joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x483248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
mov edi, ecx
push ebx
lea esi, [edi + 0x238]
mov ecx, esi
call fcn.00461175
mov ebp, eax
mov eax, dword [0x4a624c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x4aa680
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call fcn.00463140
push 0x4aa680
lea ecx, [esp + 0x18]
call fcn.00463140
push 0x4aa680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], 0
call fcn.00463140
mov al, byte [esp + 0x1c]
and al, 0xcf
and al, 0x3f
and al, 0xf0
mov byte [esp + 0x1c], al
lea eax, [esp + 0x34]
lea ecx, [edi + 0x78]
push eax
push ebp
mov dword [esp + 0x34], 3
call fcn.00437fa0
test eax, eax
je 0x439559
add eax, 0xc
lea ecx, [esp + 0x10]
push eax
call fcn.00437e50
mov ebp, dword [esp + 0x38]
push str._node__n
push ebp
call fcn.0044e4a2
add esp, 8
lea ecx, [esp + 0x38]
push ebx
push ecx
mov ecx, esi
call fcn.004610d5
mov eax, dword [eax]
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x34], 6
call fcn.00409c40
mov eax, dword [eax]
add esp, 8
push eax
push str._name__s__name__n
push ebp
call fcn.0044e4a2
add esp, 0xc
lea ecx, [esp + 0x34]
call fcn.00462fb7
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 3
call fcn.00462fb7
mov ecx, dword [esp + 0x14]
push 0x4aa680
push ecx
call fcn.0044d292
add esp, 8
test eax, eax
je 0x4394c0
mov edx, dword [esp + 0x14]
push edx
push str._cond__s__cond__n
push ebp
call fcn.0044e4a2
add esp, 0xc
mov eax, dword [edi + 0x254]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 4
push 0x110a
push eax
call ebx
mov esi, eax
test esi, esi
je 0x439506
cmp dword [esp + 0x3c], 1
jne 0x439506
push 1
push ebp
push esi
mov ecx, edi
call fcn.00439380
mov ecx, dword [edi + 0x254]
push esi
push 1
push 0x110a
push ecx
call ebx
mov esi, eax
test esi, esi
jne 0x4394dd
push str.__node__n
push ebp
call fcn.0044e4a2
add esp, 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 8
call fcn.00462fb7
mov byte [esp + 0x2c], 7
lea ecx, [esp + 0x14]
call fcn.00462fb7
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00462fb7
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 5
call fcn.00462fb7
mov byte [esp + 0x2c], 4
jmp 0x43952a
Function at 0x439a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483350
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x28], 0
mov dword [esi + 0x74], 1
mov eax, dword [0x4a624c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x4aa680
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 4
call fcn.00463140
push 0x4aa680
lea ecx, [esp + 0x14]
call fcn.00463140
push 0x4aa680
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0
call fcn.00463140
mov al, byte [esp + 0x18]
and al, 0xcf
and al, 0x3f
and al, 0xf0
mov byte [esp + 0x18], al
mov edi, dword [esi + 0x70]
lea ecx, [esp + 0xc]
inc edi
push ecx
mov ax, di
lea ecx, [esi + 0x78]
push eax
mov byte [esp + 0x30], 5
mov dword [esi + 0x70], edi
call fcn.0043a910
mov ecx, eax
call fcn.00437e50
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push edx
push eax
push 0
push 0
push 0
push 0
lea ebp, [esi + 0x238]
push 0
push ecx
push 1
mov ecx, ebp
call fcn.004611f1
push 0
push 0
push 0
push 0
push 0
mov edi, eax
push 0
push 0x22
push edi
mov ecx, ebp
call fcn.004611a3
mov eax, dword [esi + 0x70]
mov ecx, ebp
push eax
push 0
push 0
push 0
push 0
push 0
push 4
push edi
call fcn.004611a3
mov edx, dword [esi + 0x254]
push edi
push 0
push 0x1114
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 7
call fcn.00462fb7
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 6
call fcn.00462fb7
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00462fb7
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00462fb7
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.00462fb7
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10

Function at 0x44f2c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44f2eb
test byte [esp + 8], 0x80
je 0x44f2da
and al, 0xfe
jmp 0x44f2dc
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x44f2fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004510a2
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x45f280
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0044d530
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x45f34b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x45f34b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x45f2fe
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x45f309
or bh, 8
and edi, 0x8000000
je 0x45f324
mov eax, dword [0x4aeffc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x45f34b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x45f74b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x45f76f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x45f78a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x45fabd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x45fadd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004510a2
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x45fb00
test byte [esp + 8], 2
je 0x45fb00
call fcn.00451115
mov dword [eax], 0xd
call fcn.0045111e
mov dword [eax], 5
jmp 0x45fad9
xor eax, eax
ret
Function at 0x4638cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4638ee
cmp dword [edi + 0x3c], 0
jne 0x4638ee
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00479641
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0046391b
pop edi
pop esi
pop ebx
ret 8

Function at 0x463969
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00479641
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46399a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004639ad
pop edi
pop esi
pop ebx
ret 8

Function at 0x464f84
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x464fbc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046345e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00463436
jmp 0x464fc8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x466bf9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x466c3b
call fcn.00479641
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x466c3b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x466c32
xor eax, eax
jmp 0x466c43
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00466c49
pop edi
pop esi
pop ebx
ret 4
Function at 0x479f93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00479641
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x479fd0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x479fd0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x479fd4
xor eax, eax
jmp 0x47a052
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.0046359b
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x47a00c
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x479ff6
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0047a143
push ebx
mov edi, eax
call fcn.004635c4
test edi, edi
pop ecx
je 0x47a04e
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.00479f0c
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0047a057
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x47b898
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47b8c6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47b8e4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047b7fe
jmp 0x47b8e4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47b8e4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047b7fe
test edi, edi
mov eax, edi
jne 0x47b8ce
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401050
Capabilities:
Create process on windows
Get token membership
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0xa18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xa14]
push ecx
mov dword [ebp - 0xa1c], ebx
mov dword [ebp - 0xa18], ebx
mov dword [ebp - 0xa14], ebx
mov word [ebp - 0xa10], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4010c1
mov eax, dword [ebp - 0xa18]
lea edx, [ebp - 0xa1c]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4010c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0xa18]
cmp eax, ebx
je 0x4010d8
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0xa1c], ebx
jne 0x4011c9
push 0x206
lea edx, [ebp - 0x20a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x20c], cx
call fcn.00414930
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7fe
lea edx, [ebp - 0xa0a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xa0c], cx
call fcn.00414930
push 0x428938
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xa0c]
push str.Elevate_Run:__s__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0x1c
lea edx, [ebp - 0xa0c]
push edx
call esi
push 0x38
lea eax, [ebp - 0xa54]
push ebx
push eax
mov dword [ebp - 0xa58], 0x3c
call fcn.00414930
add esp, 0xc
lea edx, [ebp - 0xa0c]
lea ecx, [ebp - 0x20c]
push edx
mov dword [ebp - 0xa4c], str.runas
mov dword [ebp - 0xa48], ecx
mov dword [ebp - 0xa44], 0x428938
mov dword [ebp - 0xa50], ebx
mov dword [ebp - 0xa3c], 1
call esi
lea eax, [ebp - 0xa58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 1
call fcn.0040e24c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x4011e0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
mov word [ebp - 0x808], ax
call fcn.00414930
add esp, 0xc
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x40133a
push 0xf01ff
push 0x41af90
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x401311
lea edx, [ebp - 0x824]
push edx
push 0xc8
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x824]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4012e1
push str.QueryServiceStatusEvent
