joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1e0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
xor edi, edi
cmp dword [0x46439c], edi
je 0x40c235
mov eax, dword [0x4643a0]
cmp eax, edi
je 0x40c202
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x46439c]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40c226
mov ecx, dword [0x46439c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x46439c]
push edx
call esi
mov dword [0x46439c], edi
mov eax, dword [0x4643a0]
cmp eax, edi
je 0x40c247
push eax
call esi
mov dword [0x4643a0], edi
mov eax, dword [0x4643a8]
cmp eax, edi
je 0x40c259
push eax
call esi
mov dword [0x4643a8], edi
mov eax, dword [0x4643ac]
cmp eax, edi
je 0x40c26b
push eax
call esi
mov dword [0x4643ac], edi
mov eax, dword [0x4643b0]
cmp eax, edi
je 0x40c27d
push eax
call esi
mov dword [0x4643b0], edi
mov eax, dword [0x4643b4]
cmp eax, edi
je 0x40c293
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x4643b4], edi
mov eax, dword [0x4643a4]
cmp eax, edi
je 0x40c2a5
push eax
call esi
mov dword [0x4643a4], edi
mov eax, dword [0x4643b8]
cmp eax, edi
je 0x40c2b7
push eax
call esi
mov dword [0x4643b8], edi
pop edi
pop esi
ret

Function at 0x40c3c0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
push esi
push 0
push 2
mov dword [esp + 0xc], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c40c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0043244e
add esp, 0x234
ret
push ebx
push edi
push 0x228
xor edi, edi
lea ecx, [esp + 0x18]
push edi
push ecx
mov ebx, 0x490
call fcn.00433ff0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40c46f
nop
lea eax, [esp + 0x34]
push str.explorer.exe
push eax
call fcn.00433682
add esp, 8
test eax, eax
je 0x40c467
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40c440
jmp 0x40c477
mov edi, dword [esp + 0x18]
xor ebx, ebx
jmp 0x40c477
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40c49d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40c4bf
mov edx, dword [esp + 0x10]
push edx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40c4ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call ebp
mov eax, ebx
mov ecx, dword [esp + 0x240]
pop ebp
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.0043244e
add esp, 0x234
ret
Function at 0x40c5b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x114], eax
test esi, esi
jne 0x40c5e0
or eax, 0xffffffff
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043244e
add esp, 0x118
ret
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.00433ff0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40c618
cmp dword [esp + 4], 5
jne 0x40c618
cmp dword [esp + 8], 0
je 0x40c63a
push esi
call fcn.0040c4e0
add esp, 4
test eax, eax
jne 0x40c63a
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043244e
add esp, 0x118
ret
push esi
call fcn.0040c3c0
mov ecx, dword [esp + 0x118]
add esp, 4
xor ecx, esp
call fcn.0043244e
add esp, 0x118
ret

Function at 0x40c660
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x18
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push edi
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
mov edi, ecx
push 2
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0x37], bl
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40c741
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 2
push edi
call ebp
test eax, eax
jne 0x40c6de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40c740
mov eax, dword [esp + 0x10]
push esi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
push edx
mov esi, eax
push esi
push 2
push edi
call ebp
test eax, eax
je 0x40c734
xor edi, edi
cmp dword [esi], ebx
jbe 0x40c734
lea ebp, [esi + 4]
jmp 0x40c710
mov eax, dword [ebp]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40c72f
add edi, 1
add ebp, 8
cmp edi, dword [esi]
jb 0x40c710
jmp 0x40c734
mov byte [esp + 0x13], 1
cmp esi, ebx
je 0x40c73f
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebp
mov eax, dword [esp + 0x10]
pop edi
cmp eax, ebx
pop ebx
je 0x40c752
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x14]
mov al, byte [esp + 3]
xor ecx, esp
call fcn.0043244e
add esp, 0x18
ret
Function at 0x40c770
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 1
push 0
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40c816
push 0x110
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00433ff0
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40c7f9
cmp dword [esp + 0xc], 6
jne 0x40c7f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0043244e
add esp, 0x120
ret
mov dword [ebx], 0
xor eax, eax
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0043244e
add esp, 0x120
ret
mov edx, dword [esp + 4]
push esi
xor eax, eax
test edx, edx
push edi
mov edi, dword [esp + 8]
mov esi, 0x490
jbe 0x40c84b
lea ecx, [edi + 8]
mov edi, edi
cmp dword [ecx], 0
je 0x40c841
add eax, 1
add ecx, 0xc
cmp eax, edx
jb 0x40c830
jmp 0x40c84b
lea ecx, [eax + eax*2]
mov edx, dword [edi + ecx*4]
mov dword [ebx], edx
xor esi, esi
push edi
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [esp + 0x124]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0043244e
add esp, 0x120
ret
Function at 0x40ca30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x274
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x40ca57
xor eax, eax
jmp 0x40cb8e
push 0x206
lea eax, [esp + 0x76]
push ebx
push eax
mov word [esp + 0x7c], bx
call fcn.00433ff0
add esp, 0xc
lea edi, [esp + 0x70]
call fcn.0040c9c0
lea esi, [esp + 0x14]
xor edi, edi
mov dword [esp + 0x14], ebx
call fcn.0040c5b0
test eax, eax
jne 0x40cb7d
push 0x40
lea ecx, [esp + 0x30]
push ebx
push ecx
mov dword [esp + 0x34], 0x44
call fcn.00433ff0
xor eax, eax
add esp, 0xc
push str.userenv.dll
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], str.Winsta0Default
lea ebp, [edi + 0x30]
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40cb18
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push esi
call ebx
push str.DestroyEnvironmentBlock
push esi
mov edi, eax
call ebx
test edi, edi
mov ebx, eax
je 0x40cb18
mov edx, dword [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x40cb10
mov ebp, 0x430
jmp 0x40cb18
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push 0
push eax
push ebp
push 0
push 0
push 0
lea ecx, [esp + 0x90]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40cb56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40cb65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40cb70
mov eax, dword [esp + 0x10]
push eax
call ebx
test esi, esi
je 0x40cb7b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40cb8c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043244e
add esp, 0x274
ret
Function at 0x40cbb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x26c
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x264], eax
push esi
mov esi, ecx
test esi, esi
push edi
jne 0x40cbe5
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.0043244e
add esp, 0x26c
ret
push 0x206
lea eax, [esp + 0x66]
push 0
push eax
mov word [esp + 0x6c], 0
call fcn.00433ff0
lea edi, [esp + 0x6c]
call fcn.0040c9c0
push 0x40
lea ecx, [esp + 0x2c]
push 0
push ecx
mov dword [esp + 0x30], 0x44
call fcn.00433ff0
add esp, 0x18
xor eax, eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, edi
push ecx
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x40cc69
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40cc74
push eax
call edi
mov ecx, dword [esp + 0x26c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0043244e
add esp, 0x26c
ret
Function at 0x40cc90
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0x38c
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x384], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x40ccb7
xor eax, eax
jmp 0x40ce56
push 0x206
lea eax, [esp + 0x18e]
push ebx
push eax
mov word [esp + 0x194], bx
call fcn.00433ff0
lea edi, [esp + 0x194]
call fcn.0040c9c0
push 0x110
lea ecx, [esp + 0x84]
push ebx
push ecx
call fcn.00433ff0
add esp, 0x18
lea edx, [esp + 0x70]
push edx
mov dword [esp + 0x74], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40cd19
cmp dword [esp + 0x74], 6
jne 0x40cd19
mov esi, 1
xor ebp, ebp
cmp esi, ebx
mov dword [esp + 0x10], ebx
lea esi, [esp + 0x10]
jne 0x40cd2e
call fcn.0040c5b0
jmp 0x40cd33
call fcn.0040c540
cmp eax, ebx
jne 0x40ce45
push 0x40
lea eax, [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x34], 0x44
call fcn.00433ff0
mov ecx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.0040c660
test al, al
jne 0x40cd7f
lea ecx, [esp + 0x10]
push ecx
call fcn.0040c870
add esp, 4
push str.userenv.dll
mov dword [esp + 0x34], str.Winsta0Default
mov ebp, 0x30
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40cde0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push edi
call ebx
push str.DestroyEnvironmentBlock
push edi
mov esi, eax
call ebx
test esi, esi
mov ebx, eax
je 0x40cde0
mov edx, dword [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
je 0x40cdd8
mov ebp, 0x430
jmp 0x40cde0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x18]
push 0
push eax
push ebp
push 0
push 0
push 0
lea ecx, [esp + 0x1a8]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebp, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40ce1e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40ce2d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40ce38
mov eax, dword [esp + 0x14]
push eax
call ebx
test edi, edi
je 0x40ce43
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40ce54
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x394]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043244e
add esp, 0x38c
ret
Function at 0x40ce70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x278
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x40ce97
xor eax, eax
jmp 0x40cfe9
push 0x206
lea eax, [esp + 0x7e]
push ebx
push eax
mov word [esp + 0x84], bx
call fcn.00433ff0
lea edi, [esp + 0x84]
call fcn.0040c9c0
mov ecx, dword [esp + 0x298]
push ecx
lea edx, [esp + 0x28]
push edx
xor esi, esi
mov dword [esp + 0x2c], ebx
call fcn.0040c920
add esp, 0x14
test eax, eax
jne 0x40cfd8
push 0x40
lea eax, [esp + 0x38]
push ebx
push eax
mov dword [esp + 0x3c], 0x44
call fcn.00433ff0
xor eax, eax
add esp, 0xc
push str.userenv.dll
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], str.Winsta0Default
lea ebp, [esi + 0x30]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x40cf6f
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push edi
call ebx
push str.DestroyEnvironmentBlock
push edi
mov esi, eax
call ebx
test esi, esi
mov dword [esp + 0x1c], eax
je 0x40cf6f
mov ebx, dword [esp + 0x18]
push 0
push ebx
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40cf65
mov ebp, 0x430
jmp 0x40cf73
mov dword [esp + 0x14], 0
jmp 0x40cf73
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
push ebp
push 0
push 0
push 0
lea edx, [esp + 0x98]
push edx
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40cfad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40cfbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40cfcb
mov ecx, dword [esp + 0x14]
push ecx
call eax
test edi, edi
je 0x40cfdc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40cfdc
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x40cfe7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043244e
add esp, 0x278
ret
Function at 0x40f520
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40f562
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0x20]
jne 0x40f562
mov eax, 1
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x40f570
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
cmp ecx, 0x64
jbe 0x40f5fa
mov eax, 0x51eb851f
mul ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
shr edi, 5
mov esi, 0
je 0x40f5e3
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
push ecx
call ebp
test eax, eax
je 0x40f5e3
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x14], edx
je 0x40f5ed
push 0x64
call ebx
add esi, 1
cmp esi, edi
jb 0x40f5a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
mov eax, 1
add esp, 0x1c
ret

Function at 0x40f670
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0
push 0
mov ebx, eax
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x40f702
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push ebx
push eax
push 1
push 2
push 0x110
push 0x32
push ebp
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x40f6e8
mov edi, eax
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push 1
push edi
mov dword [esp + 0x1c], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x40f6da
push edi
call ebx
push esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x40f70a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x40f6fb
mov ecx, dword [esp + 0x18]
push ebp
push 0
push 0
push 0
push 0
push ebx
push ecx
push 1
push 2
push 0x110
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x40f6b7
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x40f7e0
Capabilities:
Start service

Disassembly:
push edi
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40f7f8
pop edi
ret
mov eax, dword [esp + 8]
push esi
push 0x14
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40f819
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
ret
push 4
mov ecx, esi
call fcn.0040f520
add esp, 4
test eax, eax
je 0x40f83d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40f86a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x40f830
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
ret
mov ecx, dword [esp + 0x10]
push ebx
push 4
push esi
call fcn.0040f570
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop esi
pop edi
ret

Function at 0x40f890
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
xor eax, eax
push edi
push 0x40000000
push eax
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40f8ce
pop edi
add esp, 0x1c
ret
mov eax, dword [esp + 0x24]
push esi
push 0x24
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40f8f2
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
push 1
mov ecx, esi
call fcn.0040f520
add esp, 4
test eax, eax
je 0x40f919
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40f945
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x2c]
push ebx
push 1
push esi
call fcn.0040f570
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop esi
pop edi
add esp, 0x1c
ret
Function at 0x40fbc0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10004
call fcn.00445780
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x10000], eax
mov eax, dword [esp + 0x10008]
push esi
push 0x40
push 0x4590c8
push eax
call fcn.00438104
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40fc0e
xor al, al
pop esi
mov ecx, dword [esp + 0x10000]
xor ecx, esp
call fcn.0043244e
add esp, 0x10004
ret
push esi
push 0x10000
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00438466
add esp, 0x10
test eax, eax
jbe 0x40fc51
test edi, edi
je 0x40fc38
push eax
lea ecx, [esp + 8]
push ecx
mov eax, edi
call fcn.0040da70
push esi
push 0x10000
lea edx, [esp + 0xc]
push 1
push edx
call fcn.00438466
add esp, 0x10
test eax, eax
ja 0x40fc27
push esi
call fcn.004352b8
mov ecx, dword [esp + 0x10008]
add esp, 4
pop esi
xor ecx, esp
mov al, 1
call fcn.0043244e
add esp, 0x10004
ret