joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b31a8
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4b31ba
add esp, 0xfffffff0
call fcn.00403f2c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004065f0
xor eax, eax
push ebp
push 0x4b323d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403b98
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004b3334
mov dl, 1
mov eax, dword [0x418b64]
call fcn.00403b98
mov dword [esi + 0x28], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4b3227
push 0x4b3260
call sub.user32.dll_RegisterClipboardFormatA
mov dword [0x539fe8], eax
push 0x4b3274
call sub.user32.dll_RegisterClipboardFormatA
mov dword [0x539fec], eax
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3244
lea eax, [ebp - 4]
call fcn.0040657c
ret

Function at 0x4b5cd4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4b5d38
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404c88
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409784
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5d3f
lea eax, [ebp - 0xc]
call fcn.00404a18
ret

Function at 0x4b604c
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b6172
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [0x538c28]
cmp dword [eax], 2
jne 0x4b615c
cmp dword [ebp - 0x20], 0x10f
jne 0x4b615c
test byte [ebp - 0x17], 8
je 0x4b615c
mov eax, dword [ebp - 4]
push eax
call sub.imm32.dll_ImmGetContext
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b615c
xor eax, eax
push ebp
push 0x4b6125
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0
push 0
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call sub.imm32.dll_ImmGetCompositionStringW
mov edx, eax
sar edx, 1
jns 0x4b60e0
adc edx, 0
lea eax, [ebp - 0x10]
call fcn.00405434
mov eax, dword [ebp - 0x10]
call fcn.004052f8
add eax, eax
push eax
mov eax, dword [ebp - 0x10]
call fcn.004052e8
push eax
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call sub.imm32.dll_ImmGetCompositionStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b612c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.imm32.dll_ImmReleaseContext
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6179
lea eax, [ebp - 0x10]
call fcn.0040514c
ret
Function at 0x4b6b58
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6c1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00468e4c
test al, al
je 0x4b6b8d
mov eax, ebx
call fcn.00468b48
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x4b6bc0
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0046224c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004052d8
mov eax, dword [0x538c28]
cmp dword [eax], 2
jne 0x4b6c05
mov edx, dword [esi]
mov eax, ebx
call fcn.004b682c
mov edx, dword [eax + 0x30]
mov eax, esi
call fcn.00405188
jmp 0x4b6c05
mov eax, ebx
call fcn.00468b48
push eax
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, esi
call fcn.00405434
mov eax, dword [esi]
call fcn.004052f8
push eax
mov eax, dword [esi]
call fcn.004052e8
push eax
mov eax, ebx
call fcn.00468b48
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [esi]
call fcn.004052f8
mov edx, eax
dec edx
mov eax, esi
call fcn.00405434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6c22
lea eax, [ebp - 4]
call fcn.00404a18
ret

Function at 0x4b7fd8
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b7ff9
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b7ff9
xor eax, eax
ret
mov al, 1
ret

Function at 0x4c1668
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ec8
xor eax, eax
push ebp
push 0x4c1714
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.00409e34
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4c16fe
mov eax, ebx
call fcn.0040278c
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4c1724
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4c16f7
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x4c16f7
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.004027ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c171b
lea eax, [ebp - 4]
call fcn.00404a18
ret
Function at 0x4dc5d4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov dl, 1
mov eax, dword [0x418e78]
call fcn.00403b98
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x43a3e4]
call fcn.00403b98
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4dc6f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004dc088
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4dc6b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc6a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call fcn.00402988
mov eax, dword [ebp - 0x18]
push eax
movzx eax, word [0x53a07c]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc6aa
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x4dc700
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4dc7d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0049f48c
mov edx, dword [ebp - 4]
mov eax, 0x4dc7e8
call fcn.0040501c
test eax, eax
je 0x4dc7bb
mov eax, dword [ebp - 4]
call fcn.00404cd8
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x4dc7bb
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
jne 0x4dc766
push ebx
call sub.kernel32.dll_GlobalFree
jmp 0x4dc7bb
mov edx, 0x4dc7ec
mov eax, esi
call fcn.00409dd8
mov eax, dword [ebp - 4]
call fcn.00404ed8
mov edx, eax
mov eax, esi
call fcn.00409e78
push ebx
call sub.kernel32.dll_GlobalUnlock
mov eax, edi
call fcn.00468b48
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x4dc7a2
push ebx
call sub.kernel32.dll_GlobalFree
jmp 0x4dc7bb
push 0x4dc7f0
call sub.user32.dll_RegisterClipboardFormatA
push ebx
movzx eax, ax
push eax
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc7d8
lea eax, [ebp - 4]
call fcn.00404a18
ret
Function at 0x51085c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51088a
mov eax, ebx
call fcn.00511310
cmp dword [ebx + 0x40], 0
je 0x510883
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5108fb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5108ed
cmp dword [ebx + 8], 0
je 0x5108ac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5108be
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5108ed
cmp dword [ebx + 8], 0
je 0x51089f
cmp eax, 3
je 0x5108d1
dec eax
jne 0x51089f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51089f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51089f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x510919
cmp dword [ebx + 0x14], 0xcc
je 0x510919
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00510924
pop ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3cb94504
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x14130af
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4011b0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1014
call fcn.00402f70
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1010], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 1
push str.Downloader
mov edi, edx
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
jne 0x401215
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.InternetOpen_failed_n
call fcn.00401b20
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.004020ca
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 7
jbe 0x40121d
mov esi, dword [esi]
push 0
push 0x80000000
push 0
push 0
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
jne 0x401264
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.InternetOpenUrl_failed_n
call fcn.00401b20
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.004020ca
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 7
jbe 0x40126c
mov edi, dword [edi]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4012bf
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.CreateFile_failed_n
call fcn.00401b20
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.004020ca
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push 0x1000
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401316
nop dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401316
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push eax
push 0x1000
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4012e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x101c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004020ca
mov esp, ebp
pop ebp
ret
Function at 0x4014a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x234], ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4014dc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020ca
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401534
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call edi
add esp, 8
test eax, eax
je 0x40154e
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x401510
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020ca
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004020ca
mov esp, ebp
pop ebp
ret

Function at 0x402965
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4029a4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4029a4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4029a4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4029a4
cmp dword [ecx + 0x74], 0xe
jbe 0x4029a4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401084
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push 0x24
push 0
lea eax, [ebp - 0xc8]
push eax
call fcn.00405bd0
add esp, 0xc
push 0x9c
push 0
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00405bd0
add esp, 0xc
mov dword [ebp - 0x9c], 0x9c
lea edx, [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4010e0
xor eax, eax
jmp 0x40113d
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x401115
lea eax, [ebp - 0xc8]
push eax
call dword [ebp - 0xa0]
jmp 0x401122
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x8c], 2
jne 0x40113b
cmp dword [ebp - 0x98], 6
jb 0x40113b
mov eax, 1
jmp 0x40113d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401fd5
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.004066a7
add esp, 0xc
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1a8], 0
je 0x402059
mov eax, dword [ebp + 8]
add eax, 0x84
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402057
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x402068
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004065fe
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4021c3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp + 0x10], eax
push 0x4132d0
push 0x64
mov eax, dword [ebp + 8]
push eax
push 0x417368
mov ecx, 0x418238
call fcn.00402710
mov dword [0x4183e0], 1
mov cx, word [0x4173c0]
mov word [ebp - 0x11c], cx
mov dl, byte [0x4173c2]
mov byte [ebp - 0x11a], dl
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401ec0
add esp, 8
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4022d1
push str.UnregServer
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40225e
mov ecx, 0x418238
call fcn.004026c0
jmp 0x402403
push str.RegServer
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402287
push 0
push 1
mov ecx, 0x418238
call fcn.00402540
jmp 0x402403
push str.Service
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4022b0
push 1
push 1
mov ecx, 0x418238
call fcn.00402540
jmp 0x402403
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.00401ec0
add esp, 8
mov dword [ebp - 0x118], eax
jmp 0x40222c
lea ecx, [ebp - 0x114]
call fcn.00403840
push 0x20019
push 0x4173e4
push SysReAllocString
lea ecx, [ebp - 0x114]
call fcn.004038f0
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x402327
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x120], ecx
lea ecx, [ebp - 0x114]
call fcn.00403860
mov eax, dword [ebp - 0x120]
jmp 0x402403
lea ecx, [ebp - 0x110]
call fcn.00403840
push 0x20019
push 0x4173ec
lea ecx, [ebp - 0x114]
call fcn.00403880
push eax
lea ecx, [ebp - 0x110]
call fcn.004038f0
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x40238c
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x124], edx
lea ecx, [ebp - 0x110]
call fcn.00403860
lea ecx, [ebp - 0x114]
call fcn.00403860
mov eax, dword [ebp - 0x124]
jmp 0x402403
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
push 0x417414
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x110]
call fcn.00403940
mov dword [ebp - 0x10c], eax
mov dword [0x4183e0], 0
cmp dword [ebp - 0x10c], 0
jne 0x4023d1
mov dword [0x4183e0], 1
mov ecx, 0x418238
call fcn.00402a00
mov edx, dword [0x4183cc]
mov dword [ebp - 0x128], edx
lea ecx, [ebp - 0x110]
call fcn.00403860
lea ecx, [ebp - 0x114]
call fcn.00403860
mov eax, dword [ebp - 0x128]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4027d0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebp - 0x110]
call fcn.00401f6d
test eax, eax
je 0x4027f8
mov eax, 1
jmp 0x4028ef
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x402838
push 0
mov eax, dword [ebp - 0x110]
add eax, 0x84
push eax
push str.Couldnt_open_service_manager
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4028ef
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push str.RPCSS
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push 1
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 0x110]
add eax, 0x84
push eax
mov ecx, dword [ebp - 0x110]
add ecx, 0x84
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x4028d0
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
mov ecx, dword [ebp - 0x110]
add ecx, 0x84
push ecx
push str.Couldnt_create_service
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4028ef
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402900
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00401f6d
test eax, eax
jne 0x40291f
mov eax, 1
jmp 0x4029f8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402956
push 0
mov eax, dword [ebp - 0x2c]
add eax, 0x84
push eax
push str.Couldnt_open_service_manager
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4029f8
push 0x10020
mov ecx, dword [ebp - 0x2c]
add ecx, 0x84
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40299f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x84
push ecx
push str.Couldnt_open_service
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4029f8
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 4], 0
je 0x4029dd
mov eax, 1
jmp 0x4029f8
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x84
push ecx
push str.Service_could_not_be_deleted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov esp, ebp
pop ebp
ret