joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f4a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420d88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x42e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 4
mov dword [edi], vtable.intel_dal::ICommandsServer.0
call fcn.0041e736
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
push 0
push 0xa
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 8], esi
mov dword [edi + 0xc], eax
mov byte [edi + 4], 0xa
lea esi, [edi + 0x10]
mov dword [ebp - 4], 0
push esi
push 0x202
mov dword [edi], vtable.intel_dal::CommandsServerSocketsWin32.0
mov dword [edi + 0x1a0], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40f551
push eax
push str.WSAStartup_failed_with_error:__d_n
call fcn.00401aa0
add esp, 8
push str.WSAStartup_failed
lea ecx, [ebp - 0x20]
call fcn.0040f3d0
push 0x42af0c
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
cmp byte [esi], 2
jne 0x40f571
cmp byte [esi + 1], 2
jne 0x40f571
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.00401aa0
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Could_not_find_a_usable_version_of_Winsock.dll
jmp 0x40f53b
Function at 0x40fbc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x42363c
push 0xc
mov edi, ecx
call fcn.0041eca4
mov esi, eax
add esp, 8
test esi, esi
jne 0x40fc09
push 0xc
push str.JHI_memory_allocation_of_size__d_failed_.
call fcn.00401aa0
push str.CS_ClientThreadParams_memory_allocation_failed
call fcn.00401b10
mov eax, dword [edi + 8]
add esp, 0xc
push esi
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push 0
push 0
push esi
push 0x40f9a0
mov dword [esi], eax
mov eax, dword [edi + 0xc]
push 0
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
push 0
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40fc4d
push str.failed_creating_thread_for_client_request_n
call fcn.00401b10
push 0xc
push esi
call fcn.0041ec73
add esp, 0xc
pop edi
pop esi
pop ebp
ret 4
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
Function at 0x411eb0
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0x2c]
push esi
push edi
mov esi, ecx
mov edx, dword [eax]
mov eax, dword [0x42eac8]
cmp eax, dword [edx + 4]
jle 0x411efb
push 0x42eac8
call fcn.0041e8f4
add esp, 4
cmp dword [0x42eac8], 0xffffffff
jne 0x411efb
call fcn.00412d10
push 0x421e30
call fcn.0041ec5e
push 0x42eac8
call fcn.0041e8b5
add esp, 8
push 0xffffffffffffffff
push dword [0x42ea60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x42ea60]
mov edi, dword [0x42ea9c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.Creating_the_event_listener_thread...
call fcn.00401b10
add esp, 4
push 0
push 0
push 0
push 0x411000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x411f61
push str.Failed_creating_event_handle_thread_n
call fcn.00401b10
mov edx, dword [edi]
add esp, 4
mov ecx, edi
push esi
call dword [edx + 0x20]
pop edi
mov eax, 0x601
pop esi
ret
push str.Event_listener_thread_created_successfully
call fcn.00401b10
add esp, 4
xor eax, eax
pop edi
pop esi
ret

Function at 0x412280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp - 4]
and eax, 0xffff02ff
or eax, 0x2ff
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4122c2
push str.Sent_FWU_GET_VERSION_to_HECI._n
call fcn.00401b10
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
push str.Error:_sending_FWU_GET_VERSION_request_to_HECI_failed._n
call fcn.00401b10
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error:__d
call fcn.00401b10
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4122f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
xor bl, bl
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
test edi, edi
je 0x4123ee
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4123ee
push esi
push eax
call fcn.00401cd0
mov esi, eax
add esp, 4
test esi, esi
je 0x4123e3
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push 0
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
push esi
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4123c6
push dword [ebp - 8]
push str.Number_bytes_read_from_HECI:__d_n
call fcn.00401b10
add esp, 8
cmp byte [esi + 3], bl
je 0x412391
push str.Got_error_status_from_HCI_GET_FW_VERSION._n
call fcn.00401b10
add esp, 4
push esi
call fcn.00401d60
add esp, 4
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx eax, word [esi + 6]
mov bl, 1
mov word [edi], ax
movzx eax, word [esi + 4]
mov word [edi + 2], ax
movzx eax, word [esi + 0xa]
mov word [edi + 4], ax
movzx eax, word [esi + 8]
push esi
mov word [edi + 6], ax
call fcn.00401d60
add esp, 4
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HeciRead_Error._LastError___d_n
call fcn.00401b10
add esp, 8
push esi
call fcn.00401d60
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416630
Capabilities:
Access the windows event log
Create thread

