joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f788
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42f7a5
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f7b3
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42f8d5
test ebx, ebx
jl 0x42f8d5
test esi, esi
jle 0x42f8d5
mov eax, dword [ebp - 8]
call fcn.0040b5f0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b5f0
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42f872
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42f8d5
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42f857
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42f826
inc dword [ebp - 0x14]
jmp 0x42f836
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42f836
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42f841
or eax, 0xffffffff
jmp 0x42f857
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42f854
inc eax
jmp 0x42f857
or eax, 0xffffffff
test eax, eax
jl 0x42f85f
cmp esi, eax
jg 0x42f814
cmp esi, eax
jg 0x42f86a
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f8d8
inc edx
dec dword [ebp - 0x1c]
jne 0x42f810
jmp 0x42f8d5
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42f8d5
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42f8bc
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42f89b
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42f8a6
or eax, 0xffffffff
jmp 0x42f8bc
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42f8b9
inc eax
jmp 0x42f8bc
or eax, 0xffffffff
test eax, eax
jl 0x42f8c4
cmp esi, eax
jg 0x42f884
cmp esi, eax
jg 0x42f8cf
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f8d8
inc edx
dec dword [ebp - 0x1c]
jne 0x42f880
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43faec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43faf4
mov eax, edx
pop esi
pop ebx
ret

Function at 0x442768
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x44277f
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x44276f
mov eax, ecx
pop ebx
ret
Function at 0x456c3c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x456c50
add esp, 0xfffffff0
call fcn.0040934c
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x450bc0]
call fcn.00475360
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x455c0c]
call fcn.00478114
mov dword [esi + 8], eax
mov dl, 1

Function at 0x4bf9ec
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4bfa2f
cmp byte [ebx + 0x11], 0
jne 0x4bfa2f
cmp byte [ebx + 0x24], 0
jne 0x4bfa2f
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4bfa46
mov ecx, dword [0x4efea4]
mov dl, 1
mov eax, dword [0x48f6c4]
call fcn.00429e24
call fcn.0040a21c
pop ebx
ret
mov ecx, dword [0x4efea4]
mov dl, 1
mov eax, dword [0x48f6c4]
call fcn.00429e24
call fcn.0040a21c
pop ebx
ret

Function at 0x4c03b4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c0402
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bf898
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c041b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c0424
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bf898
dec esi
jne 0x4c0446
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4dacbc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4dae7b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040af6c
mov eax, dword [ebp - 4]
call fcn.004da59c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4dad0e
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b9f8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004dbc40
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4dadef
xor eax, eax
push ebp
push 0x4dade8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004da8a8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004daeb0
test al, al
je 0x4dadc4
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040accc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4dadc4
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b5f0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004da808
test al, al
je 0x4dadbe
mov eax, dword [ebp - 8]
call fcn.0040b5f0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b650
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004dacbc
dec ebx
cmp ebx, 0xffffffff
jne 0x4dad6d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dadef
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004da8a8
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x4f78c8], 0
je 0x4dae2f
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004da894
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004da808
mov ebx, eax
jmp 0x4dae56
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004da894
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004da808
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dae82
lea eax, [ebp - 0x3c]
call fcn.0040ab34
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ab94
pop eax
jmp eax
Function at 0x4dbb1c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004da5b4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040b5f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004da808
test al, al
jne 0x4dbb84
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4efe00]
mov dl, 1
mov eax, dword [0x4d91c4]
call fcn.00429ef8
call fcn.0040a21c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4dbb90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b5f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004da808
test al, al
jne 0x4dbbf1
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4f0024]
mov dl, 1
mov eax, dword [0x4d91c4]
call fcn.00429ef8
call fcn.0040a21c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004da61c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dc208
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4dc334
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004da8a8
xor eax, eax
push ebp
push 0x4dc30d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004daeb0
test al, al
je 0x4dc2ef
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004dc0e0
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040accc
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4dc2ef
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004da808
test al, al
je 0x4dc2eb
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5f0
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b650
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004dc0e0
pop ecx
inc edi
dec ebx
jne 0x4dc293
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc314
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004da8a8
pop eax
jmp eax
Function at 0x4dc344
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4dc59c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004da8a8
xor eax, eax
push ebp
push 0x4dc570
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004daeb0
test al, al
je 0x4dc552
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040accc
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4dc552
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004da808
test al, al
je 0x4dc546
mov eax, dword [ebp - 4]
call fcn.0040b5f0
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b650
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004dbc40
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4dc546
xor eax, eax
push ebp
push 0x4dc53f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004da8a8
xor eax, eax
push ebp
push 0x4dc51f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b5f0
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b650
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004da8ac
mov eax, dword [ebp - 4]
call fcn.0040b5f0
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b650
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004dbc40
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4dc4fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004dc208
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004dc344
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc501
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4dc3cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc577
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004da8a8
pop eax
jmp eax
Function at 0x4dc88c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetNativeSystemInfo
movzx eax, word [esp]
sub ax, 1
jb 0x4dc8ad
sub ax, 5
je 0x4dc8b8
sub ax, 3
je 0x4dc8c3
jmp 0x4dc8ce
mov byte [0x4f78d8], 0x20
mov al, 1
jmp 0x4dc8d7
mov byte [0x4f78d8], 0x40
xor eax, eax
jmp 0x4dc8d7
mov byte [0x4f78d8], 0x40
mov al, 1
jmp 0x4dc8d7
mov byte [0x4f78d8], 0
xor eax, eax
add esp, 0x24
ret

