joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406b70
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 with custom key via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
cmp esi, 0x10
jle 0x406b85
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x406bc8
push 8
push 1
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
call edi
test eax, eax
jne 0x406bc8
push 0xf0000000
push 1
push ebx
push ebx
lea edx, [ebp - 4]
push edx
call edi
test eax, eax
je 0x406c66
mov ecx, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptImportKey]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x134
push 0x44df70
push ecx
mov dword [ebp - 0xc], ebx
call edi
test eax, eax
je 0x406c66
xor eax, eax
cmp esi, ebx
jle 0x406c05
lea ecx, [esi + 0x44e0f3]
mov dl, byte [ecx]
mov byte [eax + 0x44e0b4], dl
inc eax
dec ecx
cmp eax, esi
jl 0x406bf7
lea eax, [esi + 1]
mov byte [esi + 0x44e0b4], bl
cmp eax, 0x3e
jge 0x406c2c
mov edx, 0x3e
sub edx, eax
push edx
lea ecx, [eax + 0x44e0b4]
push 1
push ecx
call fcn.00428490
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ebx
push ecx
push 0x4c
push 0x44e0a8
push edx
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x406c66
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push ecx
push eax
mov eax, dword [ebp - 8]
push edx
push ebx
push 1
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x406c6f
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ecx
call esi
mov edx, dword [ebp - 0xc]
push edx
call esi
mov eax, dword [ebp - 4]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408b80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x212]
push ecx
mov word [ebp - 0x214], ax
call fcn.00428490
add esp, 0xc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x408bda
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x48cef8], 1
mov dword [ebp - 0x220], eax
jne 0x408c13
cmp byte [ebp + 0x10], 0
push 0
je 0x408c08
push 0x100
push esi
push edi
call eax
jmp 0x408c1b
push 0x200
push esi
push edi
call eax
jmp 0x408c1b
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x408c35
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x408c49
lea edx, [ebp - 0x218]
push edx
push 0x20119
jmp 0x408c55
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x408c6d
xor ecx, ecx
cmp eax, 2
jmp 0x408d75
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
lea ebx, [esi + eax*2]
je 0x408c8f
mov edx, 0x5c
mov word [ebx], dx
add ebx, 2
xor eax, eax
mov word [ebx], ax
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp - 0x218]
push 0
push 0
push 0
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push ecx
mov dword [ebp - 0x21c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x408d27
jmp 0x408cd0
lea edx, [ebp - 0x214]
mov ecx, ebx
call fcn.004075e0
mov edx, dword [ebp + 0x10]
push edx
push esi
push edi
call fcn.00408b80
add esp, 0xc
test eax, eax
je 0x408d27
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x218]
push 0
push 0
push 0
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push eax
mov dword [ebp - 0x21c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x408cd0
xor ecx, ecx
mov word [ebx - 2], cx
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x48cef8], 1
jne 0x408d69
cmp byte [ebp + 0x10], 0
push 0
je 0x408d5a
push 0x100
push esi
push edi
call dword [ebp - 0x220]
jmp 0x408d71
push 0x200
push esi
push edi
call dword [ebp - 0x220]
jmp 0x408d71
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
Function at 0x40af90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x214], 0
mov word [ebp - 0x20c], ax
call fcn.00428490
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
add esp, 0xc
call esi
movzx eax, ax
mov edx, eax
and edx, 0x3ff
cmp edx, 4
jne 0x40aff6
and eax, 0xfc00
cmp eax, 0x400
jne 0x40aff6
lea edi, [edx - 3]
jmp 0x40aff8
xor edi, edi
call esi
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp ecx, 4
jne 0x40b01b
and eax, 0xfc00
cmp eax, 0x800
jne 0x40b01b
lea edx, [ecx - 3]
jmp 0x40b01d
xor edx, edx
xor eax, eax
nop
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionUninstall_]
mov word [ebp + eax - 0x20c], cx
add eax, 2
test cx, cx
jne 0x40b020
test edi, edi
je 0x40b089
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b044
mov edx, dword [0x43f3d4]
mov ecx, dword [0x43f3d8]
mov dword [eax], edx
mov edx, dword [0x43f3dc]
mov dword [eax + 4], ecx
mov ecx, dword [0x43f3e0]
mov dword [eax + 8], edx
mov edx, dword [0x43f3e4]
mov dword [eax + 0xc], ecx
mov cx, word [0x43f3e8]
mov dword [eax + 0x10], edx
mov word [eax + 0x14], cx
jmp 0x40b0fc
test edx, edx
je 0x40b0db
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b096
mov edx, dword [0x43f3ec]
mov ecx, dword [str._Client7]
mov dword [eax], edx
mov edx, dword [0x43f3f4]
mov dword [eax + 4], ecx
mov ecx, dword [0x43f3f8]
mov dword [eax + 8], edx
mov edx, dword [0x43f3fc]
mov dword [eax + 0xc], ecx
mov cx, word [0x43f400]
mov dword [eax + 0x10], edx
mov word [eax + 0x14], cx
jmp 0x40b0fc
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b0e4
mov ecx, 7
mov esi, str.WiNet_Client7
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop edi
pop esi
test eax, eax
jne 0x40b18e
nop
movzx ecx, word [eax + 0x486954]
mov word [ebp + eax - 0x20c], cx
add eax, 2
test cx, cx
jne 0x40b130
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b150
mov ecx, dword [ebp - 0x210]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.DisplayVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.004217e4
mov esp, ebp
pop ebp
ret
Function at 0x40b1b0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x489430], 0
mov dword [ebp - 8], 0
je 0x40b223
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.systemcurrentcontrolset_servicesWM7F
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b21d
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push str.NetDevice
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push str.systemcurrentcontrolset_servicesWM7F
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b25b
mov eax, dword [ebp - 4]
push str.NetDevice
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40b510
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0
mov word [ebp - 0x20c], ax
call fcn.00428490
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.systemcurrentcontrolset_serviceseventlogApplicationWinNetDaily
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40b594
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
push 0x208
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.00428490
push str._SystemRoot_System32WinNetDaily.dll
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.00423d08
lea eax, [ebp - 0x20c]
add esp, 0x18
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b5d0
mov ecx, dword [ebp - 0x210]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
push edi
lea eax, [ebp - 0x20c]
push eax
push 2
push 0
push str.EventMessageFile
push ecx
call esi
mov eax, dword [ebp - 0x210]
push edi
lea edx, [ebp - 0x20c]
push edx
push 2
push 0
push str.CategoryMessageFile
push eax
call esi
push 0x104
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.00428490
mov eax, dword [ebp - 0x210]
add esp, 0xc
push 4
lea edx, [ebp - 0x214]
push edx
push 4
push 0
push str.TypesSupported
push eax
mov dword [ebp - 0x214], 7
call esi
mov edx, dword [ebp - 0x210]
push 4
lea ecx, [ebp - 0x214]
push ecx
push 4
push 0
push str.CategoryCount
push edx
mov dword [ebp - 0x214], 1
call esi
mov eax, dword [ebp - 0x210]
pop edi
pop esi
test eax, eax
je 0x40b692
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.004217e4
mov esp, ebp
pop ebp
ret

Function at 0x40b6b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00428490
push 0x48ef90
lea edx, [ebp - 0x210]
push str.__swmcSystem7.exe___di
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x44
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.00428490
add esp, 0x24
xor eax, eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x268]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0x268], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40b76d
mov ecx, dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x220]
push edx
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004217e4
mov esp, ebp
pop ebp
ret
Function at 0x40b780
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00428490
push 0x11c
lea edx, [ebp - 0x330]
push 0
push edx
call fcn.00428490
add esp, 0x18
lea eax, [ebp - 0x330]
push eax
mov dword [ebp - 0x330], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x32c], 6
push 0x48ef90
jb 0x40b7f8
push str.__swmcSystem7.exe___ai
lea ecx, [ebp - 0x210]
push ecx
jmp 0x40b804
push str.__swmcSystem7.exe___i
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x44
lea eax, [ebp - 0x388]
push 0
push eax
call fcn.00428490
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x340]
push ecx
lea edx, [ebp - 0x388]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0x388], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40b884
mov ecx, dword [ebp - 0x33c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x340]
push edx
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004217e4
mov esp, ebp
pop ebp
ret
Function at 0x40b8a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x48ba90]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00428490
add esp, 0xc
push 0x48ef90
lea edx, [ebp - 0x210]
push str.__swmcSystem7.exe___ap
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp esi, 2
jne 0x40b917
lea eax, [ebp - 0x210]
push eax
mov ecx, edi
call fcn.00405ee0
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
cmp esi, 3
jne 0x40b93c
lea ecx, [ebp - 0x210]
push ecx
mov ecx, edi
call fcn.00406370
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
cmp esi, 4
jne 0x40b961
lea edx, [ebp - 0x210]
push edx
mov ecx, edi
call fcn.00406370
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
push 0x44
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.00428490
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x268]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0x268], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40b9e4
test edi, edi
je 0x40b9cc
mov ecx, dword [ebp - 0x218]
mov dword [edi], ecx
mov edx, dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x220]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004217e4
mov esp, ebp
pop ebp
ret
Function at 0x40ba00
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x416]
push ecx
mov word [ebp - 0x418], ax
call fcn.00428490
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x61e]
push eax
mov word [ebp - 0x620], dx
call fcn.00428490
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00428490
add esp, 0xc
push str._C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00423d08
add esp, 0xc
push str.wmcUpdater.exe___smr_inst
lea ecx, [ebp - 0x418]
push 0x104
push ecx
call fcn.00423c93
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
push 0x43f850
push 0x486150
call edi
add esp, 0xc
push 0x486150
call fcn.00406870
add esp, 4
push 0x48ef90
lea eax, [ebp - 0x620]
push str._swmcUpdater.exe
push eax
call edi
add esp, 0xc
push 0x48d128
lea ecx, [ebp - 0x210]
push str._swmcUpdater.exe
push ecx
call edi
add esp, 0xc
push 0x44
lea edx, [ebp - 0x678]
push 0
push edx
call fcn.00428490
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x678]
push ecx
push 0
push 0
push 0x20
mov dword [ebp - 0x678], 0x44
push 0
push 0
push 0
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40bc30
mov eax, dword [ebp - 0x630]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x62c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x630]
push edx
call esi
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004224e1
add esp, 8
test eax, eax
je 0x40bc30
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea esp, [esp]
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x620]
push edx
inc esi
call ebx
test eax, eax
movzx eax, si
lea ecx, [ebp - 0x210]
push eax
push ecx
jne 0x40bc17
push 0x43f8ac
push 0x486150
call edi
push 0x486150
call fcn.00406870
add esp, 0x14
cmp si, 3
je 0x40bc30
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.004224e1
add esp, 8
test eax, eax
jne 0x40bbb0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
push str.uP_n
push 0x486150
call edi
push 0x486150
call fcn.00406870
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004217e4
mov esp, ebp
pop ebp
ret
Function at 0x40bc50
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x80070057
test edi, edi
je 0x40bd96
mov ecx, edi
push esi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40bc70
sub ecx, esi
sar ecx, 1
je 0x40bd95
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40bd95
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40bc93
sub ecx, esi
sar ecx, 1
je 0x40bd95
test ebx, ebx
je 0x40bd95
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40bd95
lea eax, [ebp - 4]
push eax
push 0x43646c
push 1
push 0
push 0x43647c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40bd95
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push edi
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push str._service
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bd10
sub eax, edx
sar eax, 1
je 0x40bd2d
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebx
push eax
call edx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bd32
sub eax, edx
sar eax, 1
je 0x40bd51
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push esi
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x43648c
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
js 0x40bd88
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40bda0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x40bdc4
push str.CoInitialize___failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.0040bc50
add esp, 8
test eax, eax
jns 0x40bded
push str.CreateShortCut___failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop ebp
ret
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
pop ebp
ret
Function at 0x40c500
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, byte [0x44021c]
xor eax, eax
push 2
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov eax, dword [0x440218]
push 0
push 0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], cl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x40c554
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217e4
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
xor edi, edi
jmp 0x40c564
mov eax, dword [ebp - 0x34]
push 0xf01ff
lea edx, [ebp - 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40c5a0
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40c58f
cmp dword [ebp - 0x2c], 4
je 0x40c5ad
push 0x1f4
call ebx
push esi
inc edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40c5a8
push 0x1f4
call ebx
inc edi
cmp edi, 0x3c
jl 0x40c561
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004217e4
mov esp, ebp
pop ebp
ret