
jg 0x4df028
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004de8bc
mov eax, dword [ebp - 0x21c]
call fcn.00404ae4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004dedd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df05b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404850
ret
Function at 0x401370
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
push edi
mov eax, dword [esi]
mov dword [esi + 4], eax
test ecx, ecx
je 0x401471
mov edi, dword [ebp + 8]
test edi, edi
je 0x401471
push 0
push 0x80
push 3
push 0
push 5
push 0x120089
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x401462
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x401458
mov eax, dword [ebp - 0x14]
cmp edi, eax
jb 0x4013db
mov edi, eax
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
cmp edi, ecx
jae 0x4013ed
lea ebx, [edx + edi]
jmp 0x401416
jbe 0x401419
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x401406
push ecx
push edi
mov ecx, esi
call fcn.00401d90
mov ebx, dword [esi + 4]
jmp 0x401419
sub edi, ecx
push edi
push 0
push ebx
call fcn.00437130
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov eax, dword [esi]
lea ecx, [ebp - 8]
mov edi, dword [ebp - 0xc]
sub ebx, eax
push 0
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esi]
test eax, eax
je 0x40143f
mov eax, dword [esi + 4]
sub eax, ecx
cmp dword [ebp - 8], eax
je 0x40145b
push edi
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402060
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455485
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x40228f
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
lea edx, [ecx + 2]
mov dword [ebp - 4], 0xffffffff
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4020d4
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00401680
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x78]
call fcn.00406940
push eax
mov ecx, edi
call fcn.004039b0
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x40213e
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402134
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022ac
push edx
push ecx
call fcn.0041fbbf
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
cmp edx, 8
jb 0x402191
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402187
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022ac
push edx
push ecx
call fcn.0041fbbf
add esp, 8
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x40228f
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
lea edx, [ecx + 2]
mov dword [ebp - 4], 0xffffffff
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4021d4
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00401680
lea edx, [ebp - 0x60]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x90]
call fcn.00406940
push eax
mov ecx, ebx
call fcn.004039b0
mov edx, dword [ebp - 0x7c]
cmp edx, 0x10
jb 0x402240
mov ecx, dword [ebp - 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402236
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022b1
push edx
push ecx
call fcn.0041fbbf
add esp, 8
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0xf
mov byte [ebp - 0x90], 0
cmp edx, 8
jb 0x40228b
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402281
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022b1
push edx
push ecx
call fcn.0041fbbf
add esp, 8
mov al, 1
jmp 0x402291
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
call fcn.00439d3f
call fcn.00439d3f
int3
Function at 0x406230
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], edx
test edi, edi
je 0x406248
mov dword [edi], 0
test esi, esi
jne 0x406254
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 8
call fcn.0041fb8a
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], ebx
push 0
push 4
push ebx
push 0x406200
push 0
push 0
mov dword [ebx], esi
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
setne byte [ebp + 0xb]
test esi, esi
je 0x4062b8
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test edi, edi
je 0x4062a3
mov al, byte [ebp + 0xb]
pop ebx
mov dword [edi], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4062c3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp + 0xb]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 8
push ebx
call fcn.0041fbbf
add esp, 8
mov al, byte [ebp + 0xb]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4076f0
Capabilities:
Check os version

Disassembly:
push ebx
push esi
mov esi, dword [0x47168c]
push edi
mov edi, ecx
cmp esi, 1
je 0x407777
test esi, esi
jne 0x407726
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xa4]
mov eax, dword [eax + 0xa8]
cmp ecx, 0xa
jne 0x407755
mov esi, 4
mov dword [0x47168c], esi
test edi, edi
je 0x407777
mov edx, edi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407730
sub edx, ecx
sar edx, 1
je 0x407777
xor eax, eax
test edx, edx
je 0x407783
cmp word [edi + eax*2], 0x2d
je 0x40777e
inc eax
cmp eax, edx
jb 0x407747
jmp 0x40777f
cmp ecx, 6
jne 0x40776d
cmp eax, 3
jne 0x407763
mov esi, eax
jmp 0x407720
add eax, 0xffffffff
jne 0x40776d
lea esi, [eax + 2]
jmp 0x407720
mov dword [0x47168c], 1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
inc eax
cmp edx, eax
je 0x407777
cmp esi, 4
je 0x40778d
lea edi, [edi + eax*2]
sub edx, eax
xor bl, bl
xor eax, eax
test edx, edx
je 0x4077b5
lea ecx, [edi + edx*2]
movzx esi, word [ecx]
test bl, bl
jne 0x4077a8
cmp esi, 0x2e
jne 0x4077ad
mov bl, 1
jmp 0x4077ad
cmp esi, 0x2d
je 0x4077b5
inc eax
sub ecx, 2
cmp eax, edx
jb 0x407798
sub edx, eax
je 0x407777
cmp edx, eax
je 0x407777
mov ecx, dword fs:[0x30]
mov eax, dword [0x47168c]
sub eax, 2
je 0x4077fa
sub eax, 1
je 0x4077e9
sub eax, 1
jne 0x407777
push dword [ecx + 0x38]
mov ecx, edi
call fcn.004074c0
add esp, 4
pop edi
pop esi
pop ebx
ret
push dword [ecx + 0x38]
mov ecx, edi
call fcn.00407970
add esp, 4
pop edi
pop esi
pop ebx
ret
push dword [ecx + 0x38]
mov ecx, edi
call fcn.00407810
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x407ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4716b4], 0
push esi
push edi
je 0x407b00
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ecx
mov edx, 0x466078
lea ecx, [ebp - 0x210]
call fcn.004063f0
push 0x46607c
lea eax, [ebp - 0x210]
push eax
push str._s_s
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.004064a0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x418]
add esp, 0x18
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x210]
push str.crypt32.dll
push eax
push str._s_s
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.004064a0
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
call esi
mov esi, eax
test edi, edi
je 0x407cba
test esi, esi
je 0x407cba
push ecx
mov edx, str.WinVerifyTrust
mov ecx, edi
call fcn.00408100
mov dword [0x4716a4], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CryptDecodeObject
mov ecx, esi
call fcn.00408100
mov dword [0x4716a8], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CryptQueryObject
mov ecx, esi
call fcn.00408100
mov dword [0x4716b8], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CryptMsgGetParam
mov ecx, esi
call fcn.00408100
mov dword [0x471694], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CertEnumCertificatesInStore
mov ecx, esi
call fcn.00408100
mov dword [0x4716c0], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CertFindCertificateInStore
mov ecx, esi
call fcn.00408100
mov dword [0x4716ac], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CertGetNameStringW
mov ecx, esi
call fcn.00408100
mov dword [0x471698], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CertFreeCertificateContext
mov ecx, esi
call fcn.00408100
mov dword [0x4716bc], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CertOpenSystemStoreW
mov ecx, esi
call fcn.00408100
mov dword [0x4716b0], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CertCloseStore
mov ecx, esi
call fcn.00408100
mov dword [0x47169c], eax
test eax, eax
je 0x407cba
push ecx
mov edx, str.CryptMsgClose
mov ecx, esi
call fcn.00408100
mov dword [0x4716a0], eax
test eax, eax
je 0x407cba
mov al, 1
mov byte [0x4716b4], al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x4716b4]
xor ecx, ebp
pop edi
pop esi
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
Function at 0x407cd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
call fcn.00407ad0
test al, al
jne 0x407d05
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x407e3e
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x407e3e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x274], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x29c], 0x10
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x28c], 0x30
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x280], 2
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x264], pe_nt_image_headers32
cmp dword [eax + 0xa4], 5
je 0x407de2
mov dword [ebp - 0x264], 0x1110
lea eax, [ebp - 0x28c]
push eax
push 0x46fa50
push 0xffffffffffffffff
call dword [0x4716a4]
cmp eax, 0x800b0109
je 0x407e09
xor ebx, ebx
test eax, eax
setne bl
add ebx, 3
jmp 0x407e0e
mov ebx, 4
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x270], 2
push eax
push 0x46fa50
push 0xffffffffffffffff
call dword [0x4716a4]
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 2
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret

Function at 0x4080b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push esi
mov ebx, ecx
mov esi, dword [eax + 0xc]
mov esi, dword [esi + 0xc]
test ebx, ebx
jne 0x4080ca
mov eax, dword [esi + 0x18]
pop esi
pop ebx
ret
push edi
test esi, esi
je 0x4080f0
nop
mov edi, dword [esi + 0x18]
test edi, edi
je 0x4080f0
mov edx, dword [esi + 0x30]
mov ecx, ebx
push 0xffffffffffffffff
call fcn.00406540
add esp, 4
test al, al
jne 0x4080f6
mov esi, dword [esi]
test esi, esi
jne 0x4080d0
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x40a2b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
mov edx, eax
lea ecx, [edi - 1]
mov esi, dword [ebx + 0x28]
test edi, edi
je 0x40a2fe
test ecx, ecx
je 0x40a2f9
jmp 0x40a2e0
movzx eax, word [esi]
mov word [edx], ax
test ax, ax
je 0x40a2f6
add esi, 2
add edx, 2
sub ecx, 1
jne 0x40a2e0
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov word [edx], cx
mov ecx, eax
call fcn.00406600
movzx eax, word [ebx + 0x24]
cmp eax, edi
jb 0x40a30f
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40be40
Capabilities:
Create service
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 2
push esi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x40bfa8
cmp dword [edi + 0x14], 8
jb 0x40be7a
mov edi, dword [edi]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 3
push 1
push 0x10030
push 0x466318
push 0x466318
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
je 0x40bf42
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40bf9d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x40bf9d
call edi
push eax
lea eax, [ebp - 0x1c]
push str.StartService_failed_with__i.
push eax
call fcn.004123f0
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push eax
call fcn.00403700
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40bf28
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bf1e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c014
push edx
push ecx
call fcn.0041fbbf
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call edi
push ebx
xor esi, esi
call edi
jmp 0x40bfff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.CreateService_failed_with__i.
push eax
call fcn.004123f0
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push eax
call fcn.00403700
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40bf9d
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bf93
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c019
push edx
push ecx
call fcn.0041fbbf
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
jmp 0x40bfff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.OpenSCManager_failed_with__i.
push eax
call fcn.004123f0
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push eax
call fcn.00403700
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40bfff
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40bff5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c01e
push edx
push ecx
call fcn.0041fbbf
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret 8
call fcn.00439d3f
call fcn.00439d3f
call fcn.00439d3f
int3
Function at 0x40fe20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 8
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40fec9
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x14
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40fe76
cmp dword [ebp - 0x24], 0
setne bl
jmp 0x40fef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str._EAC_Service___Error__Failed_to_get_token_info:__i.
push eax
call fcn.00412330
add esp, 0xc
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
jb 0x40fe9a
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x40fef6
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40feec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff15
jmp 0x40feec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str._EAC_Service___Error__Failed_to_get_process_token:__i.
push eax
call fcn.00412330
add esp, 0xc
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
jb 0x40fe9a
jmp 0x40fe97
push edx
push ecx
call fcn.0041fbbf
add esp, 8
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x40ff04
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041fb7c
mov esp, ebp
pop ebp
ret
call fcn.00439d3f
int3