Function at 0x4dd424
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ac28
xor eax, eax
push ebp
push 0x4dd597
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4efd08]
mov edx, 0x4dd5b0
call fcn.00408668
mov edx, dword [ebp - 4]
call fcn.00408668
mov edx, 0x4dd5e0
call fcn.00408668
call main
call fcn.00406f90
push 1
push 0x4dd5e8
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x4dd4bf
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dd614
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dd660
call fcn.00408668
call main
call fcn.00406f90
jmp 0x4dd57f
push 2
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jne 0x4dd513
push ebx
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dd674
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dd660
call fcn.00408668
call main
call fcn.00406f90
jmp 0x4dd57f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x4dd573
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dd6bc
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dd660
call fcn.00408668
call main
call fcn.00406f90
jmp 0x4dd57f
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd59e
lea eax, [ebp - 4]
call fcn.0040ab34
pop eax
jmp eax
Function at 0x4dd708
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ac28
xor eax, eax
push ebp
push 0x4dd93f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4efd08]
mov edx, 0x4dd958
call fcn.00408668
mov edx, dword [ebp - 4]
call fcn.00408668
mov edx, 0x4dd980
call fcn.00408668
call main
call fcn.00406f90
push 1
push 0x4dd988
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4dd79f
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dd9b4
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dda00
call fcn.00408668
call main
call fcn.00406f90
jmp 0x4dd927
xor eax, eax
push ebp
push 0x4dd920
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x14
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4dd805
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dda14
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dda00
call fcn.00408668
call main
call fcn.00406f90
call fcn.0040a310
jmp 0x4dd927
xor eax, eax
push ebp
push 0x4dd900
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4dd864
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dda5c
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dda00
call fcn.00408668
call main
call fcn.00406f90
call fcn.0040a310
call fcn.0040a310
jmp 0x4dd927
cmp dword [ebp - 0x28], 4
jne 0x4dd892
mov eax, dword [0x4efd08]
mov edx, 0x4ddab0
call fcn.00408668
call main
call fcn.00406f90
call fcn.0040a310
call fcn.0040a310
jmp 0x4dd927
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x4dd8e7
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4ddafc
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dda00
call fcn.00408668
call main
call fcn.00406f90
call fcn.0040a310
call fcn.0040a310
jmp 0x4dd927
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd907
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd946
lea eax, [ebp - 4]
call fcn.0040ab34
pop eax
jmp eax
Function at 0x4de570
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4de5b2
mov eax, dword [0x4efd08]
mov edx, 0x4de6c4
call fcn.00408668
call main
call fcn.00406f90
jmp 0x4de6af
xor eax, eax
push ebp
push 0x4de6a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x24
mov eax, ebx
call fcn.0040b5f0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4de606
mov eax, dword [0x4efd08]
mov edx, 0x4de720
call fcn.00408668
mov edx, ebx
call fcn.00408668
call main
call fcn.00406f90
call fcn.0040a310
jmp 0x4de6af
xor eax, eax
push ebp
push 0x4de688
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4de64f
jmp 0x4de63c
cmp dword [ebp - 0x24], 1
jne 0x4de635
mov byte [ebp - 1], 1
jmp 0x4de66f
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4de629
jmp 0x4de66f
mov eax, dword [0x4efd08]
mov edx, 0x4de768
call fcn.00408668
mov edx, ebx
call fcn.00408668
call main
call fcn.00406f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de68f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4de7c4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x4de812
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4de878
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4de8c0
call fcn.00408668
call main
call fcn.00406f90
mov eax, esi
call fcn.0040a994
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x4de860
push ebx
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4de8d4
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4de8c0
call fcn.00408668
call main
call fcn.00406f90
mov eax, esi
call fcn.0040a994
push ebx
call sub.kernel32.dll_CloseHandle
pop esi
pop ebx
ret
Function at 0x4de918
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ac28
xor eax, eax
push ebp
push 0x4de9ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407fa4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 4]
call fcn.0040b0dc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4de9b3
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov eax, dword [0x4efd08]
mov edx, 0x4dea04
call fcn.00408668
call fcn.0040d2e4
mov edx, 0x4dea50
call fcn.00408668
call main
call fcn.00406f90
jmp 0x4de9d2
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de9f1
lea eax, [ebp - 4]
call fcn.0040ab34
pop eax
jmp eax

Function at 0x4dea58
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ac28
xor eax, eax
push ebp
push 0x4deb29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040ab34
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x200
call fcn.00407fa4
cmp byte [0x4f78d8], 0x40
jne 0x4dead6
movzx eax, byte [0x4deb38]
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, 0x4deb48
mov edx, 0x4deb74
mov eax, dword [ebp - 4]
call fcn.0042bb70
mov edx, dword [ebp - 0x408]
lea eax, [ebp - 4]
call fcn.0040af6c
push 0x200
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b5f0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jbe 0x4deb06
mov eax, ebx
lea edx, [ebp - 0x404]
mov ecx, 0x200
call fcn.0040b68c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4deb30
lea eax, [ebp - 0x408]
call fcn.0040ab34
lea eax, [ebp - 4]
call fcn.0040ab34
pop eax
jmp eax