Disassembly:
push esi
push str.JHI_service_starting
call fcn.00401aa0
add esp, 4
push 0
push 0
push 0
push 0x416620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.IntelDalJhi
push 0
mov dword [0x42eef8], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41668c
push 0
push 0
push 0
push 0
push 0
push 0x40000000
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
ret

Function at 0x416690
Capabilities:
Access the windows event log

Disassembly:
push esi
push str._JHI_STOP_SERVICE__n
call fcn.00401b10
add esp, 4
push str.Closing_command_server_n
call fcn.00401b10
mov ecx, dword [0x42eef4]
add esp, 4
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x42eef8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword fs:[0x2c]
mov dword [0x42eef8], 0
mov esi, dword [eax]
mov eax, dword [0x42eac8]
cmp eax, dword [esi + 4]
jle 0x416716
push 0x42eac8
call fcn.0041e8f4
add esp, 4
cmp dword [0x42eac8], 0xffffffff
jne 0x416716
call fcn.00412d10
push 0x421e30
call fcn.0041ec5e
add esp, 4
push 0x42eac8
call fcn.0041e8b5
add esp, 4
cmp dword [0x42ea64], 0
jne 0x416797
push str.JHI_is_initialized._Resetting...
call fcn.00401b10
mov eax, dword [0x42eac8]
add esp, 4
cmp eax, dword [esi + 4]
jle 0x41676e
push 0x42eac8
call fcn.0041e8f4
add esp, 4
cmp dword [0x42eac8], 0xffffffff
jne 0x41676e
call fcn.00412d10
push 0x421e30
call fcn.0041ec5e
add esp, 4
push 0x42eac8
call fcn.0041e8b5
add esp, 4
push 0xffffffffffffffff
push dword [0x42ea60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x42ea60]
mov dword [0x42ea64], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00414470
push str.jhi_stopping
call fcn.00401aa0
add esp, 4
push str.IntelDalJhi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4167d8
push 0
push 0
push 0
push 0
push 0
push 0x40000001
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
ret
Function at 0x416f60
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, edx
mov dword [ebp - 0x38], eax
cmp dword [eax + 0x24], 0
je 0x416f92
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x416fa8
lea eax, [ebx + 8]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push esi
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x416fb0
sub esi, ecx
cmp esi, 0x20
jbe 0x416fd3
pop esi
mov eax, 8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push edi
push str..mailslot_
lea eax, [ebp - 0x34]
push 0x2e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
push ebx
lea eax, [ebp - 0x34]
push 0x2e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov eax, dword [ebp + 8]
add esp, 0x18
test eax, eax
jne 0x417029
push eax
push eax
push 0x1a8
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov edi, eax
cmp edi, 0xffffffff
je 0x417050
push 0
push 0
push 0
push 0
push 4
push 6
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
jmp 0x41704b
cmp eax, 1
jne 0x417093
push 0
push 0x80
push 3
push 0
push eax
push 0x40000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x417066
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp - 0x38]
push ebx
push 0x22
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov eax, dword [ebp + 8]
add esp, 0x10
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xa
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e725
mov esp, ebp
pop ebp
ret
Function at 0x4170b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x24], 0
jne 0x4170e4
pop edi
mov eax, 5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x28], 1
je 0x4170ff
pop edi
mov eax, 0xa
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1b0], eax
test edi, edi
je 0x417152
push ecx
lea ecx, [ebp - 0x1b0]
call fcn.00417340
lea edx, [edi + 0x12]
lea ecx, [ebp - 0x1b0]
call fcn.00417340
lea edx, [edi + 0x34]
lea ecx, [ebp - 0x1b0]
call fcn.00417340
lea edx, [edi + 0x56]
lea ecx, [ebp - 0x1b0]
call fcn.00417340
mov eax, dword [ebp - 0x1b0]
add esp, 4
mov byte [eax - 1], 0
push 0
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1ac]
push eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
and eax, 0xfffffffd
add eax, 3
pop esi
call fcn.0041e725
mov esp, ebp
pop ebp
ret

Function at 0x417250
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x28], 0
je 0x417284
pop edi
mov eax, 0xa
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x24]
test eax, eax
je 0x41729f
push 0
lea ecx, [ebp - 0x1b4]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp dword [ebp - 0x1b4], 0
ja 0x4172bd
pop edi
mov eax, 9
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x1b8]
push eax
push 0x1a8
lea eax, [ebp - 0x1b0]
push eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4172f4
pop edi
mov eax, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1b8]
cmp eax, 0x1aa
jae 0x417330
lea edx, [ebp - 0x1b0]
mov byte [ebp + eax - 0x1b0], 0
mov ecx, edi
call fcn.00417430
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
and eax, 0xfffffff5
add eax, 0xb
pop esi
call fcn.0041e725
mov esp, ebp
pop ebp
ret
call fcn.0041ee3c
int3
Function at 0x41bdb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov esi, dword [ebp + 8]
push str.dispatching_JHIS_Uninstall_n
call fcn.00401b10
push esi
mov edx, edi
mov ecx, ebx
call fcn.0041b9d0
mov esi, eax
add esp, 8
test esi, esi
je 0x41be21
cmp esi, 0x402
je 0x41be21
cmp esi, 0x2304
je 0x41be21
push str.JHI_Unload_failed_n
call fcn.00401b10
add esp, 4
jmp 0x41bedd
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41be50
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x40]
call fcn.004024e0
mov byte [ebp - 4], 1
call fcn.0040c660
lea eax, [ebp - 0x41]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403c00
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.00402470
test bl, bl
je 0x41becb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
add esp, 4
test eax, eax
je 0x41bec9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push eax
push str._JHI_file_removal_from_disk_failed__error__d_n
call fcn.00401b10
add esp, 8
test esi, esi
jne 0x41becb
mov esi, 0x104
jmp 0x41becb
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41bedd
inc eax
push eax
push dword [ebp - 0x28]
call fcn.004025b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
Function at 0x41c600
Capabilities:
Delete service

Disassembly:
push ecx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x41c650
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41c639
push str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.00412630
add esp, 4
mov eax, 2
pop edi
pop esi
pop ecx
ret
push eax
push str.OpenSCManager_failed___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x10000
push str.jhi_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x41c6af
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x41c623
cmp eax, 0x424
jne 0x41c696
push str.Error:_the_service_does_not_exist._n
call fcn.00412630
add esp, 4
lea eax, [edi + 4]
pop edi
pop esi
pop ecx
ret
call esi
push eax
push str.Uninstall_Service_failed:___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41c6d8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
jne 0x41c696
jmp 0x41c623
push str.JHI_Service_removed_successfully_n
call fcn.00412630
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x41c700
Capabilities:
Start service

Disassembly:
push ecx
push esi
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x41c74d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41c736
push str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.00412630
add esp, 4
mov eax, 2
pop edi
pop esi
pop ecx
ret
push eax
push str.OpenSCManager_failed___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x10
push str.jhi_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x41c7a9
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x41c720
cmp eax, 0x424
jne 0x41c790
push str.Error:_the_service_does_not_exist._n
call fcn.00412630
add esp, 4
lea eax, [edi + 4]
pop edi
pop esi
pop ecx
ret
call esi
push eax
push str.Open_Service_failed:___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x41c80b
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x41c720
cmp eax, 0x420
jne 0x41c7f2
push str.Error:_JHI_service_already_running._n
call fcn.00412630
add esp, 4
mov eax, 5
pop edi
pop esi
pop ecx
ret
call esi
push eax
push str.Start_Service_failed:___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push str.JHI_Service_started_successfully_n
call fcn.00412630
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x41c830
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x41c8a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41c881
push str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.00412630
add esp, 4
mov eax, 2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push eax
push str.OpenSCManager_failed___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push 0x20000000
push str.jhi_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x41c91b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x41c85f
cmp eax, 0x424
jne 0x41c8f6
push str.Error:_the_service_does_not_exist._n
call fcn.00412630
add esp, 4
lea eax, [edi + 4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
call esi
push eax
push str.Stop_Service_failed:___d__n
call fcn.00412630
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41c972
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x41c85f
cmp eax, 0x426
jne 0x41c8f6
push str.Error:_JHI_service_has_not_been_started._n
call fcn.00412630
add esp, 4
mov eax, 6
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
push str.JHI_Service_terminated_successfully_n
call fcn.00412630
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0041e725
mov esp, ebp
pop ebp
ret
Function at 0x40e67f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
movzx eax, word [esi]
add eax, esi
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, esi
mov ebp, esi
je 0x40e6fa
mov edx, dword [0x300200f0]
cmp eax, ebp
jne 0x40e6b6
movzx ecx, byte [pe_dos_header]
test ecx, ecx
je 0x40e6fa
test dl, 1
je 0x40e6d0
mov ecx, eax
and cl, 7
neg cl
mov ebx, edx
sbb ecx, ecx
add ecx, 1
and ebx, 2
xor ecx, ebx
je 0x40e6da
movzx ecx, word [eax + 2]
cmp ecx, dword [esp + 0x1c]
jge 0x40e72c
mov dword [esp + 0x18], eax
movzx eax, word [eax]
xor ecx, ecx
add eax, esi
test edi, edi
sete cl
mov edi, ecx
test edi, edi
je 0x40e6f6
movzx ebp, word [ebp]
add ebp, esi
cmp eax, esi
jne 0x40e6a7
mov ax, word [esi + 6]
cmp ax, 0xfffe
je 0x40e723
movzx eax, ax
cmp word [eax*2 + 0x300080e8], 5
jne 0x40e723
push eax
call fcn.0040ffbf
add esp, 4
test eax, eax
jne 0x40e695
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40e82f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test byte [0x300200f0], 1
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jne 0x40e85e
mov cx, word [eax]
test cx, cx
je 0x40e85e
movzx ecx, cx
add ecx, eax
movzx ecx, word [ecx + 2]
push esi
lea esi, [edx + 4]
cmp ecx, esi
pop esi
jae 0x40e86b
cmp ecx, edx
je 0x40e86b
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp fcn.0040e67f
ret

Function at 0x40f79e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x40f7d2
cmp byte [eax], 0
je 0x40f816
lea eax, [eax + 1]
test eax, 3
je 0x40f7d2
cmp byte [eax], 0
je 0x40f816
lea eax, [eax + 1]
test eax, 3
je 0x40f7d2
cmp byte [eax], 0
je 0x40f816
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x40f7d2
test cl, cl
lea eax, [eax - 4]
je 0x40f816
test ecx, 0xff00
lea eax, [eax + 1]
je 0x40f816
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x40f816
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x40f816
lea eax, [eax + 1]
jmp 0x40f7d2
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x40f825
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x40f84c
cmp word [eax], 0
je 0x40f845
lea eax, [eax + 2]
test eax, 3
je 0x40f84c
jmp 0x40f833
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x40f887
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x40f84c
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x40f887
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x40f887
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x40f84c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x41dedb
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x41deee
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41deea
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x41df1b
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x41df5a
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x41df50
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x41df5c
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x41df40
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret