joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f514
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47f755
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.0047e89c
xor eax, eax
push ebp
push 0x47f72b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047ec38
test al, al
je 0x47f70f
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004047d0
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x47f70f
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404ba0
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x47f703
mov eax, dword [ebp - 0x14]
call fcn.00404ba0
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004048d8
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047f120
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x47f703
xor eax, eax
push ebp
push 0x47f6fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0047e89c
xor eax, eax
push ebp
push 0x47f6de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00404ba0
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.004048d8
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047e8a0
mov eax, dword [ebp - 0x14]
call fcn.00404ba0
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.004048d8
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047f120
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x47f6bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0047f3ec
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0047f514
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f6c2
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x47f59f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f732
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0047e89c
ret
Function at 0x481300
Capabilities:
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, edx
mov esi, eax
mov byte [esp], 1
mov edx, ebx
mov eax, esi
call fcn.00481578
mov edi, eax
xor eax, eax
mov al, bl
lea eax, [eax + eax*8]
push edi
lea esi, [esi + eax*4 + 0x210]
lea edi, [esp + 8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 4]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x481351
push edi
call sub.advapi32.dll_CloseServiceHandle
mov byte [esp], 0
jmp 0x481357
push edi
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [esp]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x481364
Capabilities:
Pause service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, edx
mov esi, eax
mov byte [esp], 1
mov edx, ebx
mov eax, esi
call fcn.00481578
mov edi, eax
xor eax, eax
mov al, bl
lea eax, [eax + eax*8]
push edi
lea esi, [esi + eax*4 + 0x210]
lea edi, [esp + 8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 4]
push eax
push 2
push edi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x4813b5
push edi
call sub.advapi32.dll_CloseServiceHandle
mov byte [esp], 0
jmp 0x4813bb
push edi
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [esp]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x4813c8
Capabilities:
Continue service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, edx
mov esi, eax
mov byte [esp], 1
mov edx, ebx
mov eax, esi
call fcn.00481578
mov edi, eax
xor eax, eax
mov al, bl
lea eax, [eax + eax*8]
push edi
lea esi, [esi + eax*4 + 0x210]
lea edi, [esp + 8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 4]
push eax
push 3
push edi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x481419
push edi
call sub.advapi32.dll_CloseServiceHandle
mov byte [esp], 0
jmp 0x48141f
push edi
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [esp]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x48142c
Capabilities:
Modify service

Disassembly:
push ebx
push esi
mov bl, 1
call fcn.00481578
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
jne 0x48145f
push esi
call sub.advapi32.dll_CloseServiceHandle
xor ebx, ebx
jmp 0x481465
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4814ec
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov bl, 1
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
jne 0x48150f
xor ebx, ebx
jmp 0x48154d
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 1
push 3
push 0x10
push 0xf01ff
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.advapi32.dll_CreateServiceA
test eax, eax
jne 0x481541
push eax
call sub.advapi32.dll_CloseServiceHandle
xor ebx, ebx
jmp 0x48154d
push eax
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x481604
Capabilities:
Query service configuration

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbfc
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, esi
call fcn.004046e0
mov edx, ebx
mov eax, edi
call fcn.00481578
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x400
call fcn.00407984
push esp
push 0x400
lea eax, [esp + 0xc]
push eax
push 1
push ebx
call sub.ADVAPI32.DLL_QueryServiceConfig2A
test al, al
je 0x481655
mov eax, esi
lea edx, [esp + 8]
call fcn.004048d8
push ebx
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x404
pop edi
pop esi
pop ebx
ret

Function at 0x48181c
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4818f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046e0
lea eax, [ebp - 4]
mov edx, pe_nt_image_headers32
call fcn.00404d2c
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00404bf8
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4818db
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 4]
call fcn.00404bf8
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x4818db
lea eax, [ebp - 0x118]
push eax
call sub.advapi32.dll_IsValidSid
test eax, eax
je 0x4818db
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA
mov eax, ebx
mov edx, dword [ebp - 0x18]
call fcn.004048d8
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4818f8
lea eax, [ebp - 4]
call fcn.004046e0
ret
Function at 0x483440
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffc8
mov ebx, eax
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
push ebx
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0xc]
shr eax, 0xa
shr eax, 0xa
mov dword [esp + 0x2c], eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x10]
shr eax, 0xa
shr eax, 0xa
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], 0
lea edx, [esp + 0x24]
mov ecx, 2
mov eax, 0x4834a8
call fcn.0045e730
add esp, 0x38
pop ebx
ret

Function at 0x4835f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48375d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov eax, esi
and eax, 1
xor ebx, ebx
dec eax
jne 0x4836f2
mov eax, ebx
add al, 0x41
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403050
mov edx, 0x48376c
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403020
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404944
cmp byte [ebp - 0xd], 0
je 0x4836f2
mov eax, dword [ebp - 0xc]
call fcn.00404ba0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
je 0x4836f2
mov eax, dword [ebp - 0xc]
call fcn.00404ba0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4836f2
mov eax, dword [ebp - 0xc]
call fcn.00483570
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
fild qword [ebp - 0x20]
fdiv dword [0x483770]
fdiv dword [0x483770]
fdiv dword [0x483770]
call fcn.00402bf8
add edi, eax
mov eax, dword [ebp - 0xc]
call fcn.004834e8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
fild qword [ebp - 0x20]
fdiv dword [0x483770]
fdiv dword [0x483770]
fdiv dword [0x483770]
call fcn.00402bf8
add dword [ebp - 8], eax
shr esi, 1
mov eax, esi
and eax, 1
inc ebx
cmp ebx, 0x1b
jne 0x483632
push 0x48377c
lea edx, [ebp - 0x24]
mov eax, edi
call fcn.0045e474
push dword [ebp - 0x24]
push 0x483794
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0045e474
push dword [ebp - 0x28]
push 0x4837ac
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00404a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483764
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404704
lea eax, [ebp - 0xc]
call fcn.004046e0
ret
Function at 0x4837b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x483848
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404950
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx]
call fcn.004049a0
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404c00
mov eax, dword [ebp - 0x104]
mov edx, 0x48385c
call fcn.00404aec
je 0x48382f
mov eax, ebx
mov edx, 0x48385c
call fcn.004049a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48384f
lea eax, [ebp - 0x104]
call fcn.004046e0
ret

Function at 0x483944
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4839ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
mov edx, pe_nt_image_headers32
call fcn.00407984
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404950
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx]
call fcn.004049a0
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404c00
mov eax, dword [ebp - 0x104]
mov edx, 0x483a00
call fcn.00404aec
je 0x4839d3
mov eax, ebx
mov edx, 0x483a00
call fcn.004049a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4839f3
lea eax, [ebp - 0x104]
call fcn.004046e0
ret

Function at 0x4841f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
test ebx, ebx
je 0x484206
xor eax, eax
mov dword [ebx], eax
mov eax, 0x4a5834
mov edx, 0x484250
call fcn.00404734
xor eax, eax
mov dword [0x4a5838], eax
push 0
push 0x483ed8
call sub.user32.dll_EnumWindows
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, ebx
mov ecx, 0x484288
mov edx, dword [0x4a5834]
call fcn.004049ec
pop ebx
pop ebp
ret
Function at 0x484548
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa38
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x5c8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48471d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x484734
call fcn.00404734
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0x484764
call sub.user32.dll_FindWindowA
push 0
push 0x484774
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x484784
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x484790
push 0
push eax
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x484704
lea eax, [ebp - 0x10]
push eax
push edi
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x38
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 4
push 0x3000
push 0x1000
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
push 0
push 0
push 0x418
push edi
call sub.user32.dll_SendMessageA
dec eax
test eax, eax
jl 0x4846e0
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x14
call fcn.0040316c
lea eax, [ebp - 0x14]
push eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
push ebx
push esi
call sub.kernel32.dll_WriteProcessMemory
push ebx
mov eax, dword [ebp - 8]
push eax
push 0x417
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
push eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
push ebx
push esi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4846d4
inc dword [ebp - 0xc]
mov eax, ebx
add eax, 0x14
push eax
mov eax, dword [ebp - 0x28]
push eax
push 0x42d
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
push eax
push 0x401
lea eax, [ebp - 0x42d]
push eax
mov eax, ebx
add eax, 0x14
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5c8], edx
mov eax, dword [ebp - 4]
push dword [eax]
push 0x4847a8
lea eax, [ebp - 0x5c8]
lea edx, [ebp - 0x42d]
mov ecx, 0x401
call fcn.00404950
push dword [ebp - 0x5c8]
push 0x4847c0
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.00404a60
inc dword [ebp - 8]
dec dword [ebp - 0x18]
jne 0x484614
push 0x8000
push 0
push ebx
push esi
call sub.kernel32.dll_VirtualFreeEx
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
mov edx, 0x4847cc
call fcn.004049a8
mov eax, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484724
lea eax, [ebp - 0x5c8]
call fcn.004046e0
ret
Function at 0x484d0c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Get comspec environment variable
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe88
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x484eb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0xc
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xffffffff
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x484d75
xor ecx, ecx
mov edx, 0x1f41
mov eax, ebx
call fcn.00484c58
jmp 0x484e98
mov dword [ebp - 0x64], 0x44
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov word [ebp - 0x34], 0
mov dword [ebp - 0x38], 0x101
push 0x104
lea eax, [ebp - 0x178]
push eax
push 0x484ec0
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x178]
mov ecx, 0x104
call fcn.00404950
push dword [ebp - 0xc]
push 0x484ed0
push esi
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a60
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404ba0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x484e18
xor ecx, ecx
mov edx, 0x1f42
mov eax, ebx
call fcn.00484c58
jmp 0x484e98
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x1178]
mov edx, 0x1000
call fcn.00407984
push 0
lea eax, [ebp - 0x14]
push eax
push 0x1000
lea eax, [ebp - 0x1178]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x484e7b
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x1178]
mov ecx, 0x1000
call fcn.00404950
mov ecx, dword [ebp - 0x10]
mov edx, 0x1f43
mov eax, ebx
call fcn.00484c58
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x484e31
push 0xffffffffffffffff
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484eba
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404704
ret
Function at 0x486bc4
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b90
mov eax, dword [ebp - 8]
call fcn.00404b90
mov eax, dword [ebp - 0xc]
call fcn.00404b90
mov eax, dword [ebp + 8]
call fcn.00404b90
xor eax, eax
push ebp
push 0x486d16
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x486d28
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404ba0
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00404ba0
push eax
mov eax, dword [ebp - 4]
call fcn.00404ba0
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
mov eax, dword [0x4a3a9c]
cmp dword [eax], 0
je 0x486ceb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.00404c00
mov eax, 4
call fcn.004027c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
call fcn.004049a0
inc eax
call fcn.004027c0
mov esi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
xor eax, eax
push ebp
push 0x486ce4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 0x18]
call fcn.004097b0
mov eax, dword [ebp - 0x14]
push eax
push 1
push ebx
mov eax, dword [0x4a3a9c]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486ceb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004027e0
mov eax, dword [ebp - 0x14]
call fcn.004027e0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486d1d
lea eax, [ebp - 0x18]
call fcn.004046e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404704
lea eax, [ebp + 8]
call fcn.004046e0
ret

Function at 0x486d2c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b90
xor eax, eax
push ebp
push 0x486dde
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x486dbe
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0xf003f
push 0
push 0x486df0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x486da6
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404ba0
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x486da0
push edi
call sub.advapi32.dll_DeleteService
mov esi, 1
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jle 0x486db0
mov byte [ebp - 5], 1
jmp 0x486db4
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x486dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486de5
lea eax, [ebp - 4]
call fcn.004046e0
ret
Function at 0x486df4
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b90
mov eax, dword [ebp - 8]
call fcn.00404b90
xor eax, eax
push ebp
push 0x486ecd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404ba0
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x486eab
push 0x14
mov eax, dword [ebp - 8]
call fcn.00404ba0
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x486ea5
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
test eax, eax
je 0x486e9f
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x486e9f
jmp 0x486e99
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x486e9f
cmp edi, dword [ebp - 0x14]
ja 0x486e9f
cmp dword [ebp - 0x24], 4
jne 0x486e7a
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x24], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486ed4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404704
ret

Function at 0x4871c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2a4], edx
mov dword [ebp - 0x2a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4872f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4167ec]
call fcn.004038a0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4872d4
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, 0x65
lea eax, [ebp - 0x29c]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec esi
jne 0x48721a
xor esi, esi
push 0
mov eax, dword [0x4a39bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4872b3
push 0xff
lea eax, [ebp - 0x107]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4872a5
lea eax, [ebp - 0x2a0]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00404950
mov eax, dword [ebp - 0x2a0]
mov edx, 0x487310
call fcn.00404aec
je 0x4872a5
mov dword [ebp + esi*4 - 0x29c], ebx
inc esi
lea eax, [ebp - 0x2a4]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00404950
mov edx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x48723b
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4872db
mov eax, dword [ebp - 8]
call fcn.004038d0
ret