joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106d903
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
test eax, eax
jne 0x106d9f6
push 0x1080960
push 0xc
call fcn.0100d7ab
pop ecx
pop ecx
test eax, eax
je 0x106d930
and dword [eax], edi
jmp 0x106d932
xor eax, eax
mov dword [ebp - 4], eax
test eax, eax
je 0x106d9c2
push esi
mov ecx, eax
call fcn.01015bad
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov ecx, esi
call fcn.0106d74d
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
push 0x106d816
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x106d9b4
mov ecx, esi
call fcn.0106d76c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x107d1a4]
cmp ecx, 0x107d1a4
je 0x106d9ee
test byte [ecx + 0x1c], 1
je 0x106d9ee
push eax
push 0x1007940
push 0xb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01035c59
jmp 0x106d9ee
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x106d9ee
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x106d9e6
test byte [eax + 0x1c], 1
je 0x106d9e6
push 0x1007940
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 4]
call fcn.0106d8e6
mov eax, edi
pop edi
pop esi
leave
ret 0x18
Function at 0x10001050
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
mov esi, eax
test esi, esi
je 0x1000107e
mov dword [0x10011068], 0
mov eax, dword [esp + 0xc]
push edi
push eax
push esi
call fcn.10002410
add esp, 0xc
pop edi
mov eax, esi
pop esi
ret

Function at 0x10001150
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
mov dl, byte [eax + 1]
push ebp
xor ebp, ebp
cmp dword [esp + 0x10], ebp
jle 0x10001216
push ebx
push esi
push edi
movzx esi, cl
movzx edi, dl
lea eax, [esi + 1]
cdq
mov ecx, 0x242
idiv ecx
mov bl, dl
mov edx, dword [0x1001217c]
movzx esi, bl
movzx eax, byte [esi + edx]
lea ecx, [esi + edx]
add eax, edi
cdq
mov edi, 0x242
idiv edi
mov eax, dword [0x1001217c]
movzx edi, dl
add eax, edi
mov byte [esp + 0x13], dl
call fcn.10001040
mov ecx, dword [0x1001217c]
movzx eax, byte [edi + ecx]
movzx ecx, byte [esi + ecx]
add eax, ecx
cdq
mov ecx, 0x242
idiv ecx
push 0
push 0
mov byte [esp + 0x1a], dl
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x18]
movzx ecx, byte [esp + 0x12]
mov edx, ebp
sub edx, dword [0x10011068]
inc ebp
add eax, edx
mov edx, dword [0x1001217c]
mov cl, byte [ecx + edx]
xor byte [eax], cl
cmp ebp, dword [esp + 0x1c]
jl 0x10001170
mov eax, dword [esp + 0x20]
mov dl, byte [esp + 0x13]
pop edi
pop esi
mov byte [eax], bl
pop ebx
mov byte [eax + 1], dl
pop ebp
pop ecx
ret
mov byte [eax], cl
mov byte [eax + 1], dl
pop ebp
pop ecx
ret
Function at 0x10002775
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100110f0]
jne 0x1000277f
repz ret
jmp fcn.10003cbe

Function at 0x100095ed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10004a53
and dword [ebp - 4], 0
cmp dword [0x10012b7c], 0
mov ebx, eax
jne 0x1000969e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000974f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000f178
push edi
call esi
test eax, eax
je 0x1000974f
push eax
call fcn.100049e1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10012b7c], eax
call esi
push eax
call fcn.100049e1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10012b80], eax
call esi
push eax
call fcn.100049e1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10012b84], eax
call esi
push eax
call fcn.100049e1
pop ecx
mov dword [0x10012b8c], eax
test eax, eax
je 0x1000969e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100049e1
pop ecx
mov dword [0x10012b88], eax
mov eax, dword [0x10012b88]
cmp eax, ebx
je 0x100096f6
cmp dword [0x10012b8c], ebx
je 0x100096f6
push eax
call fcn.10004a5c
push dword [0x10012b8c]
mov esi, eax
call fcn.10004a5c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100096f6
test edi, edi
je 0x100096f6
call esi
test eax, eax
je 0x100096ed
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100096ed
test byte [ebp - 0xc], 1
jne 0x100096f6
or dword [ebp + 0x10], 0x200000
jmp 0x1000972f
mov eax, dword [0x10012b80]
cmp eax, ebx
je 0x1000972f
push eax
call fcn.10004a5c
pop ecx
test eax, eax
je 0x1000972f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000972f
mov eax, dword [0x10012b84]
cmp eax, ebx
je 0x1000972f
push eax
call fcn.10004a5c
pop ecx
test eax, eax
je 0x1000972f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10012b7c]
call fcn.10004a5c
pop ecx
test eax, eax
je 0x1000974f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10009751
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x495adc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x118]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x495c62
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x150]
mov eax, dword [ebx + 0x10]
call fcn.00418284
cmp byte [ebp + 8], 0
je 0x495b35
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.00418154
jmp 0x495b43
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.00418154
mov eax, dword [ebx + 0x10]
call fcn.0041827c
dec eax
jle 0x495b89
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.0041814c
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.0041827c
push eax
push 0x12200
call fcn.00405af0
mov edx, eax
mov eax, edi
call fcn.00418214
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x495beb
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x118]
call fcn.00418ea8
push eax
call fcn.00405bd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x4086d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x15c], eax
mov esp, ebp
pop ebp
ret
Function at 0x4114a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x814], ecx
xor eax, eax
mov word [ebp - 0x804], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x802]
push ecx
call fcn.004bfe20
add esp, 0xc
push 0x5466d8
lea edx, [ebp - 0x804]
push edx
call fcn.004198b0
add esp, 8
lea eax, [ebp - 0x830]
push eax
mov ecx, dword [ebp - 0x814]
add ecx, 4
call fcn.00424a30
mov dword [ebp - 0x818], eax
mov ecx, dword [ebp - 0x818]
call fcn.00409770
push eax
lea ecx, [ebp - 0x804]
push ecx
call fcn.004198d0
add esp, 8
lea ecx, [ebp - 0x830]
call fcn.00406d30
push str.Parameters
lea edx, [ebp - 0x804]
push edx
call fcn.004198d0
add esp, 8
lea eax, [ebp - 0x810]
push eax
push 1
push 0
lea ecx, [ebp - 0x804]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4115e9
mov dword [ebp - 0x80c], 0
mov dword [ebp - 0x808], 4
lea edx, [ebp - 0x808]
push edx
mov eax, dword [ebp - 0x814]
add eax, 0x4c
push eax
lea ecx, [ebp - 0x80c]
push ecx
push 0
push str.Start
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x808], 4
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x814]
add ecx, 0x50
push ecx
lea edx, [ebp - 0x80c]
push edx
push 0
push 0x546720
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x814]
mov eax, dword [ebp - 0x814]
mov ecx, dword [eax + 0x4c]
mov dword [edx + 0x54], ecx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret
Function at 0x413e20
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], ecx
push str.Saving_current_status
mov eax, dword [ebp - 0x810]
push eax
call fcn.0042a370
add esp, 8
mov dword [ebp - 0x80c], 0
xor ecx, ecx
mov word [ebp - 0x804], cx
push 0x7fe
push 0
lea edx, [ebp - 0x802]
push edx
call fcn.004bfe20
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea eax, [ebp - 0x804]
push eax
call fcn.004198b0
add esp, 8
lea ecx, [ebp - 0x830]
push ecx
mov ecx, dword [ebp - 0x810]
add ecx, 4
call fcn.00424a30
mov dword [ebp - 0x818], eax
mov ecx, dword [ebp - 0x818]
call fcn.00409770
push eax
lea edx, [ebp - 0x804]
push edx
call fcn.004198d0
add esp, 8
lea ecx, [ebp - 0x830]
call fcn.00406d30
push str.Status
lea eax, [ebp - 0x804]
push eax
call fcn.004198d0
add esp, 8
lea ecx, [ebp - 0x804]
push ecx
push str.Creating_key:__s
mov edx, dword [ebp - 0x810]
push edx
call fcn.0042a370
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x80c]
push ecx
push 0
push 0x20006
push 0
push 0x547180
push 0
lea edx, [ebp - 0x804]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x413f56
mov eax, dword [ebp - 0x814]
push eax
push str.Failed_to_create_Status_key___lu_
mov ecx, dword [ebp - 0x810]
push ecx
call fcn.0042a370
add esp, 0xc
jmp 0x413fa3
mov edx, dword [ebp - 0x810]
mov eax, dword [edx + 0x54]
push eax
push str.Saving_Current_as__ld
mov ecx, dword [ebp - 0x810]
push ecx
call fcn.0042a370
add esp, 0xc
push 4
mov edx, dword [ebp - 0x810]
add edx, 0x54
push edx
push 4
push 0
push str.Current
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret
Function at 0x4256d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x57ff96]
test eax, eax
je 0x425719
lea ecx, [ebp + 0xc]
mov dword [0x581734], ecx
mov edx, dword [0x581734]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x7ff
push 0x581f38
call fcn.004bb47d
add esp, 0x10
mov dword [0x581734], 0
push 0x581f38
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
ret

Function at 0x425720
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x57ff96]
test eax, eax
je 0x425769
lea ecx, [ebp + 0xc]
mov dword [0x581730], ecx
mov edx, dword [0x581730]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x7ff
push 0x581738
call fcn.004bb56d
add esp, 0x10
mov dword [0x581730], 0
push 0x581738
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
ret
Function at 0x427880
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5256a5
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0xf0]
push eax
call fcn.00427640
add esp, 4
mov dword [ebp - 4], 1
push 0
call fcn.00427180
add esp, 4
push eax
call fcn.004ba7ae
add esp, 4
call fcn.004ba78d
xor edx, edx
mov ecx, 0x5f5e100
div ecx
push edx
push str._08d_
lea edx, [ebp - 0xd8]
push edx
call fcn.00423930
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xf0]
call fcn.0040e3b0
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00424a30
mov dword [ebp - 0x114], eax
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x110], edx
mov byte [ebp - 4], 2
push 0
mov ecx, dword [ebp - 0x110]
call fcn.00409770
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x108]
call fcn.00406d30
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406900
mov ecx, dword [ebp - 0x10c]
or ecx, 1
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.004068e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret
Function at 0x428930
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525923
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57594c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CNTService.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00408250
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov dword [0x57ff98], ecx
lea edx, [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409390
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], 0x10
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004068e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x429ab0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x429afa
xor eax, eax
jmp 0x429c10
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
add ecx, 4
call fcn.00424a30
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 4], 0
push 0x10000
mov ecx, dword [ebp - 0x70]
call fcn.00409770
push eax
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00406d30
cmp dword [ebp - 0x64], 0
je 0x429c03
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x429bb2
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x5c]
add ecx, 4
call fcn.00424a30
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x80], edx
mov dword [ebp - 4], 1
push 0
push 0
mov ecx, dword [ebp - 0x80]
call fcn.00409770
push eax
push 0x65
push 4
mov ecx, dword [ebp - 0x5c]
call fcn.00429c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406d30
mov dword [ebp - 0x68], 1
jmp 0x429bf9
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x5c]
add ecx, 4
call fcn.00424a30
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 4], 2
push 0
push 0
mov ecx, dword [ebp - 0x7c]
call fcn.00409770
push eax
push 0x66
push 1
mov ecx, dword [ebp - 0x5c]
call fcn.00429c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406d30
mov edx, dword [ebp - 0x64]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret
Function at 0x429c30
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0x10]
mov dword [ebp + ecx - 0x1c], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0x14]
mov dword [ebp + eax - 0x1c], ecx
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 0x18]
mov dword [ebp + edx - 0x1c], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
jmp 0x429ca0
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 3
jge 0x429cbb
mov edx, dword [ebp - 0x3c]
cmp dword [ebp + edx*4 - 0x1c], 0
je 0x429cb9
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
jmp 0x429c97
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x48], 0
jne 0x429d09
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.00424a30
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x48]
call fcn.00409770
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x48], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00406d30
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x48], 0
je 0x429d39
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
movzx ecx, word [ebp - 0x40]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret 0x14