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x820]
push ecx
push 0xc8
push 0x41af90
lea edx, [ebp - 0x808]
push str._Control_Service__Set___s___Control__lu___Status__lu_
push edx
mov edi, 1
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x808]
add esp, 0x14
push eax
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push 0x41ad80
xor edi, edi
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push str._Control_Service__OpenService_Fail
xor edi, edi
call fcn.004033d0
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push str._Control_Service_
xor esi, esi
call fcn.004033d0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x402170
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
mov word [ebp - 0x808], ax
call fcn.00414930
add esp, 0xc
push 0x228
lea edx, [ebp - 0xa34]
push 0
push edx
mov dword [ebp - 0xa3c], 1
mov dword [ebp - 0xa38], 0x22c
call fcn.00414930
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xa38]
push eax
push esi
mov dword [ebp - 0xa40], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402319
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0xa14]
push str.wmcUpdater.exe
push ecx
call fcn.0040daf6
add esp, 8
test eax, eax
jne 0x402303
mov edx, dword [ebp - 0xa30]
push edx
push 1
push 0x100001
call ebx
mov esi, eax
mov eax, dword [ebp - 0xa30]
push eax
push esi
push str.wmcUpdater.exe
lea ecx, [ebp - 0x808]
push 0x41b950
push ecx
call edi
lea edx, [ebp - 0x808]
add esp, 0x14
push edx
call fcn.004033d0
add esp, 4
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3a98
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40229d
push str.wmcUpdater.exe
lea eax, [ebp - 0x808]
push 0x41b994
push eax
call edi
lea ecx, [ebp - 0x808]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
jmp 0x4022ee
cmp eax, 0x102
jne 0x4022c1
push eax
push str.wmcUpdater.exe
lea edx, [ebp - 0x808]
push 0x41b9b0
push edx
call edi
lea eax, [ebp - 0x808]
push eax
jmp 0x4022dc
push eax
push str.wmcUpdater.exe
lea ecx, [ebp - 0x808]
push 0x41b9f0
push ecx
call edi
lea edx, [ebp - 0x808]
push edx
call fcn.004033d0
mov dword [ebp - 0xa3c], 0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xa40]
lea eax, [ebp - 0xa38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402202
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa3c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x402340
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.00414930
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x230]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4023c6
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea esp, [esp]
lea edx, [ebp - 0x20c]
push str.wmcUpdater.exe
push edx
call fcn.0040daf6
add esp, 8
test eax, eax
je 0x4023df
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x4023a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x402e50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00414930
lea edx, [ebp - 0x210]
add esp, 0xc
mov eax, ebx
sub edx, ebx
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402e90
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
jmp 0x402eb0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402eb0
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x212], 0x5c
lea eax, [ebp + eax*2 - 0x210]
jne 0x402ed7
xor edx, edx
mov word [eax - 2], dx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x416]
push ecx
mov word [ebp - 0x418], ax
call fcn.00414930
add esp, 0xc
lea edx, [ebp - 0x210]
push 0x5c
push edx
call fcn.0040d805
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 8
test eax, eax
je 0x402f6a
add eax, 2
push 0x5c
push eax
call fcn.0040d805
mov esi, eax
add esp, 8
test esi, esi
je 0x402f6a
lea ecx, [ebp - 0x210]
mov eax, esi
sub eax, ecx
sar eax, 1
push eax
mov edx, ecx
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0040de3f
lea ecx, [ebp - 0x418]
add esp, 0xc
push ecx
call fcn.00402d90
add esp, 4
test eax, eax
je 0x402f98
push 0x5c
add esi, 2
push esi
call fcn.0040d805
mov esi, eax
add esp, 8
test esi, esi
jne 0x402f24
push ebx
call fcn.00402d90
add esp, 4
test eax, eax
jne 0x402f83
push eax
push ebx
call edi
test eax, eax
je 0x403007
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x418]
push edx
call edi
test eax, eax
je 0x403007
push 0x5c
add esi, 2
push esi
call fcn.0040d805
mov esi, eax
add esp, 8
test esi, esi
je 0x402f6a
jmp 0x402fc0
lea ecx, [ebp - 0x210]
mov eax, esi
sub eax, ecx
sar eax, 1
push eax
mov edx, ecx
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0040de3f
add esp, 0xc
push 0
lea ecx, [ebp - 0x418]
push ecx
call edi
test eax, eax
je 0x403007
push 0x5c
add esi, 2
push esi
call fcn.0040d805
mov esi, eax
add esp, 8
test esi, esi
jne 0x402fc0
jmp 0x402f6a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret