joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3ebf4a8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, eax
push 0
call sub.user32.dll_GetDC
mov ebx, eax
push ebx
call sub.gdi32.dll_CreateCompatibleDC
mov esi, eax
test edi, edi
jne 0x3ebf4f1
call sub.user32.dll_GetDesktopWindow
mov edi, eax
push 8
push ebx
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebp - 0xc], eax
push 0xa
push ebx
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x3ebf517
lea eax, [ebp - 0x28]
push eax
push edi
call sub.user32.dll_GetWindowRect
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub ecx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.gdi32.dll_SelectObject
mov dword [ebp - 8], eax
push 0xcc0020
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push esi
call sub.gdi32.dll_BitBlt
mov dword [ebp - 0x3c], 0x14
lea eax, [ebp - 0x3c]
push eax
call sub.user32.dll_GetCursorInfo
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
push esi
call sub.user32.dll_DrawIcon
mov eax, dword [ebp - 8]
push eax
push esi
call sub.gdi32.dll_SelectObject
push esi
call sub.gdi32.dll_DeleteDC
push ebx
push edi
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3ec0308
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
mov esi, 0x3f36fd4
xor eax, eax
push ebp
push 0x3ec03ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x3ec0393
mov eax, esi
xor ecx, ecx
mov edx, 0x44
call fcn.03cb5b68
mov dword [esi], 0x44
mov eax, dword [ebp - 4]
call fcn.03cb8d98
mov dword [esi + 8], eax
mov word [esi + 0x30], 5
mov dword [esi + 0x2c], 1
push 0x3f37018
push esi
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.03cb8d98
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov ebx, dword [0x3f37018]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec03b5
lea eax, [ebp - 8]
mov edx, 2
call fcn.03cb7eb0
ret
Function at 0x3ec0d14
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec0e2e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.03cb5b68
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.03cb5b68
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x3ec0e13
mov eax, dword [ebp - 0x60]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x3ec0df6
cmp dword [ebp - 0x6c], 0x10000
je 0x3ec0e09
add edi, dword [ebp - 0x70]
push 0x1c
lea eax, [ebp - 0x7c]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x3ec0dea
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec0e35
lea eax, [ebp - 8]
mov edx, 2
call fcn.03cb7eb0
ret
Function at 0x3ec29a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x3f3703c
cmp dword [edi], 0
jne 0x3ec2a1c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x3f37038]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x3f2a97c
mov ecx, 2
call fcn.03cb5330
mov edx, 0x3ec2978
lea eax, [esi + 5]
call fcn.03ec2998
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.03ec2998
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x3ec29f1
mov dword [0x3f37038], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x3ec2ba0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x3ec2cb6
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x3ec2cc1
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x3ec2c44
mov eax, ebx
call fcn.03cb504c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x3ec2c3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.03cb5330
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec2c44
mov eax, dword [ebp - 0xc]
call fcn.03cb5068
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xc]
xor ecx, ecx
call fcn.03cb5b68
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x3ec2cc1
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x3ec2cc1
jmp 0x3ec2cc1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.03ec2e98
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3ec2cc8
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x81]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x3ec2d4d
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [ebp - 0x81]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x3ec2d4d
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x3ec2d28
mov eax, ebx
call fcn.03ec2e1c
dec esi
jne 0x3ec2d1e
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x3ec2d4d
lea esi, [ebp - 0x81]
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3ec2e1c
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.03cb504c
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.03ec23d4
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.03cb504c
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x3ec2e7f
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x3ec3b28
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x42c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x3ec3bdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x3ec3bf4
call fcn.03e6ef58
mov edx, esi
mov eax, 8
call fcn.03e6c758
mov esi, eax
mov dword [ebp - 0x428], 0x428
lea edx, [ebp - 0x428]
mov eax, esi
call fcn.03e6c800
push dword [ebx]
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.03cb8e3c
push dword [ebp - 0x42c]
push 0x3ec3c24
mov eax, ebx
mov edx, 3
call fcn.03cb9074
lea edx, [ebp - 0x428]
mov eax, esi
call fcn.03e6c820
test eax, eax
jne 0x3ec3b7c
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec3be2
lea eax, [ebp - 0x42c]
call fcn.03cb7e50
ret

Function at 0x3ec3c28
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, eax
mov byte [ebp - 1], 0
mov edx, edi
mov eax, 4
call fcn.03e6c758
mov ebx, eax
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.03e6c7b8
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x3ec3c69
cmp eax, dword [esp]
pop edx
pop eax
jne 0x3ec3c94
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov esi, eax
cmp esi, 0xffffffff
je 0x3ec3c94
mov byte [ebp - 1], 1
push esi
call sub.kernel32.dll_SuspendThread
push esi
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.03e6c7dc
test eax, eax
jne 0x3ec3c56
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3ec3cb4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, eax
mov byte [ebp - 1], 0
mov edx, edi
mov eax, 4
call fcn.03e6c758
mov ebx, eax
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.03e6c7b8
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x3ec3cf5
cmp eax, dword [esp]
pop edx
pop eax
jne 0x3ec3d20
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov esi, eax
cmp esi, 0xffffffff
je 0x3ec3d20
mov byte [ebp - 1], 1
push esi
call sub.kernel32.dll_ResumeThread
push esi
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.03e6c7dc
test eax, eax
jne 0x3ec3ce2
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3ec3d40
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec3e00
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x3ec3e1c
call fcn.03e6ef58
mov eax, dword [ebp - 4]
mov edx, 0x3ec3e4c
call fcn.03cb9124
jne 0x3ec3d84
mov edi, 0x20
jmp 0x3ec3dc4
mov eax, dword [ebp - 4]
mov edx, 0x3ec3e68
call fcn.03cb9124
jne 0x3ec3d9a
mov edi, 0x40
jmp 0x3ec3dc4
mov eax, dword [ebp - 4]
mov edx, 0x3ec3e80
call fcn.03cb9124
jne 0x3ec3db0
mov edi, 0x80
jmp 0x3ec3dc4
mov eax, dword [ebp - 4]
mov edx, 0x3ec3e98
call fcn.03cb9124
jne 0x3ec3dea
mov edi, pe_nt_image_headers32
push esi
push 0
push 0x200
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x3ec3de4
push edi
push esi
call sub.kernel32.dll_SetPriorityClass
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec3e07
lea eax, [ebp - 4]
call fcn.03cb7e50
ret
Function at 0x3ec4840
Capabilities:
Acquire debug privileges
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec48eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x3ec4908
call fcn.03e6ef58
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x3ec48ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec48d5
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x3ec492c
Capabilities:
Acquire debug privileges
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec49dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x3ec49f8
call fcn.03e6ef58
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x3ec49bf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec49c6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x3ec4a1c
Capabilities:
Acquire debug privileges
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
mov eax, dword [ebp - 0xc]
call fcn.03cb7f34
mov eax, dword [ebp + 0xc]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec4b9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.03cd1b24
cmp dword [ebp - 0x18], 0
jne 0x3ec4a9c
mov eax, dword [ebp - 0xc]
call fcn.03cb8d98
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.03cb8e00
mov eax, dword [ebp - 0x1c]
call fcn.03e6dae4
test al, al
je 0x3ec4b6c
mov eax, 0x3ec4bbc
call fcn.03e6ef58
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x3ec4b6c
xor eax, eax
push ebp
push 0x3ec4b65
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.03cb8d98
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.03cb8d98
push eax
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
push ebx
call sub.advapi32.dll_ChangeServiceConfigW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 1
jne 0x3ec4b4e
mov eax, dword [ebp + 0xc]
push eax
push 0x3ec4bec
push dword [ebp - 4]
push 0x3ec4c40
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.03cb9074
mov edx, dword [ebp - 0x20]
mov ecx, 0x3ec4c50
mov eax, 0x80000002
call fcn.03e6ed80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec4b6c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec4ba3
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.03cb7eb0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
lea eax, [ebp + 0xc]
call fcn.03cb7e50
ret
Function at 0x3ec4c68
Capabilities:
Acquire debug privileges
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.03cb7f34
mov eax, dword [ebp - 8]
call fcn.03cb7f34
mov eax, dword [ebp - 0xc]
call fcn.03cb7f34
mov eax, dword [ebp + 0xc]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec4dcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.03cd1b24
cmp dword [ebp - 0x18], 0
jne 0x3ec4ce8
mov eax, dword [ebp - 0xc]
call fcn.03cb8d98
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.03cb8e00
mov eax, dword [ebp - 0x1c]
call fcn.03e6dae4
test al, al
je 0x3ec4d9b
mov eax, 0x3ec4dec
call fcn.03e6ef58
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x3ec4d9b
xor eax, eax
push ebp
push 0x3ec4d94
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.03cb8d98
push eax
push 0
push ebx
push 0x10
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateServiceW
test eax, eax
setne byte [ebp - 0xd]
cmp byte [ebp - 0xd], 1
jne 0x3ec4d7d
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.03ec4a1c
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
call fcn.03ec492c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec4d9b
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec4dd2
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.03cb7eb0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
lea eax, [ebp + 0xc]
call fcn.03cb7e50
ret
Function at 0x3ec4e10
Capabilities:
Acquire debug privileges
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3ec4ee9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, 0x3ec4f08
call fcn.03e6ef58
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x3ec4e60
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x3ec4ed3
xor eax, eax
push ebp
push 0x3ec4ecc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec4ed3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov edx, dword [ebp - 4]
mov eax, 0x3ec4f38
call fcn.03e78248
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec4ef0
lea eax, [ebp - 4]
call fcn.03cb7e50
ret
Function at 0x3ec51ec
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x3ec51f5
mov eax, dword [ebp - 4]
add esp, 0xfffff7d0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x482c], edx
mov dword [ebp - 0x4830], edx
mov dword [ebp - 0x4834], edx
mov dword [ebp - 0x4828], edx
mov dword [ebp - 0x481c], edx
mov dword [ebp - 0x4820], edx
mov dword [ebp - 0x4824], edx
mov dword [ebp - 0x4818], edx
mov dword [ebp - 0x4814], edx
mov esi, eax
xor eax, eax
push ebp
push 0x3ec540f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.03cb7e50
push 5
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x3ec53f1
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4800
lea eax, [ebp - 0x4810]
push eax
push 3
push 0x30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_EnumServicesStatusW
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jl 0x3ec53e8
inc edi
lea ebx, [ebp - 0x4810]
push dword [esi]
lea eax, [ebp - 0x4814]
mov edx, dword [ebx]
call fcn.03cb8e00
push dword [ebp - 0x4814]
push 0x3ec542c
mov eax, esi
mov edx, 3
call fcn.03cb9074
push dword [esi]
lea edx, [ebp - 0x4818]
mov eax, dword [ebx + 0xc]
call fcn.03ec4fa4
push dword [ebp - 0x4818]
push 0x3ec543c
mov eax, esi
mov edx, 3
call fcn.03cb9074
push dword [esi]
lea eax, [ebp - 0x4824]
mov edx, dword [ebx]
call fcn.03cb8e00
mov ecx, dword [ebp - 0x4824]
lea eax, [ebp - 0x4820]
mov edx, 0x3ec544c
call fcn.03cb8fec
mov edx, dword [ebp - 0x4820]
mov ecx, 0x3ec54a0
mov eax, 0x80000002
call fcn.03e6ece4
lea edx, [ebp - 0x481c]
call fcn.03ec5134
push dword [ebp - 0x481c]
push 0x3ec54b8
mov eax, esi
mov edx, 3
call fcn.03cb9074
push dword [esi]
lea eax, [ebp - 0x4828]
mov edx, dword [ebx + 4]
call fcn.03cb8e00
push dword [ebp - 0x4828]
push 0x3ec54c8
mov eax, esi
mov edx, 3
call fcn.03cb9074
push dword [esi]
push 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4834]
mov edx, dword [ebx]
call fcn.03cb8e00
mov ecx, dword [ebp - 0x4834]
lea eax, [ebp - 0x4830]
mov edx, 0x3ec54d8
call fcn.03cb8fec
mov edx, dword [ebp - 0x4830]
mov ecx, 0x3ec552c
mov eax, 0x80000002
call fcn.03e6ee30
push dword [ebp - 0x482c]
push 0x3ec554c
push 0x3ec555c
mov eax, esi
mov edx, 4
call fcn.03cb9074
add ebx, 0x24
dec edi
jne 0x3ec52af
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec5416
lea eax, [ebp - 0x4834]
mov edx, 9
call fcn.03cb7eb0
ret