joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f990
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47a703
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x47b254
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x18]
push eax
push str.KERNEL32.dll
mov dword [esp + 0x48], 1
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x73
mov byte [esp + 0x24], 0x65
mov byte [esp + 0x25], 0x48
mov byte [esp + 0x26], 0x61
mov byte [esp + 0x27], 0x6e
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
mov cl, 0x69
mov ebx, eax
mov byte [esp + 0x26], cl
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x24]
mov al, 0x74
push ecx
push str.KERNEL32.dll
mov byte [esp + 0x2c], 0x57
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], 0x46
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x53
mov byte [esp + 0x35], 0x6e
mov byte [esp + 0x36], 0x67
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x4f
mov byte [esp + 0x3a], 0x62
mov byte [esp + 0x3b], 0x6a
mov byte [esp + 0x3c], 0x65
mov byte [esp + 0x3d], 0x63
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], 0
call edi
push eax
call ebp
push str.InterlockedExchange
push str.KERNEL32.dll
mov dword [esp + 0x18], eax
call edi
push eax
call ebp
lea edx, [esi + 0x12]
push 0
mov edi, eax
push edx
call edi
lea eax, [esi + 0x10]
push 0
push eax
call edi
mov ecx, dword [esi + 0x1c]
mov edi, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x1c]
push eax
call ebx
mov ecx, dword [esi + 0x20]
push ecx
call ebx
mov ecx, dword [esi + 0xa8]
test ecx, ecx
je 0x42fae1
mov edx, dword [ecx]
push 1
call dword [edx]
mov ebp, dword [0x493f4c]
mov dword [esi + 0x24], 0x47b25c
lea edi, [esi + 0x68]
mov ebx, 0x10
mov eax, dword [edi]
push eax
call ebp
add edi, 4
dec ebx
jne 0x42faf6
mov ecx, esi
mov dword [esp + 0x40], 0xffffffff
call fcn.0042d5e0
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x430070
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.SetClipboardData
push str.USER32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.CloseClipboard
push str.USER32.dll
mov ebp, eax
call esi
push eax
call edi
push str.GlobalAlloc
push str.KERNEL32.dll
mov dword [esp + 0x24], eax
call esi
push eax
call edi
push str.GlobalLock
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.GlobalUnlock
push str.KERNEL32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
push str.GlobalFree
push str.KERNEL32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push 0
mov dword [esp + 0x1c], eax
call dword [0x493f44]
test eax, eax
je 0x430143
call dword [0x493f48]
mov esi, dword [esp + 0x28]
push esi
push 0x2000
call ebx
mov ebx, eax
test ebx, ebx
je 0x43013f
push ebx
call dword [esp + 0x14]
mov ecx, esi
mov esi, dword [esp + 0x24]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [esp + 0x18]
push ebx
push 1
call ebp
push ebx
call dword [esp + 0x1c]
call dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x430220
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.mouse_event
push str.USER32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.SetCursorPos
push str.USER32.dll
mov ebp, eax
call esi
push eax
call edi
push str.WindowFromPoint
push str.USER32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
push str.SetCapture
push str.USER32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push str.MapVirtualKeyA
push str.USER32.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push str.keybd_event
push str.USER32.dll
mov dword [esp + 0x14], eax
call esi
push eax
call edi
mov esi, dword [esp + 0x28]
mov edi, eax
mov eax, esi
xor edx, edx
mov ecx, 0x1c
mov dword [esp + 0x1c], edi
div ecx
test edx, edx
jne 0x430438
call fcn.00436740
mov eax, 0x24924925
mul esi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 4
test esi, esi
jle 0x430438
mov edx, dword [esp + 0x24]
push ebx
mov dword [esp + 0x2c], esi
lea ebx, [edx + 8]
mov eax, dword [ebx - 4]
cmp eax, 0x200
jb 0x430316
cmp eax, 0x208
ja 0x430316
mov edi, dword [ebx + 4]
xor esi, esi
mov si, word [ebx + 4]
shr edi, 0x10
push edi
push esi
call dword [esp + 0x1c]
push edi
push esi
call dword [esp + 0x20]
push eax
call dword [esp + 0x20]
mov edi, dword [esp + 0x20]
mov eax, dword [ebx - 4]
cmp eax, 0x203
ja 0x4303b6
je 0x43039e
cmp eax, 0x105
ja 0x430372
je 0x43035a
sub eax, 0x100
je 0x430342
dec eax
je 0x43035a
sub eax, 3
jne case.0x4303c0.521
mov eax, dword [ebx]
push 0
push 0
push 0
push eax
call dword [esp + 0x20]
mov cl, byte [ebx]
push eax
push ecx
call edi
jmp case.0x4303c0.521
mov edx, dword [ebx]
push 0
push 2
push 0
push edx
call dword [esp + 0x20]
push eax
mov al, byte [ebx]
push eax
call edi
jmp case.0x4303c0.521
sub eax, 0x201
je 0x43038f
dec eax
jne case.0x4303c0.521
push 0
push 0
push 0
push 0
push 4
jmp 0x430423
push 0
push 0
push 0
push 0
push 2
jmp 0x430423
push 0
push 0
push 0
push 0
push 6
call ebp
push 0
push 0
push 0
push 0
push 6
jmp 0x430423
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x4303c0.521
jmp dword [eax*4 + 0x430444]
push 0
push 0
push 0
push 0
push 8
jmp 0x430423
push 0
push 0
push 0
push 0
push 0x10
jmp 0x430423
push 0
push 0
push 0
push 0
push 0x18
call ebp
push 0
push 0
push 0
push 0
push 0x18
jmp 0x430423
push 0
push 0
push 0
push 0
push 0x20
jmp 0x430423
push 0
push 0
push 0
push 0
push 0x40
jmp 0x430423
mov ecx, dword [ebx]
push 0
shr ecx, 0x10
movsx edx, cx
push edx
push 0
push 0
push 0x800
call ebp
mov eax, dword [esp + 0x2c]
add ebx, 0x1c
dec eax
mov dword [esp + 0x2c], eax
jne 0x4302e4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
Function at 0x431290
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetCurrentProcess
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
mov al, 0x41
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov al, 0x6c
push str.AdjustTokenPrivileges
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], al
lea eax, [esp + 0x20]
mov byte [esp + 0x21], 0x44
push eax
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x28], 0x50
mov byte [esp + 0x29], 0x49
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], 0
call esi
push eax
call edi
lea ecx, [esp + 0x1c]
push str.LookupPrivilegeValueA
push ecx
mov dword [esp + 0x20], eax
call esi
push eax
call edi
lea edx, [esp + 0x1c]
push str.OpenProcessToken
push edx
mov dword [esp + 0x18], eax
call esi
push eax
call edi
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x20
call ebp
push eax
call ebx
test eax, eax
je 0x4313cc
lea ecx, [esp + 0x40]
push ecx
push str.SeDebugPrivilege
push 0
call dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push 0
push 0
lea edx, [esp + 0x44]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x54], 1
mov dword [esp + 0x60], 2
call dword [esp + 0x30]
mov al, 0x74
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov al, 0x72
push ecx
push str.KERNEL32.dll
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x37], 0x4c
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x73
mov byte [esp + 0x3b], 0x45
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], al
mov byte [esp + 0x3e], 0x6f
mov byte [esp + 0x3f], al
mov byte [esp + 0x40], 0
call esi
push eax
call edi
call eax
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x431440
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x244
mov al, 0x41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov al, 0x6c
push ebp
push esi
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
push edi
lea eax, [esp + 0x10]
push str.OpenSCManagerA
mov dword [esp + 0x34], ecx
push eax
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
push str.CloseServiceHandle
push ecx
mov esi, eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.QueryServiceStatus
push edx
mov dword [esp + 0x30], eax
call ebx
push eax
call ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push str.OpenServiceA
push eax
call ebx
push eax
call ebp
lea ecx, [esp + 0x10]
push str.UnlockServiceDatabase
push ecx
mov dword [esp + 0x40], eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.ChangeServiceConfigA
push edx
mov dword [esp + 0x48], eax
call ebx
push eax
call ebp
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push str.LockServiceDatabase
push eax
call ebx
push eax
call ebp
mov dword [esp + 0x3c], eax
call fcn.00431290
push 1
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0xf003f
push 0
push 0
call esi
mov edx, eax
mov edi, dword [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x34], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x34]
push 0xf01ff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x24], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
push ecx
push edx
call dword [esp + 0x44]
lea edx, [esp + 0x44]
mov esi, eax
push edx
push esi
call dword [esp + 0x34]
mov eax, dword [esp + 0x20]
push eax
call dword [esp + 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push esi
mov edi, eax
call dword [esp + 0x50]
push edi
call dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x2c]
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
push 0
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0x487390
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x64
call eax
mov ecx, dword [esp + 0x30]
call fcn.004313e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x244
ret 8
Function at 0x431600
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x244
mov al, 0x41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov al, 0x6c
push ebp
push esi
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
push edi
lea eax, [esp + 0x10]
push str.OpenSCManagerA
mov dword [esp + 0x34], ecx
push eax
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
push str.CloseServiceHandle
push ecx
mov esi, eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.QueryServiceStatus
push edx
mov dword [esp + 0x30], eax
call ebx
push eax
call ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push str.OpenServiceA
push eax
call ebx
push eax
call ebp
lea ecx, [esp + 0x10]
push str.UnlockServiceDatabase
push ecx
mov dword [esp + 0x40], eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.ChangeServiceConfigA
push edx
mov dword [esp + 0x48], eax
call ebx
push eax
call ebp
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push str.LockServiceDatabase
push eax
call ebx
push eax
call ebp
mov dword [esp + 0x3c], eax
call fcn.00431290
push 1
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0xf003f
push 0
push 0
call esi
mov edx, eax
mov edi, dword [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x34], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x34]
push 0xf01ff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x24], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
push ecx
push edx
call dword [esp + 0x44]
lea edx, [esp + 0x44]
mov esi, eax
push edx
push esi
call dword [esp + 0x34]
mov eax, dword [esp + 0x20]
push eax
call dword [esp + 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
mov edi, eax
call dword [esp + 0x50]
push edi
call dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x2c]
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
push 0
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0x487390
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x64
call eax
mov ecx, dword [esp + 0x30]
call fcn.004313e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x244
ret 8
Function at 0x4317c0
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x244
mov al, 0x41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov al, 0x6c
push ebp
push esi
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
push edi
lea eax, [esp + 0x10]
push str.OpenSCManagerA
mov dword [esp + 0x34], ecx
push eax
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
push str.CloseServiceHandle
push ecx
mov esi, eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.QueryServiceStatus
push edx
mov dword [esp + 0x30], eax
call ebx
push eax
call ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push str.OpenServiceA
push eax
call ebx
push eax
call ebp
lea ecx, [esp + 0x10]
push str.UnlockServiceDatabase
push ecx
mov dword [esp + 0x40], eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.ChangeServiceConfigA
push edx
mov dword [esp + 0x48], eax
call ebx
push eax
call ebp
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push str.LockServiceDatabase
push eax
call ebx
push eax
call ebp
mov dword [esp + 0x3c], eax
call fcn.00431290
push 1
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0xf003f
push 0
push 0
call esi
mov edx, eax
mov edi, dword [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x34], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x34]
push 0xf01ff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x24], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
push ecx
push edx
call dword [esp + 0x44]
lea edx, [esp + 0x44]
mov esi, eax
push edx
push esi
call dword [esp + 0x34]
mov eax, dword [esp + 0x20]
push eax
call dword [esp + 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
mov edi, eax
call dword [esp + 0x50]
push edi
call dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x2c]
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
push 0
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0x487390
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x64
call eax
mov ecx, dword [esp + 0x30]
call fcn.004313e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x244
ret 8
Function at 0x431980
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x23c
mov al, 0x41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov al, 0x6c
push ebp
push esi
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
push edi
lea eax, [esp + 0x10]
push str.OpenSCManagerA
mov dword [esp + 0x2c], ecx
push eax
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
push str.CloseServiceHandle
push ecx
mov esi, eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.ControlService
push edx
mov dword [esp + 0x28], eax
call ebx
push eax
call ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push str.QueryServiceStatus
push eax
call ebx
push eax
call ebp
lea ecx, [esp + 0x10]
push str.OpenServiceA
push ecx
mov dword [esp + 0x3c], eax
call ebx
push eax
call ebp
mov dword [esp + 0x30], eax
call fcn.00431290
push 1
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0xf003f
push 0
push 0
call esi
mov edi, dword [esp + 0x250]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x58]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x38], esi
mov esi, edi
mov edi, dword [esp + 0x38]
shr ecx, 2
mov dword [esp + 0x24], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xf01ff
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5c]
push ecx
push edx
call dword [esp + 0x3c]
lea edx, [esp + 0x3c]
mov esi, eax
push edx
push esi
call dword [esp + 0x3c]
cmp dword [esp + 0x40], 1
je 0x431ab9
lea eax, [esp + 0x3c]
push eax
push 1
push esi
call dword [esp + 0x38]
push esi
call dword [0x493eb0]
push esi
mov esi, dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0x24]
push ecx
call esi
push 0
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0x487390
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x64
call eax
mov ecx, dword [esp + 0x28]
call fcn.004313e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret 8
Function at 0x431b10
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x238
mov al, 0x41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov al, 0x6c
push ebp
push esi
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
push edi
lea eax, [esp + 0x10]
push str.OpenSCManagerA
mov dword [esp + 0x28], ecx
push eax
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
push str.CloseServiceHandle
push ecx
mov esi, eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.QueryServiceStatus
push edx
mov dword [esp + 0x3c], eax
call ebx
push eax
call ebp
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push str.OpenServiceA
push eax
call ebx
push eax
call ebp
mov dword [esp + 0x2c], eax
call fcn.00431290
push 1
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0xf003f
push 0
push 0
call esi
mov edi, dword [esp + 0x24c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x54]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x30], esi
mov esi, edi
mov edi, dword [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xf01ff
and ecx, 3
mov dword [esp + 0x24], edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x58]
push ecx
push edx
call dword [esp + 0x38]
lea edx, [esp + 0x38]
mov esi, eax
push edx
push esi
call dword [esp + 0x30]
cmp dword [esp + 0x3c], 1
jne 0x431c35
push 0
push 0
push esi
call dword [0x493eb8]
push esi
mov esi, dword [esp + 0x38]
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
push 0
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0x487390
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x64
call eax
mov ecx, dword [esp + 0x24]
call fcn.004313e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret 8
Function at 0x431c80
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
sub esp, 0x23c
mov al, 0x41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 4], al
mov byte [esp + 7], al
mov al, 0x6c
push ebp
push esi
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
push edi
lea eax, [esp + 0x10]
push str.OpenSCManagerA
mov dword [esp + 0x2c], ecx
push eax
mov byte [esp + 0x19], 0x44
mov byte [esp + 0x1a], 0x56
mov byte [esp + 0x1c], 0x50
mov byte [esp + 0x1d], 0x49
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
lea ecx, [esp + 0x10]
push str.CloseServiceHandle
push ecx
mov esi, eax
call ebx
push eax
call ebp
lea edx, [esp + 0x10]
push str.ControlService
push edx
mov dword [esp + 0x28], eax
call ebx
push eax
call ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push str.QueryServiceStatus
push eax
call ebx
push eax
call ebp
lea ecx, [esp + 0x10]
push str.OpenServiceA
push ecx
mov dword [esp + 0x3c], eax
call ebx
push eax
call ebp
mov dword [esp + 0x30], eax
call fcn.00431290
push 1
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0xf003f
push 0
push 0
call esi
mov edi, dword [esp + 0x250]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x58]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x38], esi
mov esi, edi
mov edi, dword [esp + 0x38]
shr ecx, 2
mov dword [esp + 0x24], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xf01ff
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5c]
push ecx
push edx
call dword [esp + 0x3c]
lea edx, [esp + 0x3c]
mov esi, eax
push edx
push esi
call dword [esp + 0x3c]
cmp dword [esp + 0x40], 1
je 0x431db9
lea eax, [esp + 0x3c]
push eax
push 1
push esi
call dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0x24]
push ecx
call esi
push 0
push str.SeDebugPrivilege
call fcn.00432250
add esp, 8
push 0x487390
push str.KERNEL32.dll
call ebx
push eax
call ebp
push 0x64
call eax
mov ecx, dword [esp + 0x28]
call fcn.004313e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret 8