joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518441
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x573790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0050c76f
and dword [ebp - 0x14], 0
cmp dword [0x57b1bc], 0
mov dword [ebp - 0x18], eax
jne 0x5184f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x51859c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x51859c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x552e10
push ebx
mov dword [0x57b1bc], eax
call edi
push eax
call esi
push 0x552dfc
push ebx
mov dword [0x57b1c0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x57b1c4], eax
call edi
push eax
call esi
mov dword [0x57b1cc], eax
test eax, eax
je 0x5184f4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x57b1c8], eax
mov eax, dword [0x57b1c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x51854d
cmp dword [0x57b1cc], ecx
je 0x51854d
push eax
call esi
push dword [0x57b1cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x51854d
test ebx, ebx
je 0x51854d
call edi
test eax, eax
je 0x518544
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x518544
test byte [ebp - 8], 1
jne 0x51854d
or dword [ebp + 0x10], 0x200000
jmp 0x518580
mov eax, dword [0x57b1c0]
cmp eax, dword [ebp - 0x18]
je 0x518580
push eax
call esi
test eax, eax
je 0x518580
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x518580
mov eax, dword [0x57b1c4]
cmp eax, dword [ebp - 0x18]
je 0x518580
push eax
call esi
test eax, eax
je 0x518580
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x57b1bc]
call esi
test eax, eax
je 0x51859c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x51859e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fecc6
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40110a
cmp dword [ebp - 4], 1
jge 0x401135
call fcn.004059b0
mov dword [ebp - 8], eax
push str.WAR:_Invalid_Args.
push 0x607258
call fcn.0040c230
add esp, 8
mov dword [ebp - 8], 0
jmp 0x40124f
push str._AutoRun1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call fcn.00492060
add esp, 8
test eax, eax
jne 0x40116c
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
push str.Ready_for_run_as_service...
push str.ParseExecCmdLine
call fcn.0040c230
add esp, 8
jmp 0x40124f
push str.install
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call fcn.00492060
add esp, 8
test eax, eax
jne 0x401190
call fcn.004032c0
mov dword [ebp - 8], eax
jmp 0x40124f
push str.uninstall
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call fcn.00492060
add esp, 8
test eax, eax
jne 0x4011b4
call fcn.00403600
mov dword [ebp - 8], eax
jmp 0x40124f
push str.stop
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00492060
add esp, 8
test eax, eax
jne 0x4011d5
call fcn.00404950
mov dword [ebp - 8], eax
jmp 0x40124f
push str.start
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call fcn.00492060
add esp, 8
test eax, eax
jne 0x4011fb
push 0
call fcn.00404d10
add esp, 4
mov dword [ebp - 8], eax
jmp 0x40124f
push 0x60730c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call fcn.00492060
add esp, 8
test eax, eax
jne 0x401226
call fcn.00404950
push 1
call fcn.00404d10
add esp, 4
mov dword [ebp - 8], eax
jmp 0x40124f
push str.start_config
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00492060
add esp, 8
test eax, eax
jne 0x401247
call fcn.004059b0
mov dword [ebp - 8], eax
jmp 0x40124f
call fcn.004059b0
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x40125f
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x401270
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6404b4], 0
jne 0x4012a5
push str.WAR:_Here_is_no_restart_flag_set__out_
push 0x606198
call fcn.0040c230
add esp, 8
xor eax, eax
jmp 0x401360
xor eax, eax
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00568440
add esp, 0xc
push 0x208
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4012f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:_GetModuleFileNameW_failed__err_d
push 0x606204
call fcn.0040c230
add esp, 0xc
xor eax, eax
jmp 0x401360
push 0
push 0
push 0x60621c
lea eax, [ebp - 0x418]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x20
jg 0x401342
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:_run_self_process_fail__err_d__out_
push 0x606290
call fcn.0040c230
add esp, 0xc
xor eax, eax
jmp 0x401360
lea ecx, [ebp - 0x418]
push ecx
push str.TIP:_restart_successed__self_s__out_
push str.TryRestartSelfIfNeed
call fcn.0040c230
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret
Function at 0x401370
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x4013b4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
mov ax, word [edx]
mov word [ebp - 0x1e], ax
add dword [ebp - 0x18], 2
cmp word [ebp - 0x1e], 0
jne 0x401392
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
sar ecx, 1
mov dword [ebp - 0x24], ecx
jne 0x4013cd
push str.ERR:_params_invalid_out_
push 0x60646c
call fcn.0040c230
add esp, 8
xor eax, eax
jmp 0x4014a6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
jne 0x401425
cmp dword [ebp - 0xc], 0
je 0x401401
mov ecx, dword [ebp - 0xc]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
push str.ERR:_WTSEnumerateProcesses_session_d_fail__code_d__out
push str.IsProcessExistInSession
call fcn.0040c230
add esp, 0x10
xor eax, eax
jmp 0x4014a6
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [ebp - 0x10], 0
jmp 0x401447
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jae 0x401494
mov eax, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
je 0x401466
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 8], 0
jne 0x401468
jmp 0x40143e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
cmp eax, dword [edx]
jne 0x401492
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401492
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 1
jmp 0x401494
jmp 0x40143e
cmp dword [ebp - 0xc], 0
je 0x4014a3
mov edx, dword [ebp - 0xc]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401940
Capabilities:
Create thread
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cc88
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x61b000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x34]
call fcn.00401e20
mov dword [ebp - 4], 0
cmp dword [0x64047c], 0
je 0x40199b
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x38]
jmp 0x401ac4
push str.Global_active_session_id_4byte
push 4
push 0
push 4
lea ecx, [ebp - 0x34]
call fcn.00401ee0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x640474], eax
cmp dword [0x640474], 0
jne 0x4019fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6069b8
push 0x606a10
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x3c]
jmp 0x401ac4
push 0
push 0
push 0
push 6
mov eax, dword [0x640474]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x640478], eax
cmp dword [0x640478], 0
jne 0x401a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x606a30
push 0x606a90
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x40]
jmp 0x401ac4
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x4014b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x64047c], eax
cmp dword [0x64047c], 0
jne 0x401aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_start_ActiveSessionCapWork_thread_fail__code_d__out_
push str.InitActiveSessionCaputure
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x44]
jmp 0x401ac4
mov dword [ebp - 0x48], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x401ae0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.taskkill__F__IM_UserSsUtil.exe
call fcn.00560cc1
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x63b1dc], 0
cmp dword [0x64047c], 0
je 0x401b5f
push 0xbb8
mov eax, dword [0x64047c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401b55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.WAR:_Wait_ActiveSessionCapWork_fail__ret_d__err_d._n
push str.UnInitActiveSessionCaputure
call fcn.0040c230
add esp, 0x10
push 0
mov edx, dword [0x64047c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x64047c], 0
cmp dword [0x640478], 0
je 0x401b7e
mov eax, dword [0x640478]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x640478], 0
cmp dword [0x640474], 0
je 0x401b9e
mov ecx, dword [0x640474]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x640474], 0
mov esp, ebp
pop ebp
ret

Function at 0x401f30
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58aba8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x61b000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x34]
call fcn.00401e20
mov dword [ebp - 4], 0
push str.Globalcdrom_interval_4byte
push 4
push 0
push 4
lea ecx, [ebp - 0x34]
call fcn.00401ee0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov edx, dword [ebp - 0x44]
cmp dword [edx], 0
jne 0x401fc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_create_file_mapping__code_d__out_
push 0x606da8
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x38]
jmp 0x402034
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x44]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x44]
cmp dword [eax + 4], 0
jne 0x40201b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x606dd0
push str.CCdromInterval::InitCdromInterval
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x3c]
jmp 0x402034
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x402050
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x40209e
push 0
push 0
push 0
push 6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x40209e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_mapping_share_mem_fail__code_d__out_
push str.CCdromInterval::SetCdromInterval
call fcn.0040c230
add esp, 0xc
jmp 0x4020af
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esp, ebp
pop ebp
ret 4
Function at 0x403600
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.taskkill__F__IM_Taskmgr.exe
call fcn.00406050
mov dword [ebp - 0x1c], eax
call fcn.00415f10
add esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x602920
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403670
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6029a8
push 0x602a10
call fcn.0040c230
add esp, 0xc
jmp 0x4036a4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x602a20
push 0x602a78
call fcn.0040c230
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40383b
push 0x10024
push 0x602994
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4037fb
push 0x640480
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x403715
push 0x602a88
push 0x602aa0
push 0x602ae0
call fcn.0040c230
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x640480
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x403759
cmp dword [0x640484], 3
jne 0x403755
push 0x602af0
push str.Wait_for_service__s_stop_pending...
push 0x602b50
call fcn.0040c230
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403757
jmp 0x403759
jmp 0x403715
mov eax, dword [0x640484]
push eax
push 0x602b60
push 0x602b9c
call fcn.0040c230
add esp, 0xc
cmp dword [0x640484], 1
jne 0x403793
push 0x602bac
push 0x602bc0
push 0x602bfc
call fcn.0040c230
add esp, 0xc
jmp 0x4037aa
push 0x602c0c
push 0x602c20
push 0x602c60
call fcn.0040c230
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4037d8
mov dword [ebp - 0x10], 1
push 0x602c70
push str.Delete_service__s_successed...
push 0x602cc4
call fcn.0040c230
add esp, 0xc
jmp 0x4037ef
push 0x602cd4
push str.Err:_Delete_service__s_failed_
push 0x602d2c
call fcn.0040c230
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40382f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x403811
mov dword [ebp - 0x10], 1
jmp 0x40382f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x602d3c
push 0x602d50
push 0x602da0
call fcn.0040c230
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403854
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x602db0
push str.remove_service
call fcn.0040c230
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x403a50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 1
push str.SeAssignPrimaryTokenPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403940
add esp, 0xc
push 1
push str.SeIncreaseQuotaPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403940
add esp, 0xc
push 1
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403940
add esp, 0xc
push 1
push str.SeSecurityPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403940
add esp, 0xc
push 1
push str.SeLoadDriverPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403940
add esp, 0xc
push 1
push str.SeShutdownPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403940
add esp, 0xc
pop ebp
ret

Function at 0x403ae0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58aa9b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x424], ax
push 0x40e
push 0
lea ecx, [ebp - 0x422]
push ecx
call fcn.00568440
add esp, 0xc
push 0x207
lea edx, [ebp - 0x424]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x428]
call fcn.00405ec0
mov dword [ebp - 4], 0
push str..old
lea ecx, [ebp - 0x428]
call fcn.00405f80
lea ecx, [ebp - 0x428]
call fcn.004027c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403c21
mov dword [ebp - 0x42c], 0x64
lea ecx, [ebp - 0x428]
call fcn.004027c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x403bff
mov ecx, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x42c]
sub edx, 1
mov dword [ebp - 0x42c], edx
test ecx, ecx
je 0x403bff
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x428]
call fcn.004027c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x430], eax
lea ecx, [ebp - 0x428]
call fcn.004027c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403bfd
jmp 0x403bff
jmp 0x403ba3
cmp dword [ebp - 0x430], 0
jne 0x403c21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Err:_delete_old_main_proc_file__err_d_r_n
push str.DeleteInvalidProcCatch
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.0042ecc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret
Function at 0x403c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403c99
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403cb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Err:_Create_delete_old_thread_fail_code_d
push str.WrapperDeleteInvalidProcCatch
call fcn.0040c230
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x403d80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x403d90
xor eax, eax
jmp 0x403e37
push 0x64
push 0x6404c8
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x640590
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
push edx
call fcn.00405790
add esp, 4
movzx eax, ax
test eax, eax
jne 0x403dcd
xor eax, eax
jmp 0x403e37
mov ecx, dword [ebp + 8]
mov dword [0x6404a8], ecx
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0
push closesocket
push 0
push closesocket
push 0xcf0000
push 0x6404c8
push 0x640590
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x6404bc], eax
cmp dword [0x6404bc], 0
jne 0x403e17
xor eax, eax
jmp 0x403e37
push 0
mov eax, dword [0x6404bc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x6404bc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop ebp
ret

Function at 0x403f60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x6404a0], 0
je 0x403f79
mov eax, dword [0x6404a0]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x6404ac], 0
je 0x403fe3
push 0x1f4
mov ecx, dword [0x6404ac]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403fc7
push 0
mov edx, dword [0x6404ac]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WAR:_Wait_ctrl_event_thread_err_u__terminated_
push 0x6035e4
call fcn.0040c230
add esp, 0xc
jmp 0x403fd9
push str.Wait_ctrl_event_thread_OK...
push str.ReleaseStopCtrlEvent
call fcn.0040c230
add esp, 8
mov dword [0x6404ac], 0
mov esp, ebp
pop ebp
ret
Function at 0x403ff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b898
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x61b000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x34]
call fcn.00401e20
mov dword [ebp - 4], 0
push 0x603650
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00401ee0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6404a0], eax
cmp dword [0x6404a0], 0
jne 0x40407e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Err:_CreateEventW_err_u_
push 0x6036fc
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x38]
jmp 0x4040ee
push 0
push 0
push 0
push 0x403ed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6404ac], eax
cmp dword [0x6404ac], 0
jne 0x4040d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Err:_CreateThread_err_u_
push str.CreateStopCtrlEvent
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x3c]
jmp 0x4040ee
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret