joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e228
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x5c2c40
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesHaspnt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e27a
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e39b
mov dword [ebp - 0xc], 0xc
push 0x532fb0
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e2e9
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10006
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e39b
push 0x532fb8
lea ecx, [ebp - 0x18]
push ecx
call fcn.00420970
add esp, 8
test eax, eax
jl 0x40e35f
push 0x532fc0
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x5c30e0
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e35f
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e39b
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e399
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e39b
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40eb75
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._setup_aladdin_
push 0x5c2a40
call fcn.004202e0
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x40ebfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x40ebfc
cmp dword [ebp - 4], 5
jne 0x40ebfc
push 0x4000b
call fcn.00406ccc
add esp, 4
push 0x2020000
call fcn.00406c68
add esp, 4
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40f831
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
cmp dword [0x430044], 0
je 0x40f911
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x533278
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f911
mov dword [ebp - 0xc], 4
push 0x5332b0
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x5c30e0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f907
push 0x5332d0
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov dword [ebp - 8], 0
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5c30e0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f8fb
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f911
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x40f918
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x430044], 0
je 0x40f98f
cmp dword [ebp + 8], 1
jne 0x40f98f
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesPerfProcPerformance
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40f98f
push str.Disable_Performance_Counters
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x5c30e0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x41054a
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x533728
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x410576
xor eax, eax
jmp 0x41067e
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0x5bc8ac
push 0
push 0x53375c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4105b7
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41067e
push 0x53377c
call fcn.00420150
add esp, 4
push eax
push 0x533788
push 1
push 0
push 0x533794
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x4105f7
xor eax, eax
jmp 0x41067e
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0x5bc8b0
push 0
push 0x53379c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410635
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41067e
push 0x5337cc
call fcn.00420150
add esp, 4
push eax
push 0x5337d8
push 1
push 0
push 0x5337e4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x41067c
xor eax, eax
jmp 0x41067e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x410e6f
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
jmp 0x410e89
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 3
cmp edx, dword [ebp + 8]
jbe 0x410ea7
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0xc]
mov dl, byte [ecx - 4]
mov byte [eax], dl
jmp 0x410e80
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 8]
mov byte [eax], 0x52
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 8]
mov byte [ecx + 1], 0x45
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 8]
mov byte [edx + 2], 0x4d
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 8]
mov byte [eax + 3], 0x20
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp + 8], ecx
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533858
push 0x5c2a40
call fcn.004202e0
add esp, 8
push str.config.nt
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x5c2a40
call fcn.00408b00
add esp, 4
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x410f50
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410faf
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410f8d
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410faf
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x410fad
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410faf
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4113dd
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.0041136d
cmp eax, 0xffffffff
jne 0x4113f5
or eax, 0xffffffff
jmp 0x41162a
mov eax, dword [0x5c2c40]
push eax
call fcn.00407ddf
add esp, 4
cmp eax, 0xffffffff
jne 0x41141d
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x41162a
push 0x5339a8
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 4
push 0x5339b8
push 1
push 0
push 0x5c30e0
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411476
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41162a
mov dword [ebp - 0xc], 0xffff
push 0x5339bc
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x5c30e0
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4114d5
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41162a
mov dword [ebp - 0x10], 3
push 0x5339c8
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x5c30e0
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411534
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41162a
mov dword [ebp - 4], 1
push 0x5339dc
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x5c30e0
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411593
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41162a
mov ecx, dword [0x5c2c40]
push ecx
call fcn.0040787b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4115bd
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x41162a
cmp dword [0x430048], 0
je 0x4115e6
push 0xd
push 0x5339f4
push 1
push 0x533a04
push 0x533a10
call fcn.00408266
add esp, 0x14
mov dword [ebp - 8], eax
jmp 0x411604
push 9
push 0x533a44
push 1
push 0x533a50
push 0x533a5c
call fcn.00408266
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41161b
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x41162a
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41162e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5c2c40
push 0x5c2820
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411662
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4116d5
push 0x533a90
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 0xd
push str.Devicehasp
push 1
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4116ab
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4116d5
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4116d3
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4116d5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41178e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
push 0x5c2820
call fcn.004202d0
add esp, 8
push str.Parallel_arbitrator
push 0x5c30a0
call fcn.004202d0
add esp, 8
push 0x5c2c40
push 0x5c2820
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4117eb
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411879
push str.HASP
push 0x5c30e0
call fcn.004202d0
add esp, 8
push 0
push 0
push 0x5c3320
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41184f
push 0x5c30e0
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41184f
push 0x10004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411879
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411877
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411879
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41187d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov ecx, 7
mov esi, str._SystemRoot_System32Drivers_
lea edi, [ebp - 0x208]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x78
xor eax, eax
lea edi, [ebp - 0x1e9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x533b84
lea eax, [ebp - 0x208]
push eax
call fcn.004202e0
add esp, 8
push 0x533b8c
lea ecx, [ebp - 0x208]
push ecx
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x41192a
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.004202d0
add esp, 8
push 0x533b94
lea ecx, [ebp - 0x208]
push ecx
call fcn.004202e0
add esp, 8
push 0x533b98
lea edx, [ebp - 0x208]
push edx
call fcn.004202e0
add esp, 8
push 0x533ba0
lea eax, [ebp - 0x208]
push eax
call fcn.004202e0
add esp, 8
push str.SYSTEMCurrentControlSetServicesEventLogSystem_
push 0x5c2e80
call fcn.004202d0
add esp, 8
push 0x533bdc
push 0x5c2e80
call fcn.004202e0
add esp, 8
push 0x5c2c40
push 0x5c2e80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411981
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411a55
push str.EventMessageFile
push 0x5c30e0
call fcn.004202d0
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call fcn.00420150
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x208]
push edx
push 2
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4119ea
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411a55
push str.TypesSupported
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov dword [ebp - 8], 7
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411a46
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411a55
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411a5b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 0x110]
push eax
push 0x10008
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411b15
mov dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
jne 0x411b13
mov dword [ebp - 4], 0x100
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x103
jne 0x411aee
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x411b13
cmp dword [ebp - 8], 0
jne 0x411b11
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x411a94
jmp 0x411b31
cmp dword [ebp - 8], 2
jne 0x411b1f
xor eax, eax
jmp 0x411b33
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411b33
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x411b37
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x411bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x431
jne 0x411b99
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x411c1e
cmp dword [ebp - 8], 0x430
je 0x411bb4
push 0x20003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411c1e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x411bd1
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x430
jne 0x411be4
cmp dword [ebp - 0xc], 0xa
jl 0x411b44
cmp dword [ebp - 0xc], 0xa
jne 0x411bfc
push 0x20003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411c1e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x411c1c
push 0x20004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411c1e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x411c22
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x411c59
push 0x20005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411d54
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x411d32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x420
jne 0x411d16
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x411cc2
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411d54
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x411cc2
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x411d14
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411d54
jmp 0x411d32
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411d54
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x411d52
push 0x20004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411d54
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x411d58
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x411da3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x411d8e
xor eax, eax
jmp 0x411e34
push 0x20005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411e34
lea edx, [ebp - 0x3c]
push edx
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x411df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x41c
je 0x411df3
cmp dword [ebp - 0x40], 0x426
je 0x411df3
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411e34
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x411df3
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x411e32
push 0x20004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411e34
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x411e38
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x411e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x411e69
xor eax, eax
jmp 0x411ec7
push 0x20005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411ec7
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x411ea5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20008
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411ec7
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x411ec5
push 0x20002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411ec7
xor eax, eax
mov esp, ebp
pop ebp
ret